diff --git a/.env.template b/.env.template
index cc195375..62231776 100644
--- a/.env.template
+++ b/.env.template
@@ -78,7 +78,7 @@
 # DB_CONNECTION_RETRIES=15
 
 ## Database timeout
-## Timeout in seconds when acquiring database connection
+## Timeout when acquiring database connection
 # DATABASE_TIMEOUT=30
 
 ## Database idle timeout
@@ -173,14 +173,14 @@
 ## Defaults to daily. Set blank to disable this job. Also without EVENTS_DAYS_RETAIN set, this job will not start.
 # EVENT_CLEANUP_SCHEDULE="0 10 0 * * *"
 ## Number of days to retain events stored in the database.
-## If unset (the default) or 0, events are kept indefinitely and the scheduled job is disabled!
+## If unset (the default), events are kept indefinitely and the scheduled job is disabled!
 # EVENTS_DAYS_RETAIN=
 ##
 ## Cron schedule of the job that cleans old auth requests from the auth request.
 ## Defaults to every minute. Set blank to disable this job.
 # AUTH_REQUEST_PURGE_SCHEDULE="30 * * * * *"
 ##
-## Cron schedule of the job that cleans expired Duo contexts from the database. Does nothing if Duo MFA is disabled.
+## Cron schedule of the job that cleans expired Duo contexts from the database. Does nothing if Duo MFA is disabled or set to use the legacy iframe prompt.
 ## Defaults to every minute. Set blank to disable this job.
 # DUO_CONTEXT_PURGE_SCHEDULE="30 * * * * *"
 #
@@ -233,7 +233,7 @@
 # USER_SEND_LIMIT=
 
 ## Number of days to wait before auto-deleting a trashed item.
-## If unset (the default) or 0, trashed items are not auto-deleted.
+## If unset (the default), trashed items are not auto-deleted.
 ## This setting applies globally, so make sure to inform all users of any changes to this setting.
 # TRASH_AUTO_DELETE_DAYS=
 
@@ -338,8 +338,6 @@
 ## "local" accepts it from any non global address, which covers a reverse proxy running on the same
 ## host or container network. Use "all" to accept it from anywhere, or list the addresses of your
 ## proxy as IPs and CIDR ranges if it connects from a public address.
-## For a list header like X-Forwarded-For, the client IP is the rightmost address that isn't one of
-## these proxies, so with several proxies in a row (a CDN in front of nginx, for example) list all of them.
 # IP_HEADER_TRUSTED_PROXIES=local
 
 ## Icon service
@@ -386,35 +384,31 @@
 # HTTP_REQUEST_BLOCK_NON_GLOBAL_IPS=true
 
 ## Client Settings
-## Server-wide Fill Assist rules feed base directory URL, not a JSON file.
-## Defaults to https://fillassist.bitwarden.com.
-## Must be a valid HTTPS URL without credentials, query parameters, fragments, or surrounding whitespace.
-# FILL_ASSIST_RULES_URL=https://fillassist.bitwarden.com
-
 ## Enable experimental feature flags for clients.
 ## This is a comma-separated list of flags, e.g. "flag1,flag2,flag3".
 ## Note that clients cache the /api/config endpoint for about 1 hour and it could take some time before they are enabled or disabled!
 ##
 ## The following flags are available:
-## - "fill-assist-targeting-rules": Enable Fill Assist targeting rules in the browser extension. (Browser >= 2026.6.0)
 ## - "pm-5594-safari-account-switching": Enable account switching in Safari. (Safari >= 2026.2.0)
 ## - "pm-32413-multi-client-password-management": Enable changing the master password directly in the client. (Desktop/Extension >= 2026.4.0)
+## - "ssh-agent": Enable SSH agent support on Desktop. (Desktop >= 2024.12.0)
 ## - "ssh-agent-v2": Enable newer SSH agent support. (Desktop >= 2026.2.1)
-## - "windows-desktop-autotype": Enable the autotype feature preview on Windows. (Desktop >= 2025.8.0)
-## - "windows-desktop-autotype-ga": Enable the new, still in development, autotype implementation on Windows. (Desktop >= 2026.9.1)
-##   Only enable one of the two autotype flags, the clients disable autotype completely when both are enabled.
-## - "pm-30529-webauthn-related-origins": Allow passkeys stored in the vault to be used on related origins listed in a site's /.well-known/webauthn file (Browser >= 2026.2.0)
+## - "ssh-key-vault-item": Enable the creation and use of SSH key vault items. (Clients >= 2024.12.0)
+## - "pm-25373-windows-biometrics-v2": Enable the new implementation of biometrics on Windows. (Desktop >= 2025.11.0)
+## - "pm-26340-linux-biometrics-v2": Enable the new implementation of biometrics on Linux. (Desktop >= 2025.11.0)
+## - "anon-addy-self-host-alias": Enable configuring self-hosted Anon Addy alias generator. (Android >= 2025.3.0, iOS >= 2025.4.0)
+## - "simple-login-self-host-alias": Enable configuring self-hosted Simple Login alias generator. (Android >= 2025.3.0, iOS >= 2025.4.0)
+## - "mutual-tls": Enable the use of mutual TLS on Android (Clients >= 2025.2.0)
+## - "cxp-import-mobile": Enable the import via CXP on iOS (Clients >= 2025.9.2)
+## - "cxp-export-mobile": Enable the export via CXP on iOS (Clients >= 2025.9.2)
+## - "pm-30529-webauthn-related-origins":
 ## - "pm-32009-new-item-types": Enable new item types: Bank Account, Driver's License, and Passport (Clients >= 2026.4.0)
 ## - "pm-34171-card-scanner": Enable the new card scanner feature on mobile (Android >= 2026.4.1, iOS >= 2026.4.1)
+## - "desktop-ui-migration-milestone-1": Special feature flag for desktop UI (Desktop >= 2026.2.0)
+## - "desktop-ui-migration-milestone-2": Special feature flag for desktop UI (Desktop >= 2026.2.0)
+## - "desktop-ui-migration-milestone-3": Special feature flag for desktop UI (Desktop >= 2026.2.0)
+## - "desktop-ui-migration-milestone-4": Special feature flag for desktop UI (Desktop >= 2026.2.0)
 ## - "enable-basic-auth-response": Enable HTTP Basic Auth autofill in the browser extension (Browser >= 2026.9.0)
-## - "undetermined-cipher-scenario-logic": Enable the rewritten add/update login notification triggering logic in the browser extension (Browser >= 2026.2.0)
-## - "biometrics-sdk-ipc": Enable biometric unlock over the SDK IPC framework (Desktop >= 2026.9.0, Browser >= 2026.9.0)
-## - "windows-native-credential-sync": Register the desktop app as a passkey provider in Windows, so passkeys in the vault can be used by other apps and browsers.
-##   Requires the Microsoft Store (appx) build of the desktop app. Stable releases up to and including 2026.9.1 lack the required plugin registration, so it has no effect there yet.
-## - "macos-native-credential-sync": Enable the desktop app as a passkey provider on macOS, so passkeys in the vault can be used by other apps and browsers.
-## - "pm-27278-v2-password-registration": Register new accounts with v2 encryption. (Web >= 2026.6.4, Desktop/Browser/CLI >= 2026.7.0, Android >= 2026.4.1, iOS >= 2026.5.1)
-## - "enable-account-encryption-v2-jit-password-registration": Give SSO users who set their master password on their first login v2 encryption. (Web >= 2026.1.1, Desktop/Browser/CLI >= 2026.1.0, Android >= 2026.4.1, iOS >= 2026.6.0)
-##   These two flags can't be undone: a v2 account stays v2, and it can only log in from clients that are 2026.10.1 or newer (2026.10.2 for the desktop app), so the versions above are only enough to create one.
 # EXPERIMENTAL_CLIENT_FEATURE_FLAGS=
 
 ## Require new device emails. When a user logs in an email is required to be sent.
@@ -475,7 +469,7 @@
 
 ## Allowed connect-src (Know the risks!)
 ## https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/connect-src
-## Allows other domains for URLs which can be loaded using script interfaces like the Forwarded email alias feature
+## Allows other domains to URLs which can be loaded using script interfaces like the Forwarded email alias feature
 ## This adds the configured value to the 'Content-Security-Policy' headers 'connect-src' value.
 ## Multiple values must be separated with a whitespace. And only HTTPS values are allowed.
 ## Example: "https://my-addy-io.domain.tld https://my-simplelogin.domain.tld"
@@ -501,15 +495,6 @@
 ## KNOW WHAT YOU ARE DOING!
 # ORG_GROUPS_ENABLED=false
 
-## EXPERIMENTAL FEATURE: Custom roles
-## Enables the Custom member role with granular permissions for organizations.
-## This is still being developed: only the permissions this version enforces can be granted.
-## This is enforced by the server and is unrelated to EXPERIMENTAL_CLIENT_FEATURE_FLAGS.
-## Disabling it again keeps the stored Custom roles and permissions, but they grant nothing until it is re-enabled.
-## Disabled by default because this is an experimental feature!
-## KNOW WHAT YOU ARE DOING!
-# EXPERIMENTAL_CUSTOM_ROLES=false
-
 ## Increase secure note size limit (Know the risks!)
 ## Sets the secure note size limit to 100_000 instead of the default 10_000.
 ## WARNING: This could cause issues with clients. Also exports will not work on Bitwarden servers!
@@ -602,6 +587,11 @@
 # DUO_HOST=<API Hostname>
 ## After that, you should be able to follow the rest of the guide linked above,
 ## ignoring the fields that ask for the values that you already configured beforehand.
+##
+## If you want to attempt to use Duo's 'Traditional Prompt' (deprecated, iframe based) set DUO_USE_IFRAME to 'true'.
+## Duo no longer supports this, but it still works for some integrations.
+## If you aren't sure, leave this alone.
+# DUO_USE_IFRAME=false
 
 ## Email 2FA settings
 ## Email token size
@@ -627,9 +617,6 @@
 ## Note that the checkbox would still be present, but ignored.
 # DISABLE_2FA_REMEMBER=false
 ##
-## Number of days before a remembered 2FA login expires (min: 1, max: 90).
-# TWO_FACTOR_REMEMBER_DAYS=30
-##
 ## Authenticator Settings
 ## Disable authenticator time drifted codes to be valid.
 ## TOTP codes of the previous and next 30 seconds will be invalid
@@ -638,7 +625,7 @@
 ## we allow by default the TOTP code which was valid one step back and one in the future.
 ## This can however allow attackers to be a bit more lucky with their attempts because there are 3 valid codes.
 ## You can disable this, so that only the current TOTP Code is allowed.
-## Keep in mind that when a server drifts out of time, valid codes could be marked as invalid.
+## Keep in mind that when a sever drifts out of time, valid codes could be marked as invalid.
 ## In any case, if a code has been used it can not be used again, also codes which predates it will be invalid.
 # AUTHENTICATOR_DISABLE_TIME_DRIFT=false
 
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index c24eda61..3a336541 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -4,4 +4,3 @@
 /.github/ISSUE_TEMPLATE/** @dani-garcia @BlackDex
 /.github/workflows/** @dani-garcia @BlackDex
 /SECURITY.md @dani-garcia @BlackDex
-/THREAT_MODEL.md @dani-garcia @BlackDex
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 97d640ae..f52bd8e4 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -57,23 +57,7 @@ jobs:
     steps:
       # Install dependencies
       - name: "Install dependencies Ubuntu"
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends openssl build-essential libmariadb-dev-compat libpq-dev libssl-dev pkg-config
-
-          # Pass the MariaDB client library to mysqlclient-sys through its environment variables.
-          # When it finds the library with pkg-config, its build script makes cargo rerun it whenever
-          # anything in the library directory changes, and the install above changes that directory on
-          # every run. So every MySQL build recompiled mysqlclient-sys, diesel and diesel_migrations,
-          # even with a cached build. Cargo compares environment variables by their value instead.
-          lib_dir="$(pkg-config --variable=libdir mysqlclient)"
-          version="$(pkg-config --modversion mysqlclient)"
-          {
-            echo "MYSQLCLIENT_NO_PKG_CONFIG=1"
-            echo "LIBMARIADB_NO_PKG_CONFIG=1"
-            echo "MYSQLCLIENT_LIB_DIR=${lib_dir}"
-            echo "MYSQLCLIENT_VERSION=${version}"
-          } | tee -a "${GITHUB_ENV}"
+        run: sudo apt-get update && sudo apt-get install -y --no-install-recommends openssl build-essential libmariadb-dev-compat libpq-dev libssl-dev pkg-config
       # End Install dependencies
 
       # Checkout the repo
@@ -129,24 +113,27 @@ jobs:
 
       # Enable Rust Caching
       - name: Rust Caching
-        uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           # Use a custom prefix-key to force a fresh start. This is sometimes needed with bigger changes.
           # Like changing the build host from Ubuntu 20.04 to 22.04 for example.
           # Only update when really needed! Use a <year>.<month>[.<inc>] format.
-          prefix-key: "v2026.11-rust"
-          # Only save caches on main to save cache space.
-          save-if: ${{ github.ref == 'refs/heads/main' }}
+          prefix-key: "v2025.09-rust"
       # End Enable Rust Caching
 
       # Run cargo tests
       # First test all features together, afterwards test them separately.
-      # enable_mimalloc and unsafe_test_mode are additive, so we test them once here.
-      - name: "test features: sqlite,mysql,postgresql,enable_mimalloc,s3,unsafe_test_mode"
+      - name: "test features: sqlite,mysql,postgresql,enable_mimalloc,s3"
         id: test_sqlite_mysql_postgresql_mimalloc_s3
         if: ${{ !cancelled() }}
         run: |
-          cargo test --profile ci --features sqlite,mysql,postgresql,enable_mimalloc,s3,unsafe_test_mode
+          cargo test --profile ci --features sqlite,mysql,postgresql,enable_mimalloc,s3
+
+      - name: "test features: sqlite,mysql,postgresql,enable_mimalloc"
+        id: test_sqlite_mysql_postgresql_mimalloc
+        if: ${{ !cancelled() }}
+        run: |
+          cargo test --profile ci --features sqlite,mysql,postgresql,enable_mimalloc
 
       - name: "test features: sqlite,mysql,postgresql"
         id: test_sqlite_mysql_postgresql
@@ -175,11 +162,11 @@ jobs:
 
 
       # Run cargo clippy, and fail on warnings
-      - name: "clippy features: sqlite,mysql,postgresql,enable_mimalloc,s3,unsafe_test_mode"
+      - name: "clippy features: sqlite,mysql,postgresql,enable_mimalloc,s3"
         id: clippy
         if: ${{ !cancelled() && matrix.channel == 'rust-toolchain' }}
         run: |
-          cargo clippy --profile ci --features sqlite,mysql,postgresql,enable_mimalloc,s3,unsafe_test_mode
+          cargo clippy --profile ci --features sqlite,mysql,postgresql,enable_mimalloc,s3
       # End Run cargo clippy
 
 
@@ -198,6 +185,7 @@ jobs:
         if: ${{ failure() }}
         env:
           TEST_DB_M_S3: ${{ steps.test_sqlite_mysql_postgresql_mimalloc_s3.outcome }}
+          TEST_DB_M: ${{ steps.test_sqlite_mysql_postgresql_mimalloc.outcome }}
           TEST_DB: ${{ steps.test_sqlite_mysql_postgresql.outcome }}
           TEST_SQLITE: ${{ steps.test_sqlite.outcome }}
           TEST_MYSQL: ${{ steps.test_mysql.outcome }}
@@ -209,12 +197,13 @@ jobs:
           echo "" >> "${GITHUB_STEP_SUMMARY}"
           echo "|Job|Status|" >> "${GITHUB_STEP_SUMMARY}"
           echo "|---|------|" >> "${GITHUB_STEP_SUMMARY}"
-          echo "|test (sqlite,mysql,postgresql,enable_mimalloc,s3,unsafe_test_mode)|${TEST_DB_M_S3}|" >> "${GITHUB_STEP_SUMMARY}"
+          echo "|test (sqlite,mysql,postgresql,enable_mimalloc,s3)|${TEST_DB_M_S3}|" >> "${GITHUB_STEP_SUMMARY}"
+          echo "|test (sqlite,mysql,postgresql,enable_mimalloc)|${TEST_DB_M}|" >> "${GITHUB_STEP_SUMMARY}"
           echo "|test (sqlite,mysql,postgresql)|${TEST_DB}|" >> "${GITHUB_STEP_SUMMARY}"
           echo "|test (sqlite)|${TEST_SQLITE}|" >> "${GITHUB_STEP_SUMMARY}"
           echo "|test (mysql)|${TEST_MYSQL}|" >> "${GITHUB_STEP_SUMMARY}"
           echo "|test (postgresql)|${TEST_POSTGRESQL}|" >> "${GITHUB_STEP_SUMMARY}"
-          echo "|clippy (sqlite,mysql,postgresql,enable_mimalloc,s3,unsafe_test_mode)|${CLIPPY}|" >> "${GITHUB_STEP_SUMMARY}"
+          echo "|clippy (sqlite,mysql,postgresql,enable_mimalloc,s3)|${CLIPPY}|" >> "${GITHUB_STEP_SUMMARY}"
           echo "|fmt|${FMT}|" >> "${GITHUB_STEP_SUMMARY}"
           echo "" >> "${GITHUB_STEP_SUMMARY}"
           echo "Please check the failed jobs and fix where needed." >> "${GITHUB_STEP_SUMMARY}"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6f80509d..903a5e22 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -106,7 +106,7 @@ jobs:
 
       # Login to Docker Hub
       - name: Login to Docker Hub
-        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -121,7 +121,7 @@ jobs:
 
       # Login to GitHub Container Registry
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
@@ -137,7 +137,7 @@ jobs:
 
       # Login to Quay.io
       - name: Login to Quay.io
-        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: quay.io
           username: ${{ secrets.QUAY_USERNAME }}
@@ -185,7 +185,7 @@ jobs:
 
       - name: Bake ${{ matrix.base_image }} containers
         id: bake_vw
-        uses: docker/bake-action@59cb1203cd42bcefd40a1b6d73b589e48c86040e # v7.5.0
+        uses: docker/bake-action@018cb6412ab401ebaa809aa5f85966b74628600f # v7.4.0
         env:
           BASE_TAGS: "${{ steps.determine-version.outputs.BASE_TAGS }}"
           SOURCE_COMMIT: "${{ env.SOURCE_COMMIT }}"
@@ -222,7 +222,7 @@ jobs:
           touch "${RUNNER_TEMP}/digests/${digest#sha256:}"
 
       - name: Upload digest
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: digests-${{ env.NORMALIZED_ARCH }}-${{ matrix.base_image }}
           path: ${{ runner.temp }}/digests/*
@@ -242,7 +242,7 @@ jobs:
           subject-path: vaultwarden-${{ env.NORMALIZED_ARCH }}
 
       - name: Upload binaries as artifacts
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: vaultwarden-${{ env.SOURCE_VERSION }}-linux-${{ env.NORMALIZED_ARCH }}-${{ matrix.base_image }}
           path: vaultwarden-${{ env.NORMALIZED_ARCH }}
@@ -264,7 +264,7 @@ jobs:
 
     steps:
       - name: Download digests
-        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           path: ${{ runner.temp }}/digests
           pattern: digests-*-${{ matrix.base_image }}
@@ -272,7 +272,7 @@ jobs:
 
       # Login to Docker Hub
       - name: Login to Docker Hub
-        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -287,7 +287,7 @@ jobs:
 
       # Login to GitHub Container Registry
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
@@ -303,7 +303,7 @@ jobs:
 
       # Login to Quay.io
       - name: Login to Quay.io
-        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: quay.io
           username: ${{ secrets.QUAY_USERNAME }}
diff --git a/.github/workflows/sdk-live-tests.yml b/.github/workflows/sdk-live-tests.yml
deleted file mode 100644
index 25680f56..00000000
--- a/.github/workflows/sdk-live-tests.yml
+++ /dev/null
@@ -1,166 +0,0 @@
-name: SDK live tests
-permissions: {}
-
-# Runs the live-server end-to-end tests of bitwarden/sdk-internal against this branch, see tools/sdk-live-tests/run.sh.
-# By default it tests the latest @bitwarden/sdk-internal on npm, which the SDK publishes for every commit to its main
-# branch, with the e2e tests from that commit. A manual run can name an npm version instead, or a branch, tag or commit
-# to build the SDK from. It runs daily, by hand, and on changes to the test seeder or the runner.
-on:
-  schedule:
-    # 04:15 UTC, off the top of the hour, when GitHub may delay or drop scheduled runs
-    - cron: "15 4 * * *"
-  workflow_dispatch:
-    inputs:
-      sdk_npm_version:
-        description: "Version of @bitwarden/sdk-internal on npm to test (empty for the latest)"
-        required: false
-        default: ""
-      sdk_ref:
-        description: "Or a branch, tag or commit of bitwarden/sdk-internal to build and test (slower)"
-        required: false
-        default: ""
-  pull_request:
-    paths:
-      - ".github/workflows/sdk-live-tests.yml"
-      - "src/api/test_seeder.rs"
-      - "tools/sdk-live-tests/**"
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  sdk-live-tests:
-    name: SDK live tests
-    runs-on: ubuntu-24.04
-    timeout-minutes: 90
-    env:
-      # Less to compile and link, and a smaller cache. Panics still show file and line.
-      CARGO_PROFILE_DEV_DEBUG: "0"
-    steps:
-      - name: "Install dependencies Ubuntu"
-        run: sudo apt-get update && sudo apt-get install -y --no-install-recommends build-essential libssl-dev pkg-config
-
-      - name: "Checkout"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-
-      # A published package (npm) or a build from a git ref (git), and the sdk-internal commit to check out
-      - name: "Pick the SDK"
-        id: sdk
-        env:
-          NPM_VERSION: ${{ inputs.sdk_npm_version }}
-          GIT_REF: ${{ inputs.sdk_ref }}
-        run: |
-          if [[ -n "${NPM_VERSION}" && -n "${GIT_REF}" ]]; then
-            echo "::error::Give an npm version or a git ref, not both"
-            exit 1
-          fi
-          if [[ -n "${GIT_REF}" ]]; then
-            {
-              echo "source=git"
-              echo "ref=${GIT_REF}"
-            } >> "${GITHUB_OUTPUT}"
-            echo "SDK: bitwarden/sdk-internal \`${GIT_REF}\`, built from source" >> "${GITHUB_STEP_SUMMARY}"
-            exit 0
-          fi
-          spec="${NPM_VERSION:-latest}"
-          if [[ ! "${spec}" =~ ^[0-9A-Za-z.+-]+$ ]]; then
-            echo "::error::That is not an npm version or tag"
-            exit 1
-          fi
-          manifest="$(curl -fsS --retry 3 "https://registry.npmjs.org/@bitwarden%2Fsdk-internal/${spec}")"
-          version="$(jq -r .version <<< "${manifest}")"
-          commit="$(jq -r .gitHead <<< "${manifest}")"
-          if [[ ! "${commit}" =~ ^[0-9a-f]{40}$ ]]; then
-            echo "::error::@bitwarden/sdk-internal@${version} doesn't name the commit it was built from"
-            exit 1
-          fi
-          {
-            echo "source=npm"
-            echo "version=${version}"
-            echo "ref=${commit}"
-          } >> "${GITHUB_OUTPUT}"
-          echo "SDK: @bitwarden/sdk-internal ${version} from npm, e2e tests at ${commit}" >> "${GITHUB_STEP_SUMMARY}"
-
-      - name: "Checkout sdk-internal"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          repository: bitwarden/sdk-internal
-          ref: ${{ steps.sdk.outputs.ref }}
-          path: sdk-internal
-          persist-credentials: false
-
-      # Each checkout pins its own toolchain in rust-toolchain.toml. The SDK's is only needed to build it.
-      - name: "Install toolchains"
-        env:
-          SDK_SOURCE: ${{ steps.sdk.outputs.source }}
-        run: |
-          rustup toolchain install
-          if [[ "${SDK_SOURCE}" == git ]]; then
-            cd sdk-internal
-            rustup toolchain install
-            rustup target add wasm32-unknown-unknown
-            rustup component add rust-src
-          fi
-
-      # One cache per SDK source, so that neither restores the other's.
-      # Only save caches on main to save cache space.
-      - name: "Cache Rust builds"
-        if: ${{ steps.sdk.outputs.source == 'npm' }}
-        uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
-        with:
-          key: sdk-live-tests-npm
-          add-job-id-key: false
-          workspaces: ". -> target"
-          save-if: ${{ github.ref == 'refs/heads/main' }}
-
-      - name: "Cache Rust builds (with the SDK)"
-        if: ${{ steps.sdk.outputs.source == 'git' }}
-        uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
-        with:
-          key: sdk-live-tests-sdk-build
-          add-job-id-key: false
-          workspaces: |
-            . -> target
-            sdk-internal -> target
-          save-if: ${{ github.ref == 'refs/heads/main' }}
-
-      - name: "Setup Node"
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version-file: sdk-internal/.nvmrc
-
-      # Where the SDK's build would put it
-      - name: "Download the SDK package"
-        if: ${{ steps.sdk.outputs.source == 'npm' }}
-        env:
-          SDK_VERSION: ${{ steps.sdk.outputs.version }}
-          SDK_COMMIT: ${{ steps.sdk.outputs.ref }}
-        run: |
-          # npm checks the tarball against the registry's checksum
-          tarball="$(npm pack "@bitwarden/sdk-internal@${SDK_VERSION}" --pack-destination "${RUNNER_TEMP}" --json | jq -r '.[0].filename')"
-          package_dir=sdk-internal/crates/bitwarden-wasm-internal/npm
-          tar -xzf "${RUNNER_TEMP}/${tarball}" --strip-components=1 -C "${package_dir}"
-          if [[ "$(cat "${package_dir}/VERSION")" != "${SDK_COMMIT}" ]]; then
-            echo "::error::The package's VERSION doesn't match its commit ${SDK_COMMIT}"
-            exit 1
-          fi
-
-      - name: "Run the SDK live tests"
-        env:
-          SDK_SOURCE: ${{ steps.sdk.outputs.source }}
-        run: |
-          args=(--sdk-dir sdk-internal)
-          if [[ "${SDK_SOURCE}" == npm ]]; then
-            args+=(--skip-sdk-build)
-          fi
-          tools/sdk-live-tests/run.sh "${args[@]}"
-
-      - name: "Upload logs"
-        if: ${{ !cancelled() }}
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
-        with:
-          name: sdk-live-tests-logs
-          path: target/sdk-live-tests/**/*.log
diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml
index 7ffbe632..f0fbf192 100644
--- a/.github/workflows/trivy.yml
+++ b/.github/workflows/trivy.yml
@@ -50,6 +50,6 @@ jobs:
           severity: CRITICAL,HIGH
 
       - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
+        uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
         with:
           sarif_file: 'trivy-results.sarif'
diff --git a/.github/workflows/typos.yml b/.github/workflows/typos.yml
index f7d1f92c..3c880e91 100644
--- a/.github/workflows/typos.yml
+++ b/.github/workflows/typos.yml
@@ -23,4 +23,4 @@ jobs:
 
       # When this version is updated, do not forget to update this in `.pre-commit-config.yaml` too
       - name: Spell Check Repo
-        uses: crate-ci/typos@7f9d0819ca1c008ade73f4b41fa9d258d48f605b # v1.51.1
+        uses: crate-ci/typos@512fc24f32f44ab01972217aaaf3dc86ec234d53 # v1.50.2
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 7372759b..31153b07 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -24,7 +24,7 @@ jobs:
           persist-credentials: false
 
       - name: Run zizmor
-        uses: zizmorcore/zizmor-action@53290badfa369cb0bf7ad16342cb62c2fa47ac7b # v0.8.0
+        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
         with:
           # intentionally not scanning the entire repository,
           # since it contains integration tests.
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index b6352bbb..d2a509e2 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -18,7 +18,7 @@ repos:
 
   # When this version is updated, do not forget to update this in `.github/workflows/typos.yaml` too
   - repo: https://github.com/crate-ci/typos
-    rev: 7f9d0819ca1c008ade73f4b41fa9d258d48f605b # v1.51.1
+    rev: 512fc24f32f44ab01972217aaaf3dc86ec234d53 # v1.50.2
     hooks:
       - id: typos
         always_run: true
diff --git a/.typos.toml b/.typos.toml
index dabcadb4..ca870f4e 100644
--- a/.typos.toml
+++ b/.typos.toml
@@ -14,8 +14,11 @@ extend-ignore-re = [
     # In SMTP it's called HELO, so ignore it
     "(?i)helo_name",
     "Server name sent during.+HELO",
-    # COSE Is short for CBOR Object Signing and Encryption
-    "(?i)cose",
+    # COSE Is short for CBOR Object Signing and Encryption, ignore these specific items
+    "COSE",
+    "COSEKey",
+    "COSEAlgorithm",
+    "CoseEncrypt0",
     # Ignore this specific string as it's valid
     "Ensure they are valid OTPs",
     # This word is misspelled upstream
diff --git a/Cargo.lock b/Cargo.lock
index 91299665..2ccd4b1a 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -32,15 +32,15 @@ dependencies = [
 
 [[package]]
 name = "alloc-no-stdlib"
-version = "3.0.0"
+version = "2.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c2fb6cfd47bf496ff64095c20eaba0c201404ee38714d4142fcfa1dc334fcc7a"
+checksum = "cc7bb162ec39d46ab1ca8c77bf72e890535becd1751bb45f64c597edb4c8c6b3"
 
 [[package]]
 name = "alloc-stdlib"
-version = "0.3.0"
+version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b5c1865780388bfa186411ab5f247819487fc4864c6e9c3106611fa347586e1"
+checksum = "0e76a019e91224d279006ff972f1e984179a6e9feb050adba6ce8274aef23195"
 dependencies = [
  "alloc-no-stdlib",
 ]
@@ -68,9 +68,9 @@ checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
 
 [[package]]
 name = "arc-swap"
-version = "1.9.3"
+version = "1.9.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "380962b3d93b99642e50b9febf72c071e97e8b32d86eae9cf4ef582bb960ae6e"
+checksum = "c049c0be4daef0b145cb3555416b3b8ef5b7888a38aea1a3a155801fe7b0810b"
 dependencies = [
  "rustversion",
 ]
@@ -151,9 +151,9 @@ dependencies = [
 
 [[package]]
 name = "async-compression"
-version = "0.4.51"
+version = "0.4.48"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9d5755640120b24961f8231e05892e4a4f7e0d04e8aeca161508c9c397946970"
+checksum = "fb61aea1a7def73ee7c350a184f0e70b32c182344e2e75bf70c9b621b83417fd"
 dependencies = [
  "compression-codecs",
  "compression-core",
@@ -318,14 +318,20 @@ checksum = "82f6aeea286b8eb4dd3431a1be1b59d290ace00f5bfd8e2a159bc2a05e2c1667"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.9",
+ "syn 3.0.6",
 ]
 
 [[package]]
 name = "asyncband"
-version = "0.7.4"
+version = "0.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d2050892d4691cf110586070786712b504985a4d37ed64a9cd8a402718e1706"
+checksum = "f2d85fd3d291fabcc40c7232c92c280ec1754fd7b5d7ea769f143222143e179a"
+
+[[package]]
+name = "atomic"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c59bdb34bc650a32731b31bd8f0829cc15d24a708ee31559e0bb34f2bc320cba"
 
 [[package]]
 name = "atomic"
@@ -350,9 +356,9 @@ checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
 
 [[package]]
 name = "aws-config"
-version = "1.13.0"
+version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "939e256cfe0ed68e96d32f194339d88210d5c10685cff0787400158f852c6819"
+checksum = "b8d7b388a9fc3a6db15a5ec778c38b354eff1364882c94d08e0252f7a47dcaa4"
 dependencies = [
  "aws-credential-types",
  "aws-runtime",
@@ -381,9 +387,9 @@ dependencies = [
 
 [[package]]
 name = "aws-credential-types"
-version = "1.3.1"
+version = "1.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "576e8da35751dc85409ec1cd15999f692c277a1fbe9336780fe6f15e49dd637d"
+checksum = "e93964ffdaf57857f544be3666a5f57570bb699e934700f11b49708f61bb556e"
 dependencies = [
  "aws-smithy-async",
  "aws-smithy-runtime-api",
@@ -393,9 +399,9 @@ dependencies = [
 
 [[package]]
 name = "aws-runtime"
-version = "1.10.2"
+version = "1.9.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a0cc2144962cc5e358467b16e3d82981b1d424a7c3d34602be0036103814a1a"
+checksum = "25b43ad47adc2517efe3d706559d94b97e50e80e0321b3cadbc9f77cee88adcd"
 dependencies = [
  "aws-credential-types",
  "aws-sigv4",
@@ -409,7 +415,7 @@ dependencies = [
  "bytes-utils",
  "fastrand",
  "http 1.5.0",
- "http-body",
+ "http-body 1.1.0",
  "percent-encoding",
  "pin-project-lite",
  "tracing",
@@ -418,9 +424,9 @@ dependencies = [
 
 [[package]]
 name = "aws-sdk-sso"
-version = "1.119.0"
+version = "1.111.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c414f25ec4aa9dc18f5cc8f55e18848bb509fcda4ce7c77bee6072e95806bc9"
+checksum = "65700d75f6da78c89a61a49f1539979400a4609d3329376b1dc2133d7a1b2b90"
 dependencies = [
  "arc-swap",
  "aws-credential-types",
@@ -436,6 +442,7 @@ dependencies = [
  "aws-types",
  "bytes",
  "fastrand",
+ "http 0.2.12",
  "http 1.5.0",
  "regex-lite",
  "tracing",
@@ -443,9 +450,9 @@ dependencies = [
 
 [[package]]
 name = "aws-sdk-ssooidc"
-version = "1.121.0"
+version = "1.113.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bc638bb4355e6514334dcc3228cd4622f5ee54d704bd6a9010a5a91d7856d9d9"
+checksum = "eb1147c254af7b6cee3ace90ae7da6f21366ce9a9b899035fa8a0fdf586eb75a"
 dependencies = [
  "arc-swap",
  "aws-credential-types",
@@ -461,6 +468,7 @@ dependencies = [
  "aws-types",
  "bytes",
  "fastrand",
+ "http 0.2.12",
  "http 1.5.0",
  "regex-lite",
  "tracing",
@@ -468,9 +476,9 @@ dependencies = [
 
 [[package]]
 name = "aws-sdk-sts"
-version = "1.124.0"
+version = "1.116.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f8a0dd8fbde04ba58ad722113c7addb11bf94cf549b1ea0eb9ea427fb87198a"
+checksum = "035c7392e751d20bf1060d625d023587eb14099646110a9cff7c697bfe4b253a"
 dependencies = [
  "arc-swap",
  "aws-credential-types",
@@ -487,6 +495,7 @@ dependencies = [
  "aws-smithy-xml",
  "aws-types",
  "fastrand",
+ "http 0.2.12",
  "http 1.5.0",
  "regex-lite",
  "tracing",
@@ -494,9 +503,9 @@ dependencies = [
 
 [[package]]
 name = "aws-sigv4"
-version = "1.6.4"
+version = "1.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f385da9b7757ed4c8214797ad663ff534fb622006143530aa80e21f8e06ff85c"
+checksum = "31d955e76ff96acd555bf06fa0fa6d5bf9335fa84ae7c64481b20ae61d231f70"
 dependencies = [
  "aws-credential-types",
  "aws-smithy-http",
@@ -506,18 +515,19 @@ dependencies = [
  "form_urlencoded",
  "hex",
  "hmac 0.13.0",
+ "http 0.2.12",
  "http 1.5.0",
  "percent-encoding",
- "sha2 0.11.1",
+ "sha2 0.11.0",
  "time",
  "tracing",
 ]
 
 [[package]]
 name = "aws-smithy-async"
-version = "1.3.1"
+version = "1.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "de681a9df7ff79823b759ee17061076ec049cd61a8fa28ece4293d89c9f6964e"
+checksum = "f02e407fb3b54891734224b9ffac8a71fdd35f542500fa1af95754a6b2beb316"
 dependencies = [
  "futures-util",
  "pin-project-lite",
@@ -526,9 +536,9 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-http"
-version = "0.64.3"
+version = "0.64.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "19af609dd5edf8b056cd0bb001c706c8b3b1458055328b334ec13d7f46f6aaa8"
+checksum = "37843d9add67c3aff5856f409c6dc315d3cdff60f9c0cb5b670dab1e9920306d"
 dependencies = [
  "aws-smithy-runtime-api",
  "aws-smithy-types",
@@ -537,18 +547,19 @@ dependencies = [
  "futures-core",
  "futures-util",
  "http 1.5.0",
- "http-body",
+ "http-body 1.1.0",
  "http-body-util",
  "percent-encoding",
  "pin-project-lite",
+ "pin-utils",
  "tracing",
 ]
 
 [[package]]
 name = "aws-smithy-json"
-version = "0.65.1"
+version = "0.63.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b45f9fc77ffe92c92c341165a01a565bd30c39ecf5aa8c0719b41719009604f9"
+checksum = "3385d469edbe8b60cc72002784652b5efca39178192aa9cc4b44c9875c6bdc18"
 dependencies = [
  "aws-smithy-runtime-api",
  "aws-smithy-schema",
@@ -566,9 +577,9 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-query"
-version = "0.64.0"
+version = "0.62.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "165f6265342a313ad6f7a1ac17a0cdba30c522039d3f41d8d6871ce8a2b34ecd"
+checksum = "f1d1d71f6562be974caa85442ecd90194c40fdb5df045f182a6c2e872ce95056"
 dependencies = [
  "aws-smithy-runtime-api",
  "aws-smithy-schema",
@@ -579,9 +590,9 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-runtime"
-version = "1.16.2"
+version = "1.14.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4cb80fb19c084da5fca9d797845735e184445e5b958599440d67529bf6ef1b64"
+checksum = "3296253d3a91b3f938a3f2bcce4daebadcb4aa4228153fcec90f9d23532b4484"
 dependencies = [
  "aws-smithy-async",
  "aws-smithy-http",
@@ -591,24 +602,28 @@ dependencies = [
  "aws-smithy-types",
  "bytes",
  "fastrand",
+ "http 0.2.12",
  "http 1.5.0",
- "http-body",
+ "http-body 0.4.6",
+ "http-body 1.1.0",
  "http-body-util",
  "pin-project-lite",
+ "pin-utils",
  "tokio",
  "tracing",
 ]
 
 [[package]]
 name = "aws-smithy-runtime-api"
-version = "1.19.2"
+version = "1.16.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8c4e85cffe9944b10d576b075432bd8f98dbc081e8681cb37d5b2d87dc27bc84"
+checksum = "6d881a7b7ad179fd6611680c9de89f716fb00ab40299a9a7b8c6913e8f7511a8"
 dependencies = [
  "aws-smithy-async",
  "aws-smithy-runtime-api-macros",
  "aws-smithy-types",
  "bytes",
+ "http 0.2.12",
  "http 1.5.0",
  "pin-project-lite",
  "tokio",
@@ -618,9 +633,9 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-runtime-api-macros"
-version = "1.2.0"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce237f890a2283c9b328955c3b0918d2d5bf66a1cb6ceccd36a0047246fbc6e6"
+checksum = "221eaa237ddf1ca79b60d1372aad77e47f9c0ea5b3ce5099da8c61d027dc77b3"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -629,9 +644,9 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-schema"
-version = "1.1.2"
+version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9543fc722ed4865ab29fb66bd7ed0bef7b029d265ba8c587144511e30006d431"
+checksum = "e8f395d93304280b64b7632fea798d177e74897fe7f063416ce627cd6fa24829"
 dependencies = [
  "aws-smithy-runtime-api",
  "aws-smithy-types",
@@ -640,19 +655,22 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-types"
-version = "1.9.1"
+version = "1.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf183d70774ea2cfcc101ca74a8884e4c76be8b9df65cd303f6a1175c88e8f80"
+checksum = "0b791f3ac597193fe1d08b82366986eb1f5bc31f2ac6c194c0855276116c76cd"
 dependencies = [
  "base64-simd",
  "bytes",
  "bytes-utils",
+ "http 0.2.12",
  "http 1.5.0",
- "http-body",
+ "http-body 0.4.6",
+ "http-body 1.1.0",
  "http-body-util",
  "itoa",
  "num-integer",
  "pin-project-lite",
+ "pin-utils",
  "ryu",
  "serde",
  "time",
@@ -660,9 +678,9 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-xml"
-version = "0.64.1"
+version = "0.62.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "590fdc1a70546b2f7f2061c42eaf173fb6f26d935330d069edc04dbd8f01d924"
+checksum = "0b932c8d6dc127fc980eecd78f8694ae9b9551b69a93a7def2a199c1c0033daf"
 dependencies = [
  "aws-smithy-runtime-api",
  "aws-smithy-schema",
@@ -672,9 +690,9 @@ dependencies = [
 
 [[package]]
 name = "aws-types"
-version = "1.7.0"
+version = "1.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ba0d970d3947bb064d2ae1d823efa186c1dbde88f88afa8f6549946e5d8deee"
+checksum = "209f3a6d82a6e9e5f94abbed94c7a26e1c052341002bf57a5fb5481f625896fc"
 dependencies = [
  "aws-credential-types",
  "aws-smithy-async",
@@ -691,12 +709,6 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4c7f02d4ea65f2c1853089ffd8d2787bdbc63de2f0d29dedbcf8ccdfa0ccd4cf"
 
-[[package]]
-name = "base16ct"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fd307490d624467aa6f74b0eabb77633d1f758a7b25f12bceb0b22e08d9726f6"
-
 [[package]]
 name = "base64"
 version = "0.21.7"
@@ -744,9 +756,9 @@ dependencies = [
 
 [[package]]
 name = "bigdecimal"
-version = "0.4.11"
+version = "0.4.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8fa3f3d8cbf4dffcfe4991de61d012bef509a409ecbe9dd41049bfe32b4d4653"
+checksum = "4d6867f1565b3aad85681f1015055b087fcfd840d6aeee6eee7f2da317603695"
 dependencies = [
  "autocfg",
  "libm",
@@ -815,9 +827,9 @@ dependencies = [
 
 [[package]]
 name = "brotli"
-version = "9.1.1"
+version = "8.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "627b7cfb0578f0eafce087a90fcd40add1231900b69e4d4de2d456260a4f5d81"
+checksum = "5cc91aac060a7a1e25823bdccbfb6af1875b88f17c6daac97894eed8207166b3"
 dependencies = [
  "alloc-no-stdlib",
  "alloc-stdlib",
@@ -826,9 +838,9 @@ dependencies = [
 
 [[package]]
 name = "brotli-decompressor"
-version = "6.2.0"
+version = "5.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34c6783f42c21c952ad7112b354f0ba2f10760e9decea5b1b60523d6e270faaf"
+checksum = "3a32acac15fe1967bc3986b2a6347dffc965602354ea6f450ad07e8bfd253583"
 dependencies = [
  "alloc-no-stdlib",
  "alloc-stdlib",
@@ -879,17 +891,17 @@ dependencies = [
 
 [[package]]
 name = "cached"
-version = "4.1.0"
+version = "4.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6f886e989b5b6e7991606f2550e45a99e130024465ba8d67f9f9b256eb7044bf"
+checksum = "c5a6cf8262820194a1488ece477f5fb5ba9256ef25229d525470e71d6e9a5835"
 dependencies = [
  "ahash",
  "async-lock",
  "cached_proc_macro",
  "cached_proc_macro_types",
  "hashbrown 0.17.1",
- "parking_lot 0.12.5",
- "thiserror 2.0.21",
+ "parking_lot",
+ "thiserror 2.0.20",
  "web-time",
 ]
 
@@ -914,9 +926,9 @@ checksum = "f5813789573ae815c8b4be58c4428e0e7ae05f0227678ba9de332ded585b9159"
 
 [[package]]
 name = "cc"
-version = "1.10.0"
+version = "1.4.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "86e055fa6e3e40ad6187ba25b6855eeb635d5271f8e0f0e1e9a5826b8d75bea0"
+checksum = "54413ede23c2daf518f35156dfde027feb2374004d63bd497f983c8db9c0e313"
 dependencies = [
  "find-msvc-tools",
  "jobserver",
@@ -985,9 +997,9 @@ checksum = "b9e769b5c8c8283982a987c6e948e540254f1058d5a74b8794914d4ef5fc2a24"
 
 [[package]]
 name = "combine"
-version = "4.6.9"
+version = "4.6.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4356eba6976435498d05a311ee9fc486da3bc81c200d3f0d7dd9703b41913f92"
+checksum = "cfc320937d09e6de266b31b9afb480f197d7a861be86be7cb2ea7e5d1bfffc5e"
 dependencies = [
  "bytes",
  "memchr",
@@ -995,9 +1007,9 @@ dependencies = [
 
 [[package]]
 name = "compression-codecs"
-version = "0.4.46"
+version = "0.4.43"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cae36683101b2899f48bd31f8db9839437356188e3b1ff23096e73dab09ba8fe"
+checksum = "bef16c47ba2797aa6a909cc37d39911f3a6743811fe7408ac0b0cc0276b656e9"
 dependencies = [
  "brotli",
  "compression-core",
@@ -1009,9 +1021,9 @@ dependencies = [
 
 [[package]]
 name = "compression-core"
-version = "0.4.34"
+version = "0.4.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2ebdda89edc534bf8d5dd2857562633b6495557e5846552ade994b99ed13c36a"
+checksum = "6e8ccc4ea9f6acc32d102c0f6d471d11d913ad15f20c04de743374861fa1d414"
 
 [[package]]
 name = "concurrent-queue"
@@ -1124,12 +1136,6 @@ version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7f8f80099a98041a3d1622845c271458a2d73e688351bf3cb999266764b81d48"
 
-[[package]]
-name = "cpubits"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "15b85f9c39137c3a891689859392b1bd49812121d0d61c9caf00d46ed5ce06ae"
-
 [[package]]
 name = "cpufeatures"
 version = "0.2.17"
@@ -1160,9 +1166,9 @@ dependencies = [
 
 [[package]]
 name = "crc32fast"
-version = "1.5.3"
+version = "1.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ba106e844045ddc02c20768ac4b0b7cb45f2cc2ecbd833ac9f5dacb183c2055"
+checksum = "01a7799fd6b852db0e61728dde9a204c423b44d689dbd432522543614b490e78"
 dependencies = [
  "cfg-if",
 ]
@@ -1227,22 +1233,6 @@ dependencies = [
  "zeroize",
 ]
 
-[[package]]
-name = "crypto-bigint"
-version = "0.7.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c035cb64cba03dad2fb921f3e218785e8cf9a41790da5eb3a1400f62fa2be11"
-dependencies = [
- "cpubits",
- "ctutils",
- "getrandom 0.4.3",
- "hybrid-array",
- "num-traits",
- "rand_core 0.10.1",
- "subtle",
- "zeroize",
-]
-
 [[package]]
 name = "crypto-common"
 version = "0.1.6"
@@ -1259,19 +1249,16 @@ version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453"
 dependencies = [
- "getrandom 0.4.3",
  "hybrid-array",
- "rand_core 0.10.1",
 ]
 
 [[package]]
 name = "ctutils"
-version = "0.4.7"
+version = "0.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a2376ffd6f96d8a9db59875b4b6b0237d6900b5baf64279714e05493ce64828a"
+checksum = "7d5515a3834141de9eafb9717ad39eea8247b5674e6066c404e8c4b365d2a29e"
 dependencies = [
  "cmov",
- "subtle",
 ]
 
 [[package]]
@@ -1284,23 +1271,7 @@ dependencies = [
  "cpufeatures 0.2.17",
  "curve25519-dalek-derive",
  "digest 0.10.7",
- "fiat-crypto 0.2.9",
- "rustc_version",
- "subtle",
- "zeroize",
-]
-
-[[package]]
-name = "curve25519-dalek"
-version = "5.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5eed333089e2e1c1ac8c6c0398e5e2497b4c9926ca6d0365ed1e099afa5bc23"
-dependencies = [
- "cfg-if",
- "cpufeatures 0.3.1",
- "curve25519-dalek-derive",
- "digest 0.11.3",
- "fiat-crypto 0.3.0",
+ "fiat-crypto",
  "rustc_version",
  "subtle",
  "zeroize",
@@ -1385,7 +1356,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "strsim",
- "syn 3.0.9",
+ "syn 3.0.6",
 ]
 
 [[package]]
@@ -1418,7 +1389,7 @@ checksum = "2ac7135c3ef02b2f7833bbeb1be5ba7f966dcde8a87c6b87f65a778d71a02785"
 dependencies = [
  "darling_core 0.24.1",
  "quote",
- "syn 3.0.9",
+ "syn 3.0.6",
 ]
 
 [[package]]
@@ -1430,9 +1401,9 @@ dependencies = [
  "cfg-if",
  "crossbeam-utils",
  "hashbrown 0.14.5",
- "lock_api 0.4.14",
+ "lock_api",
  "once_cell",
- "parking_lot_core 0.9.12",
+ "parking_lot_core",
 ]
 
 [[package]]
@@ -1449,9 +1420,9 @@ checksum = "be1e0bca6c3637f992fc1cc7cbc52a78c1ef6db076dbf1059c4323d6a2048376"
 
 [[package]]
 name = "defmt"
-version = "1.2.0"
+version = "1.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e4a0795ac740cb54d7b3775c9c17345f6aaecf884c01733b39d6017738e0e3e1"
+checksum = "e2953bfe4f93bbd20cc71198842756f77d161884c99ebbabc41d80231ded88d1"
 dependencies = [
  "bitflags 1.3.2",
  "defmt-macros",
@@ -1459,23 +1430,23 @@ dependencies = [
 
 [[package]]
 name = "defmt-macros"
-version = "1.2.0"
+version = "1.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "840bb056bd99c495c9188198a258ab787c79f306d864db3e6e8451442d6d8366"
+checksum = "bad9c72e7ca2137e0dc3813245a0d282fd6daad32fd800af018306a9169b5fe8"
 dependencies = [
  "defmt-parser",
  "proc-macro2",
  "quote",
- "syn 3.0.9",
+ "syn 2.0.119",
 ]
 
 [[package]]
 name = "defmt-parser"
-version = "1.1.0"
+version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "71958f69fb2de856c5dd51ac9377e986ca1aa5919f931bf5395a807277f889a0"
+checksum = "10d60334b3b2e7c9d91ef8150abfb6fa4c1c39ebbcf4a81c2e346aad939fee3e"
 dependencies = [
- "thiserror 2.0.21",
+ "thiserror 2.0.20",
 ]
 
 [[package]]
@@ -1485,18 +1456,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb"
 dependencies = [
  "const-oid 0.9.6",
- "pem-rfc7468 0.7.0",
- "zeroize",
-]
-
-[[package]]
-name = "der"
-version = "0.8.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a996a108feb8b427a6e12fcf6af4aa83409b79d72c15337d7741368131ee004"
-dependencies = [
- "const-oid 0.10.2",
- "pem-rfc7468 1.0.0",
+ "pem-rfc7468",
  "zeroize",
 ]
 
@@ -1516,9 +1476,9 @@ dependencies = [
 
 [[package]]
 name = "deranged"
-version = "0.5.9"
+version = "0.5.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e9de72ce2ad1f90dc62fa25f0f430ef85eb4b0d8fa0be4f30373bc40a21d28e"
+checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
 dependencies = [
  "serde_core",
 ]
@@ -1579,9 +1539,9 @@ dependencies = [
 
 [[package]]
 name = "devise"
-version = "0.5.0"
+version = "0.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "143afb21c617f66c792ef2d75f9fb4c9dd774ff206bcc24df08a1bda294a37bc"
+checksum = "f1d90b0c4c777a2cad215e3c7be59ac7c15adf45cf76317009b7d096d46f651d"
 dependencies = [
  "devise_codegen",
  "devise_core",
@@ -1589,9 +1549,9 @@ dependencies = [
 
 [[package]]
 name = "devise_codegen"
-version = "0.5.0"
+version = "0.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50b3187e4283046e01d16d724ed05326427aa9c1c3a376548ef31820e6eb9717"
+checksum = "71b28680d8be17a570a2334922518be6adc3f58ecc880cbb404eaeb8624fd867"
 dependencies = [
  "devise_core",
  "quote",
@@ -1599,22 +1559,22 @@ dependencies = [
 
 [[package]]
 name = "devise_core"
-version = "0.5.0"
+version = "0.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "970e4b2fcd605ffa79715510663a9fe76b87f5483d59857399129cf047f73d27"
+checksum = "b035a542cf7abf01f2e3c4d5a7acbaebfefe120ae4efc7bde3df98186e4b8af7"
 dependencies = [
  "bitflags 2.13.2",
  "proc-macro2",
- "proc-macro2-diagnostics 0.11.0",
+ "proc-macro2-diagnostics",
  "quote",
- "syn 3.0.9",
+ "syn 2.0.119",
 ]
 
 [[package]]
 name = "diesel"
-version = "2.3.14"
+version = "2.3.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ebe9f7eaef33febd60290c5a9f3b0571d03c4c04a24739cd64808ce30e65a5d3"
+checksum = "e3b934ddbdcb2abb9f9fc9c30bd47bcc5618b615eea1d334cda5fdf8ff9b072a"
 dependencies = [
  "bigdecimal",
  "bitflags 2.13.2",
@@ -1712,7 +1672,7 @@ checksum = "c6232dd377dcc64799954cbd3a9bb882e9cdc1308ccd87b1c098f1fb2eaf82a8"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.9",
+ "syn 3.0.6",
 ]
 
 [[package]]
@@ -1771,27 +1731,12 @@ version = "0.16.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ee27f32b5c5292967d2d4a9d7f1e0b0aed2c15daded5a60300e4abb9d8020bca"
 dependencies = [
- "der 0.7.10",
+ "der",
  "digest 0.10.7",
- "elliptic-curve 0.13.8",
- "rfc6979 0.4.0",
- "signature 2.2.0",
- "spki 0.7.3",
-]
-
-[[package]]
-name = "ecdsa"
-version = "0.17.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0681a4fc24c767085329728d8dfba959af91228aa4610cca4f8ce317ba46ae0"
-dependencies = [
- "der 0.8.3",
- "digest 0.11.3",
- "elliptic-curve 0.14.3",
- "rfc6979 0.6.0",
- "signature 3.0.0",
- "spki 0.8.1",
- "zeroize",
+ "elliptic-curve",
+ "rfc6979",
+ "signature",
+ "spki",
 ]
 
 [[package]]
@@ -1800,18 +1745,8 @@ version = "2.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "115531babc129696a58c64a4fef0a8bf9e9698629fb97e9e40767d235cfbcd53"
 dependencies = [
- "pkcs8 0.10.2",
- "signature 2.2.0",
-]
-
-[[package]]
-name = "ed25519"
-version = "3.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "29fcf32e6c73d1079f83ab4d782de2d81620346a5f38c6237a86a22f8368980a"
-dependencies = [
- "pkcs8 0.11.0",
- "signature 3.0.0",
+ "pkcs8",
+ "signature",
 ]
 
 [[package]]
@@ -1820,34 +1755,19 @@ version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "70e796c081cee67dc755e1a36a0a172b897fab85fc3f6bc48307991f64e4eca9"
 dependencies = [
- "curve25519-dalek 4.1.3",
- "ed25519 2.2.3",
+ "curve25519-dalek",
+ "ed25519",
  "serde",
  "sha2 0.10.9",
  "subtle",
  "zeroize",
 ]
 
-[[package]]
-name = "ed25519-dalek"
-version = "3.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ebaa1a2bf1290ab3bfe5a7b771d050ebffab2711c19a81691c683a5144a25de"
-dependencies = [
- "curve25519-dalek 5.0.0",
- "ed25519 3.0.0",
- "serde",
- "sha2 0.11.1",
- "signature 3.0.0",
- "subtle",
- "zeroize",
-]
-
 [[package]]
 name = "either"
-version = "1.19.0"
+version = "1.18.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e9c71c2167ca323c882b99918929403426e2373ea17242ff5653e0d5e1058be"
+checksum = "252afb9ae5eaa683babdc6a068b3f5726eb19e05070c731f9b2a23a7c3e8ed34"
 
 [[package]]
 name = "elliptic-curve"
@@ -1855,38 +1775,17 @@ version = "0.13.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b5e6043086bf7973472e0c7dff2142ea0b680d30e18d9cc40f267efbf222bd47"
 dependencies = [
- "base16ct 0.2.0",
- "crypto-bigint 0.5.5",
+ "base16ct",
+ "crypto-bigint",
  "digest 0.10.7",
- "ff 0.13.1",
+ "ff",
  "generic-array",
- "group 0.13.0",
+ "group",
  "hkdf",
- "pem-rfc7468 0.7.0",
- "pkcs8 0.10.2",
+ "pem-rfc7468",
+ "pkcs8",
  "rand_core 0.6.4",
- "sec1 0.7.3",
- "subtle",
- "zeroize",
-]
-
-[[package]]
-name = "elliptic-curve"
-version = "0.14.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "900f37e7e18d74a2347389af6cd69e3a30d5cc9e697f40004865679aa75e9c7c"
-dependencies = [
- "base16ct 1.0.0",
- "crypto-bigint 0.7.10",
- "crypto-common 0.2.2",
- "digest 0.11.3",
- "ff 0.14.0",
- "group 0.14.0",
- "hybrid-array",
- "pem-rfc7468 1.0.0",
- "pkcs8 0.11.0",
- "rand_core 0.10.1",
- "sec1 0.8.1",
+ "sec1",
  "subtle",
  "zeroize",
 ]
@@ -1912,12 +1811,13 @@ dependencies = [
 
 [[package]]
 name = "encoding_rs"
-version = "0.8.44"
+version = "0.8.41"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "89253175e704ab869b04f9db224d38630e0211a53841a79181deae0889e169f5"
+checksum = "7b5ef0006ac9ab233c38522f5ae99cae3625151de8f706cacee1cba4b8e2832a"
 dependencies = [
  "cfg-if",
  "core_detect",
+ "multiversion",
  "multiversion_no_op",
  "rustversion",
  "scopeguard",
@@ -1926,9 +1826,9 @@ dependencies = [
 
 [[package]]
 name = "equivalent"
-version = "1.0.3"
+version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "00d174d5400e5e8fd687ad1049e2f578285fa914201b1af7e8b112a4546bd826"
+checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
 
 [[package]]
 name = "errno"
@@ -1994,36 +1894,20 @@ dependencies = [
  "subtle",
 ]
 
-[[package]]
-name = "ff"
-version = "0.14.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1f686ab92a9fb0eaf188f6c6c87b89490baa6fdb0db4544ba4dc47f7942489f"
-dependencies = [
- "rand_core 0.10.1",
- "subtle",
-]
-
 [[package]]
 name = "fiat-crypto"
 version = "0.2.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d"
 
-[[package]]
-name = "fiat-crypto"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "64cd1e32ddd350061ae6edb1b082d7c54915b5c672c389143b9a63403a109f24"
-
 [[package]]
 name = "figment"
 version = "0.10.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8cb01cd46b0cf372153850f4c6c272d9cbea2da513e07538405148f95bd789f3"
 dependencies = [
- "atomic",
- "pear 0.2.9",
+ "atomic 0.6.1",
+ "pear",
  "serde",
  "toml 0.8.23",
  "uncased",
@@ -2032,9 +1916,9 @@ dependencies = [
 
 [[package]]
 name = "find-msvc-tools"
-version = "0.1.15"
+version = "0.1.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1c66915cc5391097de7a2b0b972e8505aa33c0df401fd3a6811dbdb32881ba48"
+checksum = "ef25905e51abafe4dcea6c15fec58c57b601cdbd0ee53d22ea1d3016c587d39b"
 
 [[package]]
 name = "flate2"
@@ -2152,7 +2036,7 @@ checksum = "9fb9654ba8355388abeb8dcb4fc62f511300867002afc858860463bdd9fe0c44"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.9",
+ "syn 3.0.6",
 ]
 
 [[package]]
@@ -2248,11 +2132,9 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
 dependencies = [
  "cfg-if",
- "js-sys",
  "libc",
  "r-efi 6.0.0",
  "rand_core 0.10.1",
- "wasm-bindgen",
 ]
 
 [[package]]
@@ -2287,7 +2169,7 @@ dependencies = [
  "getrandom 0.3.4",
  "hashbrown 0.16.1",
  "nonzero_ext",
- "parking_lot 0.12.5",
+ "parking_lot",
  "portable-atomic",
  "quanta",
  "rand 0.9.5",
@@ -2315,27 +2197,16 @@ version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f0f9ef7462f7c099f518d754361858f86d8a07af53ba9af0fe635bbccb151a63"
 dependencies = [
- "ff 0.13.1",
+ "ff",
  "rand_core 0.6.4",
  "subtle",
 ]
 
-[[package]]
-name = "group"
-version = "0.14.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7fd1a1c7a5206c5b7a3f5a0d7ccd3ff85d0c8f5133d62a02680255b0004af5f4"
-dependencies = [
- "ff 0.14.0",
- "rand_core 0.10.1",
- "subtle",
-]
-
 [[package]]
 name = "h2"
-version = "0.4.20"
+version = "0.4.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d29020232d6aa3fb1daca64c1127cf662cf97f254ae16c18c05b8ab635fc118"
+checksum = "ef8e5e5a340588f4452631496976cf8636d4a7ecf600239fdc27615d2530bc16"
 dependencies = [
  "atomic-waker",
  "bytes",
@@ -2374,7 +2245,7 @@ dependencies = [
  "pest_derive",
  "serde",
  "serde_json",
- "thiserror 2.0.21",
+ "thiserror 2.0.20",
  "walkdir",
 ]
 
@@ -2450,8 +2321,8 @@ dependencies = [
  "idna",
  "ipnet",
  "jni",
- "rand 0.10.3",
- "thiserror 2.0.21",
+ "rand 0.10.2",
+ "thiserror 2.0.20",
  "tinyvec",
  "tokio",
  "tracing",
@@ -2470,9 +2341,9 @@ dependencies = [
  "jni",
  "once_cell",
  "prefix-trie",
- "rand 0.10.3",
+ "rand 0.10.2",
  "ring",
- "thiserror 2.0.21",
+ "thiserror 2.0.20",
  "tinyvec",
  "tracing",
  "url",
@@ -2494,12 +2365,12 @@ dependencies = [
  "moka",
  "ndk-context",
  "once_cell",
- "parking_lot 0.12.5",
- "rand 0.10.3",
+ "parking_lot",
+ "rand 0.10.2",
  "resolv-conf",
  "smallvec",
  "system-configuration",
- "thiserror 2.0.21",
+ "thiserror 2.0.20",
  "tokio",
  "tracing",
 ]
@@ -2544,9 +2415,12 @@ dependencies = [
 
 [[package]]
 name = "html5gum"
-version = "0.9.0"
+version = "0.8.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bbae3133814a10216af5242a254420a74cb0d2f7715646924f5a8e7720cd188b"
+checksum = "428502d3ec1742c35e015871aef742bc4722a9acfcb616b8ff79b519922e1c36"
+dependencies = [
+ "jetscii",
+]
 
 [[package]]
 name = "http"
@@ -2569,6 +2443,17 @@ dependencies = [
  "itoa",
 ]
 
+[[package]]
+name = "http-body"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ceab25649e9960c0311ea418d17bee82c0dcec1bd053b5f9a66e265a693bed2"
+dependencies = [
+ "bytes",
+ "http 0.2.12",
+ "pin-project-lite",
+]
+
 [[package]]
 name = "http-body"
 version = "1.1.0"
@@ -2588,7 +2473,7 @@ dependencies = [
  "bytes",
  "futures-core",
  "http 1.5.0",
- "http-body",
+ "http-body 1.1.0",
  "pin-project-lite",
 ]
 
@@ -2610,16 +2495,37 @@ version = "0.4.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "27f864f10dfb56725ce5ce5472bc52252c8f93a4ab86327122cebf62c5f59a17"
 dependencies = [
- "subtle",
  "typenum",
- "zeroize",
 ]
 
 [[package]]
 name = "hyper"
-version = "1.12.0"
+version = "0.14.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c3e324da4c95177d6291d4c8730197c0d1822f8a9766814a4a44fa5ab797c9c"
+checksum = "41dfc780fdec9373c01bae43289ea34c972e40ee3c9f6b3c8801a35f35586ce7"
+dependencies = [
+ "bytes",
+ "futures-channel",
+ "futures-core",
+ "futures-util",
+ "http 0.2.12",
+ "http-body 0.4.6",
+ "httparse",
+ "httpdate",
+ "itoa",
+ "pin-project-lite",
+ "socket2 0.5.10",
+ "tokio",
+ "tower-service",
+ "tracing",
+ "want",
+]
+
+[[package]]
+name = "hyper"
+version = "1.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "27b501faa50e7a26c3d3560ca625132f4078a17771f4810baf70475ae48cbe43"
 dependencies = [
  "atomic-waker",
  "bytes",
@@ -2627,9 +2533,8 @@ dependencies = [
  "futures-core",
  "h2",
  "http 1.5.0",
- "http-body",
+ "http-body 1.1.0",
  "httparse",
- "httpdate",
  "itoa",
  "pin-project-lite",
  "smallvec",
@@ -2639,38 +2544,37 @@ dependencies = [
 
 [[package]]
 name = "hyper-rustls"
-version = "0.27.10"
+version = "0.27.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dfa8e654703247911e29c23fbeaa261834bd9bb74efba2f9acddc37bfb127f53"
+checksum = "33ca68d021ef39cf6463ab54c1d0f5daf03377b70561305bb89a8f83aab66e0f"
 dependencies = [
  "http 1.5.0",
- "hyper",
+ "hyper 1.11.1",
  "hyper-util",
- "rustls",
+ "rustls 0.23.45",
  "tokio",
- "tokio-rustls",
+ "tokio-rustls 0.26.5",
  "tower-service",
 ]
 
 [[package]]
 name = "hyper-util"
-version = "0.1.21"
+version = "0.1.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ddc03d96684f9226b8a787cdb71488417b53ab5ea8fdb1dac946cb9431cc8bff"
+checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0"
 dependencies = [
- "base64 0.23.1",
+ "base64 0.22.1",
  "bytes",
  "futures-channel",
  "futures-util",
  "http 1.5.0",
- "http-body",
- "httparse",
- "hyper",
+ "http-body 1.1.0",
+ "hyper 1.11.1",
  "ipnet",
  "libc",
  "percent-encoding",
  "pin-project-lite",
- "socket2",
+ "socket2 0.6.5",
  "system-configuration",
  "tokio",
  "tower-service",
@@ -2704,9 +2608,9 @@ dependencies = [
 
 [[package]]
 name = "icu_collections"
-version = "2.4.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fe090a42a0d3140fed8c63263ed1fecc02422cb2f4bfe55cd8de2de1b8e105dd"
+checksum = "fa68d21081c4a05d5a901a1c62add574c77048b6a1c67be3b50ce0b60d4ca513"
 dependencies = [
  "displaydoc",
  "potential_utf",
@@ -2718,9 +2622,9 @@ dependencies = [
 
 [[package]]
 name = "icu_locale_core"
-version = "2.4.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "25d29b57c17c6528d0dc4c2141cfa2d08200465acb537a3909c8b9b8a4a984c0"
+checksum = "d56e28588da92eee5c3201a6eff33fabdd49b62269c8938d4ff050ce4d900deb"
 dependencies = [
  "displaydoc",
  "litemap",
@@ -2731,9 +2635,9 @@ dependencies = [
 
 [[package]]
 name = "icu_normalizer"
-version = "2.4.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "404a3b8c486f205c87fe7f23ab6894d84a4ad76d6e4671ae1981ba7def87c599"
+checksum = "12f9cf5f235641ed274641dd81c3f28d870e276763d0797aeeab72317b1c646f"
 dependencies = [
  "icu_collections",
  "icu_normalizer_data",
@@ -2745,15 +2649,15 @@ dependencies = [
 
 [[package]]
 name = "icu_normalizer_data"
-version = "2.4.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "20f0088bfb7441f7a37fa0c9e20cb1e9cba1cac6b9ce8cd2a6dc44294f8e8cbc"
+checksum = "1563da1ed3e0b3bf3d74c9b85917ac9c56464d2f57242270c09c9e752f8021a0"
 
 [[package]]
 name = "icu_properties"
-version = "2.4.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2ea83d991c56158f7cf898bf86436c1dfe7c07ee82fe88951f2695c9f37a379f"
+checksum = "7e7ca276ad3145661a65914e6daf131ca5120cd3dcee8f8f3214b8875184a148"
 dependencies = [
  "displaydoc",
  "icu_collections",
@@ -2766,15 +2670,15 @@ dependencies = [
 
 [[package]]
 name = "icu_properties_data"
-version = "2.4.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b98f29af82d02b163fe50161388350e743bb3107cc8e8c2f7314cb505faddfcf"
+checksum = "e590f038c1464a96894fd6d10127e90a8be4509f56ff7ecef851b15cee0b7caa"
 
 [[package]]
 name = "icu_provider"
-version = "2.4.0"
+version = "2.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "413099315636c588ee8f011190b329b971a09a8fae9d157e01dcae8379468514"
+checksum = "d27bbb9d3abbefac45d55f647c9de1d44aafcd1186eb91879afef17c396c3e73"
 dependencies = [
  "displaydoc",
  "icu_locale_core",
@@ -2847,7 +2751,7 @@ version = "0.3.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4d40460c0ce33d6ce4b0630ad68ff63d6661961c48b6dba35e5a4d81cfb48222"
 dependencies = [
- "socket2",
+ "socket2 0.6.5",
  "widestring",
  "windows-registry",
  "windows-result",
@@ -2876,9 +2780,9 @@ dependencies = [
 
 [[package]]
 name = "itertools"
-version = "0.14.0"
+version = "0.10.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b192c782037fadd9cfa75548310488aabdbf3d2da73885b31bd0abd03351285"
+checksum = "b0fd2260e829bddf4cb6ea802289de2f86d6a7a690192fbe91b3f46e0f2c8473"
 dependencies = [
  "either",
 ]
@@ -2890,10 +2794,16 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
 
 [[package]]
-name = "jiff"
-version = "0.2.38"
+name = "jetscii"
+version = "0.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b2b005715dcbeb0089a3c0dab99f2ff1cc3b2525323552703d648585d342a383"
+checksum = "47f142fe24a9c9944451e8349de0a56af5f3e7226dc46f3ed4d4ecc0b85af75e"
+
+[[package]]
+name = "jiff"
+version = "0.2.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ab1baf72f08796de0260609515130699b890ac25f30e610ad894bc5856cafdb"
 dependencies = [
  "defmt",
  "jiff-core",
@@ -2920,9 +2830,9 @@ dependencies = [
 
 [[package]]
 name = "jiff-static"
-version = "0.2.38"
+version = "0.2.37"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2cc9817253cf7c7ee4684451bd327e88d6f3658014e54a29198625590650695c"
+checksum = "378268a1116ad67ae6228701118ac9f491d78fda38a40a1f1a9e1348de6f7212"
 dependencies = [
  "jiff-core",
  "proc-macro2",
@@ -2932,9 +2842,9 @@ dependencies = [
 
 [[package]]
 name = "jiff-tzdb"
-version = "0.1.9"
+version = "0.1.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fa8377070c6bae868759445e5a77f66d84f0b72f3a054bfb00e6d038b8282da7"
+checksum = "142bd39932ad231f10513df9ab62661fead8719872150b7ad02a2df79f4e141e"
 
 [[package]]
 name = "jiff-tzdb-platform"
@@ -2957,7 +2867,7 @@ dependencies = [
  "jni-sys",
  "log",
  "simd_cesu8",
- "thiserror 2.0.21",
+ "thiserror 2.0.20",
  "walkdir",
  "windows-link",
 ]
@@ -3017,9 +2927,9 @@ dependencies = [
 
 [[package]]
 name = "js-sys"
-version = "0.3.107"
+version = "0.3.105"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8dc09d2154098bbf4ef54eab6b117a3c24cbbffe94046b16ee6d6d4510584d3a"
+checksum = "ce57d20d1ea864ce2ac172ab472d409214f4fd359f0b2a2775abdf522e2af99e"
 dependencies = [
  "cfg-if",
  "futures-util",
@@ -3033,19 +2943,19 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e75fe14a82d81e5f5af639997db37d8b96045938a7ac6ab18cdbe1c7467e05e1"
 dependencies = [
  "base64 0.22.1",
- "ed25519-dalek 2.2.0",
+ "ed25519-dalek",
  "getrandom 0.2.17",
  "hmac 0.12.1",
  "js-sys",
- "p256 0.13.2",
- "p384 0.13.1",
+ "p256",
+ "p384",
  "pem",
  "rand 0.8.8",
  "rsa",
  "serde",
  "serde_json",
  "sha2 0.10.9",
- "signature 2.2.0",
+ "signature",
  "simple_asn1",
  "zeroize",
 ]
@@ -3070,9 +2980,9 @@ dependencies = [
 
 [[package]]
 name = "lazy_static"
-version = "1.5.1"
+version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "20870f649af7073d53e38067b2a84312175d56ea15217e1b15bc83506ec50afb"
+checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
 dependencies = [
  "spin 0.9.9",
 ]
@@ -3098,21 +3008,21 @@ dependencies = [
  "nom 8.0.0",
  "percent-encoding",
  "quoted_printable",
- "rustls",
+ "rustls 0.23.45",
  "rustls-native-certs",
  "serde",
- "socket2",
+ "socket2 0.6.5",
  "tokio",
- "tokio-rustls",
+ "tokio-rustls 0.26.5",
  "tracing",
  "url",
 ]
 
 [[package]]
 name = "libc"
-version = "0.2.191"
+version = "0.2.189"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "65cd87c9a6d60536580b316ad985726104730a5151c99845f2490428ef91240a"
+checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
 
 [[package]]
 name = "libm"
@@ -3154,9 +3064,9 @@ checksum = "47d9d19d1d6efa0109d2f65ff4c85cddd50bd572e5a00127ab10987290bcefae"
 
 [[package]]
 name = "litrs"
-version = "1.0.1"
+version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4744e383959f0db86ede514b809b1c53251889093803c05267acc7d4e7030d70"
+checksum = "11d3d7f243d5c5a8b9bb5d6dd2b1602c0cb0b9db1621bafc7ed66e35ff9fe092"
 
 [[package]]
 name = "lock_api"
@@ -3167,20 +3077,11 @@ dependencies = [
  "scopeguard",
 ]
 
-[[package]]
-name = "lock_api"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "65d91b22da179613dcf4d6ec8349563f52a363f6849e03b00dd0a185ec4a59af"
-dependencies = [
- "scopeguard",
-]
-
 [[package]]
 name = "log"
-version = "0.4.35"
+version = "0.4.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d15f86d12da44cd8d4ec3c73984537eb7f4cadcb9776a575a0a8a05ca11005c"
+checksum = "f9f8bd3e56ce4dfc153cf470fffbfa98c7620958b312ca5c3a4b8d5181fd13c6"
 dependencies = [
  "value-bag",
 ]
@@ -3205,7 +3106,7 @@ name = "macros"
 version = "0.1.0"
 dependencies = [
  "quote",
- "syn 3.0.9",
+ "syn 3.0.6",
 ]
 
 [[package]]
@@ -3227,6 +3128,16 @@ dependencies = [
  "digest 0.11.3",
 ]
 
+[[package]]
+name = "mea"
+version = "0.6.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c709842c4ce65cb91e2666ad5319dfc1efc3af0d34f02075eddca9000d9f8afb"
+dependencies = [
+ "hashbrown 0.17.1",
+ "slab",
+]
+
 [[package]]
 name = "memchr"
 version = "2.8.3"
@@ -3245,14 +3156,13 @@ dependencies = [
 
 [[package]]
 name = "migrations_macros"
-version = "2.3.1"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9423d6affd681fb4d25d35885d0d0262c52f8ade16e96f87c064c442e5aa5d47"
+checksum = "36fc5ac76be324cfd2d3f2cf0fdf5d5d3c4f14ed8aaebadb09e304ba42282703"
 dependencies = [
  "migrations_internals",
  "proc-macro2",
  "quote",
- "syn 3.0.9",
 ]
 
 [[package]]
@@ -3288,9 +3198,9 @@ dependencies = [
 
 [[package]]
 name = "mio"
-version = "1.2.4"
+version = "1.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1788edb87fdc09c7e26304471e2f5be8cdefb1b6930d6e3985fc02ff53bf86ee"
+checksum = "4b18443e9c262bfe8fa82f51666e2642c53393f7e5c27b3e1aeab922cff5b9d8"
 dependencies = [
  "libc",
  "wasi",
@@ -3310,7 +3220,7 @@ dependencies = [
  "equivalent",
  "event-listener 5.4.2",
  "futures-util",
- "parking_lot 0.12.5",
+ "parking_lot",
  "portable-atomic",
  "smallvec",
  "tagptr",
@@ -3336,6 +3246,27 @@ dependencies = [
  "version_check",
 ]
 
+[[package]]
+name = "multiversion"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4ca4bea16ffc3f443cf7d866912118196bfef4c6a1556ca00f9f9b00bb43f7c"
+dependencies = [
+ "multiversion-macros",
+]
+
+[[package]]
+name = "multiversion-macros"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d416831a7317ef4b08bee00b69cbbb9c8763da7959a7026244d6266869f9c83"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "rustversion",
+ "syn 3.0.6",
+]
+
 [[package]]
 name = "multiversion_no_op"
 version = "1.0.0"
@@ -3445,7 +3376,7 @@ checksum = "e4e98dc3b890f6c23a0f9d3d491a2823d0dea0fa656302a13dd225fa924112a8"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.9",
+ "syn 3.0.6",
 ]
 
 [[package]]
@@ -3504,9 +3435,9 @@ dependencies = [
 
 [[package]]
 name = "num_threads"
-version = "0.1.8"
+version = "0.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cabcc654086861f9e1bc5115258de62ef92c79b20f4615a1b0cc57c4e82027d4"
+checksum = "5c7398b9c8b70908f6371f47ed36737907c87c52af34c268fed0bf0ceb92ead9"
 dependencies = [
  "libc",
 ]
@@ -3551,9 +3482,9 @@ dependencies = [
 
 [[package]]
 name = "opendal"
-version = "0.59.5"
+version = "0.59.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "46081824c74bac9f68f0bc4408077f77b0e315c006514719c97af1c2227ac2d2"
+checksum = "9fe43e16d96bed57937eb7c4a28559bf4c5fc4a3951656505d1fdd4f856349b4"
 dependencies = [
  "opendal-core",
  "opendal-service-fs",
@@ -3562,9 +3493,9 @@ dependencies = [
 
 [[package]]
 name = "opendal-core"
-version = "0.59.5"
+version = "0.59.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "33d5a635dfea36a7a0c3bbb2ca34c97af17f98dd69b0cdf31a1d436a346e0a12"
+checksum = "de4566a412776e3f65d53dd9fceced5b432a0a9c9a1e8d50ccf58823795e5c5b"
 dependencies = [
  "anyhow",
  "asyncband",
@@ -3588,23 +3519,23 @@ dependencies = [
 
 [[package]]
 name = "opendal-http-transport-reqwest"
-version = "0.59.5"
+version = "0.59.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc025e163c43993e30cf1829a30b791934e5b0f7cd4d7e03acc902a9efb7e8f5"
+checksum = "f772ce6c137ab43647726116d505a649a88d41928fcd813438eb30b02312bcbb"
 dependencies = [
  "bytes",
  "futures",
  "http 1.5.0",
- "http-body",
+ "http-body 1.1.0",
  "opendal-core",
  "reqwest",
 ]
 
 [[package]]
 name = "opendal-service-fs"
-version = "0.59.5"
+version = "0.59.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "70768b8f5af6996a494e784a1dc2a76b5cf890c422aff31ad094319bde98feb7"
+checksum = "a0e7d8974aebd33be899200c9d0d50b2141fd5fa5c462b29e20653e3ddbfe339"
 dependencies = [
  "bytes",
  "log",
@@ -3616,9 +3547,9 @@ dependencies = [
 
 [[package]]
 name = "opendal-service-s3"
-version = "0.59.5"
+version = "0.59.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0932321e27c712a30ef72db56b12f31e41e9f0d2d3841d63a91bc8075cd8f0ef"
+checksum = "2942f2d8d3d4953c0e8d07cd1244879628d084948e48ce6b6d808c5938f7858d"
 dependencies = [
  "base64 0.23.1",
  "bytes",
@@ -3637,22 +3568,21 @@ dependencies = [
 
 [[package]]
 name = "openidconnect"
-version = "4.1.0"
+version = "4.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df0d098a59353679624d406825940139e2b2d554a52b64c9fb1b1bc42a11fe5c"
+checksum = "0d8c6709ba2ea764bbed26bce1adf3c10517113ddea6f2d4196e4851757ef2b2"
 dependencies = [
- "base64 0.22.1",
+ "base64 0.21.7",
  "chrono",
  "dyn-clone",
- "ed25519-dalek 3.0.0",
- "getrandom 0.4.3",
+ "ed25519-dalek",
  "hmac 0.12.1",
  "http 1.5.0",
  "itertools",
  "log",
  "oauth2",
- "p256 0.14.0",
- "p384 0.14.0",
+ "p256",
+ "p384",
  "rand 0.8.8",
  "rsa",
  "serde",
@@ -3694,9 +3624,9 @@ dependencies = [
 
 [[package]]
 name = "openssl-probe"
-version = "0.2.2"
+version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7e036b411754132fd6b74e94b74e9a13c5cf606fa93d1885c35860d3060820b1"
+checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe"
 
 [[package]]
 name = "openssl-src"
@@ -3751,51 +3681,24 @@ version = "0.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c9863ad85fa8f4460f9c48cb909d38a0d689dba1f6f6988a5e3e0d31071bcd4b"
 dependencies = [
- "ecdsa 0.16.9",
- "elliptic-curve 0.13.8",
- "primeorder 0.13.6",
+ "ecdsa",
+ "elliptic-curve",
+ "primeorder",
  "sha2 0.10.9",
 ]
 
-[[package]]
-name = "p256"
-version = "0.14.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2c9239b2dbc807adbbe147e8cf72ea7450c3a0aabe62cb8e75ff4ec22e1f72a"
-dependencies = [
- "ecdsa 0.17.0",
- "elliptic-curve 0.14.3",
- "primefield",
- "primeorder 0.14.0",
- "sha2 0.11.1",
-]
-
 [[package]]
 name = "p384"
 version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fe42f1670a52a47d448f14b6a5c61dd78fce51856e68edaa38f7ae3a46b8d6b6"
 dependencies = [
- "ecdsa 0.16.9",
- "elliptic-curve 0.13.8",
- "primeorder 0.13.6",
+ "ecdsa",
+ "elliptic-curve",
+ "primeorder",
  "sha2 0.10.9",
 ]
 
-[[package]]
-name = "p384"
-version = "0.14.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d17b851e6b3e378ab4ecb07fa2ed23f4d15f075735f8fec9fa1e7bdce5f8301f"
-dependencies = [
- "ecdsa 0.17.0",
- "elliptic-curve 0.14.3",
- "fiat-crypto 0.3.0",
- "primefield",
- "primeorder 0.14.0",
- "sha2 0.11.1",
-]
-
 [[package]]
 name = "parking"
 version = "2.2.1"
@@ -3808,18 +3711,8 @@ version = "0.12.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "93857453250e3077bd71ff98b6a65ea6621a19bb0f559a85248955ac12c45a1a"
 dependencies = [
- "lock_api 0.4.14",
- "parking_lot_core 0.9.12",
-]
-
-[[package]]
-name = "parking_lot"
-version = "0.13.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a9cf937ca4e1d0b7578784559063422fc39ae7c5a00f02471f2614d5486fd226"
-dependencies = [
- "lock_api 0.5.0",
- "parking_lot_core 0.10.0",
+ "lock_api",
+ "parking_lot_core",
 ]
 
 [[package]]
@@ -3830,19 +3723,7 @@ checksum = "2621685985a2ebf1c516881c026032ac7deafcda1a2c9b7850dc81e3dfcb64c1"
 dependencies = [
  "cfg-if",
  "libc",
- "redox_syscall 0.5.18",
- "smallvec",
- "windows-link",
-]
-
-[[package]]
-name = "parking_lot_core"
-version = "0.10.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9cfff060068cc18aa7815010fcaf80c68c7fb9e85fc7f5c0f9bf142c21d19826"
-dependencies = [
- "libc",
- "redox_syscall 0.9.5",
+ "redox_syscall",
  "smallvec",
  "windows-link",
 ]
@@ -3876,18 +3757,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bdeeaa00ce488657faba8ebf44ab9361f9365a97bd39ffb8a60663f57ff4b467"
 dependencies = [
  "inlinable_string",
- "pear_codegen 0.2.9",
- "yansi",
-]
-
-[[package]]
-name = "pear"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4bdc582f5ece4663ba62cb9cc81b9f86aa23884ee92cddb1d5e75a94991119cb"
-dependencies = [
- "inlinable_string",
- "pear_codegen 0.3.0",
+ "pear_codegen",
  "yansi",
 ]
 
@@ -3898,23 +3768,11 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4bab5b985dc082b345f812b7df84e1bef27e7207b39e448439ba8bd69c93f147"
 dependencies = [
  "proc-macro2",
- "proc-macro2-diagnostics 0.10.1",
+ "proc-macro2-diagnostics",
  "quote",
  "syn 2.0.119",
 ]
 
-[[package]]
-name = "pear_codegen"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b4262794e70dac544a759fd50088c6331e7a2ba4fc204b4b6e29c9b5257f9c4"
-dependencies = [
- "proc-macro2",
- "proc-macro2-diagnostics 0.11.0",
- "quote",
- "syn 3.0.9",
-]
-
 [[package]]
 name = "pem"
 version = "3.0.6"
@@ -3934,15 +3792,6 @@ dependencies = [
  "base64ct",
 ]
 
-[[package]]
-name = "pem-rfc7468"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6305423e0e7738146434843d1694d621cce767262b2a86910beab705e4493d9"
-dependencies = [
- "base64ct",
-]
-
 [[package]]
 name = "percent-encoding"
 version = "2.3.2"
@@ -3951,20 +3800,19 @@ checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
 
 [[package]]
 name = "pest"
-version = "2.9.5"
+version = "2.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a8db75153506001cb36ed924f08cadc862eb3f8c4d0d534139f29074769d7660"
+checksum = "6d45aeb61b4bf818e12d4205f2466f8c4748f85f4fce0146d1c03d69d753f0ad"
 dependencies = [
  "memchr",
- "pest_stack_guard",
  "ucd-trie",
 ]
 
 [[package]]
 name = "pest_derive"
-version = "2.9.5"
+version = "2.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "20aa17e11fb35664b67d5214a0afac57a360d231b6ec53d6eba0700b27d933b4"
+checksum = "89cc5a242e25ed4e7704d0be240f2cfbe20a8c27e7e252d94835be93d92dc39f"
 dependencies = [
  "pest",
  "pest_generator",
@@ -3972,36 +3820,26 @@ dependencies = [
 
 [[package]]
 name = "pest_generator"
-version = "2.9.5"
+version = "2.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "626ec5afccf44ccbfeb2b232316510bb55b4bf34d891afcb0fb07d2b17d7fe9d"
+checksum = "7abf21475cc3820fe4b2ca2dc2142902f67a02189f3b5b3a229f4febc01a43e5"
 dependencies = [
  "pest",
  "pest_meta",
  "proc-macro2",
  "quote",
- "syn 3.0.9",
+ "syn 2.0.119",
 ]
 
 [[package]]
 name = "pest_meta"
-version = "2.9.5"
+version = "2.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b3f45b6caa65c1b08186832745159c2529994146340a7bf44168095469720f5d"
+checksum = "adba4db388f687393c18c51348d44a41d870ca9df71a2c98172ea3035dc6936e"
 dependencies = [
  "pest",
 ]
 
-[[package]]
-name = "pest_stack_guard"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97e6cd2217057fa86b6eaa512917e58089d875b957a31e35e7ab729977e0a5f2"
-dependencies = [
- "psm",
- "stacker",
-]
-
 [[package]]
 name = "phc"
 version = "0.6.1"
@@ -4087,9 +3925,9 @@ checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
 
 [[package]]
 name = "pin-utils"
-version = "0.1.1"
+version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "13bee6c73da26345c729282832b60b0363cf3dd9f4bfd81d8551b7a1c889a113"
+checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
 
 [[package]]
 name = "piper"
@@ -4108,9 +3946,9 @@ version = "0.7.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c8ffb9f10fa047879315e6625af03c164b16962a5368d724ed16323b68ace47f"
 dependencies = [
- "der 0.7.10",
- "pkcs8 0.10.2",
- "spki 0.7.3",
+ "der",
+ "pkcs8",
+ "spki",
 ]
 
 [[package]]
@@ -4119,18 +3957,8 @@ version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7"
 dependencies = [
- "der 0.7.10",
- "spki 0.7.3",
-]
-
-[[package]]
-name = "pkcs8"
-version = "0.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "451913da69c775a56034ea8d9003d27ee8948e12443eae7c038ba100a4f21cb7"
-dependencies = [
- "der 0.8.3",
- "spki 0.8.1",
+ "der",
+ "spki",
 ]
 
 [[package]]
@@ -4179,9 +4007,9 @@ dependencies = [
 
 [[package]]
 name = "powerfmt"
-version = "0.2.1"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4a6394b9e965e73d0a289ee54f589087e2c676aedf60885baf52c76b771e4958"
+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
 
 [[package]]
 name = "ppv-lite86"
@@ -4194,9 +4022,9 @@ dependencies = [
 
 [[package]]
 name = "pq-sys"
-version = "0.7.8"
+version = "0.7.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "297a95d6f2378891f949d9556723e15140e50d29eac07458dabcee8688995b1d"
+checksum = "574ddd6a267294433f140b02a726b0640c43cf7c6f717084684aaa3b285aba61"
 dependencies = [
  "libc",
  "pkg-config",
@@ -4214,40 +4042,13 @@ dependencies = [
  "num-traits",
 ]
 
-[[package]]
-name = "primefield"
-version = "0.14.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c555a6e4eb7d4e158fcb028c835c3b8642206ddc279b5c6b202ef9a8bdb592f4"
-dependencies = [
- "crypto-bigint 0.7.10",
- "crypto-common 0.2.2",
- "ff 0.14.0",
- "rand_core 0.10.1",
- "subtle",
- "zeroize",
-]
-
 [[package]]
 name = "primeorder"
 version = "0.13.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "353e1ca18966c16d9deb1c69278edbc5f194139612772bd9537af60ac231e1e6"
 dependencies = [
- "elliptic-curve 0.13.8",
-]
-
-[[package]]
-name = "primeorder"
-version = "0.14.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c9f42978c78a00e3d68f69fc03e57a234debae69da4020a4fb588fcdcd07b06"
-dependencies = [
- "elliptic-curve 0.14.3",
- "once_cell",
- "primefield",
- "serdect",
- "wnaf",
+ "elliptic-curve",
 ]
 
 [[package]]
@@ -4256,7 +4057,7 @@ version = "3.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e67ba7e9b2b56446f1d419b1d807906278ffa1a658a8a5d8a39dcb1f5a78614f"
 dependencies = [
- "toml_edit 0.25.17+spec-1.1.0",
+ "toml_edit 0.25.15+spec-1.1.0",
 ]
 
 [[package]]
@@ -4281,33 +4082,12 @@ dependencies = [
  "yansi",
 ]
 
-[[package]]
-name = "proc-macro2-diagnostics"
-version = "0.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df921e1ef974ebc8dd9effdb0c037a96928ae8cbf871438e02d6fd67204b595e"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 3.0.9",
- "version_check",
-]
-
 [[package]]
 name = "psl-types"
 version = "2.0.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "33cb294fe86a74cbcf50d4445b37da762029549ebeea341421c7c70370f86cac"
 
-[[package]]
-name = "psm"
-version = "0.1.24"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "200b9ff220857e53e184257720a14553b2f4aa02577d2ed9842d45d4b9654810"
-dependencies = [
- "cc",
-]
-
 [[package]]
 name = "publicsuffix"
 version = "2.3.0"
@@ -4341,9 +4121,9 @@ checksum = "a993555f31e5a609f617c12db6250dedcac1b0a85076912c436e6fc9b2c8e6a3"
 
 [[package]]
 name = "quick-xml"
-version = "0.42.0"
+version = "0.41.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41b1177fdf999d2321d3fb46ff47159d9c1fb9ad66a4879f8c50a0b504615e9b"
+checksum = "e660451e55124f798a69a5af3f49ccfbefbd41910eefd25caf2393e1f3473ec1"
 dependencies = [
  "memchr",
  "serde",
@@ -4383,7 +4163,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "51de85fb3fb6524929c8a2eb85e6b6d363de4e8c48f9e2c2eac4944abc181c93"
 dependencies = [
  "log",
- "parking_lot 0.12.5",
+ "parking_lot",
  "scheduled-thread-pool",
 ]
 
@@ -4410,9 +4190,9 @@ dependencies = [
 
 [[package]]
 name = "rand"
-version = "0.10.3"
+version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "65c9fb96cbc91e3478eaae79a69fcd3f1ae4ad052e471fe6732fff548984b4af"
+checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80"
 dependencies = [
  "chacha20",
  "getrandom 0.4.3",
@@ -4481,15 +4261,6 @@ dependencies = [
  "bitflags 2.13.2",
 ]
 
-[[package]]
-name = "redox_syscall"
-version = "0.9.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "580c875845b41ecb1564ad1ae4703044cef774145e3d7a94dc2b3fa7c97868fd"
-dependencies = [
- "bitflags 2.13.2",
-]
-
 [[package]]
 name = "ref-cast"
 version = "1.0.27"
@@ -4507,15 +4278,9 @@ checksum = "92ecd8964f8453721699a1ed72037b0db49ce2f5a5138486ee89bed6f67cdf3a"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.9",
+ "syn 3.0.6",
 ]
 
-[[package]]
-name = "ref-swap"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09c30c54dffee5b40af088d5d50aa3455c91a0127164b51f0215efc4cb28fb3c"
-
 [[package]]
 name = "regex"
 version = "1.13.1"
@@ -4564,9 +4329,9 @@ dependencies = [
 
 [[package]]
 name = "reqsign-aws-core"
-version = "3.2.0"
+version = "3.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d38c902d8ec745bd9eadd1abbcbe227f4c1fc2926b2ec8929f89234af3114500"
+checksum = "bac4749b7dfa7bfaccd01eb03e9dc795ed37e3f20d6f0f38e2c67ee85ad6bc86"
 dependencies = [
  "bytes",
  "form_urlencoded",
@@ -4585,9 +4350,9 @@ dependencies = [
 
 [[package]]
 name = "reqsign-aws-v4"
-version = "3.3.1"
+version = "3.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "906bfd028f96bfe73fdb892ce26f3b3f99b4f30feb9bd024be58bd6657f68b2b"
+checksum = "ff250f0fd0b913fbd565e405acc553da0f13bde30bfb5403178c9d0313cdc15f"
 dependencies = [
  "bytes",
  "http 1.5.0",
@@ -4600,30 +4365,31 @@ dependencies = [
 
 [[package]]
 name = "reqsign-core"
-version = "3.3.2"
+version = "3.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85fed85c436b6b920e4b36310f699a77771a91e38ae483df48447bd7d162671c"
+checksum = "ff052daffb0599681c50f85c59e7236438976efe991ab864edd9f3b235501a0f"
 dependencies = [
  "anyhow",
- "asyncband",
  "base64 0.23.1",
  "bytes",
+ "futures",
  "hex",
  "hmac 0.13.0",
  "http 1.5.0",
  "jiff",
  "log",
+ "mea",
  "percent-encoding",
  "sha1 0.11.0",
- "sha2 0.11.1",
+ "sha2 0.11.0",
  "windows-sys 0.61.2",
 ]
 
 [[package]]
 name = "reqsign-file-read-tokio"
-version = "3.0.7"
+version = "3.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "586a8e198057773f9616901fd723a4bc186812b9765bc0f20368661d6169d906"
+checksum = "b3235df90a6bca681aa47dd86f2393d122a6d77042aa8a7c81e218cd45c5bfc0"
 dependencies = [
  "anyhow",
  "reqsign-core",
@@ -4645,9 +4411,9 @@ dependencies = [
  "futures-util",
  "h2",
  "http 1.5.0",
- "http-body",
+ "http-body 1.1.0",
  "http-body-util",
- "hyper",
+ "hyper 1.11.1",
  "hyper-rustls",
  "hyper-util",
  "js-sys",
@@ -4655,7 +4421,7 @@ dependencies = [
  "mime",
  "percent-encoding",
  "pin-project-lite",
- "rustls",
+ "rustls 0.23.45",
  "rustls-pki-types",
  "rustls-platform-verifier",
  "serde",
@@ -4663,7 +4429,7 @@ dependencies = [
  "serde_urlencoded",
  "sync_wrapper",
  "tokio",
- "tokio-rustls",
+ "tokio-rustls 0.26.5",
  "tokio-util",
  "tower",
  "tower-http",
@@ -4691,16 +4457,6 @@ dependencies = [
  "subtle",
 ]
 
-[[package]]
-name = "rfc6979"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4a459cddafb3fe76b31fd8f1108007566c40301feb64dc7b54656eb7388172b"
-dependencies = [
- "crypto-bigint 0.7.10",
- "hmac 0.13.0",
-]
-
 [[package]]
 name = "ring"
 version = "0.17.14"
@@ -4735,28 +4491,27 @@ dependencies = [
 
 [[package]]
 name = "rocket"
-version = "0.5.2"
+version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c17431360eb641a861453b57107ee1b425a799f49ec1b0fe9b8a45fe437447ce"
+checksum = "a516907296a31df7dc04310e7043b61d71954d703b603cc6867a026d7e72d73f"
 dependencies = [
  "async-stream",
  "async-trait",
+ "atomic 0.5.3",
  "binascii",
  "bytes",
  "either",
  "figment",
  "futures",
- "http-body-util",
- "hyper-util",
  "indexmap 2.14.2",
  "log",
  "memchr",
  "multer",
  "num_cpus",
- "parking_lot 0.12.5",
+ "parking_lot",
  "pin-project-lite",
+ "rand 0.8.8",
  "ref-cast",
- "ref-swap",
  "rocket_codegen",
  "rocket_http",
  "serde",
@@ -4774,50 +4529,48 @@ dependencies = [
 
 [[package]]
 name = "rocket_codegen"
-version = "0.5.2"
+version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "352bd0b773ca6f5bea6cd18efc2fd7f04fcd34c75c242dad6ef1bbd729cc619d"
+checksum = "575d32d7ec1a9770108c879fc7c47815a80073f96ca07ff9525a94fcede1dd46"
 dependencies = [
  "devise",
  "glob",
  "indexmap 2.14.2",
  "proc-macro2",
- "proc-macro2-diagnostics 0.11.0",
  "quote",
  "rocket_http",
- "syn 3.0.9",
+ "syn 2.0.119",
  "unicode-xid",
  "version_check",
 ]
 
 [[package]]
 name = "rocket_http"
-version = "0.5.2"
+version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "847886ef963dff77126f110fd2b4401f5149440ab32973bef16c4a2cc83e525f"
+checksum = "e274915a20ee3065f611c044bd63c40757396b6dbc057d6046aec27f14f882b9"
 dependencies = [
  "cookie",
  "either",
  "futures",
  "http 0.2.12",
- "hyper",
+ "hyper 0.14.32",
  "indexmap 2.14.2",
  "log",
  "memchr",
- "pear 0.3.0",
+ "pear",
  "percent-encoding",
  "pin-project-lite",
  "ref-cast",
- "rustls",
- "rustls-pki-types",
- "rustls-webpki",
+ "rustls 0.21.12",
+ "rustls-pemfile",
  "serde",
  "smallvec",
  "stable-pattern",
  "state",
  "time",
  "tokio",
- "tokio-rustls",
+ "tokio-rustls 0.24.1",
  "uncased",
 ]
 
@@ -4854,21 +4607,22 @@ dependencies = [
  "num-integer",
  "num-traits",
  "pkcs1",
- "pkcs8 0.10.2",
+ "pkcs8",
  "rand_core 0.6.4",
- "signature 2.2.0",
- "spki 0.7.3",
+ "signature",
+ "spki",
  "subtle",
  "zeroize",
 ]
 
 [[package]]
 name = "rsqlite-vfs"
-version = "0.2.0"
+version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "353b74f9810d5b085b6c42c9d86a5f0fdb795553235cdd48753b32e3809d18a7"
+checksum = "c51c9ae4df8a7fba42103df5c621fa3c37eccf3a3c650879e90fc48b11cc192c"
 dependencies = [
- "thiserror 2.0.21",
+ "hashbrown 0.16.1",
+ "thiserror 2.0.20",
 ]
 
 [[package]]
@@ -4911,9 +4665,9 @@ dependencies = [
 
 [[package]]
 name = "rustix"
-version = "1.1.6"
+version = "1.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e5e76742e5294153d4dde1207dbec5bdd81eef6fabdc0d2118babadabfd858aa"
+checksum = "891efababe418670775f199f0d233d84843c227a0949a883ce15b37c78d6629d"
 dependencies = [
  "bitflags 2.13.2",
  "errno",
@@ -4924,24 +4678,36 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.46"
+version = "0.21.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf"
+checksum = "3f56a14d1f48b391359b22f731fd4bd7e43c97f3c50eee276f3aa09c94784d3e"
+dependencies = [
+ "log",
+ "ring",
+ "rustls-webpki 0.101.7",
+ "sct",
+]
+
+[[package]]
+name = "rustls"
+version = "0.23.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634"
 dependencies = [
  "log",
  "once_cell",
  "ring",
  "rustls-pki-types",
- "rustls-webpki",
+ "rustls-webpki 0.103.15",
  "subtle",
  "zeroize",
 ]
 
 [[package]]
 name = "rustls-native-certs"
-version = "0.8.5"
+version = "0.8.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4a073f5dc7469f984c52ad2752b63b0807745133b6de880b7b64c1ac4c48aec4"
+checksum = "dab5152771c58876a2146916e53e35057e1a4dfa2b9df0f0305b07f611fdea4d"
 dependencies = [
  "openssl-probe",
  "rustls-pki-types",
@@ -4949,6 +4715,15 @@ dependencies = [
  "security-framework",
 ]
 
+[[package]]
+name = "rustls-pemfile"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1c74cae0a4cf6ccbbf5f359f08efdf8ee7e1dc532573bf0db71968cb56b1448c"
+dependencies = [
+ "base64 0.21.7",
+]
+
 [[package]]
 name = "rustls-pki-types"
 version = "1.15.1"
@@ -4960,19 +4735,19 @@ dependencies = [
 
 [[package]]
 name = "rustls-platform-verifier"
-version = "0.7.1"
+version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1167586491e2b18b8bfbb293e8180ec17c201c4f076d7cb3070ca964e7598f98"
+checksum = "26d1e2536ce4f35f4846aa13bff16bd0ff40157cdb14cc056c7b14ba41233ba0"
 dependencies = [
  "core-foundation 0.10.1",
  "core-foundation-sys",
  "jni",
  "log",
  "once_cell",
- "rustls",
+ "rustls 0.23.45",
  "rustls-native-certs",
  "rustls-platform-verifier-android",
- "rustls-webpki",
+ "rustls-webpki 0.103.15",
  "security-framework",
  "security-framework-sys",
  "webpki-root-certs",
@@ -4981,15 +4756,25 @@ dependencies = [
 
 [[package]]
 name = "rustls-platform-verifier-android"
-version = "0.2.0"
+version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eec689c0bc40ff2458a5977b6619cb718087084a18e02a131c599b62d05e1a5f"
+checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f"
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.16"
+version = "0.101.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281"
+checksum = "8b6275d1ee7a1cd780b64aca7726599a1dbc893b1e64144529e55c3c2f745765"
+dependencies = [
+ "ring",
+ "untrusted",
+]
+
+[[package]]
+name = "rustls-webpki"
+version = "0.103.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2"
 dependencies = [
  "ring",
  "rustls-pki-types",
@@ -5019,20 +4804,20 @@ dependencies = [
 
 [[package]]
 name = "schannel"
-version = "0.1.30"
+version = "0.1.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9cb23c424d8ee841bb4d813677ca237e2a610067d594fec130f87d6093495ab5"
+checksum = "91c1b7e4904c873ef0710c1f407dde2e6287de2bebc1bbbf7d430bb7cbffd939"
 dependencies = [
  "windows-sys 0.61.2",
 ]
 
 [[package]]
 name = "scheduled-thread-pool"
-version = "0.2.8"
+version = "0.2.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f304b290c05b371b2aa1e8718242ff0394530f9334ecedcb9ae51330f37fc1ba"
+checksum = "3cbc66816425a074528352f5789333ecff06ca41b36b0b0efdfbb29edc391a19"
 dependencies = [
- "parking_lot 0.13.0",
+ "parking_lot",
 ]
 
 [[package]]
@@ -5049,9 +4834,9 @@ dependencies = [
 
 [[package]]
 name = "schemars"
-version = "1.2.3"
+version = "1.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ab508826f74a77ca9d5aba6ff19b522583ee3eaf28a19384ff3d0e5835fadf6e"
+checksum = "687274d293b6cdc6e73e0fee520bf2049650090d7164f87672d212a3c530cf4a"
 dependencies = [
  "dyn-clone",
  "ref-cast",
@@ -5071,30 +4856,26 @@ version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
+[[package]]
+name = "sct"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da046153aa2352493d6cb7da4b6e5c0c057d8a1d0a9aa8560baffdd945acd414"
+dependencies = [
+ "ring",
+ "untrusted",
+]
+
 [[package]]
 name = "sec1"
 version = "0.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d3e97a565f76233a6003f9f5c54be1d9c5bdfa3eccfb189469f11ec4901c47dc"
 dependencies = [
- "base16ct 0.2.0",
- "der 0.7.10",
+ "base16ct",
+ "der",
  "generic-array",
- "pkcs8 0.10.2",
- "subtle",
- "zeroize",
-]
-
-[[package]]
-name = "sec1"
-version = "0.8.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d56d437c2f19203ce5f7122e507831de96f3d2d4d3be5af44a0b0a09d8a80e4d"
-dependencies = [
- "base16ct 1.0.0",
- "ctutils",
- "der 0.8.3",
- "hybrid-array",
+ "pkcs8",
  "subtle",
  "zeroize",
 ]
@@ -5175,14 +4956,14 @@ checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.9",
+ "syn 3.0.6",
 ]
 
 [[package]]
 name = "serde_json"
-version = "1.0.154"
+version = "1.0.151"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e7e9cc8b1b85264074fbcc02a88680c4096b1e47df8f739dceb03bf482f04bd6"
+checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
 dependencies = [
  "itoa",
  "memchr",
@@ -5222,9 +5003,9 @@ dependencies = [
 
 [[package]]
 name = "serde_spanned"
-version = "1.1.2"
+version = "1.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4e7523beb55eece201a2356bee0bbca0d1ab466c14c07703b2e0ee6d42cb0c2c"
+checksum = "6662b5879511e06e8999a8a235d848113e942c9124f211511b16466ee2995f26"
 dependencies = [
  "serde_core",
 ]
@@ -5243,9 +5024,9 @@ dependencies = [
 
 [[package]]
 name = "serde_with"
-version = "3.24.0"
+version = "3.23.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df9adc193c780ef8f159aee8b61e2d5801aaa555e6eb0947fe45530ec506296f"
+checksum = "935177bb8c0cd8ca1a4e6d1a2ac8988bea69cab4f9d3a31311e012ad27868ea4"
 dependencies = [
  "base64 0.23.1",
  "bs58",
@@ -5255,7 +5036,7 @@ dependencies = [
  "indexmap 2.14.2",
  "jiff",
  "schemars 0.9.0",
- "schemars 1.2.3",
+ "schemars 1.2.2",
  "serde_core",
  "serde_json",
  "serde_with_macros",
@@ -5264,24 +5045,14 @@ dependencies = [
 
 [[package]]
 name = "serde_with_macros"
-version = "3.24.0"
+version = "3.23.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3e17bbc68e28663bbbb90df47e058aa7eda4fb445b89fe70457bb94fbccf6e49"
+checksum = "1d607aa01a3cb0ad757d6fd216136910db3c97b102fe686585689615a02dbcdc"
 dependencies = [
  "darling 0.24.1",
  "proc-macro2",
  "quote",
- "syn 3.0.9",
-]
-
-[[package]]
-name = "serdect"
-version = "0.4.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "66cf8fedced2fcf12406bcb34223dffb92eaf34908ede12fed414c82b7f00b3e"
-dependencies = [
- "base16ct 1.0.0",
- "serde",
+ "syn 3.0.6",
 ]
 
 [[package]]
@@ -5319,9 +5090,9 @@ dependencies = [
 
 [[package]]
 name = "sha2"
-version = "0.11.1"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "47d7069beb7d6ac7b9acd1039986e73443f24234f41074da099d6f994ac9ad19"
+checksum = "446ba717509524cb3f22f17ecc096f10f4822d76ab5c0b9822c5f9c284e825f4"
 dependencies = [
  "cfg-if",
  "cpufeatures 0.3.1",
@@ -5373,16 +5144,6 @@ dependencies = [
  "rand_core 0.6.4",
 ]
 
-[[package]]
-name = "signature"
-version = "3.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28d567dcbaf0049cb8ac2608a76cd95ff9e4412e1899d389ee400918ca7537f5"
-dependencies = [
- "digest 0.11.3",
- "rand_core 0.10.1",
-]
-
 [[package]]
 name = "simd-adler32"
 version = "0.3.10"
@@ -5413,15 +5174,15 @@ checksum = "0d585997b0ac10be3c5ee635f1bab02d512760d14b7c468801ac8a01d9ae5f1d"
 dependencies = [
  "num-bigint",
  "num-traits",
- "thiserror 2.0.21",
+ "thiserror 2.0.20",
  "time",
 ]
 
 [[package]]
 name = "siphasher"
-version = "1.0.4"
+version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "33f4fe9184a62d842c9ef383018f3306d8ba224fd9d836f56d7288308847c256"
+checksum = "8ee5873ec9cce0195efcb7a4e9507a04cd49aec9c83d0389df45b1ef7ba2e649"
 
 [[package]]
 name = "slab"
@@ -5431,9 +5192,19 @@ checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
 
 [[package]]
 name = "smallvec"
-version = "1.16.4"
+version = "1.16.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d0d5d4b1981b8bbbb7aed204cae5726d683d5d6ac7e74ec54122ea28f315e7c8"
+checksum = "ba467056f1b547ed52077911161fc86985becbc60e8e1857c8a144dab0def891"
+
+[[package]]
+name = "socket2"
+version = "0.5.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e22376abed350d73dd1cd119b57ffccad95b4e585a7cda43e286245ce23c0678"
+dependencies = [
+ "libc",
+ "windows-sys 0.52.0",
+]
 
 [[package]]
 name = "socket2"
@@ -5459,11 +5230,11 @@ checksum = "023a211cb3138dbc438680b32560ad89f699977624c9f8dbb95a47d5b4c07dd3"
 
 [[package]]
 name = "spinning_top"
-version = "0.3.1"
+version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9cf02766a1eb909bc7653557c66b384e44edc3ad979e6257c6173c65ea51bc7d"
+checksum = "d96d2d1d716fb500937168cc09353ffdc7a012be8475ac7308e1bdf0e3923300"
 dependencies = [
- "lock_api 0.4.14",
+ "lock_api",
 ]
 
 [[package]]
@@ -5473,27 +5244,19 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d"
 dependencies = [
  "base64ct",
- "der 0.7.10",
-]
-
-[[package]]
-name = "spki"
-version = "0.8.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ef958a98b9d5da290cfc78946e9f3e61e1e62a18db0d92cac0b83cc161491a9"
-dependencies = [
- "base64ct",
- "der 0.8.3",
+ "der",
 ]
 
 [[package]]
 name = "sqlite-wasm-rs"
-version = "0.6.2"
+version = "0.5.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "36bd8e29bf08189a005b2df1df99823aa0861cabe9044e5f31ed54ca292ee618"
+checksum = "dc3efc0da82635d7e1ced0053bbbfa8c7ab9645d0bf36ceb4f7127bb85315d75"
 dependencies = [
  "cc",
+ "js-sys",
  "rsqlite-vfs",
+ "wasm-bindgen",
 ]
 
 [[package]]
@@ -5511,19 +5274,6 @@ version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
 
-[[package]]
-name = "stacker"
-version = "0.1.25"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "707f49d46706bacf8a2b00d51dace3f9de527c13eec3778f570c411f89e69967"
-dependencies = [
- "cc",
- "cfg-if",
- "libc",
- "psm",
- "windows-sys 0.61.2",
-]
-
 [[package]]
 name = "state"
 version = "0.6.0"
@@ -5571,9 +5321,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "3.0.9"
+version = "3.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d78c8dee4c7bf0e14673097256fed6142ce9d3b85a408189d07482442145823b"
+checksum = "8593e8e72159ed2257d083c7a454a85cbf854f37a0966d8d483aff8c8a3ebcee"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -5608,7 +5358,7 @@ checksum = "901704edd0dfe137f1987838ee4f259e4e063c31371bdb423f7ae38ec6f77f02"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.9",
+ "syn 3.0.6",
 ]
 
 [[package]]
@@ -5674,11 +5424,11 @@ dependencies = [
 
 [[package]]
 name = "thiserror"
-version = "2.0.21"
+version = "2.0.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09e52cb86a36cede5cb101bf8908837b3e4c6e5e59fe7fd85c23fb56200d189e"
+checksum = "ec86235f5fcc2a73650310756d2ac5b138a5780bbbdfae3eeccec992c435ba4f"
 dependencies = [
- "thiserror-impl 2.0.21",
+ "thiserror-impl 2.0.20",
 ]
 
 [[package]]
@@ -5694,13 +5444,13 @@ dependencies = [
 
 [[package]]
 name = "thiserror-impl"
-version = "2.0.21"
+version = "2.0.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fe5197923287db20a58125f0bc85c062f7f2c892de97b18c356f9efb14b28524"
+checksum = "bc04cd3e1236dd4a98afca4569f2deb3f120e5422a4023be2cb683f8486292af"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.9",
+ "syn 3.0.6",
 ]
 
 [[package]]
@@ -5755,9 +5505,9 @@ dependencies = [
 
 [[package]]
 name = "tinystr"
-version = "0.8.5"
+version = "0.8.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "abc840c238154d58f9e86b2792261edfde565a17696e1cda1a449de27979801a"
+checksum = "b1e27c91459209c2986af3dcf603a5a74a4368754ce37414f59acc971167f643"
 dependencies = [
  "displaydoc",
  "zerovec",
@@ -5771,17 +5521,17 @@ checksum = "fd3ca314f692efd6c868f8408f53fe444634a845f96c028b97d35f6a1f79f0ee"
 
 [[package]]
 name = "tokio"
-version = "1.54.1"
+version = "1.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b52fd3255258d26fac7264ab5a76b53c13367136dc011d3d6ad4f8ed070396a3"
+checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed"
 dependencies = [
  "bytes",
  "libc",
  "mio",
- "parking_lot 0.12.5",
+ "parking_lot",
  "pin-project-lite",
  "signal-hook-registry",
- "socket2",
+ "socket2 0.6.5",
  "tokio-macros",
  "windows-sys 0.61.2",
 ]
@@ -5794,16 +5544,26 @@ checksum = "78773a2a397f451582ce068015985c33193cf6dea8b74d2a639fe457b2f07b0e"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.9",
+ "syn 3.0.6",
 ]
 
 [[package]]
 name = "tokio-rustls"
-version = "0.26.6"
+version = "0.24.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c9cc2678c2cdd569ef8215e2afd7954ada2ae20b4fdd2c5fe6139a3b02d105db"
+checksum = "c28327cf380ac148141087fbfb9de9d7bd4e84ab5d2c28fbc911d753de8a7081"
 dependencies = [
- "rustls",
+ "rustls 0.21.12",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-rustls"
+version = "0.26.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b0c85f2c3ef0b1cd58b36682f4b17aaa995f0e5db534d85692b4903abce21f67"
+dependencies = [
+ "rustls 0.23.45",
  "tokio",
 ]
 
@@ -5832,9 +5592,9 @@ dependencies = [
 
 [[package]]
 name = "tokio-util"
-version = "0.7.20"
+version = "0.7.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e464cf451ba96ebfc6f9b6542f17ee8b8956e33f1e40d9690624e59d7a7f8a4b"
+checksum = "494815d09bf52b5548659851081238f0ca39ff638363907596da739561c62c52"
 dependencies = [
  "bytes",
  "futures-core",
@@ -5864,7 +5624,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cf92845e79fc2e2def6a5d828f0801e29a2f8acc037becc5ab08595c7d5e9863"
 dependencies = [
  "serde_core",
- "serde_spanned 1.1.2",
+ "serde_spanned 1.1.1",
  "toml_datetime 0.7.5+spec-1.1.0",
  "toml_parser",
  "winnow 0.7.15",
@@ -5890,9 +5650,9 @@ dependencies = [
 
 [[package]]
 name = "toml_datetime"
-version = "1.1.2+spec-1.1.0"
+version = "1.1.1+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b86d767906c6c42421dcba507eb9d203e779497710a47782a224bb871653053"
+checksum = "3165f65f62e28e0115a00b2ebdd37eb6f3b641855f9d636d3cd4103767159ad7"
 dependencies = [
  "serde_core",
 ]
@@ -5913,21 +5673,21 @@ dependencies = [
 
 [[package]]
 name = "toml_edit"
-version = "0.25.17+spec-1.1.0"
+version = "0.25.15+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3641d5bbb5349a79e1020a242d251efbc546ad8048d133958323ce9c40a9c9c"
+checksum = "1340ea94a5856333492c9064b02c778b191dd2c853778d9609debdcdfea3a614"
 dependencies = [
  "indexmap 2.14.2",
- "toml_datetime 1.1.2+spec-1.1.0",
+ "toml_datetime 1.1.1+spec-1.1.0",
  "toml_parser",
  "winnow 1.0.4",
 ]
 
 [[package]]
 name = "toml_parser"
-version = "1.1.5+spec-1.1.0"
+version = "1.1.3+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "baa693a8032d7e1cada7d0041e96126df243179ff061456783ac7f12bda4744c"
+checksum = "1d38ac1cf9b95face32296c0a3ede1fdc270627c9d9c02a7274dd6d960dc4d56"
 dependencies = [
  "winnow 1.0.4",
 ]
@@ -5977,7 +5737,7 @@ dependencies = [
  "futures-core",
  "futures-util",
  "http 1.5.0",
- "http-body",
+ "http-body 1.1.0",
  "http-body-util",
  "pin-project-lite",
  "tokio",
@@ -6120,9 +5880,9 @@ dependencies = [
 
 [[package]]
 name = "unicode-ident"
-version = "1.0.27"
+version = "1.0.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a2c754d6c33795a1c324727428e5a7dedb5b06195f9890bdbcba760d3e246563"
+checksum = "d245f478577f809a851594d02313b640fb437e0bb33866753cff937863096954"
 
 [[package]]
 name = "unicode-segmentation"
@@ -6169,24 +5929,15 @@ checksum = "09cc8ee72d2a9becf2f2febe0205bbed8fc6615b7cb429ad062dc7b7ddd036a9"
 
 [[package]]
 name = "utf8_iter"
-version = "1.1.0"
+version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "af3bd9d3e571c26fcce9d033b87ea5ab061b8d2ffe9b7a5675d810d68f03edf0"
-dependencies = [
- "utf_types",
-]
-
-[[package]]
-name = "utf_types"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3a3b425286980a367278453f3b6d28cdcb134b574e5a35824a6ff5eebad50bb6"
+checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
 
 [[package]]
 name = "uuid"
-version = "1.29.0"
+version = "1.26.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4a0e2d11620c50695fe12bbbfde96b3477fe606e7284c22d505c12ce51214514"
+checksum = "2ef6dac1e96601b4fb3acccccff2139741fcb757cb9a36089bf5be91cfb285ce"
 dependencies = [
  "getrandom 0.4.3",
  "js-sys",
@@ -6257,7 +6008,7 @@ dependencies = [
  "pastey 0.2.3",
  "percent-encoding",
  "pico-args",
- "rand 0.10.3",
+ "rand 0.10.2",
  "regex",
  "reqsign-aws-v4",
  "reqsign-core",
@@ -6267,10 +6018,9 @@ dependencies = [
  "rocket",
  "rocket_ws",
  "rpassword",
- "rustls",
+ "rustls 0.23.45",
  "semver",
  "serde",
- "serde_cbor_2",
  "serde_json",
  "subtle",
  "svg-hush",
@@ -6319,9 +6069,9 @@ dependencies = [
 
 [[package]]
 name = "want"
-version = "0.3.2"
+version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec4cdd0dd910afe868b7ef477227d8d538b46b3075031afee8a9f2acb0a2ed0b"
+checksum = "bfa7760aed19e106de2c7c0b581b509f2f25d3dacaf737cb82ac61bc6d760b0e"
 dependencies = [
  "try-lock",
 ]
@@ -6343,11 +6093,12 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.130"
+version = "0.2.128"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a0181c14ddd6c7b8b0b0132a5f1ea2f32be0d893cd3ea97b6e3b28886b8a3d1c"
+checksum = "aecb87a33d3b0c5e3b7aa46336eaf486cffafbd281b195e4c8b80d50df2351bf"
 dependencies = [
  "cfg-if",
+ "once_cell",
  "rustversion",
  "wasm-bindgen-macro",
  "wasm-bindgen-shared",
@@ -6355,20 +6106,19 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-futures"
-version = "0.4.80"
+version = "0.4.78"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e14e0327cb5368ad60ccb22d04a9827a693c95a926d8d125e9fa39e0baec501"
+checksum = "6ef4c5d3d2cdf5c54f4231181768f5510842e350db025faf1f7163b1030ed928"
 dependencies = [
  "js-sys",
- "tokio",
  "wasm-bindgen",
 ]
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.130"
+version = "0.2.128"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e931a02a39abdbf66966fc35902b5ed58344750a70885bed4ebb3d8eaf28ed9"
+checksum = "a690d511e3c1a8b3a55e33511e3c2c00c78415cd23650f32b808627f5696b9ed"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -6376,22 +6126,22 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.130"
+version = "0.2.128"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2ca4b54280e455bd831e33a6b8e734baf432fe63fbc35c42ac14ce67a043a53a"
+checksum = "411e4887f0071ef2d2164a9d5fdf2d20efbef78fccd3a78b0c10a1dc5295e48a"
 dependencies = [
  "bumpalo",
  "proc-macro2",
  "quote",
- "syn 3.0.9",
+ "syn 3.0.6",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.130"
+version = "0.2.128"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b1f9c3798725016c6ee5f2f57869ec0831e8bbc0ab0310a86e787e97f41389e"
+checksum = "81941cd78d0c92026c33e5e01312845a4cb1e9af3407f9134b100dd03144103e"
 dependencies = [
  "unicode-ident",
 ]
@@ -6411,9 +6161,9 @@ dependencies = [
 
 [[package]]
 name = "web-sys"
-version = "0.3.107"
+version = "0.3.105"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7d179596ff5ec0f6de4db64d54011bde6289cc49603d3a6e4ce3f329207ab88"
+checksum = "9fbddc4a036f00ec4f18c83445bd3115cb306a91da554919a099d9222fe4a7f8"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
@@ -6499,9 +6249,9 @@ dependencies = [
 
 [[package]]
 name = "webpki-root-certs"
-version = "1.0.11"
+version = "1.0.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e49d0e65abc00c142e8f9428da991da9f1a250c39be97459901eb12b9b49f62a"
+checksum = "b96554aa2acc8ccdb7e1c9a58a7a68dd5d13bccc69cd124cb09406db612a1c9b"
 dependencies = [
  "rustls-pki-types",
 ]
@@ -6794,18 +6544,6 @@ version = "0.57.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
 
-[[package]]
-name = "wnaf"
-version = "0.14.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "795ca18b3fdb5e62bf982199278341ddcf7ebf7d32e25e212ad05d496e95f6fa"
-dependencies = [
- "ff 0.14.0",
- "group 0.14.0",
- "hybrid-array",
- "primefield",
-]
-
 [[package]]
 name = "writeable"
 version = "0.6.4"
@@ -6831,9 +6569,9 @@ dependencies = [
 
 [[package]]
 name = "xattr"
-version = "1.7.0"
+version = "1.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "963d6fab92d5504b971dc8bd90ca743c2575e590bc8071ea5bc571598667ae08"
+checksum = "32e45ad4206f6d2479085147f02bc2ef834ac85886624a23575ae137c8aa8156"
 dependencies = [
  "libc",
  "rustix",
@@ -6862,9 +6600,9 @@ dependencies = [
 
 [[package]]
 name = "yoke"
-version = "0.8.4"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "417ef3fcf6c300b7dbd25c85531a746931c02ad536f3cf4786ed1e88223340b3"
+checksum = "709fe23a0424b6a435d82152b1bd3fdfb0833487d5fa90d05d42762a9891fef5"
 dependencies = [
  "stable_deref_trait",
  "yoke-derive",
@@ -6873,13 +6611,13 @@ dependencies = [
 
 [[package]]
 name = "yoke-derive"
-version = "0.8.4"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec8ebde2db3681e8c9980cc27822030e68752690ddfa9473e739aeb4dbde6d71"
+checksum = "33811428bee40dbceb6d545e95754741d17a6aef9a4849f0fd62e2ba4f412a78"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.9",
+ "syn 3.0.6",
  "synstructure 0.14.0",
 ]
 
@@ -6898,18 +6636,18 @@ dependencies = [
 
 [[package]]
 name = "zerocopy"
-version = "0.8.63"
+version = "0.8.57"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e5fe1f8f1b06191a00962174c61aa5005e0bb391a6d80d07e24d115c01a92ed8"
+checksum = "d35102a9f36d089ccae9e4c6802bc118be4487b80aaffc0ab4e0cf5ce92d2873"
 dependencies = [
  "zerocopy-derive",
 ]
 
 [[package]]
 name = "zerocopy-derive"
-version = "0.8.63"
+version = "0.8.57"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "863ad3ac83293fb4d740aedbfdc9240dd8d1a50c1099acd76ce80ce7c7230c7f"
+checksum = "146c01f5ab44258da43cf276c74a2763db2ff3969c9c652c3f2de07041d0b2bc"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -6933,15 +6671,15 @@ checksum = "f75b4683f6c7f45248d4d64056a24298c6281e0993356d7d1b4a1a962ef10d4a"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.9",
+ "syn 3.0.6",
  "synstructure 0.14.0",
 ]
 
 [[package]]
 name = "zeroize"
-version = "1.9.1"
+version = "1.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e13084392c5e4bc371903e2935a5eaeed24905a7511356b883835e18a78f6879"
+checksum = "e13c156562582aa81c60cb29407084cdb54c4164760106ab78e6c5b0858cf64e"
 dependencies = [
  "zeroize_derive",
 ]
@@ -6970,9 +6708,9 @@ dependencies = [
 
 [[package]]
 name = "zerovec"
-version = "0.11.9"
+version = "0.11.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f58a2799cfe9a1670c7ea8edbd52ef8edb93cb37a7f83bf31ba9e35d9dae6a40"
+checksum = "bb0464e17806c1d976d5cba29399c7f08e516e279e2ba493f63123b5fca67dd8"
 dependencies = [
  "yoke",
  "zerofrom",
@@ -6981,13 +6719,13 @@ dependencies = [
 
 [[package]]
 name = "zerovec-derive"
-version = "0.11.7"
+version = "0.11.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c3743ddbf47738d929cd1ae2e199d40d0162979dfe31aef8ae646d2bf00bf97a"
+checksum = "34df6fc39dbd26ddc9c10e6a2984476e13acce22e64e4487636ef494369225da"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.9",
+ "syn 3.0.6",
 ]
 
 [[package]]
@@ -7004,27 +6742,27 @@ checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
 
 [[package]]
 name = "zstd"
-version = "0.14.3"
+version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "db3ae9bf90af6e40197bef767eeefc46ad6397420fe873830bd85e5fbbfb3c70"
+checksum = "bf06bd8162af0734b344780deb55b42a2429ae430870d13fcc12f238e880fe6e"
 dependencies = [
  "zstd-safe",
 ]
 
 [[package]]
 name = "zstd-safe"
-version = "8.2.0"
+version = "8.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ded520f16b29e1a9b771c722221b2b0a0398c2316d9bb3c42b458a5414d7434b"
+checksum = "ae42c0555055784c70058d19ba8e275528e8a99a706684868ace5da4e716a4ab"
 dependencies = [
  "zstd-sys",
 ]
 
 [[package]]
 name = "zstd-sys"
-version = "2.1.2+zstd.1.5.7"
+version = "2.1.0+zstd.1.5.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "481ada9c543b2323cbb7bbdbb5249177fbf0188ed959ed2c15e4b22421c84ed3"
+checksum = "0ef0a8027ec3ee71300ab3bcbcd0393f434aa72b91ca6d635a39941deae8eea0"
 dependencies = [
  "cc",
  "pkg-config",
diff --git a/Cargo.toml b/Cargo.toml
index e677b162..a419b12b 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [workspace.package]
 edition = "2024"
-rust-version = "1.97.1"
+rust-version = "1.96.1"
 license = "AGPL-3.0-only"
 repository = "https://github.com/dani-garcia/vaultwarden"
 publish = false
@@ -57,9 +57,6 @@ oidc-accept-string-booleans = ["openidconnect/accept-string-booleans"]
 # Currently only used to enable rusts official ip support
 unstable = []
 
-# Enables special test mode features. This should NEVER be enabled in production
-unsafe_test_mode = ["dep:serde_cbor_2"]
-
 [target."cfg(unix)".dependencies]
 nix = { version = "0.31.3", features = ["fs"] }
 # Logging
@@ -69,7 +66,7 @@ syslog = "7.0.0"
 macros = { path = "./macros" }
 
 # Logging
-log = "0.4.35"
+log = "0.4.34"
 fern = { version = "0.7.1", features = ["syslog-7", "reopen-1"] }
 # We need the `log` feature for `tracing` to enable logging for several crates to work, like lettre or webauthn-rs
 tracing = { version = "0.1.44", features = ["log"] }
@@ -80,10 +77,10 @@ dotenvy = { version = "0.15.7", default-features = false }
 # Numerical libraries
 num-traits = "0.2.19"
 num-derive = "0.5.1"
-bigdecimal = "0.4.11"
+bigdecimal = "0.4.10"
 
 # Web framework
-rocket = { version = "0.5.2", default-features = false, features = ["json", "tls"] }
+rocket = { version = "0.5.1", default-features = false, features = ["json", "tls"] }
 rocket_ws = { version = "0.1.1" }
 
 # WebSockets libraries
@@ -94,7 +91,7 @@ dashmap = "6.2.1"
 
 # Async futures
 futures = "0.3.34"
-tokio = { version = "1.54.1", features = [
+tokio = { version = "1.53.1", features = [
     "fs",
     "io-util",
     "net",
@@ -103,14 +100,14 @@ tokio = { version = "1.54.1", features = [
     "signal",
     "time",
 ] }
-tokio-util = { version = "0.7.20", features = ["compat"] }
+tokio-util = { version = "0.7.19", features = ["compat"] }
 
 # A generic serialization/deserialization framework
 serde = { version = "1.0.229", features = ["derive"] }
-serde_json = "1.0.154"
+serde_json = "1.0.151"
 
 # A safe, extensible ORM and Query builder
-diesel = { version = "2.3.14", features = ["chrono", "r2d2", "numeric", "64-column-tables"] }
+diesel = { version = "2.3.13", features = ["chrono", "r2d2", "numeric", "64-column-tables"] }
 diesel_migrations = "2.3.2"
 
 derive_more = { version = "2.1.1", features = [
@@ -126,13 +123,13 @@ diesel-derive-newtype = "2.1.3"
 libsqlite3-sys = { version = "0.38.2", optional = true }
 
 # Crypto-related libraries
-rand = "0.10.3"
+rand = "0.10.2"
 ring = "0.17.14"
-rustls = { version = "0.23.46", features = ["ring", "std"], default-features = false }
+rustls = { version = "0.23.45", features = ["ring", "std"], default-features = false }
 subtle = "2.6.1"
 
 # UUID generation
-uuid = { version = "1.29.0", features = ["v4"] }
+uuid = { version = "1.26.1", features = ["v4"] }
 
 # Date and time libraries
 chrono = { version = "0.4.45", default-features = false, features = ["clock", "serde"] }
@@ -160,7 +157,6 @@ yubico_ng = { version = "1.0.0", default-features = false }
 webauthn-rs = { version = "0.5.5", features = ["danger-allow-state-serialisation", "danger-credential-internals"] }
 webauthn-rs-proto = "0.5.5"
 webauthn-rs-core = "0.5.5"
-serde_cbor_2 = { version = "0.13.0", optional = true }
 
 # Handling of URL's for WebAuthn and favicons
 url = "2.5.8"
@@ -208,7 +204,7 @@ reqwest = { version = "0.13.5", default-features = false, features = [
 hickory-resolver = "0.26.3"
 
 # Favicon extraction libraries
-html5gum = "0.9.0"
+html5gum = "0.8.4"
 regex = { version = "1.13.1", default-features = false, features = [
     "perf",
     "std",
@@ -219,7 +215,7 @@ bytes = "1.12.1"
 svg-hush = "0.9.7"
 
 # Cache function results (Used for version check and favicon fetching)
-cached = { version = "4.1.0", features = ["async"] }
+cached = { version = "4.0.0", features = ["async"] }
 
 # Used for custom short lived cookie jar during favicon extraction
 cookie = "0.18.2"
@@ -239,7 +235,7 @@ governor = "0.10.4"
 ipnet = "2.12.2"
 
 # OIDC for SSO
-openidconnect = { version = "4.1.0", default-features = false }
+openidconnect = { version = "4.0.1", default-features = false }
 moka = { version = "0.12.16", features = ["future"] }
 
 # Check client versions for specific features.
@@ -261,21 +257,21 @@ rpassword = "7.5.4"
 grass_compiler = { version = "0.13.4", default-features = false }
 
 # File are accessed through Apache OpenDAL
-opendal = { version = "0.59.5", default-features = false, features = ["services-fs"] }
-opendal-http-transport-reqwest = { version = "0.59.5", default-features = false, features = ["rustls-no-provider"], optional = true }
+opendal = { version = "0.59.2", default-features = false, features = ["services-fs"] }
+opendal-http-transport-reqwest = { version = "0.59.2", default-features = false, features = ["rustls-no-provider"], optional = true }
 
 # For retrieving AWS credentials, including temporary SSO credentials
-aws-config = { version = "1.13.0", optional = true, default-features = false, features = [
+aws-config = { version = "1.12.0", optional = true, default-features = false, features = [
     "behavior-version-latest",
     "credentials-process",
     "rt-tokio",
     "sso",
 ] }
-aws-credential-types = { version = "1.3.1", optional = true }
-aws-smithy-runtime-api = { version = "1.19.2", optional = true }
+aws-credential-types = { version = "1.3.0", optional = true }
+aws-smithy-runtime-api = { version = "1.16.2", optional = true }
 http = { version = "1.5.0", optional = true }
-reqsign-aws-v4 = { version = "3.3.1", optional = true }
-reqsign-core = { version = "3.3.2", optional = true }
+reqsign-aws-v4 = { version = "3.3.0", optional = true }
+reqsign-core = { version = "3.3.1", optional = true }
 
 # Strip debuginfo from the release builds
 # The debug symbols are to provide better panic traces
diff --git a/SECURITY.md b/SECURITY.md
index 93c740cb..4d23e51c 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -1,38 +1,49 @@
-Vaultwarden tries to prevent security issues, but something could always slip through. If you believe you've found a security issue in our application, we encourage you to notify us. We welcome working with you to resolve the issue promptly. Thanks in advance!
+Vaultwarden tries to prevent security issues but there could always slip something through.
+If you believe you've found a security issue in our application, we encourage you to
+notify us. We welcome working with you to resolve the issue promptly. Thanks in advance!
 
-# Scope
+# Disclosure Policy
 
-Security issues in the current release of Vaultwarden and in the `main` branch (the `testing` image) are in scope. Our [threat model](THREAT_MODEL.md) describes who is trusted with what, what is out of scope, and how we rate severity. Please read it before reporting.
+- Let us know as soon as possible upon discovery of a potential security issue, and we'll make every
+  effort to quickly resolve the issue.
+- Provide us a reasonable amount of time to resolve the issue before any disclosure to the public or a
+  third-party. We may publicly disclose the issue before resolving it, if appropriate.
+- Make a good faith effort to avoid privacy violations, destruction of data, and interruption or
+  degradation of our service. Only interact with accounts you own or with explicit permission of the
+  account holder.
 
-# How to report a security issue
+# In-scope
 
-- Let us know as soon as possible upon discovery of a potential security issue, and we'll make every effort to quickly resolve the issue.
-- Provide us a reasonable amount of time to resolve the issue before any disclosure to the public or a third party. We may publicly disclose the issue before resolving it, if appropriate.
-- Credit goes on the advisory and needs a GitHub account or email address. Reports of an issue whose fix is already public, from the moment its pull request is opened, are normally not credited.
-- Vaultwarden is an open source project and does not offer rewards.
+- Security issues in any current release of Vaultwarden. Source code is available at https://github.com/dani-garcia/vaultwarden. This includes the current `latest` release and `main / testing` release.
 
-Vaultwarden has no hosted service. Test only on instances you run yourself, and make a good-faith effort to avoid privacy violations, destruction of data, and interruption or degradation of other people's servers. Only interact with accounts you own or with the explicit permission of the account holder.
+# Exclusions
+
+The following bug classes are out-of scope:
+
+- Bugs that are already reported on Vaultwarden's issue tracker (https://github.com/dani-garcia/vaultwarden/issues)
+- Bugs that are not part of Vaultwarden, like on the web-vault or mobile and desktop clients. These issues need to be reported in the respective project issue tracker at https://github.com/bitwarden to which we are not associated
+- Issues in an upstream software dependency (ex: Rust, or External Libraries) which are already reported to the upstream maintainer
+- Attacks requiring physical access to a user's device
+- Issues related to software or protocols not under Vaultwarden's control
+- Vulnerabilities in outdated versions of Vaultwarden
+- Missing security best practices that do not directly lead to a vulnerability (You may still report them as a normal issue)
+- Issues that do not have any impact on the general public
 
 While researching, we'd like to ask you to refrain from:
 
-- Denial of service against servers you do not run. You can still report availability issues you reproduce on your own instance.
-- Spamming.
-- Social engineering (including phishing) of Vaultwarden developers, contributors or users.
+- Denial of service
+- Spamming
+- Social engineering (including phishing) of Vaultwarden developers, contributors or users
 
-A good report covers one root cause and states the version or commit you tested, the lowest privileges needed, what the attacker gains, any non-default settings, the steps to reproduce it, and whether you ran them or only read the code.
-
-If you use AI tools, you remain responsible for what you send. Reproduce the issue on your own instance before reporting it, check its scope and severity against our threat model rather than the tool's assessment, and include the requests, responses or logs that show it.
+Thank you for helping keep Vaultwarden and our users safe!
 
 # How to contact us
 
-- You can open a [private vulnerability report](https://github.com/dani-garcia/vaultwarden/security/advisories/new) on GitHub.
+- You can contact us on Matrix https://matrix.to/#/#vaultwarden:matrix.org (users: `@danig:matrix.org` and/or `@blackdex:matrix.org`)
 - You can send an ![security-contact](/.github/security-contact.gif) to report a security issue.<br>
-  If you want to send an encrypted email, you can use the following GPG key: `13BB3A34C9E380258CE43D595CB150B31F6426BC`<br>
+  If you want to send an encrypted email you can use the following GPG key: 13BB3A34C9E380258CE43D595CB150B31F6426BC<br>
   It can be found on several public GPG key servers.<br>
-    - https://keys.openpgp.org/search?q=security%40vaultwarden.org
-    - https://keys.mailvelope.com/pks/lookup?op=get&search=security%40vaultwarden.org
-    - https://pgpkeys.eu/pks/lookup?search=security%40vaultwarden.org&fingerprint=on&op=index
-    - https://keyserver.ubuntu.com/pks/lookup?search=security%40vaultwarden.org&fingerprint=on&op=index
-- You can contact us on Matrix for questions, without vulnerability details: https://matrix.to/#/#vaultwarden:matrix.org (users: `@danig:matrix.org` and/or `@blackdex:matrix.org`).
-
-Thank you for helping keep Vaultwarden and our users safe!
+    * https://keys.openpgp.org/search?q=security%40vaultwarden.org
+    * https://keys.mailvelope.com/pks/lookup?op=get&search=security%40vaultwarden.org
+    * https://pgpkeys.eu/pks/lookup?search=security%40vaultwarden.org&fingerprint=on&op=index
+    * https://keyserver.ubuntu.com/pks/lookup?search=security%40vaultwarden.org&fingerprint=on&op=index
diff --git a/THREAT_MODEL.md b/THREAT_MODEL.md
deleted file mode 100644
index 524c4dce..00000000
--- a/THREAT_MODEL.md
+++ /dev/null
@@ -1,148 +0,0 @@
-# Vaultwarden threat model
-
-To report a security issue, see [SECURITY.md](SECURITY.md).
-
-## Overview
-
-Vaultwarden is an unofficial, self-hosted server for the Bitwarden clients, written in Rust. It stores encrypted vaults, handles login, two-factor authentication, organizations, file and text sharing through Send, and emergency access, and provides an admin panel for the operator. It is not affiliated with Bitwarden. The browser, desktop, mobile and CLI clients come from Bitwarden. Our container images include a web vault built from Bitwarden's web client with our own patches.
-
-## Security expectations
-
-### Deployment
-
-We expect a TLS-terminating reverse proxy in front of the server, `DOMAIN` set to its public URL, and an operator who keeps the host secure. This model covers Vaultwarden itself. Third-party software that consumes its output or sits in front of it, such as log parsers and reverse proxies, is the operator's to configure and secure.
-
-### Encryption
-
-Clients encrypt vault contents end to end. The server stores and serves ciphertext it cannot decrypt, and it never sees the master password. The server enforces access to data and actions itself, without relying on a client to behave. A few settings rely on the client for part of their effect, listed under [Out of scope](#out-of-scope).
-
-A member receives the organization key when they are confirmed. Invited and accepted members do not have it. A revoked member who was once confirmed may still have it. Every confirmed member holds the same key for the whole organization, so only the server separates collections.
-
-The server can read everything that is not end-to-end encrypted, such as user, group, device and organization names, email addresses, who owns what, item types and timestamps, attachment sizes, password hints, the stored master password hash and KDF settings, the TOTP and other 2FA secrets that protect login to the account, API keys, refresh tokens, security stamps, the JWT signing key, and SMTP and push credentials. TOTP secrets that users store in vault items are end-to-end encrypted with the rest of the item.
-
-Someone who controls the server can also serve a modified web vault, so end-to-end encryption does not protect web vault users from them.
-
-### Trust
-
-Registration is open by default (`SIGNUPS_ALLOWED=true`), but many personal and small-team instances turn it off, so holding an account usually implies a minimal level of trust. Account holders are still never trusted with anyone else's data. Members of an organization have some trust in each other.
-
-| Actor | Can reach | Must not reach |
-|---|---|---|
-| Anonymous internet | Login, prelogin, registration, public Send access, icons, the anonymous notifications hub, static files | Any vault, organization or member data; Sends they have no link to; the admin panel; the internal network through outbound requests |
-| Websites and icon sources | The icon fetcher, through any response, redirect or DNS answer; the server, through cross-site requests from a visitor's browser | The internal network through outbound requests; script on the vault origin; acting through a visitor's session |
-| Registered user | Their own vault, Sends, devices and settings; organizations they belong to | Another user's data; any other organization; raising their own role or status |
-| Invited or accepted member | Accepting the invitation, enrolling in account recovery, and the organization's name, public key and policies | Items, collections, the member list, the organization key, any other privileged action before confirmation |
-| Revoked member | Nothing in that organization | Any organization data from the server, even data they could once read |
-| Organization User | Items in assigned collections, with `read_only` and `manage` enforced by the server | Other collections, write access to read-only collections, Admin-level metadata |
-| Organization Manager (a legacy role, shown as Custom in clients) | The above, plus managing collections where they have `manage`. With "Manage all collections" (`access_all`), every collection and full member and group details | Without `access_all`: managing other collections, full member and group details. Always: changing policies or roles |
-| Organization Admin | All data in that organization, members below Owner (some actions on Managers and Admins are limited to Owners), policies, events, account recovery for enrolled members below Owner | Owners, other organizations, the personal vault of a member who is not enrolled in recovery, the organization API key |
-| Organization Owner | The whole organization, including account recovery for enrolled members | Other organizations, the personal vault of a member who is not enrolled in recovery |
-| Organization API key holder (Owner-issued) | Directory import into its own organization | Other organizations, item content, Owners |
-| Send recipient | One Send, within its limits | Other Sends, access beyond the configured limits, the owner's vault |
-| Emergency access grantee | After approval or the wait time: the access the grantor configured, which can be full takeover by design | Anything before that, or more than the access the grantor configured |
-| Admin panel (`ADMIN_TOKEN`) | All users, organizations and settings | No limit once authenticated |
-| Host operator, database and data folder access | Everything | No limit |
-| Services the operator configures (SSO provider, SMTP server, push relay, S3 endpoint, Yubico) | What they need for their function | Vault contents |
-
-### Configuration
-
-Optional features that operators turn on, other than experimental and beta ones, carry the same expectations as the defaults, such as SSO, organization events, anything needing SMTP (email 2FA, invitations), push, S3 storage, the admin panel, and the MySQL and PostgreSQL backends.
-
-Some settings remove a protection on purpose, and using them is the operator's choice: `DISABLE_ADMIN_TOKEN`, a plain-text `ADMIN_TOKEN`, `IP_HEADER_TRUSTED_PROXIES=all` on a directly exposed instance, turning off `HTTP_REQUEST_BLOCK_NON_GLOBAL_IPS`, `SSO_DEBUG_TOKENS`, `SSO_ALLOW_UNKNOWN_EMAIL_VERIFICATION`, `SSO_PKCE=false`, `SHOW_PASSWORD_HINT`, `SMTP_SECURITY=off`, `SMTP_ACCEPT_INVALID_CERTS`, `SMTP_ACCEPT_INVALID_HOSTNAMES`, `SMTP_DEBUG`, `ALLOWED_IFRAME_ANCESTORS`, `ALLOWED_CONNECT_SRC`, and `LOG_LEVEL` set to `debug` or `trace`. Issues that need one of them are out of scope.
-
-### Upstream Bitwarden
-
-Where this document does not cover a behavior, we follow upstream Bitwarden by default.
-
-## Out of scope
-
-These are intended behavior or outside this model. Several match upstream Bitwarden.
-
-- What an admin token holder or the host operator can do, including running code on the server. We expect them to have admin access to the machine.
-- Organization Owners and Admins reading all organization data, and account recovery of enrolled members.
-- Organization Managers listing basic member details, such as names and emails. Upstream allows this for all members.
-- Settings the client applies: `hide_passwords` ("hidden passwords" in the clients), master password reprompt, and organization policies on values the server never sees, such as master password complexity and password generator rules. The client already holds the data.
-- Bugs in Bitwarden's client code, including in the web vault we bundle, such as CSV formula injection (exports are built in the browser) or a client failing on a malformed stored value. The advisory and CVE for those belong to Bitwarden. Report them through [Bitwarden's HackerOne program](https://hackerone.com/bitwarden/). When the bundled web vault is affected, we ship a security release that references theirs. Bugs that our own web vault patches add are ours.
-- The server not decrypting or authenticating ciphertext. It holds no key.
-- `/identity/accounts/prelogin` and `/identity/accounts/prelogin/password` returning KDF settings for any email, with deterministic fake settings for unknown ones.
-- Login timing not being equalized.
-- Probing whether an icon is already cached. Setting `ICON_SERVICE` to an external service avoids it.
-- Download link replay: an attachment token or Send access token being reusable by its holder until it expires (1 and 2 minutes), and object storage presigned URLs that we cannot count or revoke. The holder already has the content.
-- Short-lived tokens that stay valid after an authorization change elsewhere until they expire, such as an organization API token (1 hour) after its key is rotated. This includes connections the notifications WebSocket accepted before the change, which stay open and carry change notifications and device login requests, not vault data.
-- The access token in the notifications WebSocket's `access_token` query parameter, which reverse proxies may log. Clients send it that way, and our [hardening guide](https://github.com/dani-garcia/vaultwarden/wiki/Hardening-Guide#access-logs-contain-access_token-parameter) covers redacting it.
-- A client's tokens staying valid after it logs out. Logging out discards them on that device, as upstream, and deauthorizing sessions or changing the password ends them.
-- The personal API key skipping 2FA, and working after a password change until the user rotates it. It is a separate credential.
-- A linked SSO identity still logging in after a master password change, and the SSO provider deciding how long a session lasts (`SSO_AUTH_ONLY_NOT_SESSION` turns that off). The provider manages that credential, and it doesn't unlock the vault.
-- A revoked or removed member's login session staying valid. It belongs to their own account, and the server checks membership on every request.
-- A revoked or removed member keeping what their client already synced, and the organization key not being rotated when a member leaves.
-- Unauthenticated requests to `/api/devices/identifier/<id>/clear-token`. The impact is delayed push delivery.
-- Limits we leave out or keep simple by design: no cap on the number of items a user stores, no cleanup of attachments reserved but never uploaded, and rate limits kept in memory per process and IP, which reset on restart and are shared by users behind one address.
-- Log injection. It only affects software that parses our logs, such as Fail2Ban with our community wiki's filters.
-- Attacks that need a missing or misconfigured reverse proxy, such as one not sending `X-Forwarded-Proto` (it decides the admin cookie's `Secure` flag).
-- Attacks that need another component to break its own specification, such as a NAT64 translator that forwards the `64:ff9b::/96` prefix to private addresses, against RFC 6052.
-- Outbound requests to the SSO provider, Yubico server or S3 endpoint the operator configures, which skip the outbound filter and can be on the internal network.
-- File permissions in the data folder. Host security belongs to the operator.
-- Attacks that need physical access to a user's device.
-- Self-exploitation, where someone can only affect their own account, such as self-XSS or weak KDF settings they choose.
-- Text that users choose showing up in emails or pages, such as an organization, user or device name, as long as it can't cause XSS or modify the page.
-- Dependency and base image CVEs without a path reachable through Vaultwarden.
-- Packages, images and deployment templates that we don't publish. Report those to their maintainers.
-- Missing best practices with no demonstrated impact, such as security headers, `style-src 'unsafe-inline'` (the web vault needs it) or version disclosure, and design recommendations without a concrete issue.
-- Bugs already reported on our [issue tracker](https://github.com/dani-garcia/vaultwarden/issues).
-- Experimental and beta features. They are opt-in and outside this model until they are stable.
-- Issues that only affect outdated versions.
-
-## Severity
-
-We rate issues by what the attacker ends up with, such as decrypted data, ciphertext, or the power to change or delete data, and by the access they needed first. An attack that needs no account usually rates higher than one that does. Our ratings can differ from CVSS 3.1, which doesn't translate well to an end-to-end encrypted system. Older advisories may be rated differently.
-
-Denial of service and resource exhaustion only count if they still apply with a reverse proxy in front. Races, denial of service and resource exhaustion are never rated above Medium.
-
-Secrets written to logs at the default log level are rated by what they give someone who can read the logs but not the host.
-
-### Critical
-
-- Reading another account's data decrypted, with or without an account, such as through script on the vault origin or exposed key material.
-- Code execution on the server by anyone other than an admin token holder.
-- Changing released builds or images, including through our CI workflows or their secrets.
-- Anyone other than the named grantee reaching an emergency access outcome.
-- With no account: forging login or admin tokens, reading the JWT signing key, reaching the admin panel without the token, or taking over accounts with no action by the victim.
-
-### High
-
-- Decrypted reads within the same organization, such as a member reaching collections they are not assigned to.
-- Changing or deleting another user's or organization's existing data.
-- Reading another user's server-held secrets, such as their 2FA secrets, API keys, stored master password hash or encrypted user key.
-- SSRF that returns the response to the attacker.
-- Escalating within an organization.
-- Account takeover through SSO.
-- The named emergency access grantee reaching the outcome early.
-- Script or a cross-site request acting through an admin panel session.
-- Script on the vault origin that needs unusual victim interaction.
-
-### Medium
-
-- Ciphertext read by someone with no key.
-- Defeating login brute-force protection.
-- 2FA bypass that needs the password, such as a remembered device still skipping 2FA after the method is removed.
-- A refresh token still working after a password change or "Deauthorize sessions".
-- Getting past an organization policy the server enforces.
-- Adding data to another user's or organization's space without permission.
-- Data loss for another user or organization that the attacker cannot reliably trigger or aim.
-- SSRF where the response is filtered or blind.
-- Reading a Send that is disabled or expired.
-- Denial of service that lasts until someone restarts the server or repairs data, from one request with no account in the default configuration.
-
-### Low
-
-These may be handled as ordinary hardening.
-
-- Behavior that differs from upstream Bitwarden with low impact.
-- Bypassing a non-default limit, such as `USER_ATTACHMENT_LIMIT`.
-- Metadata across a boundary, such as who is assigned to which collection.
-- Exceeding a Send's access limits when the attacker already holds the link.
-- A missing rate limit outside login.
-- Forging organization audit events.
-- Other ways to tell whether an email has an account.
-- Denial of service that lasts until someone acts, from one operation that needs an account or a non-default setting.
-- Denial of service that lasts only while the attacker keeps going or that recovers by itself, such as a crash the container restarts from.
diff --git a/docker/DockerSettings.yaml b/docker/DockerSettings.yaml
index 4ef24c9d..6ae6e9a8 100644
--- a/docker/DockerSettings.yaml
+++ b/docker/DockerSettings.yaml
@@ -1,10 +1,10 @@
 ---
-vault_version: "v2026.10.1"
-vault_image_digest: "sha256:7baaa7d5349742548b6c44e557c1512157b22010cdf314ccc399ffdcacb5eb52"
-# Cross Compile Docker Helper Scripts v1.10.0
+vault_version: "v2026.7.0"
+vault_image_digest: "sha256:ba8bab66d4330ab9dbafa8f245bcbe99cf6ee3f2c8ce9b5fbb10e9c49658451c"
+# Cross Compile Docker Helper Scripts v1.9.0
 # We use the linux/amd64 platform shell scripts since there is no difference between the different platform scripts
 # https://github.com/tonistiigi/xx | https://hub.docker.com/r/tonistiigi/xx/tags
-xx_image_digest: "sha256:40fe21f44bb8cddf1eb1226db190d0a984118f62ee02a91b77d99448d28264a6"
+xx_image_digest: "sha256:c64defb9ed5a91eacb37f96ccc3d4cd72521c4bd18d5442905b95e2226b0e707"
 # The `rust_version` variable is extracted from `rust-toolchain.toml`
 # rust_version: x.yy.z # Rust version to be used
 debian_version: trixie # Debian release name to be used
diff --git a/docker/Dockerfile.alpine b/docker/Dockerfile.alpine
index 95e8784d..a91deb07 100644
--- a/docker/Dockerfile.alpine
+++ b/docker/Dockerfile.alpine
@@ -19,23 +19,23 @@
 # - From https://hub.docker.com/r/vaultwarden/web-vault/tags,
 #   click the tag name to view the digest of the image it currently points to.
 # - From the command line:
-#     $ docker pull docker.io/vaultwarden/web-vault:v2026.10.1
-#     $ docker image inspect --format "{{.RepoDigests}}" docker.io/vaultwarden/web-vault:v2026.10.1
-#     [docker.io/vaultwarden/web-vault@sha256:7baaa7d5349742548b6c44e557c1512157b22010cdf314ccc399ffdcacb5eb52]
+#     $ docker pull docker.io/vaultwarden/web-vault:v2026.7.0
+#     $ docker image inspect --format "{{.RepoDigests}}" docker.io/vaultwarden/web-vault:v2026.7.0
+#     [docker.io/vaultwarden/web-vault@sha256:ba8bab66d4330ab9dbafa8f245bcbe99cf6ee3f2c8ce9b5fbb10e9c49658451c]
 #
 # - Conversely, to get the tag name from the digest:
-#     $ docker image inspect --format "{{.RepoTags}}" docker.io/vaultwarden/web-vault@sha256:7baaa7d5349742548b6c44e557c1512157b22010cdf314ccc399ffdcacb5eb52
-#     [docker.io/vaultwarden/web-vault:v2026.10.1]
+#     $ docker image inspect --format "{{.RepoTags}}" docker.io/vaultwarden/web-vault@sha256:ba8bab66d4330ab9dbafa8f245bcbe99cf6ee3f2c8ce9b5fbb10e9c49658451c
+#     [docker.io/vaultwarden/web-vault:v2026.7.0]
 #
-FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@sha256:7baaa7d5349742548b6c44e557c1512157b22010cdf314ccc399ffdcacb5eb52 AS vault
+FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@sha256:ba8bab66d4330ab9dbafa8f245bcbe99cf6ee3f2c8ce9b5fbb10e9c49658451c AS vault
 
 ########################## ALPINE BUILD IMAGES ##########################
 ## NOTE: The Alpine Base Images do not support other platforms then linux/amd64 and linux/arm64
 ## And for Alpine we define all build images here, they will only be loaded when actually used
-FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:x86_64-musl-stable-1.99.1 AS build_amd64
-FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:aarch64-musl-stable-1.99.1 AS build_arm64
-FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:armv7-musleabihf-stable-1.99.1 AS build_armv7
-FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:arm-musleabi-stable-1.99.1 AS build_armv6
+FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:x86_64-musl-stable-1.98.1 AS build_amd64
+FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:aarch64-musl-stable-1.98.1 AS build_arm64
+FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:armv7-musleabihf-stable-1.98.1 AS build_armv7
+FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:arm-musleabi-stable-1.98.1 AS build_armv6
 
 ########################## BUILD IMAGE ##########################
 # hadolint ignore=DL3006
diff --git a/docker/Dockerfile.debian b/docker/Dockerfile.debian
index 621cfafe..b8490609 100644
--- a/docker/Dockerfile.debian
+++ b/docker/Dockerfile.debian
@@ -19,24 +19,24 @@
 # - From https://hub.docker.com/r/vaultwarden/web-vault/tags,
 #   click the tag name to view the digest of the image it currently points to.
 # - From the command line:
-#     $ docker pull docker.io/vaultwarden/web-vault:v2026.10.1
-#     $ docker image inspect --format "{{.RepoDigests}}" docker.io/vaultwarden/web-vault:v2026.10.1
-#     [docker.io/vaultwarden/web-vault@sha256:7baaa7d5349742548b6c44e557c1512157b22010cdf314ccc399ffdcacb5eb52]
+#     $ docker pull docker.io/vaultwarden/web-vault:v2026.7.0
+#     $ docker image inspect --format "{{.RepoDigests}}" docker.io/vaultwarden/web-vault:v2026.7.0
+#     [docker.io/vaultwarden/web-vault@sha256:ba8bab66d4330ab9dbafa8f245bcbe99cf6ee3f2c8ce9b5fbb10e9c49658451c]
 #
 # - Conversely, to get the tag name from the digest:
-#     $ docker image inspect --format "{{.RepoTags}}" docker.io/vaultwarden/web-vault@sha256:7baaa7d5349742548b6c44e557c1512157b22010cdf314ccc399ffdcacb5eb52
-#     [docker.io/vaultwarden/web-vault:v2026.10.1]
+#     $ docker image inspect --format "{{.RepoTags}}" docker.io/vaultwarden/web-vault@sha256:ba8bab66d4330ab9dbafa8f245bcbe99cf6ee3f2c8ce9b5fbb10e9c49658451c
+#     [docker.io/vaultwarden/web-vault:v2026.7.0]
 #
-FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@sha256:7baaa7d5349742548b6c44e557c1512157b22010cdf314ccc399ffdcacb5eb52 AS vault
+FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@sha256:ba8bab66d4330ab9dbafa8f245bcbe99cf6ee3f2c8ce9b5fbb10e9c49658451c AS vault
 
 ########################## Cross Compile Docker Helper Scripts ##########################
 ## We use the linux/amd64 no matter which Build Platform, since these are all bash scripts
 ## And these bash scripts do not have any significant difference if at all
-FROM --platform=linux/amd64 docker.io/tonistiigi/xx@sha256:40fe21f44bb8cddf1eb1226db190d0a984118f62ee02a91b77d99448d28264a6 AS xx
+FROM --platform=linux/amd64 docker.io/tonistiigi/xx@sha256:c64defb9ed5a91eacb37f96ccc3d4cd72521c4bd18d5442905b95e2226b0e707 AS xx
 
 ########################## BUILD IMAGE ##########################
 # hadolint ignore=DL3006
-FROM --platform=$BUILDPLATFORM docker.io/library/rust:1.99.1-slim-trixie AS build
+FROM --platform=$BUILDPLATFORM docker.io/library/rust:1.98.1-slim-trixie AS build
 # hadolint ignore=DL3067
 COPY --from=xx / /
 ARG TARGETARCH
@@ -101,17 +101,9 @@ RUN . /env-cargo && \
     # https://github.com/tonistiigi/xx/pull/108#issuecomment-3700635977
     # https://github.com/dani-garcia/vaultwarden/discussions/7522
     if xx-info is-cross; then \
-        XX_RUSTFLAGS="-Clink-arg=-Wl,-rpath-link,/usr/lib/$(xx-info triple)"; \
+        XX_RUSTFLAGS="-C link-arg=-Wl,-rpath-link,/usr/lib/$(xx-info triple)"; \
+        export XX_RUSTFLAGS; \
     fi && \
-    # Debian's GCC adds a special fix for cortex-a53 arch's which gets losts when using xx-cargo, which uses clang
-    # Checking if the arch is arm64 and adding this extra link-arg should cause this fix to be applied
-    # This should fix issues reported when running on a RPi3 which is a Cortex-A35 chip
-    # See: https://salsa.debian.org/toolchain-team/gcc/-/blob/master/debian/rules2?pow_referer=#L543-548
-    # See: https://github.com/dani-garcia/vaultwarden/issues/7754
-    if [ "$(xx-info arch)" = "arm64" ]; then \
-        XX_RUSTFLAGS="${XX_RUSTFLAGS} -Clink-arg=-Wl,--fix-cortex-a53-843419"; \
-    fi && \
-    export XX_RUSTFLAGS && \
     PKG_CONFIG="$(command -v "$(xx-info)-pkg-config")" xx-cargo build --features ${DB} --profile "${CARGO_PROFILE}" && \
     find . -not -path "./target*" -delete
 
@@ -131,17 +123,9 @@ RUN . /env-cargo && \
     # https://github.com/tonistiigi/xx/pull/108#issuecomment-3700635977
     # https://github.com/dani-garcia/vaultwarden/discussions/7522
     if xx-info is-cross; then \
-        XX_RUSTFLAGS="-Clink-arg=-Wl,-rpath-link,/usr/lib/$(xx-info triple)"; \
+        XX_RUSTFLAGS="-C link-arg=-Wl,-rpath-link,/usr/lib/$(xx-info triple)"; \
+        export XX_RUSTFLAGS; \
     fi && \
-    # Debian's GCC adds a special fix for cortex-a53 arch's which gets losts when using xx-cargo, which uses clang
-    # Checking if the arch is arm64 and adding this extra link-arg should cause this fix to be applied
-    # This should fix issues reported when running on a RPi3 which is a Cortex-A35 chip
-    # See: https://salsa.debian.org/toolchain-team/gcc/-/blob/master/debian/rules2?pow_referer=#L543-548
-    # See: https://github.com/dani-garcia/vaultwarden/issues/7754
-    if [ "$(xx-info arch)" = "arm64" ]; then \
-        XX_RUSTFLAGS="${XX_RUSTFLAGS} -Clink-arg=-Wl,--fix-cortex-a53-843419"; \
-    fi && \
-    export XX_RUSTFLAGS && \
     PKG_CONFIG="$(command -v "$(xx-info)-pkg-config")" xx-cargo build --features ${DB} --profile "${CARGO_PROFILE}" && \
     if [ "${CARGO_PROFILE}" = "dev" ] ; then \
         ln -vfsr "/app/target/${CARGO_TARGET}/debug" /app/target/final ; \
diff --git a/docker/Dockerfile.j2 b/docker/Dockerfile.j2
index 2dc175b0..633d6955 100644
--- a/docker/Dockerfile.j2
+++ b/docker/Dockerfile.j2
@@ -32,17 +32,9 @@
     # https://github.com/tonistiigi/xx/pull/108#issuecomment-3700635977
     # https://github.com/dani-garcia/vaultwarden/discussions/7522
     if xx-info is-cross; then \
-        XX_RUSTFLAGS="-Clink-arg=-Wl,-rpath-link,/usr/lib/$(xx-info triple)"; \
+        XX_RUSTFLAGS="-C link-arg=-Wl,-rpath-link,/usr/lib/$(xx-info triple)"; \
+        export XX_RUSTFLAGS; \
     fi && \
-    # Debian's GCC adds a special fix for cortex-a53 arch's which gets losts when using xx-cargo, which uses clang
-    # Checking if the arch is arm64 and adding this extra link-arg should cause this fix to be applied
-    # This should fix issues reported when running on a RPi3 which is a Cortex-A35 chip
-    # See: https://salsa.debian.org/toolchain-team/gcc/-/blob/master/debian/rules2?pow_referer=#L543-548
-    # See: https://github.com/dani-garcia/vaultwarden/issues/7754
-    if [ "$(xx-info arch)" = "arm64" ]; then \
-        XX_RUSTFLAGS="${XX_RUSTFLAGS} -Clink-arg=-Wl,--fix-cortex-a53-843419"; \
-    fi && \
-    export XX_RUSTFLAGS && \
     PKG_CONFIG="$(command -v "$(xx-info)-pkg-config")" xx-cargo build --features ${DB} --profile "${CARGO_PROFILE}"
 {%- endmacro %}
 FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@{{ vault_image_digest }} AS vault
diff --git a/docker/README.md b/docker/README.md
index 3bbc31e1..d64d5789 100644
--- a/docker/README.md
+++ b/docker/README.md
@@ -15,7 +15,6 @@ Some unsupported platforms for Debian based images. These are not built and test
 - 386     (linux/386)
 - ppc64le (linux/ppc64le)
 - s390x   (linux/s390x)
-- riscv64 (linux/riscv64)
 
 To build these containers you need to enable QEMU binfmt support to be able to run/emulate architectures which are different then your host.<br>
 This ensures the container build process can run binaries from other architectures.<br>
diff --git a/docker/docker-bake.hcl b/docker/docker-bake.hcl
index 30902bba..c27c39a6 100644
--- a/docker/docker-bake.hcl
+++ b/docker/docker-bake.hcl
@@ -148,12 +148,6 @@ target "debian-s390x" {
   platforms = ["linux/s390x"]
   tags = generate_tags("", "-s390x")
 }
-
-target "debian-riscv64" {
-  inherits = ["debian"]
-  platforms = ["linux/riscv64"]
-  tags = generate_tags("", "-riscv64")
-}
 // ==== End of unsupported Debian architecture targets ===
 
 // A Group to build all platforms individually for local testing
diff --git a/macros/Cargo.toml b/macros/Cargo.toml
index ee9fd206..b397fbe1 100644
--- a/macros/Cargo.toml
+++ b/macros/Cargo.toml
@@ -14,7 +14,7 @@ proc-macro = true
 
 [dependencies]
 quote = "1.0.47"
-syn = "3.0.9"
+syn = "3.0.6"
 
 [lints]
 workspace = true
diff --git a/migrations/mysql/2026-10-09-120000_user_crypto_v2/down.sql b/migrations/mysql/2026-09-20-120000_user_crypto_v2/down.sql
similarity index 63%
rename from migrations/mysql/2026-10-09-120000_user_crypto_v2/down.sql
rename to migrations/mysql/2026-09-20-120000_user_crypto_v2/down.sql
index 49700440..b57c715e 100644
--- a/migrations/mysql/2026-10-09-120000_user_crypto_v2/down.sql
+++ b/migrations/mysql/2026-09-20-120000_user_crypto_v2/down.sql
@@ -3,3 +3,5 @@ DROP TABLE IF EXISTS user_signature_key_pairs;
 ALTER TABLE users DROP COLUMN signed_public_key;
 ALTER TABLE users DROP COLUMN security_state;
 ALTER TABLE users DROP COLUMN security_version;
+ALTER TABLE users DROP COLUMN v2_upgrade_token;
+ALTER TABLE users_organizations DROP COLUMN v2_upgrade_token;
diff --git a/migrations/mysql/2026-10-09-120000_user_crypto_v2/up.sql b/migrations/mysql/2026-09-20-120000_user_crypto_v2/up.sql
similarity index 84%
rename from migrations/mysql/2026-10-09-120000_user_crypto_v2/up.sql
rename to migrations/mysql/2026-09-20-120000_user_crypto_v2/up.sql
index 73edfa6a..f6a9948d 100644
--- a/migrations/mysql/2026-10-09-120000_user_crypto_v2/up.sql
+++ b/migrations/mysql/2026-09-20-120000_user_crypto_v2/up.sql
@@ -1,6 +1,8 @@
 ALTER TABLE users ADD COLUMN signed_public_key TEXT;
 ALTER TABLE users ADD COLUMN security_state TEXT;
 ALTER TABLE users ADD COLUMN security_version INTEGER;
+ALTER TABLE users ADD COLUMN v2_upgrade_token TEXT;
+ALTER TABLE users_organizations ADD COLUMN v2_upgrade_token TEXT;
 
 CREATE TABLE user_signature_key_pairs (
     uuid                CHAR(36) NOT NULL PRIMARY KEY,
diff --git a/migrations/mysql/2026-10-07-120000_add_org_policy_revision_date/down.sql b/migrations/mysql/2026-10-07-120000_add_org_policy_revision_date/down.sql
deleted file mode 100644
index 27c33623..00000000
--- a/migrations/mysql/2026-10-07-120000_add_org_policy_revision_date/down.sql
+++ /dev/null
@@ -1 +0,0 @@
-ALTER TABLE org_policies DROP COLUMN revision_date;
diff --git a/migrations/mysql/2026-10-07-120000_add_org_policy_revision_date/up.sql b/migrations/mysql/2026-10-07-120000_add_org_policy_revision_date/up.sql
deleted file mode 100644
index 97a84117..00000000
--- a/migrations/mysql/2026-10-07-120000_add_org_policy_revision_date/up.sql
+++ /dev/null
@@ -1,7 +0,0 @@
--- DATETIME (not TIMESTAMP) to match this repo's convention for revision_date
--- columns elsewhere, and to avoid MySQL's implicit session-timezone
--- conversion and 2038 range limit on TIMESTAMP.
-ALTER TABLE org_policies
-ADD COLUMN revision_date DATETIME NOT NULL DEFAULT '1970-01-01 00:00:00';
-
-UPDATE org_policies SET revision_date = UTC_TIMESTAMP();
diff --git a/migrations/mysql/2026-10-08-120000_cipher_data_longtext/down.sql b/migrations/mysql/2026-10-08-120000_cipher_data_longtext/down.sql
deleted file mode 100644
index e69de29b..00000000
diff --git a/migrations/mysql/2026-10-08-120000_cipher_data_longtext/up.sql b/migrations/mysql/2026-10-08-120000_cipher_data_longtext/up.sql
deleted file mode 100644
index 09abbaee..00000000
--- a/migrations/mysql/2026-10-08-120000_cipher_data_longtext/up.sql
+++ /dev/null
@@ -1,3 +0,0 @@
--- A blob-encrypted cipher keeps all of its content in `data`, up to 500,000 characters, so the
--- 64 KiB of TEXT is too small. Like upstream, which uses LONGTEXT.
-ALTER TABLE ciphers MODIFY data LONGTEXT NOT NULL;
diff --git a/migrations/mysql/2026-10-10-120000_add_custom_role_permissions/down.sql b/migrations/mysql/2026-10-10-120000_add_custom_role_permissions/down.sql
deleted file mode 100644
index 85ebcbfb..00000000
--- a/migrations/mysql/2026-10-10-120000_add_custom_role_permissions/down.sql
+++ /dev/null
@@ -1,22 +0,0 @@
--- Dropping the permissions would silently take them away from the Custom members, who would also keep a role (4) the
--- versions before this one don't know. So while there are any, this fails on the duplicate key below, before anything
--- is dropped: change their role first, or restore the backup taken before the upgrade.
--- A failed attempt leaves the temporary table on this connection. Clear it before retrying.
-DROP TEMPORARY TABLE IF EXISTS custom_role_downgrade;
-CREATE TEMPORARY TABLE custom_role_downgrade (blocked_by VARCHAR(255) NOT NULL PRIMARY KEY);
-INSERT INTO custom_role_downgrade VALUES ('Custom members: change their role first, or restore the backup taken before the upgrade');
-INSERT INTO custom_role_downgrade
-    SELECT 'Custom members: change their role first, or restore the backup taken before the upgrade'
-    FROM users_organizations WHERE atype = 4 LIMIT 1;
-DROP TEMPORARY TABLE custom_role_downgrade;
-
-ALTER TABLE users_organizations
-    DROP COLUMN manage_users,
-    DROP COLUMN manage_groups,
-    DROP COLUMN manage_policies,
-    DROP COLUMN create_new_collections,
-    DROP COLUMN edit_any_collection,
-    DROP COLUMN delete_any_collection,
-    DROP COLUMN access_event_logs,
-    DROP COLUMN access_import_export,
-    DROP COLUMN access_reports;
diff --git a/migrations/mysql/2026-10-10-120000_add_custom_role_permissions/up.sql b/migrations/mysql/2026-10-10-120000_add_custom_role_permissions/up.sql
deleted file mode 100644
index d28b0d64..00000000
--- a/migrations/mysql/2026-10-10-120000_add_custom_role_permissions/up.sql
+++ /dev/null
@@ -1,13 +0,0 @@
--- The granular permissions of the Custom member role. They only take effect on a Custom membership
--- (atype 4) while EXPERIMENTAL_CUSTOM_ROLES is enabled, and every existing membership starts without any.
--- A single statement, so an interrupted upgrade cannot leave only some of the columns behind.
-ALTER TABLE users_organizations
-    ADD COLUMN manage_users BOOLEAN NOT NULL DEFAULT FALSE,
-    ADD COLUMN manage_groups BOOLEAN NOT NULL DEFAULT FALSE,
-    ADD COLUMN manage_policies BOOLEAN NOT NULL DEFAULT FALSE,
-    ADD COLUMN create_new_collections BOOLEAN NOT NULL DEFAULT FALSE,
-    ADD COLUMN edit_any_collection BOOLEAN NOT NULL DEFAULT FALSE,
-    ADD COLUMN delete_any_collection BOOLEAN NOT NULL DEFAULT FALSE,
-    ADD COLUMN access_event_logs BOOLEAN NOT NULL DEFAULT FALSE,
-    ADD COLUMN access_import_export BOOLEAN NOT NULL DEFAULT FALSE,
-    ADD COLUMN access_reports BOOLEAN NOT NULL DEFAULT FALSE;
diff --git a/migrations/mysql/2026-11-02-120000_reset_user_key_id/down.sql b/migrations/mysql/2026-11-02-120000_reset_user_key_id/down.sql
deleted file mode 100644
index e69de29b..00000000
diff --git a/migrations/mysql/2026-11-02-120000_reset_user_key_id/up.sql b/migrations/mysql/2026-11-02-120000_reset_user_key_id/up.sql
deleted file mode 100644
index eeffa854..00000000
--- a/migrations/mysql/2026-11-02-120000_reset_user_key_id/up.sql
+++ /dev/null
@@ -1,4 +0,0 @@
--- Key rotations before this kept the id of the old user key, so every new
--- cipher was refused from then on. Stale ids can't be told apart, so clear
--- all of them; clients record their current key's id again when it's empty.
-UPDATE users SET key_id = NULL;
diff --git a/migrations/mysql/2026-11-04-120000_add_v2_upgrade_token/down.sql b/migrations/mysql/2026-11-04-120000_add_v2_upgrade_token/down.sql
deleted file mode 100644
index 89e12c15..00000000
--- a/migrations/mysql/2026-11-04-120000_add_v2_upgrade_token/down.sql
+++ /dev/null
@@ -1,2 +0,0 @@
-ALTER TABLE users DROP COLUMN v2_upgrade_token;
-ALTER TABLE users_organizations DROP COLUMN v2_upgrade_token;
diff --git a/migrations/mysql/2026-11-04-120000_add_v2_upgrade_token/up.sql b/migrations/mysql/2026-11-04-120000_add_v2_upgrade_token/up.sql
deleted file mode 100644
index 45c58491..00000000
--- a/migrations/mysql/2026-11-04-120000_add_v2_upgrade_token/up.sql
+++ /dev/null
@@ -1,2 +0,0 @@
-ALTER TABLE users ADD COLUMN v2_upgrade_token TEXT;
-ALTER TABLE users_organizations ADD COLUMN v2_upgrade_token TEXT;
diff --git a/migrations/postgresql/2026-10-09-120000_user_crypto_v2/down.sql b/migrations/postgresql/2026-09-20-120000_user_crypto_v2/down.sql
similarity index 63%
rename from migrations/postgresql/2026-10-09-120000_user_crypto_v2/down.sql
rename to migrations/postgresql/2026-09-20-120000_user_crypto_v2/down.sql
index 49700440..b57c715e 100644
--- a/migrations/postgresql/2026-10-09-120000_user_crypto_v2/down.sql
+++ b/migrations/postgresql/2026-09-20-120000_user_crypto_v2/down.sql
@@ -3,3 +3,5 @@ DROP TABLE IF EXISTS user_signature_key_pairs;
 ALTER TABLE users DROP COLUMN signed_public_key;
 ALTER TABLE users DROP COLUMN security_state;
 ALTER TABLE users DROP COLUMN security_version;
+ALTER TABLE users DROP COLUMN v2_upgrade_token;
+ALTER TABLE users_organizations DROP COLUMN v2_upgrade_token;
diff --git a/migrations/postgresql/2026-10-09-120000_user_crypto_v2/up.sql b/migrations/postgresql/2026-09-20-120000_user_crypto_v2/up.sql
similarity index 83%
rename from migrations/postgresql/2026-10-09-120000_user_crypto_v2/up.sql
rename to migrations/postgresql/2026-09-20-120000_user_crypto_v2/up.sql
index d3186ef0..54c4c790 100644
--- a/migrations/postgresql/2026-10-09-120000_user_crypto_v2/up.sql
+++ b/migrations/postgresql/2026-09-20-120000_user_crypto_v2/up.sql
@@ -1,6 +1,8 @@
 ALTER TABLE users ADD COLUMN signed_public_key TEXT;
 ALTER TABLE users ADD COLUMN security_state TEXT;
 ALTER TABLE users ADD COLUMN security_version INTEGER;
+ALTER TABLE users ADD COLUMN v2_upgrade_token TEXT;
+ALTER TABLE users_organizations ADD COLUMN v2_upgrade_token TEXT;
 
 CREATE TABLE user_signature_key_pairs (
     uuid                CHAR(36) NOT NULL PRIMARY KEY,
diff --git a/migrations/postgresql/2026-10-07-120000_add_org_policy_revision_date/down.sql b/migrations/postgresql/2026-10-07-120000_add_org_policy_revision_date/down.sql
deleted file mode 100644
index 27c33623..00000000
--- a/migrations/postgresql/2026-10-07-120000_add_org_policy_revision_date/down.sql
+++ /dev/null
@@ -1 +0,0 @@
-ALTER TABLE org_policies DROP COLUMN revision_date;
diff --git a/migrations/postgresql/2026-10-07-120000_add_org_policy_revision_date/up.sql b/migrations/postgresql/2026-10-07-120000_add_org_policy_revision_date/up.sql
deleted file mode 100644
index 44229de2..00000000
--- a/migrations/postgresql/2026-10-07-120000_add_org_policy_revision_date/up.sql
+++ /dev/null
@@ -1,9 +0,0 @@
--- Backfill via `now() AT TIME ZONE 'utc'` rather than a DEFAULT of now():
--- assigning timestamptz now() into a naive TIMESTAMP column casts through
--- the server's TimeZone GUC, so a DEFAULT now() would store local wall-clock
--- instead of UTC on non-UTC servers, unlike every other naive-UTC timestamp
--- column in this schema.
-ALTER TABLE org_policies
-ADD COLUMN revision_date TIMESTAMP NOT NULL DEFAULT '1970-01-01 00:00:00';
-
-UPDATE org_policies SET revision_date = (now() AT TIME ZONE 'utc');
diff --git a/migrations/postgresql/2026-10-08-120000_cipher_data_longtext/down.sql b/migrations/postgresql/2026-10-08-120000_cipher_data_longtext/down.sql
deleted file mode 100644
index e69de29b..00000000
diff --git a/migrations/postgresql/2026-10-08-120000_cipher_data_longtext/up.sql b/migrations/postgresql/2026-10-08-120000_cipher_data_longtext/up.sql
deleted file mode 100644
index aab2e86a..00000000
--- a/migrations/postgresql/2026-10-08-120000_cipher_data_longtext/up.sql
+++ /dev/null
@@ -1,3 +0,0 @@
--- TEXT has no size limit here, only MySQL needed the change.
--- PostgreSQL rejects a migration that is only comments ("Received an empty query"), hence the no-op.
-SELECT 1;
diff --git a/migrations/postgresql/2026-10-10-120000_add_custom_role_permissions/down.sql b/migrations/postgresql/2026-10-10-120000_add_custom_role_permissions/down.sql
deleted file mode 100644
index 0cc5dd03..00000000
--- a/migrations/postgresql/2026-10-10-120000_add_custom_role_permissions/down.sql
+++ /dev/null
@@ -1,20 +0,0 @@
--- Dropping the permissions would silently take them away from the Custom members, who would also keep a role (4) the
--- versions before this one don't know. So while there are any, this fails on the duplicate key below: change their
--- role first, or restore the backup taken before the upgrade. It needs to run in one transaction, as Diesel does.
-CREATE TEMPORARY TABLE custom_role_downgrade (blocked_by VARCHAR(255) NOT NULL PRIMARY KEY);
-INSERT INTO custom_role_downgrade VALUES ('Custom members: change their role first, or restore the backup taken before the upgrade');
-INSERT INTO custom_role_downgrade
-    SELECT 'Custom members: change their role first, or restore the backup taken before the upgrade'
-    FROM users_organizations WHERE atype = 4 LIMIT 1;
-DROP TABLE custom_role_downgrade;
-
-ALTER TABLE users_organizations
-    DROP COLUMN manage_users,
-    DROP COLUMN manage_groups,
-    DROP COLUMN manage_policies,
-    DROP COLUMN create_new_collections,
-    DROP COLUMN edit_any_collection,
-    DROP COLUMN delete_any_collection,
-    DROP COLUMN access_event_logs,
-    DROP COLUMN access_import_export,
-    DROP COLUMN access_reports;
diff --git a/migrations/postgresql/2026-10-10-120000_add_custom_role_permissions/up.sql b/migrations/postgresql/2026-10-10-120000_add_custom_role_permissions/up.sql
deleted file mode 100644
index d28b0d64..00000000
--- a/migrations/postgresql/2026-10-10-120000_add_custom_role_permissions/up.sql
+++ /dev/null
@@ -1,13 +0,0 @@
--- The granular permissions of the Custom member role. They only take effect on a Custom membership
--- (atype 4) while EXPERIMENTAL_CUSTOM_ROLES is enabled, and every existing membership starts without any.
--- A single statement, so an interrupted upgrade cannot leave only some of the columns behind.
-ALTER TABLE users_organizations
-    ADD COLUMN manage_users BOOLEAN NOT NULL DEFAULT FALSE,
-    ADD COLUMN manage_groups BOOLEAN NOT NULL DEFAULT FALSE,
-    ADD COLUMN manage_policies BOOLEAN NOT NULL DEFAULT FALSE,
-    ADD COLUMN create_new_collections BOOLEAN NOT NULL DEFAULT FALSE,
-    ADD COLUMN edit_any_collection BOOLEAN NOT NULL DEFAULT FALSE,
-    ADD COLUMN delete_any_collection BOOLEAN NOT NULL DEFAULT FALSE,
-    ADD COLUMN access_event_logs BOOLEAN NOT NULL DEFAULT FALSE,
-    ADD COLUMN access_import_export BOOLEAN NOT NULL DEFAULT FALSE,
-    ADD COLUMN access_reports BOOLEAN NOT NULL DEFAULT FALSE;
diff --git a/migrations/postgresql/2026-11-02-120000_reset_user_key_id/down.sql b/migrations/postgresql/2026-11-02-120000_reset_user_key_id/down.sql
deleted file mode 100644
index e69de29b..00000000
diff --git a/migrations/postgresql/2026-11-02-120000_reset_user_key_id/up.sql b/migrations/postgresql/2026-11-02-120000_reset_user_key_id/up.sql
deleted file mode 100644
index eeffa854..00000000
--- a/migrations/postgresql/2026-11-02-120000_reset_user_key_id/up.sql
+++ /dev/null
@@ -1,4 +0,0 @@
--- Key rotations before this kept the id of the old user key, so every new
--- cipher was refused from then on. Stale ids can't be told apart, so clear
--- all of them; clients record their current key's id again when it's empty.
-UPDATE users SET key_id = NULL;
diff --git a/migrations/postgresql/2026-11-04-120000_add_v2_upgrade_token/down.sql b/migrations/postgresql/2026-11-04-120000_add_v2_upgrade_token/down.sql
deleted file mode 100644
index 89e12c15..00000000
--- a/migrations/postgresql/2026-11-04-120000_add_v2_upgrade_token/down.sql
+++ /dev/null
@@ -1,2 +0,0 @@
-ALTER TABLE users DROP COLUMN v2_upgrade_token;
-ALTER TABLE users_organizations DROP COLUMN v2_upgrade_token;
diff --git a/migrations/postgresql/2026-11-04-120000_add_v2_upgrade_token/up.sql b/migrations/postgresql/2026-11-04-120000_add_v2_upgrade_token/up.sql
deleted file mode 100644
index 45c58491..00000000
--- a/migrations/postgresql/2026-11-04-120000_add_v2_upgrade_token/up.sql
+++ /dev/null
@@ -1,2 +0,0 @@
-ALTER TABLE users ADD COLUMN v2_upgrade_token TEXT;
-ALTER TABLE users_organizations ADD COLUMN v2_upgrade_token TEXT;
diff --git a/migrations/sqlite/2026-10-09-120000_user_crypto_v2/down.sql b/migrations/sqlite/2026-09-20-120000_user_crypto_v2/down.sql
similarity index 63%
rename from migrations/sqlite/2026-10-09-120000_user_crypto_v2/down.sql
rename to migrations/sqlite/2026-09-20-120000_user_crypto_v2/down.sql
index 49700440..b57c715e 100644
--- a/migrations/sqlite/2026-10-09-120000_user_crypto_v2/down.sql
+++ b/migrations/sqlite/2026-09-20-120000_user_crypto_v2/down.sql
@@ -3,3 +3,5 @@ DROP TABLE IF EXISTS user_signature_key_pairs;
 ALTER TABLE users DROP COLUMN signed_public_key;
 ALTER TABLE users DROP COLUMN security_state;
 ALTER TABLE users DROP COLUMN security_version;
+ALTER TABLE users DROP COLUMN v2_upgrade_token;
+ALTER TABLE users_organizations DROP COLUMN v2_upgrade_token;
diff --git a/migrations/sqlite/2026-10-09-120000_user_crypto_v2/up.sql b/migrations/sqlite/2026-09-20-120000_user_crypto_v2/up.sql
similarity index 83%
rename from migrations/sqlite/2026-10-09-120000_user_crypto_v2/up.sql
rename to migrations/sqlite/2026-09-20-120000_user_crypto_v2/up.sql
index c15e5b5e..ff026d80 100644
--- a/migrations/sqlite/2026-10-09-120000_user_crypto_v2/up.sql
+++ b/migrations/sqlite/2026-09-20-120000_user_crypto_v2/up.sql
@@ -1,6 +1,8 @@
 ALTER TABLE users ADD COLUMN signed_public_key TEXT;
 ALTER TABLE users ADD COLUMN security_state TEXT;
 ALTER TABLE users ADD COLUMN security_version INTEGER;
+ALTER TABLE users ADD COLUMN v2_upgrade_token TEXT;
+ALTER TABLE users_organizations ADD COLUMN v2_upgrade_token TEXT;
 
 CREATE TABLE user_signature_key_pairs (
     uuid                TEXT     NOT NULL PRIMARY KEY,
diff --git a/migrations/sqlite/2026-10-07-120000_add_org_policy_revision_date/down.sql b/migrations/sqlite/2026-10-07-120000_add_org_policy_revision_date/down.sql
deleted file mode 100644
index e69de29b..00000000
diff --git a/migrations/sqlite/2026-10-07-120000_add_org_policy_revision_date/up.sql b/migrations/sqlite/2026-10-07-120000_add_org_policy_revision_date/up.sql
deleted file mode 100644
index 86595711..00000000
--- a/migrations/sqlite/2026-10-07-120000_add_org_policy_revision_date/up.sql
+++ /dev/null
@@ -1,6 +0,0 @@
--- SQLite forbids non-constant defaults in ALTER TABLE ... ADD COLUMN, so add
--- the column with a constant placeholder and backfill separately.
-ALTER TABLE org_policies
-ADD COLUMN revision_date DATETIME NOT NULL DEFAULT '1970-01-01 00:00:00';
-
-UPDATE org_policies SET revision_date = CURRENT_TIMESTAMP;
diff --git a/migrations/sqlite/2026-10-08-120000_cipher_data_longtext/down.sql b/migrations/sqlite/2026-10-08-120000_cipher_data_longtext/down.sql
deleted file mode 100644
index e69de29b..00000000
diff --git a/migrations/sqlite/2026-10-08-120000_cipher_data_longtext/up.sql b/migrations/sqlite/2026-10-08-120000_cipher_data_longtext/up.sql
deleted file mode 100644
index f18eb816..00000000
--- a/migrations/sqlite/2026-10-08-120000_cipher_data_longtext/up.sql
+++ /dev/null
@@ -1 +0,0 @@
--- TEXT has no size limit here, only MySQL needed the change
diff --git a/migrations/sqlite/2026-10-10-120000_add_custom_role_permissions/down.sql b/migrations/sqlite/2026-10-10-120000_add_custom_role_permissions/down.sql
deleted file mode 100644
index 11c30bec..00000000
--- a/migrations/sqlite/2026-10-10-120000_add_custom_role_permissions/down.sql
+++ /dev/null
@@ -1,19 +0,0 @@
--- Dropping the permissions would silently take them away from the Custom members, who would also keep a role (4) the
--- versions before this one don't know. So while there are any, this fails on the duplicate key below: change their
--- role first, or restore the backup taken before the upgrade. It needs to run in one transaction, as Diesel does.
-CREATE TEMPORARY TABLE custom_role_downgrade (blocked_by VARCHAR(255) NOT NULL PRIMARY KEY);
-INSERT INTO custom_role_downgrade VALUES ('Custom members: change their role first, or restore the backup taken before the upgrade');
-INSERT INTO custom_role_downgrade
-    SELECT 'Custom members: change their role first, or restore the backup taken before the upgrade'
-    FROM users_organizations WHERE atype = 4 LIMIT 1;
-DROP TABLE custom_role_downgrade;
-
-ALTER TABLE users_organizations DROP COLUMN manage_users;
-ALTER TABLE users_organizations DROP COLUMN manage_groups;
-ALTER TABLE users_organizations DROP COLUMN manage_policies;
-ALTER TABLE users_organizations DROP COLUMN create_new_collections;
-ALTER TABLE users_organizations DROP COLUMN edit_any_collection;
-ALTER TABLE users_organizations DROP COLUMN delete_any_collection;
-ALTER TABLE users_organizations DROP COLUMN access_event_logs;
-ALTER TABLE users_organizations DROP COLUMN access_import_export;
-ALTER TABLE users_organizations DROP COLUMN access_reports;
diff --git a/migrations/sqlite/2026-10-10-120000_add_custom_role_permissions/up.sql b/migrations/sqlite/2026-10-10-120000_add_custom_role_permissions/up.sql
deleted file mode 100644
index c708c693..00000000
--- a/migrations/sqlite/2026-10-10-120000_add_custom_role_permissions/up.sql
+++ /dev/null
@@ -1,11 +0,0 @@
--- The granular permissions of the Custom member role. They only take effect on a Custom membership
--- (atype 4) while EXPERIMENTAL_CUSTOM_ROLES is enabled, and every existing membership starts without any.
-ALTER TABLE users_organizations ADD COLUMN manage_users BOOLEAN NOT NULL DEFAULT 0; -- FALSE
-ALTER TABLE users_organizations ADD COLUMN manage_groups BOOLEAN NOT NULL DEFAULT 0; -- FALSE
-ALTER TABLE users_organizations ADD COLUMN manage_policies BOOLEAN NOT NULL DEFAULT 0; -- FALSE
-ALTER TABLE users_organizations ADD COLUMN create_new_collections BOOLEAN NOT NULL DEFAULT 0; -- FALSE
-ALTER TABLE users_organizations ADD COLUMN edit_any_collection BOOLEAN NOT NULL DEFAULT 0; -- FALSE
-ALTER TABLE users_organizations ADD COLUMN delete_any_collection BOOLEAN NOT NULL DEFAULT 0; -- FALSE
-ALTER TABLE users_organizations ADD COLUMN access_event_logs BOOLEAN NOT NULL DEFAULT 0; -- FALSE
-ALTER TABLE users_organizations ADD COLUMN access_import_export BOOLEAN NOT NULL DEFAULT 0; -- FALSE
-ALTER TABLE users_organizations ADD COLUMN access_reports BOOLEAN NOT NULL DEFAULT 0; -- FALSE
diff --git a/migrations/sqlite/2026-11-02-120000_reset_user_key_id/down.sql b/migrations/sqlite/2026-11-02-120000_reset_user_key_id/down.sql
deleted file mode 100644
index e69de29b..00000000
diff --git a/migrations/sqlite/2026-11-02-120000_reset_user_key_id/up.sql b/migrations/sqlite/2026-11-02-120000_reset_user_key_id/up.sql
deleted file mode 100644
index eeffa854..00000000
--- a/migrations/sqlite/2026-11-02-120000_reset_user_key_id/up.sql
+++ /dev/null
@@ -1,4 +0,0 @@
--- Key rotations before this kept the id of the old user key, so every new
--- cipher was refused from then on. Stale ids can't be told apart, so clear
--- all of them; clients record their current key's id again when it's empty.
-UPDATE users SET key_id = NULL;
diff --git a/migrations/sqlite/2026-11-04-120000_add_v2_upgrade_token/down.sql b/migrations/sqlite/2026-11-04-120000_add_v2_upgrade_token/down.sql
deleted file mode 100644
index 89e12c15..00000000
--- a/migrations/sqlite/2026-11-04-120000_add_v2_upgrade_token/down.sql
+++ /dev/null
@@ -1,2 +0,0 @@
-ALTER TABLE users DROP COLUMN v2_upgrade_token;
-ALTER TABLE users_organizations DROP COLUMN v2_upgrade_token;
diff --git a/migrations/sqlite/2026-11-04-120000_add_v2_upgrade_token/up.sql b/migrations/sqlite/2026-11-04-120000_add_v2_upgrade_token/up.sql
deleted file mode 100644
index 45c58491..00000000
--- a/migrations/sqlite/2026-11-04-120000_add_v2_upgrade_token/up.sql
+++ /dev/null
@@ -1,2 +0,0 @@
-ALTER TABLE users ADD COLUMN v2_upgrade_token TEXT;
-ALTER TABLE users_organizations ADD COLUMN v2_upgrade_token TEXT;
diff --git a/playwright/README.md b/playwright/README.md
index cd18bebd..000725d7 100644
--- a/playwright/README.md
+++ b/playwright/README.md
@@ -2,7 +2,7 @@
 
 This allows running integration tests using [Playwright](https://playwright.dev/).
 \
-It uses its own [test.env](./test.env) with different ports to not collide with a running dev instance.
+It usse its own [test.env](/test/scenarios/test.env) with different ports to not collide with a running dev instance.
 
 ## Install
 
@@ -62,7 +62,7 @@ DOCKER_BUILDKIT=1 docker compose --profile playwright --env-file test.env run Pl
 
 ### Keep services running
 
-If you want you can keep the DB and Keycloak running (states are not impacted by the tests):
+If you want you can keep the DB and Keycloak runnning (states are not impacted by the tests):
 
 ```bash
 PW_KEEP_SERVICE_RUNNING=true npx playwright test
diff --git a/playwright/tests/emergency.spec.ts b/playwright/tests/emergency.spec.ts
deleted file mode 100644
index 4c836986..00000000
--- a/playwright/tests/emergency.spec.ts
+++ /dev/null
@@ -1,131 +0,0 @@
-import { test, expect, type Page, type TestInfo, Test } from '@playwright/test';
-import { MailDev } from 'maildev';
-
-import * as utils from "../global-utils";
-import { createAccount, logUser } from './setups/user';
-import { activateTOTP } from './setups/2fa';
-
-let users = utils.loadEnv();
-let mailserver;
-
-test.beforeAll('Setup', async ({ browser }, testInfo: TestInfo) => {
-    mailserver = new MailDev({
-        port: process.env.MAILDEV_SMTP_PORT,
-        web: { port: process.env.MAILDEV_HTTP_PORT },
-    })
-
-    await mailserver.listen();
-
-    await utils.startVault(browser, testInfo, {
-        SMTP_HOST: process.env.MAILDEV_HOST,
-        SMTP_FROM: process.env.PW_SMTP_FROM,
-    });
-});
-
-test.afterAll('Teardown', async ({}) => {
-    utils.stopVault();
-    if( mailserver ){
-        await mailserver.close();
-    }
-});
-
-async function emergencyAccess(test: Test, page: Page, user: { name: string }) {
-    await test.step('Navigate', async () => {
-        await page.getByRole('button', { name: user.name }).click();
-        await page.getByRole('menuitem', { name: 'Account settings' }).click();
-        await page.getByRole('link', { name: 'Emergency access' }).click();
-        await expect(page.locator('#main-content').getByText('Emergency access', { exact: true })).toBeVisible();
-    });
-}
-
-test('Emergency access', async ({ browser, page }) => {
-    const context2 = await browser.newContext();
-    const page2 = await context2.newPage();
-
-    const mailBuffer = mailserver.buffer(users.user1.email);
-    const mailBuffer2 = mailserver.buffer(users.user2.email);
-
-    await createAccount(test, page, users.user1);
-    await createAccount(test, page2, users.user2);
-
-    await test.step('Add test2', async () => {
-        await emergencyAccess(test, page, users.user1);
-        await page.getByRole('button', { name: 'Add emergency contact' }).click();
-        await page.getByRole('textbox', { name: 'Email * (required)' }).fill(users.user2.email);
-        await page.getByRole('radio', { name: 'Takeover Can reset your' }).check();
-        await page.getByRole('button', { name: 'Save' }).click();
-        await utils.checkNotification(page, 'User(s) invited');
-    });
-
-    await test.step('Accept', async () => {
-        const email = await mailBuffer2.expect((m) => m.subject === "Emergency access for " + users.user1.name);
-        const pageE = await context2.newPage();
-        await pageE.setContent(email.html);
-        const link = await pageE.getByTestId("emergency").getAttribute("href");
-        await pageE.close();
-
-        await page2.goto(link);
-        await utils.checkNotification(page2, 'Invitation accepted');
-    });
-
-    await test.step('Confirm', async () => {
-        await emergencyAccess(test, page, users.user1);
-        await expect(page.locator('#main-content').getByText('Needs confirmation')).toBeVisible();
-        await page.getByRole('button', { name: 'Options' }).click();
-        await page.getByRole('menuitem', { name: 'Confirm' }).click();
-        await page.getByRole('button', { name: 'Confirm' }).click();
-        await utils.checkNotification(page, users.user2.name + ' confirmed');
-        await mailBuffer2.expect((m) => m.subject === "Emergency access contact for " + users.user1.name + " confirmed");
-    });
-
-    await test.step('Request', async () => {
-        await emergencyAccess(test, page2, users.user2);
-        await page2.getByRole('button', { name: 'Options' }).click();
-        await page2.getByRole('menuitem', { name: 'Request Access' }).click();
-        await page2.getByRole('button', { name: 'Request Access' }).click();
-        await utils.checkNotification(page2, 'Emergency access requested');
-        await mailBuffer.expect((m) => m.subject === "Emergency access request by " + users.user2.name + " initiated");
-    });
-
-    await test.step('Approved', async () => {
-        await emergencyAccess(test, page, users.user1);
-        await page.getByRole('button', { name: 'Options' }).click();
-        await page.getByRole('menuitem', { name: 'Approve' }).click();
-        await page.getByRole('button', { name: 'Approve' }).click();
-        await utils.checkNotification(page, 'Emergency access approved');
-        await mailBuffer2.expect((m) => m.subject === "Emergency access request for " + users.user1.name + " approved");
-    });
-    await activateTOTP(test, page, users.user1);
-
-    let newPassword = "TotoNewPassword";
-    await test.step('Access', async () => {
-        await emergencyAccess(test, page2, users.user2);
-        await page2.getByRole('button', { name: 'Options' }).click();
-        await page2.getByRole('menuitem', { name: 'Takeover' }).click();
-        await page2.getByRole('textbox', { name: 'New master password * (required)', exact: true }).fill(newPassword);
-        await page2.getByRole('textbox', { name: 'Confirm new master password' }).fill(newPassword);
-        await page2.getByRole('button', { name: 'Save' }).click();
-        await utils.checkNotification(page2, 'Password reset for ' + users.user1.name);
-    });
-
-    await test.step('Changed no 2fa', async () => {
-        users.user1.password = newPassword;
-        await logUser(test, page, users.user1);
-    });
-
-    await test.step('Reject', async () => {
-        await emergencyAccess(test, page, users.user1);
-        await page.getByRole('button', { name: 'Options' }).click();
-        await page.getByRole('menuitem', { name: 'Reject' }).click();
-        await utils.checkNotification(page, 'Emergency access rejected');
-        await mailBuffer2.expect((m) => m.subject === "Emergency access request to " + users.user1.name + " rejected");
-    });
-
-    await test.step('Remove', async () => {
-        await page.getByRole('button', { name: 'Options' }).click();
-        await page.getByRole('menuitem', { name: 'Remove' }).click();
-        await page.getByRole('button', { name: 'Yes' }).click();
-        await utils.checkNotification(page, 'Removed user ' + users.user2.name);
-        await expect(page.getByText('You have not added any emergency contacts')).toBeVisible();
-    });
-});
diff --git a/playwright/tests/login.spec.ts b/playwright/tests/login.spec.ts
index bc229c43..194976ea 100644
--- a/playwright/tests/login.spec.ts
+++ b/playwright/tests/login.spec.ts
@@ -3,7 +3,7 @@ import * as OTPAuth from "otpauth";
 
 import * as utils from "../global-utils";
 import { createAccount, logUser } from './setups/user';
-import { activateTOTP, disableTOTP, recoveryCodes } from './setups/2fa';
+import { activateTOTP, disableTOTP } from './setups/2fa';
 
 let users = utils.loadEnv();
 let totp;
@@ -31,42 +31,21 @@ test('Authenticator 2fa', async ({ page }) => {
 
     await utils.logout(test, page, users.user1);
 
-    await logUser(test, page, users.user1, { totp });
-
-    await disableTOTP(test, page, users.user1);
-});
-
-test('Recovery codes', async ({ context, page }) => {
-    await logUser(test, page, users.user1);
-
-    await activateTOTP(test, page, users.user1);
-    let recovery = await recoveryCodes(test, page, users.user1);
-
-    await utils.logout(test, page, users.user1);
-
     await test.step('login', async () => {
+        let timestamp = Date.now(); // Needed to use the next token
+        timestamp = timestamp + (totp.period - (Math.floor(timestamp / 1000) % totp.period) + 1) * 1000;
+
         await page.getByLabel(/Email address/).fill(users.user1.email);
         await page.getByRole('button', { name: 'Continue' }).click();
         await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(users.user1.password);
         await page.getByRole('button', { name: 'Log in', exact: true }).click();
 
         await expect(page.getByRole('heading', { name: 'Verify your Identity' })).toBeVisible();
+        await page.getByLabel(/Verification code/).fill(totp.generate({timestamp}));
+        await page.getByRole('button', { name: 'Continue' }).click();
 
         await expect(page).toHaveTitle(/Vaultwarden Web/);
-
-        const newPagePromise = context.waitForEvent('page');
-        await page.getByRole('button', { name: 'Use your recovery code' }).click();
-        const newPage = await newPagePromise;
-
-        const tabs = context.pages();
-        await tabs[1].bringToFront();
-        await expect(tabs[1].getByRole('heading', { name: 'Recover account two-step login' })).toBeVisible();
-        await tabs[1].getByRole('textbox', { name: 'Email address * (required)' }).fill(users.user1.email);
-        await tabs[1].getByRole('textbox', { name: 'Master password * (required)' }).fill(users.user1.password);
-        await tabs[1].getByRole('textbox', { name: 'Recovery code * (required)' }).fill(recovery);
-        await tabs[1].getByRole('button', { name: 'Submit' }).click();
-
-        await expect(tabs[1]).toHaveTitle(/Two-step login/);
     });
-});
 
+    await disableTOTP(test, page, users.user1);
+});
diff --git a/playwright/tests/setups/2fa.ts b/playwright/tests/setups/2fa.ts
index 0b1711a1..d430d053 100644
--- a/playwright/tests/setups/2fa.ts
+++ b/playwright/tests/setups/2fa.ts
@@ -4,24 +4,6 @@ import * as OTPAuth from "otpauth";
 
 import * as utils from '../../global-utils';
 
-export async function recoveryCodes(test: Test, page: Page, user: { name: string, password: string }): string {
-    return await test.step('Recovery code', async () => {
-        await page.getByRole('button', { name: user.name }).click();
-        await page.getByRole('menuitem', { name: 'Account settings' }).click();
-        await page.getByRole('link', { name: 'Security' }).click();
-        await page.getByRole('link', { name: 'Two-step login' }).click();
-
-        await page.getByRole('button', { name: 'View recovery code' }).click();
-        await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(user.password);
-        await page.getByRole('button', { name: 'Continue' }).click();
-
-        const recovery = await page.getByRole('code').innerText();
-        await page.getByLabel('Close').click();
-
-        return recovery;
-    })
-}
-
 export async function activateTOTP(test: Test, page: Page, user: { name: string, password: string }): OTPAuth.TOTP {
     return await test.step('Activate TOTP 2FA', async () => {
         await page.getByRole('button', { name: user.name }).click();
@@ -39,6 +21,7 @@ export async function activateTOTP(test: Test, page: Page, user: { name: string,
         await page.getByLabel(/Verification code/).fill(totp.generate());
         await page.getByRole('button', { name: 'Turn on' }).click();
         await page.getByRole('heading', { name: 'Turned on', exact: true });
+        await page.getByLabel('Close').click();
 
         return totp;
     })
diff --git a/playwright/tests/setups/user.ts b/playwright/tests/setups/user.ts
index 11b39763..3d3990e9 100644
--- a/playwright/tests/setups/user.ts
+++ b/playwright/tests/setups/user.ts
@@ -2,7 +2,6 @@ import { expect, type Browser, Page } from '@playwright/test';
 
 import { type MailBuffer } from 'maildev';
 
-import * as OTPAuth from "otpauth";
 import * as utils from '../../global-utils';
 import { retrieveEmailCode } from './2fa';
 
@@ -44,7 +43,6 @@ export async function logUser(
         mailBuffer ?: MailBuffer,
         mail2fa?: boolean,
         notNewDevice?: boolean,
-        totp?: OTPAuth.TOTP,
     } = {}
 ) {
     await test.step(`Log user ${user.email}`, async () => {
@@ -57,23 +55,11 @@ export async function logUser(
         await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(user.password);
         await page.getByRole('button', { name: 'Log in', exact: true }).click();
 
-        if( options.mail2fa || options.totp ){
-            let code;
-
+        if( options.mail2fa ){
             await test.step('2FA check', async () => {
                 await expect(page.getByRole('heading', { name: 'Verify your Identity' })).toBeVisible();
-
-                if( options.totp ) {
-                    const totp = options.totp;
-                    let timestamp = Date.now(); // Needed to use the next token
-                    timestamp = timestamp + (totp.period - (Math.floor(timestamp / 1000) % totp.period) + 1) * 1000;
-                    code = totp.generate({timestamp});
-                } else if( options.mail2fa ){
-                    code = await retrieveEmailCode(test, page, options.mailBuffer);
-                }
-
+                let code = await retrieveEmailCode(test, page, options.mailBuffer);
                 await page.getByLabel(/Verification code/).fill(code);
-
                 await page.getByRole('button', { name: 'Continue' }).click();
             });
         }
diff --git a/rust-toolchain.toml b/rust-toolchain.toml
index b195f645..2be20926 100644
--- a/rust-toolchain.toml
+++ b/rust-toolchain.toml
@@ -1,4 +1,4 @@
 [toolchain]
-channel = "1.99.1"
+channel = "1.98.1"
 components = [ "rustfmt", "clippy" ]
 profile = "minimal"
diff --git a/src/api/admin.rs b/src/api/admin.rs
index 62004d50..4bdf8e71 100644
--- a/src/api/admin.rs
+++ b/src/api/admin.rs
@@ -1,4 +1,4 @@
-use std::{collections::HashMap, env, sync::LazyLock};
+use std::{env, sync::LazyLock};
 
 use reqwest::Method;
 use rocket::{
@@ -17,7 +17,7 @@ use crate::{
     api::{
         ApiResult, EmptyResult, JsonResult, Notify,
         core::{log_event, two_factor},
-        push_logout_to_relay, unregister_push_device,
+        unregister_push_device,
     },
     auth::{ClientIp, Secure, decode_admin, encode_jwt, generate_admin_claims},
     config::ConfigBuilder,
@@ -26,7 +26,6 @@ use crate::{
         models::{
             Attachment, Cipher, Collection, Device, Event, EventType, Group, Invitation, Membership, MembershipId,
             MembershipType, OrgPolicy, Organization, OrganizationId, SsoUser, TwoFactor, User, UserId,
-            custom_roles_enabled,
         },
     },
     error::{Error, MapResult},
@@ -202,15 +201,12 @@ fn post_admin_login(
     // If the token is invalid, redirect to login page
     if validate_token(&data.token) {
         // If the token received is valid, generate JWT and save it as a cookie
-        let claims = match generate_admin_claims() {
-            Ok(claims) => claims,
-            Err(e) => return Err(AdminResponse::Ok(render_admin_login(Some(e.message()), redirect.as_deref()))),
-        };
+        let claims = generate_admin_claims();
         let jwt = encode_jwt(&claims);
 
         let cookie = Cookie::build((COOKIE_NAME, jwt))
             .path(admin_path())
-            .max_age(time::Duration::minutes(i64::from(CONFIG.admin_session_lifetime())))
+            .max_age(time::Duration::minutes(CONFIG.admin_session_lifetime()))
             .same_site(SameSite::Strict)
             .http_only(true)
             .secure(secure.https);
@@ -257,7 +253,6 @@ struct AdminTemplateData {
     logged_in: bool,
     urlpath: String,
     sso_enabled: bool,
-    custom_roles_enabled: bool,
 }
 
 impl AdminTemplateData {
@@ -268,7 +263,6 @@ impl AdminTemplateData {
             logged_in: true,
             urlpath: CONFIG.domain_path(),
             sso_enabled: CONFIG.sso_enabled(),
-            custom_roles_enabled: custom_roles_enabled(),
         }
     }
 
@@ -393,18 +387,6 @@ async fn users_overview(_token: AdminToken, conn: DbConn) -> ApiResult<Html<Stri
 
         usr["sso_identifier"] = json!(sso_u.map_or(String::new(), |u| u.identifier.to_string()));
 
-        // The clients are shown a Manager as a Custom member, but the admin panel tells the two roles apart
-        let roles: HashMap<String, i32> = Membership::find_confirmed_by_user(&u.uuid, &conn)
-            .await
-            .into_iter()
-            .map(|member| (member.org_uuid.to_string(), member.atype))
-            .collect();
-        for org in usr["organizations"].as_array_mut().into_iter().flatten() {
-            if let Some(atype) = org["id"].as_str().and_then(|org_id| roles.get(org_id)) {
-                org["type"] = json!(atype);
-            }
-        }
-
         users_json.push(usr);
     }
 
@@ -434,21 +416,13 @@ async fn get_user_json(user_id: UserId, _token: AdminToken, conn: DbConn) -> Jso
 }
 
 #[post("/users/<user_id>/delete", format = "application/json")]
-async fn delete_user(user_id: UserId, token: AdminToken, conn: DbConn, nt: Notify<'_>) -> EmptyResult {
+async fn delete_user(user_id: UserId, token: AdminToken, conn: DbConn) -> EmptyResult {
     let user = get_user_or_404(&user_id, &conn).await?;
 
-    // Get the membership records and push devices before deleting the actual user
+    // Get the membership records before deleting the actual user
     let memberships = Membership::find_any_state_by_user(&user_id, &conn).await;
-    let has_push_device = CONFIG.push_enabled() && Device::check_user_has_push_device(&user_id, &conn).await;
     let res = user.delete(&conn).await;
 
-    if res.is_ok() {
-        nt.send_logout(&user, None, &conn).await;
-        if has_push_device {
-            push_logout_to_relay(&user, None, None);
-        }
-    }
-
     for membership in memberships {
         log_event(
             EventType::OrganizationUserDeleted,
@@ -534,7 +508,6 @@ async fn enable_user(user_id: UserId, _token: AdminToken, conn: DbConn) -> Empty
 async fn remove_2fa(user_id: UserId, token: AdminToken, conn: DbConn) -> EmptyResult {
     let mut user = get_user_or_404(&user_id, &conn).await?;
     TwoFactor::delete_all_by_user(&user.uuid, &conn).await?;
-    Device::clear_twofactor_remember_by_user(&user.uuid, &conn).await?;
     two_factor::enforce_2fa_policy(&user, &ACTING_ADMIN_USER.into(), 14, &token.ip.ip, &conn).await?;
     user.totp_recover = None;
     user.save(&conn).await
@@ -580,14 +553,10 @@ async fn update_membership_type(data: Json<MembershipTypeData>, token: AdminToke
         err!("The specified user isn't member of the organization")
     };
 
-    let new_type = match MembershipType::from_str(&data.user_type.into_string()) {
-        // Unlike the clients, the admin panel tells the Custom and the legacy Manager role apart. Unless Custom roles
-        // are enabled, a Custom role is a Manager here as well, but an existing Custom member is kept as one.
-        Some(MembershipType::Custom) if !custom_roles_enabled() && !member_to_edit.has_type(MembershipType::Custom) => {
-            MembershipType::Manager
-        }
-        Some(new_type) => new_type,
-        None => err!("Invalid type"),
+    let new_type = if let Some(new_type) = MembershipType::from_str(&data.user_type.into_string()) {
+        new_type as i32
+    } else {
+        err!("Invalid type")
     };
 
     if member_to_edit.atype == MembershipType::Owner && new_type != MembershipType::Owner {
@@ -597,16 +566,7 @@ async fn update_membership_type(data: Json<MembershipTypeData>, token: AdminToke
         }
     }
 
-    // A Manager only becomes a Custom member if that changes nothing they may do. Here they would keep the permissions
-    // they are shown with, the admin panel can't give up their access to all collections, so that is refused.
-    if new_type == MembershipType::Custom
-        && let Some(loss) =
-            member_to_edit.custom_role_conversion_loss(&member_to_edit.legacy_manager_permissions(), &conn).await
-    {
-        err!(loss)
-    }
-
-    member_to_edit.set_type(new_type);
+    member_to_edit.atype = new_type;
     // This check is also done at api::organizations::{accept_invite, _confirm_invite, _activate_member, edit_member}, update_membership_type
     OrgPolicy::check_user_allowed(&member_to_edit, "modify", &conn).await?;
 
@@ -818,8 +778,6 @@ async fn diagnostics(_token: AdminToken, ip_header: IpHeader, conn: DbConn) -> A
     .into_keys()
     .collect();
 
-    let invalid_env_vars = crate::util::INVALID_ENV_VARS.lock().unwrap().join(", ");
-
     let diagnostics_json = json!({
         "dns_resolved": dns_resolved,
         "current_release": VERSION,
@@ -842,9 +800,7 @@ async fn diagnostics(_token: AdminToken, ip_header: IpHeader, conn: DbConn) -> A
         "db_version": get_sql_server_version(&conn).await,
         "admin_url": format!("{}/diagnostics", admin_url()),
         "overrides": &CONFIG.get_overrides().join(", "),
-        "config_file_status": &CONFIG.get_config_file_status(),
         "template_overrides": check_template_overrides().join(", "),
-        "invalid_env_vars": invalid_env_vars,
         "invalid_feature_flags": invalid_feature_flags,
         "host_arch": env::consts::ARCH,
         "host_os":  env::consts::OS,
@@ -949,23 +905,23 @@ mod tests {
     fn validate_web_vault_compare() {
         // web_vault_compare(active, latest)
         // Test normal versions
-        assert_eq!(web_vault_compare("2025.12.0", "2025.12.1"), -1);
-        assert_eq!(web_vault_compare("2025.12.1", "2025.12.1"), 0);
-        assert_eq!(web_vault_compare("2025.12.2", "2025.12.1"), 1);
+        assert!(web_vault_compare("2025.12.0", "2025.12.1") == -1);
+        assert!(web_vault_compare("2025.12.1", "2025.12.1") == 0);
+        assert!(web_vault_compare("2025.12.2", "2025.12.1") == 1);
 
         // Test patched/+build.n versions
         // Newer latest version
-        assert_eq!(web_vault_compare("2025.12.0+build.1", "2025.12.1"), -1);
-        assert_eq!(web_vault_compare("2025.12.1", "2025.12.1+build.1"), -1);
-        assert_eq!(web_vault_compare("2025.12.0+build.1", "2025.12.1+build.1"), -1);
-        assert_eq!(web_vault_compare("2025.12.1+build.1", "2025.12.1+build.2"), -1);
+        assert!(web_vault_compare("2025.12.0+build.1", "2025.12.1") == -1);
+        assert!(web_vault_compare("2025.12.1", "2025.12.1+build.1") == -1);
+        assert!(web_vault_compare("2025.12.0+build.1", "2025.12.1+build.1") == -1);
+        assert!(web_vault_compare("2025.12.1+build.1", "2025.12.1+build.2") == -1);
         // Equal versions
-        assert_eq!(web_vault_compare("2025.12.1+build.1", "2025.12.1+build.1"), 0);
-        assert_eq!(web_vault_compare("2025.12.2+build.2", "2025.12.2+build.2"), 0);
+        assert!(web_vault_compare("2025.12.1+build.1", "2025.12.1+build.1") == 0);
+        assert!(web_vault_compare("2025.12.2+build.2", "2025.12.2+build.2") == 0);
         // Newer active version
-        assert_eq!(web_vault_compare("2025.12.1+build.1", "2025.12.1"), 1);
-        assert_eq!(web_vault_compare("2025.12.2", "2025.12.1+build.1"), 1);
-        assert_eq!(web_vault_compare("2025.12.2+build.1", "2025.12.1+build.1"), 1);
-        assert_eq!(web_vault_compare("2025.12.1+build.3", "2025.12.1+build.2"), 1);
+        assert!(web_vault_compare("2025.12.1+build.1", "2025.12.1") == 1);
+        assert!(web_vault_compare("2025.12.2", "2025.12.1+build.1") == 1);
+        assert!(web_vault_compare("2025.12.2+build.1", "2025.12.1+build.1") == 1);
+        assert!(web_vault_compare("2025.12.1+build.3", "2025.12.1+build.2") == 1);
     }
 }
diff --git a/src/api/core/accounts.rs b/src/api/core/accounts.rs
index b2dd5845..e4f75982 100644
--- a/src/api/core/accounts.rs
+++ b/src/api/core/accounts.rs
@@ -12,9 +12,9 @@ use serde_json::Value;
 use crate::{
     CONFIG,
     api::{
-        AnonymousNotify, ApiResult, EmptyResult, JsonResult, LogOutReason, Notify, PasswordOrOtpData,
+        AnonymousNotify, ApiResult, EmptyResult, JsonResult, LogOutReason, Notify, PasswordOrOtpData, UpdateType,
         core::{accept_org_invite, log_user_event, two_factor::email},
-        master_password_policy, push_logout_to_relay, register_push_device, unregister_push_device,
+        master_password_policy, register_push_device, unregister_push_device,
     },
     auth::{ClientHeaders, ClientIp, Headers, decode_delete, decode_invite, decode_verify_email},
     crypto,
@@ -32,8 +32,8 @@ use crate::{
 };
 
 use super::{
-    ciphers::{CipherData, rotate_cipher_data, validate_rotated_cipher},
-    sends::SendData,
+    ciphers::{CipherData, update_cipher_from_data},
+    sends::{SendData, update_send_from_data},
 };
 
 pub fn routes() -> Vec<rocket::Route> {
@@ -64,6 +64,7 @@ pub fn routes() -> Vec<rocket::Route> {
         delete_account,
         revision_date,
         password_hint,
+        post_prelogin,
         verify_password,
         post_api_key,
         rotate_api_key,
@@ -97,15 +98,6 @@ pub struct KDFData {
     kdf_parallelism: Option<i32>,
 }
 
-impl KDFData {
-    pub(super) fn matches_user(&self, user: &User) -> bool {
-        self.kdf == user.client_kdf_type
-            && self.kdf_iterations == user.client_kdf_iter
-            && self.kdf_memory == user.client_kdf_memory
-            && self.kdf_parallelism == user.client_kdf_parallelism
-    }
-}
-
 #[derive(Debug, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct RegisterData {
@@ -122,8 +114,11 @@ pub struct RegisterData {
 
     master_password_hint: Option<String>,
 
+    name: Option<String>,
+
     organization_user_id: Option<MembershipId>,
 
+    // Used only from the register/finish endpoint
     email_verification_token: Option<String>,
     accept_emergency_access_id: Option<EmergencyAccessId>,
     accept_emergency_access_invite_token: Option<String>,
@@ -146,9 +141,7 @@ struct RegisterDataOld {
 #[derive(Debug, Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct RegisterDataCur {
-    #[serde(alias = "MasterPasswordAuthentication")]
     master_password_authentication: MasterPasswordAuthentication,
-    #[serde(alias = "MasterPasswordUnlock")]
     master_password_unlock: MasterPasswordUnlock,
 }
 
@@ -215,21 +208,17 @@ struct KeysData {
     public_key: String,
 }
 
-/// Upstream's implicit `[Required]` on a non-nullable string: present and not blank.
-fn required(value: Option<String>, field: &str) -> ApiResult<String> {
-    match value {
-        Some(value) if !value.trim().is_empty() => Ok(value),
-        _ => err!(format!("The {field} field is required.")),
-    }
-}
-
-/// The `accountKeys` payload: a v1 key pair, or v2 with a signature key pair and security state.
+/// The `accountKeys` payload, which replaces the flat `keys`/`userAsymmetricKeys` object.
 ///
-/// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Core/KeyManagement/Models/Api/Request/AccountKeysRequestModel.cs#L6-L50>
+/// It carries either a "v1" state (just the encryption key pair) or a "v2" one, which adds a
+/// signature key pair, a signed public key, and a signed security state. The two deprecated
+/// top-level fields are still sent by the SDK alongside the nested ones and are only used as a
+/// fallback for clients that don't send `publicKeyEncryptionKeyPair` yet.
+///
+/// Ref: <https://github.com/bitwarden/server/blob/main/src/Core/KeyManagement/Models/Api/Request/AccountKeysRequestModel.cs>
 #[derive(Debug, Deserialize)]
 #[serde(rename_all = "camelCase")]
-struct AccountKeysData {
-    // Required like upstream, but only used without `public_key_encryption_key_pair`
+pub struct AccountKeysData {
     user_key_encrypted_account_private_key: Option<String>,
     account_public_key: Option<String>,
 
@@ -261,7 +250,7 @@ struct SecurityStateData {
     security_version: i32,
 }
 
-struct ValidatedAccountKeys {
+pub struct ValidatedAccountKeys {
     private_key: String,
     public_key: String,
     v2: Option<ValidatedV2AccountKeys>,
@@ -277,43 +266,28 @@ struct ValidatedV2AccountKeys {
 }
 
 impl AccountKeysData {
-    /// Upstream's model checks, plus the v2 fields all or none: no client can unlock a partial v2 state.
-    fn validate(self) -> ApiResult<ValidatedAccountKeys> {
-        let top_private_key =
-            required(self.user_key_encrypted_account_private_key, "UserKeyEncryptedAccountPrivateKey")?;
-        let top_public_key = required(self.account_public_key, "AccountPublicKey")?;
-        let (private_key, public_key, signed_public_key) = match self.public_key_encryption_key_pair {
-            Some(key_pair) => (
-                required(Some(key_pair.wrapped_private_key), "WrappedPrivateKey")?,
-                required(Some(key_pair.public_key), "PublicKey")?,
-                key_pair.signed_public_key,
-            ),
-            // Older clients only send the top-level fields, which are always v1
-            None => (top_private_key, top_public_key, None),
+    /// Checks that the payload describes a complete account cryptographic state.
+    ///
+    /// The v2 fields have to be all present or all absent: a client that receives a COSE-wrapped
+    /// private key without the matching signature key pair and security state refuses to unlock the
+    /// vault, so storing half a state would produce an account nobody can log into.
+    pub fn validate(self) -> ApiResult<ValidatedAccountKeys> {
+        let (private_key, public_key, signed_public_key) = if let Some(key_pair) = self.public_key_encryption_key_pair {
+            (key_pair.wrapped_private_key, key_pair.public_key, key_pair.signed_public_key)
+        // Older clients only send the deprecated top-level fields, which are always v1.
+        } else if let (Some(private_key), Some(public_key)) =
+            (self.user_key_encrypted_account_private_key, self.account_public_key)
+        {
+            (private_key, public_key, None)
+        } else {
+            err!("The account keys are missing an encryption key pair")
         };
 
-        if let Some(signature_key_pair) = &self.signature_key_pair {
-            required(Some(signature_key_pair.signature_algorithm.clone()), "SignatureAlgorithm")?;
-            required(Some(signature_key_pair.wrapped_signing_key.clone()), "WrappedSigningKey")?;
-            required(Some(signature_key_pair.verifying_key.clone()), "VerifyingKey")?;
-        }
-        if let Some(security_state) = &self.security_state {
-            required(Some(security_state.security_state.clone()), "SecurityState")?;
-            if security_state.security_state.encode_utf16().count() > 10_000 {
-                err!("The field SecurityState must be a string with a maximum length of 10000.")
-            }
-        }
-
         let v2 = match (signed_public_key, self.signature_key_pair, self.security_state) {
             (Some(signed_public_key), Some(signature_key_pair), Some(security_state)) => {
-                // Upstream fails on a null one, but takes an empty one that no client can unlock with
-                let signed_public_key = required(Some(signed_public_key), "SignedPublicKey")?;
                 let Some(signature_algorithm) = SignatureAlgorithm::parse(&signature_key_pair.signature_algorithm)
                 else {
-                    err!(format!(
-                        "Unsupported signature algorithm: {}",
-                        signature_key_pair.signature_algorithm.escape_debug()
-                    ))
+                    err!(format!("Unsupported signature algorithm: {}", signature_key_pair.signature_algorithm))
                 };
 
                 Some(ValidatedV2AccountKeys {
@@ -340,13 +314,15 @@ impl AccountKeysData {
 }
 
 impl WrappedAccountCryptographicState {
-    /// v2-only: the nested pair stands in for the top-level keys, so a partial state can't pass as v1.
+    /// This shape is v2-only: the key pairs and security state were already required by the
+    /// deserializer, so a missing signed public key fails the all-or-nothing check in
+    /// [`AccountKeysData::validate`] rather than falling back to v1, which would silently turn a
+    /// rotation into a downgrade.
     fn validate(self) -> ApiResult<ValidatedAccountKeys> {
-        let key_pair = self.public_key_encryption_key_pair;
         AccountKeysData {
-            user_key_encrypted_account_private_key: Some(key_pair.wrapped_private_key.clone()),
-            account_public_key: Some(key_pair.public_key.clone()),
-            public_key_encryption_key_pair: Some(key_pair),
+            user_key_encrypted_account_private_key: None,
+            account_public_key: None,
+            public_key_encryption_key_pair: Some(self.public_key_encryption_key_pair),
             signature_key_pair: Some(self.signature_key_pair),
             security_state: Some(self.security_state),
         }
@@ -365,30 +341,28 @@ impl From<KeysData> for ValidatedAccountKeys {
 }
 
 impl ValidatedAccountKeys {
-    /// The keys of a registration: `accountKeys` only for a v2 account, like upstream.
-    ///
-    /// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Core/Auth/Models/Api/Request/Accounts/RegisterFinishRequestModel.cs#L77-L100>
-    fn for_registration(account_keys: Option<AccountKeysData>, keys: Option<KeysData>) -> ApiResult<Self> {
-        if let Some(account_keys) = account_keys {
-            let account_keys = account_keys.validate()?;
-            if account_keys.is_v2() {
-                return Ok(account_keys);
-            }
+    /// The keys of a request that may carry either shape. `accountKeys` supersedes the flat `keys`
+    /// object when both are sent.
+    fn from_request(account_keys: Option<AccountKeysData>, keys: Option<KeysData>) -> ApiResult<Option<Self>> {
+        match (account_keys, keys) {
+            (Some(account_keys), _) => account_keys.validate().map(Some),
+            (None, keys) => Ok(keys.map(Self::from)),
         }
-        let Some(keys) = keys else {
-            err!("PublicKey and WrappedPrivateKey not found in RequestModel")
-        };
-        Ok(keys.into())
     }
 
     fn is_v2(&self) -> bool {
         self.v2.is_some()
     }
 
-    /// Sets the keys on the user. Save [`Self::save_signature_key_pair`] before the user: a v2 user without its key
-    /// pair can't unlock, while a key pair saved for a user who isn't v2 yet is ignored until it is, and replaced on
-    /// the next try. A rotation of a v2 account replaces its key pair, see `rotate_account`.
-    fn apply(&self, user: &mut User) -> EmptyResult {
+    /// Writes the parts of the state that live on the user itself. The user still needs saving, and
+    /// [`Self::save_signature_key_pair`] still needs calling once it has been.
+    ///
+    /// Rejects downgrading an account from v2 back to v1.
+    pub fn apply(&self, user: &mut User) -> EmptyResult {
+        if user.is_v2() && self.v2.is_none() {
+            err!("Cannot downgrade an account from v2 to v1 encryption")
+        }
+
         user.private_key = Some(self.private_key.clone());
         user.public_key = Some(self.public_key.clone());
 
@@ -399,8 +373,9 @@ impl ValidatedAccountKeys {
         Ok(())
     }
 
-    /// Saves the signature key pair, which needs the user to exist for its foreign key.
-    async fn save_signature_key_pair(&self, user_id: &UserId, conn: &DbConn) -> EmptyResult {
+    /// Persists the signature key pair. Separate from [`Self::apply`] because the row has a foreign
+    /// key to the user, so it can only be written once the user exists.
+    pub async fn save_signature_key_pair(&self, user_id: &UserId, conn: &DbConn) -> EmptyResult {
         // Skip if the account is v1, since v1 accounts don't have a signature key pair.
         let Some(v2) = &self.v2 else {
             return Ok(());
@@ -427,12 +402,10 @@ impl ValidatedAccountKeys {
 #[derive(Debug, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct MasterPasswordAuthentication {
-    #[serde(alias = "Kdf")]
     kdf: KDFData,
-    #[serde(alias = "Salt")]
     salt: String,
 
-    #[serde(alias = "masterPasswordAuthenticationHash", alias = "MasterPasswordAuthenticationHash")]
+    #[serde(alias = "masterPasswordAuthenticationHash")]
     hash: String,
 }
 
@@ -491,11 +464,12 @@ async fn is_email_2fa_required(member_id: Option<MembershipId>, conn: &DbConn) -
     false
 }
 
-pub async fn register(data: Json<RegisterData>, conn: DbConn) -> JsonResult {
-    let data: RegisterData = data.into_inner();
+pub async fn register(data: Json<RegisterData>, email_verification: bool, conn: DbConn) -> JsonResult {
+    let mut data: RegisterData = data.into_inner();
     let email = data.email.to_lowercase();
 
-    let mut name = None;
+    let mut email_verified = false;
+
     let mut pending_emergency_access = None;
 
     if data.compat.unprocessable(&data.email) {
@@ -503,65 +477,69 @@ pub async fn register(data: Json<RegisterData>, conn: DbConn) -> JsonResult {
     }
 
     // First, validate the provided verification tokens
-    let mut email_verified = match (
-        &data.email_verification_token,
-        &data.accept_emergency_access_id,
-        &data.accept_emergency_access_invite_token,
-        &data.organization_user_id,
-        &data.org_invite_token,
-    ) {
-        // Normal user registration, when email verification is required
-        (Some(email_verification_token), None, None, None, None) => {
-            let claims = crate::auth::decode_register_verify(email_verification_token)?;
-            if claims.sub != data.email {
-                err!("Email verification token does not match email");
+    if email_verification {
+        match (
+            &data.email_verification_token,
+            &data.accept_emergency_access_id,
+            &data.accept_emergency_access_invite_token,
+            &data.organization_user_id,
+            &data.org_invite_token,
+        ) {
+            // Normal user registration, when email verification is required
+            (Some(email_verification_token), None, None, None, None) => {
+                let claims = crate::auth::decode_register_verify(email_verification_token)?;
+                if claims.sub != data.email {
+                    err!("Email verification token does not match email");
+                }
+
+                // During this call we don't get the name, so extract it from the claims
+                if claims.name.is_some() {
+                    data.name = claims.name;
+                }
+                email_verified = claims.verified;
+            }
+            // Emergency access registration
+            (None, Some(accept_emergency_access_id), Some(accept_emergency_access_invite_token), None, None) => {
+                if !CONFIG.emergency_access_allowed() {
+                    err!("Emergency access is not enabled.")
+                }
+
+                let claims = crate::auth::decode_emergency_access_invite(accept_emergency_access_invite_token)?;
+
+                if claims.email != data.email {
+                    err!("Claim email does not match email")
+                }
+                if &claims.emer_id != accept_emergency_access_id {
+                    err!("Claim emer_id does not match accept_emergency_access_id")
+                }
+
+                pending_emergency_access = Some((accept_emergency_access_id, claims));
+                email_verified = true;
+            }
+            // Org invite
+            (None, None, None, Some(organization_user_id), Some(org_invite_token)) => {
+                let claims = decode_invite(org_invite_token)?;
+
+                if claims.email != data.email {
+                    err!("Claim email does not match email")
+                }
+
+                if &claims.member_id != organization_user_id {
+                    err!("Claim org_user_id does not match organization_user_id")
+                }
+
+                email_verified = true;
             }
 
-            // During this call we don't get the name, so extract it from the claims
-            name = claims.name;
-            claims.verified
+            _ => {
+                err!("Registration is missing required parameters")
+            }
         }
-        // Emergency access registration
-        (None, Some(accept_emergency_access_id), Some(accept_emergency_access_invite_token), None, None) => {
-            if !CONFIG.emergency_access_allowed() {
-                err!("Emergency access is not enabled.")
-            }
-
-            let claims = crate::auth::decode_emergency_access_invite(accept_emergency_access_invite_token)?;
-
-            if claims.email != data.email {
-                err!("Claim email does not match email")
-            }
-            if &claims.emer_id != accept_emergency_access_id {
-                err!("Claim emer_id does not match accept_emergency_access_id")
-            }
-
-            pending_emergency_access = Some((accept_emergency_access_id, claims));
-            true
-        }
-        // Org invite
-        (None, None, None, Some(organization_user_id), Some(org_invite_token)) => {
-            let claims = decode_invite(org_invite_token)?;
-
-            if claims.email != data.email {
-                err!("Claim email does not match email")
-            }
-
-            if &claims.member_id != organization_user_id {
-                err!("Claim org_user_id does not match organization_user_id")
-            }
-
-            true
-        }
-
-        _ => {
-            err!("Registration is missing required parameters")
-        }
-    };
+    }
 
     // Check if the length of the username exceeds 50 characters (Same is Upstream Bitwarden)
     // This also prevents issues with very long usernames causing to large JWT's. See #2419
-    if let Some(ref name) = name
+    if let Some(ref name) = data.name
         && name.len() > 50
     {
         err!("The field Name must be a string with a maximum length of 50.");
@@ -571,11 +549,9 @@ pub async fn register(data: Json<RegisterData>, conn: DbConn) -> JsonResult {
     // the user can retry without losing their invitation below.
     let password_hint = clean_password_hint(data.master_password_hint.as_ref());
     enforce_password_hint_setting(password_hint.as_ref())?;
-    let account_keys = ValidatedAccountKeys::for_registration(data.account_keys, data.keys)?;
+    let account_keys = ValidatedAccountKeys::from_request(data.account_keys, data.keys)?;
 
-    let existing_user = User::find_by_mail(&email, &conn).await;
-    let is_new_user = existing_user.is_none();
-    let mut user = match existing_user {
+    let mut user = match User::find_by_mail(&email, &conn).await {
         Some(user) => {
             if !user.password_hash.is_empty() {
                 err!("Registration not allowed or user already exists")
@@ -626,14 +602,17 @@ pub async fn register(data: Json<RegisterData>, conn: DbConn) -> JsonResult {
     user.password_hint = password_hint;
 
     // Add extra fields if present
-    if let Some(name) = name {
+    if let Some(name) = data.name {
         user.name = name;
     }
 
-    account_keys.apply(&mut user)?;
-    // Like upstream, only a v2 registration records the key id; v1 accounts report it through `user-key-id`
-    if account_keys.is_v2() {
-        user.key_id = data.compat.key_id();
+    if let Some(ref account_keys) = account_keys {
+        account_keys.apply(&mut user)?;
+        // Like upstream, only a v2 registration records the user key id. A v1 account reports it
+        // later, through `user-key-id`.
+        if account_keys.is_v2() {
+            user.key_id = data.compat.key_id();
+        }
     }
 
     if email_verified {
@@ -655,16 +634,12 @@ pub async fn register(data: Json<RegisterData>, conn: DbConn) -> JsonResult {
         }
     }
 
-    // The key pair first, as in a rotation, but its foreign key needs the user: a new one is saved before without a
-    // password or keys, like an invited user, so a failure in between leaves a registration that can be retried.
-    if is_new_user && account_keys.is_v2() {
-        let mut unregistered = User::new(&user.email, None);
-        unregistered.uuid.clone_from(&user.uuid);
-        unregistered.save(&conn).await?;
-    }
-    account_keys.save_signature_key_pair(&user.uuid, &conn).await?;
     user.save(&conn).await?;
 
+    if let Some(account_keys) = account_keys {
+        account_keys.save_signature_key_pair(&user.uuid, &conn).await?;
+    }
+
     // accept any open emergency access invitations
     if !CONFIG.mail_enabled() && CONFIG.emergency_access_allowed() {
         for mut emergency_invite in EmergencyAccess::find_all_invited_by_grantee_email(&user.email, &conn).await {
@@ -673,48 +648,17 @@ pub async fn register(data: Json<RegisterData>, conn: DbConn) -> JsonResult {
     }
 
     Ok(Json(json!({
-      "object": "registerFinish",
+      "object": "register",
+      "captchaBypassToken": "",
     })))
 }
 
-/// Upstream's shape checks of the set-password body, on the raw JSON that the untagged compat would hide.
-///
-/// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Api/Auth/Models/Request/Accounts/SetInitialPasswordRequestModel.cs#L75-L106>
-fn validate_set_password_shape(body: &Value) -> EmptyResult {
-    let has = |name: &str| {
-        body.as_object().is_some_and(|o| o.iter().any(|(k, v)| k.eq_ignore_ascii_case(name) && !v.is_null()))
-    };
-
-    if has("accountKeys") && has("keys") {
-        err!("Cannot specify both AccountKeys and Keys. Provide exactly one keypair.")
-    }
-    let (authentication, unlock) = (has("masterPasswordAuthentication"), has("masterPasswordUnlock"));
-    if authentication != unlock {
-        err!(
-            "Must provide both MasterPasswordAuthentication and MasterPasswordUnlock together. Cannot provide one without the other."
-        )
-    }
-    if authentication && (has("masterPasswordHash") || has("key") || has("kdf")) {
-        err!(
-            "Cannot mix modern (MasterPasswordAuthentication/MasterPasswordUnlock) and legacy (MasterPasswordHash/Key/Kdf) fields. Provide one shape or the other."
-        )
-    }
-    Ok(())
-}
-
 #[post("/accounts/set-password", data = "<data>")]
-async fn post_set_password(data: Json<Value>, headers: Headers, conn: DbConn) -> JsonResult {
-    let data = data.into_inner();
-    validate_set_password_shape(&data)?;
-    let Ok(data) = serde_json::from_value::<SetPasswordData>(data) else {
-        err_code!("Unexpected SetPasswordData format", Status::UnprocessableEntity.code)
-    };
-    if data.master_password_hint.as_ref().is_some_and(|h| h.encode_utf16().count() > 50) {
-        err!("The field MasterPasswordHint must be a string with a maximum length of 50.")
-    }
+async fn post_set_password(data: Json<SetPasswordData>, headers: Headers, conn: DbConn) -> JsonResult {
+    let data: SetPasswordData = data.into_inner();
     let mut user = headers.user;
 
-    if user.private_key.is_some() || !user.password_hash.is_empty() {
+    if user.private_key.is_some() {
         err!("Account already initialized, cannot set password")
     }
 
@@ -727,25 +671,7 @@ async fn post_set_password(data: Json<Value>, headers: Headers, conn: DbConn) ->
     let password_hint = clean_password_hint(data.master_password_hint.as_ref());
     enforce_password_hint_setting(password_hint.as_ref())?;
 
-    // Like upstream, `accountKeys` only through the v2 JIT flow
-    // Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Api/Auth/Controllers/AccountsController.cs#L314-L359>
-    let account_keys = match data.account_keys {
-        Some(account_keys) => {
-            if !matches!(data.compat, RegisterDataCompat::RegisterDataCur(_))
-                || !crate::util::is_client_feature_flag_enabled(
-                    "enable-account-encryption-v2-jit-password-registration",
-                )
-            {
-                err!("Request includes V2 AccountKeys but V2 encryption is not enabled.")
-            }
-            let account_keys = account_keys.validate()?;
-            if !account_keys.is_v2() {
-                err!("AccountKeys are only supported for V2 encryption.")
-            }
-            Some(account_keys)
-        }
-        None => data.keys.map(ValidatedAccountKeys::from),
-    };
+    let account_keys = ValidatedAccountKeys::from_request(data.account_keys, data.keys)?;
 
     set_kdf_data(&mut user, data.compat.kdf())?;
 
@@ -788,16 +714,18 @@ async fn post_set_password(data: Json<Value>, headers: Headers, conn: DbConn) ->
         Membership::accept_user_invitations(&user.uuid, &conn).await?;
     }
 
-    log_user_event(EventType::UserChangedPassword, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
+    log_user_event(EventType::UserChangedPassword as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn)
+        .await;
+
+    user.save(&conn).await?;
 
-    // The key pair first, as in a rotation: if saving the user then fails, the password isn't set either
     if let Some(account_keys) = account_keys {
         account_keys.save_signature_key_pair(&user.uuid, &conn).await?;
     }
-    user.save(&conn).await?;
 
     Ok(Json(json!({
       "object": "set-password",
+      "captchaBypassToken": "",
     })))
 }
 
@@ -891,26 +819,20 @@ async fn get_account_public_keys(user_id: UserId, _headers: Headers, conn: DbCon
 async fn get_keys(headers: Headers, conn: DbConn) -> JsonResult {
     let user = headers.user;
 
-    // The SDK reads a 404 as the user having no key pair yet
-    if user.private_key.is_none() || user.public_key.is_none() {
-        err_code!("User has no key pair", Status::NotFound.code)
-    }
-
     Ok(Json(json!({
-        "key": (!user.akey.is_empty()).then_some(&user.akey),
-        "publicKey": user.public_key,
+        "key": user.akey,
         "privateKey": user.private_key,
+        "publicKey": user.public_key,
         "accountKeys": user.account_keys_json(&conn).await,
-        "object": "keys",
+        "object": "keys"
     })))
 }
 
 #[derive(Debug, Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct PostKeysData {
-    // Required like upstream, even next to `accountKeys`
-    public_key: Option<String>,
-    encrypted_private_key: Option<String>,
+    #[serde(flatten)]
+    keys: Option<KeysData>,
     account_keys: Option<AccountKeysData>,
     // The id of the user key these account keys belong to, only honored for v2 `accountKeys`
     user_key_id: Option<KeyId>,
@@ -922,18 +844,15 @@ async fn post_keys(data: Json<PostKeysData>, headers: Headers, conn: DbConn) ->
 
     let mut user = headers.user;
 
-    // Only for an account without keys, replacing them is what a key rotation does
+    // This only sets the keys of an account that has none yet. Replacing existing ones is what a key
+    // rotation does, with the checks that go with it.
     if user.private_key.is_some() || user.public_key.is_some() {
         err!("User has existing keypair")
     }
 
-    // Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Core/Auth/Models/Api/Request/Accounts/KeysRequestModel.cs#L11-L19>
-    let public_key = required(data.public_key, "PublicKey")?;
-    let encrypted_private_key = required(data.encrypted_private_key, "EncryptedPrivateKey")?;
-
-    // `accountKeys` supersedes the flat keys when both are sent
-    let account_keys = match data.account_keys {
-        Some(account_keys) => {
+    // `accountKeys` supersedes the flat `keys` object when both are sent.
+    let account_keys = match (data.account_keys, data.keys) {
+        (Some(account_keys), _) => {
             let account_keys = account_keys.validate()?;
             if !account_keys.is_v2() {
                 err!("AccountKeys are only supported for V2 encryption.")
@@ -944,20 +863,16 @@ async fn post_keys(data: Json<PostKeysData>, headers: Headers, conn: DbConn) ->
             }
             account_keys
         }
-        None => KeysData {
-            encrypted_private_key,
-            public_key,
-        }
-        .into(),
+        (None, Some(keys)) => keys.into(),
+        (None, None) => err!("No account keys provided"),
     };
 
     account_keys.apply(&mut user)?;
-    // The key pair first, as in a rotation: if saving the user then fails, the account stays without keys
-    account_keys.save_signature_key_pair(&user.uuid, &conn).await?;
     user.save(&conn).await?;
+    account_keys.save_signature_key_pair(&user.uuid, &conn).await?;
 
     Ok(Json(json!({
-        "key": (!user.akey.is_empty()).then_some(&user.akey),
+        "key": user.akey,
         "privateKey": user.private_key,
         "publicKey": user.public_key,
         "accountKeys": user.account_keys_json(&conn).await,
@@ -987,7 +902,8 @@ async fn post_password(data: Json<ChangePassData>, headers: Headers, conn: DbCon
         err!("Invalid password")
     }
 
-    log_user_event(EventType::UserChangedPassword, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
+    log_user_event(EventType::UserChangedPassword as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn)
+        .await;
 
     let (new_master_password_hash, new_key) =
         if let (Some(unlock_data), Some(authentication_data)) = (data.unlock_data, data.authentication_data) {
@@ -995,8 +911,7 @@ async fn post_password(data: Json<ChangePassData>, headers: Headers, conn: DbCon
                 err!("KDF settings must be equal for authentication and unlock")
             }
 
-            let salt = user.master_password_salt();
-            if salt != authentication_data.salt || salt != unlock_data.salt {
+            if user.email != authentication_data.salt || user.email != unlock_data.salt {
                 err!("Invalid master password salt")
             }
 
@@ -1075,41 +990,26 @@ fn set_kdf_data(user: &mut User, data: &KDFData) -> EmptyResult {
 
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub(super) struct AuthenticationData {
-    #[serde(alias = "Salt")]
+struct AuthenticationData {
     salt: String,
-    #[serde(alias = "Kdf")]
-    pub(super) kdf: KDFData,
-    #[serde(alias = "MasterPasswordAuthenticationHash")]
-    pub(super) master_password_authentication_hash: String,
-}
-
-impl AuthenticationData {
-    pub(super) fn check(&self, user: &User, unlock: &UnlockData) -> EmptyResult {
-        if self.kdf != unlock.kdf {
-            err!("KDF settings must be equal for authentication and unlock")
-        }
-
-        if self.salt != user.master_password_salt() || self.salt != unlock.salt {
-            err!("Invalid master password salt")
-        }
-
-        Ok(())
-    }
+    kdf: KDFData,
+    master_password_authentication_hash: String,
 }
 
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub(super) struct UnlockData {
+struct UnlockData {
     salt: String,
     kdf: KDFData,
-    pub(super) master_key_wrapped_user_key: String,
+    master_key_wrapped_user_key: String,
     contained_key_id: Option<KeyId>,
 }
 
-/// A password or KDF change keeps the user key, so its key id must be the current one, when both are known.
+/// A password or KDF change re-wraps the same user key, so a key id sent with it has to be the
+/// current one. Either may be missing: from a client that predates key ids, or a user whose key id
+/// isn't known yet. There is nothing to compare in those cases.
 ///
-/// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Core/KeyManagement/Models/Data/MasterPasswordUnlockData.cs#L27-L47>
+/// Ref: <https://github.com/bitwarden/server/blob/main/src/Core/KeyManagement/Models/Data/MasterPasswordUnlockData.cs>
 fn validate_key_id_unchanged(user: &User, unlock_data: &UnlockData) -> EmptyResult {
     if let (Some(current), Some(contained)) = (&user.key_id, &unlock_data.contained_key_id)
         && current != contained
@@ -1119,17 +1019,6 @@ fn validate_key_id_unchanged(user: &User, unlock_data: &UnlockData) -> EmptyResu
     Ok(())
 }
 
-/// A rotation's unlock data has to wrap the new user key. Neither id is sent by clients that predate them.
-///
-/// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Core/KeyManagement/Models/Data/MasterPasswordUnlockData.cs#L49-L61>
-fn validate_contained_key_id(contained_key_id: Option<&KeyId>, new_user_key_id: Option<&KeyId>) -> EmptyResult {
-    match (contained_key_id, new_user_key_id) {
-        (None, None) => Ok(()),
-        (Some(contained), Some(new)) if contained == new => Ok(()),
-        _ => err!("Invalid user key sent in master-password unlock data."),
-    }
-}
-
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct ChangeKdfData {
@@ -1146,7 +1035,13 @@ async fn post_kdf(data: Json<ChangeKdfData>, headers: Headers, conn: DbConn, nt:
         err!("Invalid password")
     }
 
-    data.authentication_data.check(&headers.user, &data.unlock_data)?;
+    if data.authentication_data.kdf != data.unlock_data.kdf {
+        err!("KDF settings must be equal for authentication and unlock")
+    }
+
+    if headers.user.email != data.authentication_data.salt || headers.user.email != data.unlock_data.salt {
+        err!("Invalid master password salt")
+    }
 
     validate_key_id_unchanged(&headers.user, &data.unlock_data)?;
 
@@ -1184,9 +1079,7 @@ struct UpdateFolderData {
 #[serde(rename_all = "camelCase")]
 struct UpdateEmergencyAccessData {
     id: EmergencyAccessId,
-    key_encrypted: Option<String>,
-    // Only validated, upstream doesn't store it either
-    wait_time_days: Option<i32>,
+    key_encrypted: String,
 }
 
 #[derive(Deserialize)]
@@ -1204,7 +1097,6 @@ struct KeyData {
     account_keys: AccountKeysData,
     account_data: RotateAccountData,
     old_master_key_authentication_hash: String,
-    old_user_key_id: Option<KeyId>,
     new_user_key_id: Option<KeyId>,
 }
 
@@ -1224,27 +1116,27 @@ struct MasterPasswordUnlockData {
     email: String,
     master_key_authentication_hash: String,
     master_key_encrypted_user_key: String,
-    master_password_hint: Option<String>,
-    master_password_salt: Option<String>,
     contained_key_id: Option<KeyId>,
 }
 
-/// The unlock data of both rotation endpoints; passkey and device keys are ignored, as we support neither.
+/// The unlock data both rotation endpoints share. Vaultwarden has neither trusted device encryption
+/// nor passkey login, so `key-rotation-data` reports none of either and these must arrive empty.
 ///
-/// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Api/KeyManagement/Models/Requests/CommonUnlockDataRequestModel.cs#L7-L14>
+/// Ref: <https://github.com/bitwarden/server/blob/main/src/Api/KeyManagement/Models/Requests/CommonUnlockDataRequestModel.cs>
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct CommonUnlockData {
     emergency_access_unlock_data: Vec<UpdateEmergencyAccessData>,
     organization_account_recovery_unlock_data: Vec<UpdateResetPasswordData>,
-    #[expect(dead_code, reason = "Required like upstream, but unused")]
+    #[serde(default)]
     passkey_unlock_data: Vec<Value>,
-    #[expect(dead_code, reason = "Required like upstream, but unused")]
+    #[serde(default)]
     device_key_unlock_data: Vec<Value>,
     v2_upgrade_token: Option<V2UpgradeTokenData>,
 }
 
-/// Lets other sessions with the v1 user key unwrap the v2 one after an upgrade. Opaque to us.
+/// Lets clients that still hold the v1 user key derive the v2 one after another client upgraded the
+/// account, so a v1 -> v2 upgrade doesn't have to log every other session out. Opaque to us.
 #[derive(Deserialize, Serialize)]
 #[serde(rename_all = "camelCase")]
 struct V2UpgradeTokenData {
@@ -1268,7 +1160,6 @@ struct RotateUserKeysData {
     unlock_data: CommonUnlockData,
     account_data: RotateAccountData,
     unlock_method_data: UnlockMethodData,
-    old_user_key_id: Option<KeyId>,
     new_user_key_id: Option<KeyId>,
 }
 
@@ -1285,11 +1176,32 @@ struct WrappedAccountCryptographicState {
 #[serde(rename_all = "camelCase")]
 struct UnlockMethodData {
     unlock_method: i32,
-    master_password_unlock_data: Option<UnlockData>,
-    key_connector_key_wrapped_user_key: Option<String>,
+    master_password_unlock_data: Option<RotateMasterPasswordUnlockData>,
+    // `keyConnectorKeyWrappedUserKey` is deliberately not read: that unlock method is rejected.
 }
 
-/// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Api/KeyManagement/Enums/UnlockMethod.cs#L3-L8>
+#[derive(Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct RotateMasterPasswordUnlockData {
+    kdf: KDFData,
+    salt: String,
+    master_key_wrapped_user_key: String,
+    contained_key_id: Option<KeyId>,
+}
+
+/// The user key wrapped in the master password unlock data has to be the new one.
+///
+/// Ref: <https://github.com/bitwarden/server/blob/main/src/Core/KeyManagement/Models/Data/MasterPasswordUnlockData.cs>
+fn validate_contained_key_id(contained_key_id: Option<&KeyId>, new_user_key_id: Option<&KeyId>) -> EmptyResult {
+    match (contained_key_id, new_user_key_id) {
+        // Neither is sent by clients that predate key ids
+        (None, None) => Ok(()),
+        (Some(contained), Some(new)) if contained == new => Ok(()),
+        _ => err!("Invalid user key sent in master-password unlock data."),
+    }
+}
+
+/// Ref: <https://github.com/bitwarden/server/blob/main/src/Api/KeyManagement/Enums/UnlockMethod.cs>
 #[derive(num_derive::FromPrimitive)]
 enum UnlockMethod {
     Tde = 0,
@@ -1297,9 +1209,14 @@ enum UnlockMethod {
     KeyConnector = 2,
 }
 
-/// The rotation checks on the new keys: the public key never changes, nor the verifying key of a v2 account.
+/// The rotation-specific checks on the new account keys.
 ///
-/// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Core/KeyManagement/UserKey/Implementations/RotateUserAccountKeysCommand.cs#L192-L287>
+/// A rotation re-wraps the existing keys under a new user key; it must not swap the identity the
+/// account presents to others. So the public key never changes, and for an account that is already
+/// v2 the verifying key doesn't either — only the *wrapped* signing key does. A v1 account may gain
+/// a signature key pair, which is the v1 -> v2 upgrade.
+///
+/// Ref: <https://github.com/bitwarden/server/blob/main/src/Core/KeyManagement/UserKey/Implementations/RotateUserAccountKeysCommand.cs>
 async fn validate_rotation_account_keys(keys: &ValidatedAccountKeys, user: &User, conn: &DbConn) -> EmptyResult {
     if user.public_key.as_ref() != Some(&keys.public_key) {
         err!("Changing the asymmetric keypair is not possible during key rotation")
@@ -1362,7 +1279,8 @@ impl KDFData {
     }
 }
 
-/// Every existing item must be in the rotation, or it would be unreadable afterwards.
+/// A rotation re-encrypts everything under the new user key, so anything left out would be
+/// unreadable afterwards. Both rotation endpoints require the client to send the complete set.
 fn validate_rotation_data(
     data: &RotateData,
     existing_ciphers: &[Cipher],
@@ -1371,10 +1289,11 @@ fn validate_rotation_data(
     existing_memberships: &[Membership],
     existing_sends: &[Send],
 ) -> EmptyResult {
+    let account_data = &data.account_data;
+
     // Check that we're correctly rotating all the user's ciphers
     let existing_cipher_ids = existing_ciphers.iter().map(|c| &c.uuid).collect::<HashSet<&CipherId>>();
-    let provided_cipher_ids = data
-        .account_data
+    let provided_cipher_ids = account_data
         .ciphers
         .iter()
         .filter(|c| c.organization_id.is_none())
@@ -1386,8 +1305,7 @@ fn validate_rotation_data(
 
     // Check that we're correctly rotating all the user's folders
     let existing_folder_ids = existing_folders.iter().map(|f| &f.uuid).collect::<HashSet<&FolderId>>();
-    let provided_folder_ids =
-        data.account_data.folders.iter().filter_map(|f| f.id.as_ref()).collect::<HashSet<&FolderId>>();
+    let provided_folder_ids = account_data.folders.iter().filter_map(|f| f.id.as_ref()).collect::<HashSet<&FolderId>>();
     if !provided_folder_ids.is_superset(&existing_folder_ids) {
         err!("All existing folders must be included in the rotation")
     }
@@ -1416,7 +1334,7 @@ fn validate_rotation_data(
 
     // Check that we're correctly rotating all the user's sends
     let existing_send_ids = existing_sends.iter().map(|s| &s.uuid).collect::<HashSet<&SendId>>();
-    let provided_send_ids = data.account_data.sends.iter().filter_map(|s| s.id.as_ref()).collect::<HashSet<&SendId>>();
+    let provided_send_ids = account_data.sends.iter().filter_map(|s| s.id.as_ref()).collect::<HashSet<&SendId>>();
     if !provided_send_ids.is_superset(&existing_send_ids) {
         err!("All existing sends must be included in the rotation")
     }
@@ -1424,9 +1342,14 @@ fn validate_rotation_data(
     Ok(())
 }
 
-/// The keys a rotation re-shares the new user key with. The SDK needs all four lists, even when empty.
+/// The public keys and encrypted keysets that participate in a key rotation, so the client can
+/// re-share the new user key without having to piece this together from several endpoints.
 ///
-/// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Core/KeyManagement/UserKey/Queries/KeyRotationDataQuery.cs#L14-L122>
+/// The four collections must always be present, even when empty: the SDK errors out if any of them
+/// is missing. `trustedDeviceKeyData` and `passkeyKeyData` are always empty here, since vaultwarden
+/// supports neither trusted device encryption nor passkey (PRF) login.
+///
+/// Ref: <https://github.com/bitwarden/server/blob/main/src/Core/KeyManagement/UserKey/Queries/KeyRotationDataQuery.cs>
 #[get("/accounts/key-management/key-rotation-data")]
 async fn get_key_rotation_data(headers: Headers, conn: DbConn) -> JsonResult {
     let user_id = &headers.user.uuid;
@@ -1490,127 +1413,46 @@ struct RotateData {
     account_keys: ValidatedAccountKeys,
     account_data: RotateAccountData,
     unlock_data: CommonUnlockData,
-    /// The id of the key the client rotates from, `None` from clients that don't send it.
-    old_user_key_id: Option<KeyId>,
-    /// `None` from clients that predate key ids.
+    /// Only v2 (COSE) user keys have an id, so this is `None` for a v1 -> v1 rotation.
     new_user_key_id: Option<KeyId>,
     /// The new user key, wrapped by the master key.
     wrapped_user_key: String,
-    /// Only for `rotate-user-account-keys`: the new password hash and hint.
-    new_password: Option<(String, Option<String>)>,
-}
-
-/// Upstream's `[StringLength(max)]`, which counts UTF-16 code units.
-fn validate_max_length(value: &str, max: usize, field: &str) -> EmptyResult {
-    if value.encode_utf16().count() > max {
-        err!(format!("The field {field} must be a string with a maximum length of {max}."))
-    }
-    Ok(())
-}
-
-impl KDFData {
-    /// Upstream's check that the parameters fit the KDF type.
-    fn validate_parameters(&self) -> EmptyResult {
-        let has_argon2_parameters = (self.kdf_memory.is_some(), self.kdf_parallelism.is_some());
-        if self.kdf == UserKdfType::Pbkdf2 as i32 {
-            if has_argon2_parameters != (false, false) {
-                err!("KdfMemory and KdfParallelism must be null for PBKDF2_SHA256")
-            }
-        } else if self.kdf == UserKdfType::Argon2id as i32 {
-            if has_argon2_parameters != (true, true) {
-                err!("KdfMemory and KdfParallelism must have values for Argon2id")
-            }
-        } else {
-            err!("Invalid KdfType")
-        }
-        Ok(())
-    }
-}
-
-impl MasterPasswordUnlockData {
-    /// Upstream's model validation.
-    ///
-    /// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Api/KeyManagement/Models/Requests/MasterPasswordUnlockDataAndAuthenticationModel.cs#L8-L48>
-    fn validate(&self) -> EmptyResult {
-        self.kdf.validate_parameters()?;
-        if !crate::util::is_valid_email(&self.email) {
-            err!("The Email field is not a supported e-mail address format.")
-        }
-        validate_max_length(&self.email, 256, "Email")?;
-        required(Some(self.master_key_authentication_hash.clone()), "MasterKeyAuthenticationHash")?;
-        validate_max_length(&self.master_key_authentication_hash, 300, "MasterKeyAuthenticationHash")?;
-        required(Some(self.master_key_encrypted_user_key.clone()), "MasterKeyEncryptedUserKey")?;
-        if let Some(hint) = &self.master_password_hint {
-            validate_max_length(hint, 50, "MasterPasswordHint")?;
-        }
-        if self.master_password_salt.as_ref().is_some_and(|salt| salt.encode_utf16().count() > 256) {
-            err!("The field MasterPasswordSalt must be a string or array type with a maximum length of '256'.")
-        }
-        Ok(())
-    }
+    /// Only for `rotate-user-account-keys`, where the master password changes along with the keys.
+    new_password_hash: Option<String>,
 }
 
 impl CommonUnlockData {
-    /// Upstream's model validation.
+    /// We advertise no trusted devices or passkeys in `key-rotation-data`, so a client sending
+    /// either has produced keys for something that doesn't exist here. Silently dropping them would
+    /// leave the client believing an unlock method was rotated when it wasn't.
     fn validate(&self) -> EmptyResult {
-        // Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Api/Auth/Models/Request/EmergencyAccessRequestModels.cs#L32-L39>
-        for emergency_access in &self.emergency_access_unlock_data {
-            if !emergency_access.wait_time_days.is_some_and(|days| (1..=i32::from(i16::MAX)).contains(&days)) {
-                err!("The field WaitTimeDays must be between 1 and 32767.")
-            }
+        if !self.passkey_unlock_data.is_empty() {
+            err!("Passkey unlock is not supported")
         }
-        if let Some(token) = &self.v2_upgrade_token {
-            required(Some(token.wrapped_user_key1.clone()), "WrappedUserKey1")?;
-            required(Some(token.wrapped_user_key2.clone()), "WrappedUserKey2")?;
+        if !self.device_key_unlock_data.is_empty() {
+            err!("Trusted device unlock is not supported")
         }
         Ok(())
     }
 }
 
-/// The model validation of the parts both rotation endpoints share, which upstream runs before anything else.
-fn validate_rotation_request(account_data: &RotateAccountData, unlock_data: &CommonUnlockData) -> EmptyResult {
-    unlock_data.validate()?;
-
-    // Validate the import before continuing
-    // Bitwarden does not process the import if there is one item invalid.
-    // Since we check for the size of the encrypted note length, we need to do that here to pre-validate it.
-    // TODO: See if we can optimize the whole cipher adding/importing and prevent duplicate code and checks.
-    Cipher::validate_cipher_data(&account_data.ciphers)?;
-
-    if account_data.ciphers.iter().any(|cipher| cipher.id.is_none()) {
-        err!("The Id field is required.")
-    }
-    if account_data.sends.iter().any(|send| send.id.is_none()) {
-        err!("The Id field is required.")
-    }
-    Ok(())
-}
-
 #[post("/accounts/key-management/rotate-user-account-keys", data = "<data>")]
 async fn post_rotatekey(data: Json<KeyData>, headers: Headers, conn: DbConn, nt: Notify<'_>) -> EmptyResult {
     let data: KeyData = data.into_inner();
 
-    let unlock_data = data.account_unlock_data.master_password_unlock_data;
-    validate_max_length(&data.old_master_key_authentication_hash, 300, "OldMasterKeyAuthenticationHash")?;
-    unlock_data.validate()?;
-    validate_rotation_request(&data.account_data, &data.account_unlock_data.common)?;
-
     if !headers.user.check_valid_password(&data.old_master_key_authentication_hash) {
         err!("Invalid password")
     }
 
-    // Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Core/KeyManagement/UserKey/Models/Data/PasswordChangeAndRotateUserAccountKeysData.cs#L17-L32>
-    let salt = unlock_data.master_password_salt.as_ref().unwrap_or(&unlock_data.email);
-    if !unlock_data.kdf.is_unchanged_for(&headers.user) || *salt != headers.user.master_password_salt() {
-        err!("The provided master password unlock data is not valid for this user.")
+    let unlock_data = data.account_unlock_data.master_password_unlock_data;
+    if !unlock_data.kdf.is_unchanged_for(&headers.user) || unlock_data.email != headers.user.email {
+        err!("Changing the kdf variant or email is not supported during key rotation");
     }
     validate_contained_key_id(unlock_data.contained_key_id.as_ref(), data.new_user_key_id.as_ref())?;
-    let password_hint = clean_password_hint(unlock_data.master_password_hint.as_ref());
-    enforce_password_hint_setting(password_hint.as_ref())?;
 
     let mut common = data.account_unlock_data.common;
-    // Like upstream, this endpoint logs every session out, so an upgrade token is never kept
-    // Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Core/KeyManagement/UserKey/Implementations/RotateUserAccountKeysCommand.cs#L94-L96>
+    // This endpoint always logs every session out, so an upgrade token is never kept here. That
+    // also clears one left over from an earlier upgrade. Ref: upstream's AccountsKeyManagementController
     common.v2_upgrade_token = None;
 
     rotate_account(
@@ -1618,10 +1460,9 @@ async fn post_rotatekey(data: Json<KeyData>, headers: Headers, conn: DbConn, nt:
             account_keys: data.account_keys.validate()?,
             account_data: data.account_data,
             unlock_data: common,
-            old_user_key_id: data.old_user_key_id,
             new_user_key_id: data.new_user_key_id,
             wrapped_user_key: unlock_data.master_key_encrypted_user_key,
-            new_password: Some((unlock_data.master_key_authentication_hash, password_hint)),
+            new_password_hash: Some(unlock_data.master_key_authentication_hash),
         },
         headers,
         conn,
@@ -1630,14 +1471,16 @@ async fn post_rotatekey(data: Json<KeyData>, headers: Headers, conn: DbConn, nt:
     .await
 }
 
-/// Both rotation endpoints: every check first, then the re-encrypted data and the new keys are saved.
+/// The body shared by both rotation endpoints: check that the client re-encrypted everything, re-save
+/// it, then swap the account keys and the wrapped user key.
 async fn rotate_account(data: RotateData, headers: Headers, conn: DbConn, nt: Notify<'_>) -> EmptyResult {
+    // TODO: See if we can wrap everything within a SQL Transaction. If something fails it should revert everything.
+    data.unlock_data.validate()?;
+
     let user_id = &headers.user.uuid;
     let mut existing_ciphers = Cipher::find_owned_by_user(user_id, &conn).await;
     let mut existing_folders = Folder::find_by_user(user_id, &conn).await;
     let mut existing_emergency_access = EmergencyAccess::find_all_confirmed_by_grantor_uuid(user_id, &conn).await;
-    // Like upstream, only the ones with a key take part
-    existing_emergency_access.retain(|ea| ea.key_encrypted.is_some());
     let mut existing_memberships = Membership::find_by_user(user_id, &conn).await;
     // We only rotate the reset password key if it is set.
     existing_memberships.retain(|m| m.reset_password_key.is_some());
@@ -1652,33 +1495,25 @@ async fn rotate_account(data: RotateData, headers: Headers, conn: DbConn, nt: No
         &existing_sends,
     )?;
 
-    // Like upstream, a client that rotates a user key that was already replaced has to sync first
-    // Ref: <https://github.com/bitwarden/server/blob/15c94ac58bf361a162381749c146d254a21b2098/src/Core/KeyManagement/UserKey/Models/Data/BaseRotateUserAccountKeysData.cs#L34-L46>
-    if let (Some(current), Some(old)) = (&headers.user.key_id, &data.old_user_key_id)
-        && current != old
-    {
-        err_code!("The user key being rotated is not the current user key. Sync and try again.", Status::Conflict.code)
-    }
-
     validate_rotation_account_keys(&data.account_keys, &headers.user, &conn).await?;
 
-    // An upgrade keeps the sessions; for an account already on v2 the token means nothing and is dropped
+    // The upgrade token only means anything for a v1 account moving to v2: it lets sessions still
+    // holding the v1 user key pick up the v2 one instead of being forced to re-authenticate. For an
+    // account that is already v2 it is meaningless, so it gets discarded and the security stamp is
+    // reset, as a rotation otherwise would. That ends the refresh tokens, while the access tokens in
+    // use run out on their own, as upstream.
     let is_upgrade = data.unlock_data.v2_upgrade_token.is_some() && !headers.user.is_v2();
     let upgrade_token = match &data.unlock_data.v2_upgrade_token {
         Some(token) if is_upgrade => Some(serde_json::to_string(token)?),
         _ => None,
     };
 
-    // An upgrade can't re-wrap the recovery keys without a trust prompt, so they're kept and get the token
-    // Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Api/KeyManagement/Validators/OrganizationUserRotationValidator.cs#L39-L64>
-    for membership in &existing_memberships {
-        let has_key = data
-            .unlock_data
-            .organization_account_recovery_unlock_data
-            .iter()
-            .find(|rp| rp.organization_id == membership.org_uuid)
-            .and_then(|rp| rp.reset_password_key.as_deref())
-            .is_some_and(|key| !key.trim().is_empty());
+    // An upgrade can't re-wrap the account recovery keys: that needs the organization's public key
+    // to be trusted, and an upgrade shows the user no prompt. So the stored keys are kept, and each
+    // organization gets the upgrade token instead, to unwrap the v2 user key with.
+    // Ref: upstream's OrganizationUserRotationValidator
+    for reset_password_data in &data.unlock_data.organization_account_recovery_unlock_data {
+        let has_key = reset_password_data.reset_password_key.as_deref().is_some_and(|k| !k.is_empty());
         if is_upgrade && has_key {
             err!("Account recovery keys cannot be rotated during a V1 to V2 upgrade rotation.")
         }
@@ -1687,80 +1522,76 @@ async fn rotate_account(data: RotateData, headers: Headers, conn: DbConn, nt: No
         }
     }
 
-    // Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Api/KeyManagement/Validators/EmergencyAccessRotationValidator.cs#L23-L53>
-    for emergency_access in &existing_emergency_access {
-        if data
-            .unlock_data
-            .emergency_access_unlock_data
-            .iter()
-            .find(|ea| ea.id == emergency_access.uuid)
-            .is_some_and(|ea| ea.key_encrypted.is_none())
-        {
-            err!("Emergency access keys cannot be set to null during rotation.")
-        }
-    }
-
-    // Saving's own checks, so that they can't fail halfway
-    for cipher_data in data.account_data.ciphers.iter().filter(|c| c.organization_id.is_none()) {
-        if let Some(cipher) = existing_ciphers.iter().find(|c| cipher_data.id.as_ref() == Some(&c.uuid)) {
-            validate_rotated_cipher(cipher, cipher_data, &headers, &conn).await?;
-        }
-    }
+    // Validate the import before continuing
+    // Bitwarden does not process the import if there is one item invalid.
+    // Since we check for the size of the encrypted note length, we need to do that here to pre-validate it.
+    // TODO: See if we can optimize the whole cipher adding/importing and prevent duplicate code and checks.
+    Cipher::validate_cipher_data(&data.account_data.ciphers)?;
 
     // TODO: Ideally we'd do everything after this point in a single transaction.
 
-    // Update folder data, ignoring ids that aren't the user's, like upstream
+    // Update folder data
     for folder_data in data.account_data.folders {
         // Skip `null` folder id entries.
         // See: https://github.com/bitwarden/clients/issues/8453
-        if let Some(saved_folder) = folder_data.id.and_then(|id| existing_folders.iter_mut().find(|f| f.uuid == id)) {
+        if let Some(folder_id) = folder_data.id {
+            let Some(saved_folder) = existing_folders.iter_mut().find(|f| f.uuid == folder_id) else {
+                err!("Folder doesn't exist")
+            };
+
             saved_folder.name = folder_data.name;
             saved_folder.save(&conn).await?;
         }
     }
 
-    // Like upstream, the unlock data below comes from the first entry for each, as checked above
-    for saved_emergency_access in &mut existing_emergency_access {
-        if let Some(emergency_access_data) =
-            data.unlock_data.emergency_access_unlock_data.iter().find(|ea| ea.id == saved_emergency_access.uuid)
-        {
-            saved_emergency_access.key_encrypted.clone_from(&emergency_access_data.key_encrypted);
-            saved_emergency_access.save(&conn).await?;
-        }
+    // Update emergency access data
+    for emergency_access_data in data.unlock_data.emergency_access_unlock_data {
+        let Some(saved_emergency_access) =
+            existing_emergency_access.iter_mut().find(|ea| ea.uuid == emergency_access_data.id)
+        else {
+            err!("Emergency access doesn't exist or is not owned by the user")
+        };
+
+        saved_emergency_access.key_encrypted = Some(emergency_access_data.key_encrypted);
+        saved_emergency_access.save(&conn).await?;
     }
 
-    for membership in &mut existing_memberships {
-        if let Some(reset_password_data) = data
-            .unlock_data
-            .organization_account_recovery_unlock_data
-            .iter()
-            .find(|rp| rp.organization_id == membership.org_uuid)
-        {
-            if !is_upgrade {
-                membership.reset_password_key.clone_from(&reset_password_data.reset_password_key);
-            }
-            membership.v2_upgrade_token.clone_from(&upgrade_token);
-            membership.save(&conn).await?;
+    // Update reset password data
+    for reset_password_data in data.unlock_data.organization_account_recovery_unlock_data {
+        let Some(membership) =
+            existing_memberships.iter_mut().find(|m| m.org_uuid == reset_password_data.organization_id)
+        else {
+            err!("Reset password doesn't exist")
+        };
+
+        if !is_upgrade {
+            membership.reset_password_key = reset_password_data.reset_password_key;
         }
+        membership.v2_upgrade_token.clone_from(&upgrade_token);
+        membership.save(&conn).await?;
     }
 
     // Update send data
     for send_data in data.account_data.sends {
-        if let Some(send) = send_data.id.as_ref().and_then(|id| existing_sends.iter_mut().find(|s| &s.uuid == id)) {
-            // Like upstream, only the key changes on rotation
-            send.akey = send_data.key;
-            send.save(&conn).await?;
-        }
+        let Some(send) = existing_sends.iter_mut().find(|s| &s.uuid == send_data.id.as_ref().unwrap()) else {
+            err!("Send doesn't exist")
+        };
+
+        update_send_from_data(send, send_data, &headers, &conn, &nt, UpdateType::None).await?;
     }
 
     // Update cipher data
     for cipher_data in data.account_data.ciphers {
-        if cipher_data.organization_id.is_none()
-            && let Some(saved_cipher) =
-                cipher_data.id.as_ref().and_then(|id| existing_ciphers.iter_mut().find(|c| &c.uuid == id))
-        {
-            // No cipher pushes: the other sessions still hold the old user key
-            rotate_cipher_data(saved_cipher, cipher_data, &headers, &conn, &nt).await?;
+        if cipher_data.organization_id.is_none() {
+            let Some(saved_cipher) = existing_ciphers.iter_mut().find(|c| &c.uuid == cipher_data.id.as_ref().unwrap())
+            else {
+                err!("Cipher doesn't exist")
+            };
+
+            // Prevent triggering cipher updates via WebSockets by settings UpdateType::None
+            // Other sessions still hold the old user key, so an update to a re-encrypted cipher could cause issues.
+            // After the user is saved they are logged out, or on an upgrade, told to sync the new key.
+            update_cipher_from_data(saved_cipher, cipher_data, &headers, None, &conn, &nt, UpdateType::None).await?;
         }
     }
 
@@ -1773,34 +1604,38 @@ async fn rotate_account(data: RotateData, headers: Headers, conn: DbConn, nt: No
     user.key_id = data.new_user_key_id;
 
     user.akey = data.wrapped_user_key;
-    if let Some((new_password_hash, new_password_hint)) = data.new_password {
-        // A password change ends every session, as `/accounts/password` does
-        user.password_hint = new_password_hint;
-        user.set_password(&new_password_hash, None, true, None, &conn).await?;
-    } else if !is_upgrade {
-        // An upgrade keeps the sessions alive, see `is_upgrade` above
+    if let Some(new_password_hash) = data.new_password_hash {
+        user.set_password(&new_password_hash, None, false, None, &conn).await?;
+    }
+    // An upgrade keeps the sessions alive, see `is_upgrade` above
+    if !is_upgrade {
         user.reset_security_stamp_after_key_rotation(&conn).await?;
     }
 
-    // The key pair first, so that a v2 account is never saved without one. The data above is already re-encrypted by
-    // now, and for an account that was already v2 so is the signing key saved here, so a failure in either save
-    // leaves them under a key that isn't stored (see the TODO before the first write).
+    // The key pair goes first: if saving the user then fails during an upgrade, the account is still
+    // v1 and the key pair unused, instead of a v2 account without one, which no client could unlock.
+    // A failure between the two writes of a v2 rotation still needs a transaction to undo.
     data.account_keys.save_signature_key_pair(&user.uuid, &conn).await?;
     user.save(&conn).await?;
 
     // Prevent logging out the client where the user requested this endpoint from.
     // If you do logout the user it will causes issues at the client side.
     // Adding the device uuid will prevent this.
-    // On an upgrade, the reason lets clients sync instead
+    // When the sessions were kept alive, the reason lets the other clients sync the new keys (through
+    // the upgrade token) instead of logging out, if they have `pm-31050-no-logout-key-upgrade-rotation`.
     let reason = is_upgrade.then_some(LogOutReason::KeyRotation);
     nt.send_logout_with_reason(&user, Some(&headers.device), reason, &conn).await;
 
     Ok(())
 }
 
-/// Rotates the keys without changing the master password; like upstream, the session is the only proof.
+/// Rotates the account keys without changing the master password.
 ///
-/// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs#L174-L208>
+/// Unlike `rotate-user-account-keys` this carries no proof of the master password: the request is
+/// authorized by the session alone, which is how upstream defines it, and the client has to be
+/// unlocked to produce the payload in the first place.
+///
+/// Ref: <https://github.com/bitwarden/server/blob/main/src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs>
 #[post("/accounts/key-management/rotate-user-keys", data = "<data>")]
 async fn post_rotate_user_keys(
     data: Json<RotateUserKeysData>,
@@ -1809,32 +1644,17 @@ async fn post_rotate_user_keys(
     nt: Notify<'_>,
 ) -> EmptyResult {
     let data: RotateUserKeysData = data.into_inner();
-    validate_rotation_request(&data.account_data, &data.unlock_data)?;
 
-    // Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Api/KeyManagement/Models/Requests/UnlockMethodRequestModel.cs#L20-L46>
     let wrapped_user_key = match UnlockMethod::from_i32(data.unlock_method_data.unlock_method) {
         Some(UnlockMethod::MasterPassword) => {
-            let (Some(unlock_data), None) = (
-                data.unlock_method_data.master_password_unlock_data,
-                data.unlock_method_data.key_connector_key_wrapped_user_key,
-            ) else {
-                err!(
-                    "Invalid MasterPassword unlock method request, MasterPasswordUnlockData must be provided and KeyConnectorKeyWrappedUserKey must be null"
-                )
+            let Some(unlock_data) = data.unlock_method_data.master_password_unlock_data else {
+                err!("Missing master password unlock data")
             };
-            required(Some(unlock_data.master_key_wrapped_user_key.clone()), "MasterKeyWrappedUserKey")?;
-            required(Some(unlock_data.salt.clone()), "Salt")?;
-            validate_max_length(&unlock_data.salt, 256, "Salt")?;
-
-            // Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Core/KeyManagement/UserKey/Models/Data/MasterPasswordRotateUserAccountKeysData.cs#L12-L23>
-            if headers.user.password_hash.is_empty() || headers.user.akey.is_empty() {
-                err!("User is in an invalid state for master password key rotation.")
-            }
-            if unlock_data.salt != headers.user.master_password_salt() {
-                err!("Invalid master password salt.")
-            }
             if !unlock_data.kdf.is_unchanged_for(&headers.user) {
-                err!("Invalid KDF settings.")
+                err!("Changing the kdf variant is not supported during key rotation")
+            }
+            if unlock_data.salt != headers.user.email {
+                err!("Invalid master password salt")
             }
             validate_contained_key_id(unlock_data.contained_key_id.as_ref(), data.new_user_key_id.as_ref())?;
             unlock_data.master_key_wrapped_user_key
@@ -1849,10 +1669,9 @@ async fn post_rotate_user_keys(
             account_keys: data.wrapped_account_cryptographic_state.validate()?,
             account_data: data.account_data,
             unlock_data: data.unlock_data,
-            old_user_key_id: data.old_user_key_id,
             new_user_key_id: data.new_user_key_id,
             wrapped_user_key,
-            new_password: None,
+            new_password_hash: None,
         },
         headers,
         conn,
@@ -1946,11 +1765,7 @@ async fn post_email_token(data: Json<EmailTokenData>, headers: Headers, conn: Db
             error!("Error sending change-email email: {e:#?}");
         }
     } else {
-        debug!(
-            "Email change request for user ({}) to email ({}) with token ({token})",
-            user.uuid,
-            data.new_email.escape_debug()
-        );
+        debug!("Email change request for user ({}) to email ({}) with token ({token})", user.uuid, data.new_email);
     }
 
     user.email_new = Some(data.new_email);
@@ -2103,7 +1918,7 @@ struct DeleteRecoverTokenData {
 }
 
 #[post("/accounts/delete-recover-token", data = "<data>")]
-async fn post_delete_recover_token(data: Json<DeleteRecoverTokenData>, conn: DbConn, nt: Notify<'_>) -> EmptyResult {
+async fn post_delete_recover_token(data: Json<DeleteRecoverTokenData>, conn: DbConn) -> EmptyResult {
     let data: DeleteRecoverTokenData = data.into_inner();
 
     let Ok(claims) = decode_delete(&data.token) else {
@@ -2117,44 +1932,22 @@ async fn post_delete_recover_token(data: Json<DeleteRecoverTokenData>, conn: DbC
     if claims.sub != *user.uuid {
         err!("Invalid claim");
     }
-
-    // The devices are deleted together with the user, so check for push devices beforehand
-    let has_push_device = CONFIG.push_enabled() && Device::check_user_has_push_device(&user.uuid, &conn).await;
-    user.delete(&conn).await?;
-
-    nt.send_logout(&user, None, &conn).await;
-    if has_push_device {
-        push_logout_to_relay(&user, None, None);
-    }
-    Ok(())
+    user.delete(&conn).await
 }
 
 #[post("/accounts/delete", data = "<data>")]
-async fn post_delete_account(
-    data: Json<PasswordOrOtpData>,
-    headers: Headers,
-    conn: DbConn,
-    nt: Notify<'_>,
-) -> EmptyResult {
-    delete_account(data, headers, conn, nt).await
+async fn post_delete_account(data: Json<PasswordOrOtpData>, headers: Headers, conn: DbConn) -> EmptyResult {
+    delete_account(data, headers, conn).await
 }
 
 #[delete("/accounts", data = "<data>")]
-async fn delete_account(data: Json<PasswordOrOtpData>, headers: Headers, conn: DbConn, nt: Notify<'_>) -> EmptyResult {
+async fn delete_account(data: Json<PasswordOrOtpData>, headers: Headers, conn: DbConn) -> EmptyResult {
     let data: PasswordOrOtpData = data.into_inner();
     let user = headers.user;
 
     data.validate(&user, true, &conn).await?;
 
-    // The devices are deleted together with the user, so check for push devices beforehand
-    let has_push_device = CONFIG.push_enabled() && Device::check_user_has_push_device(&user.uuid, &conn).await;
-    user.delete(&conn).await?;
-
-    nt.send_logout(&user, None, &conn).await;
-    if has_push_device {
-        push_logout_to_relay(&user, None, None);
-    }
-    Ok(())
+    user.delete(&conn).await
 }
 
 #[expect(clippy::needless_pass_by_value, reason = "Not beneficial for Headers")]
@@ -2205,7 +1998,7 @@ async fn password_hint(data: Json<PasswordHintData>, ip: ClientIp, conn: DbConn)
                 mail::send_password_hint(email, hint).await?;
                 Ok(())
             } else if let Some(hint) = hint {
-                err_silent!(format!("Your password hint is: {hint}"));
+                err!(format!("Your password hint is: {hint}"));
             } else {
                 err!(NO_HINT);
             }
@@ -2219,33 +2012,19 @@ pub struct PreloginData {
     email: String,
 }
 
-/// Like upstream, an unknown email gets KDF settings picked from a list of common ones by a keyed hash of the email,
-/// so they stay the same between requests. The salt stays null, as for existing users.
-fn unknown_email_kdf(email: &str) -> (i32, i32, Option<i32>, Option<i32>) {
-    const PBKDF2: i32 = UserKdfType::Pbkdf2 as i32;
-    const ARGON2ID: i32 = UserKdfType::Argon2id as i32;
-    // Same list as upstream, the default is in it twice to give it more weight
-    const KDF_SETTINGS: [(i32, i32, Option<i32>, Option<i32>); 6] = [
-        (User::CLIENT_KDF_TYPE_DEFAULT, User::CLIENT_KDF_ITER_DEFAULT, None, None),
-        (User::CLIENT_KDF_TYPE_DEFAULT, User::CLIENT_KDF_ITER_DEFAULT, None, None),
-        (PBKDF2, 100_000, None, None),
-        (PBKDF2, 5_000, None, None),
-        (ARGON2ID, 3, Some(64), Some(4)),
-        (ARGON2ID, 6, Some(32), Some(4)),
-    ];
-    KDF_SETTINGS[crate::auth::prelogin_kdf_index(email, KDF_SETTINGS.len())]
+#[post("/accounts/prelogin", data = "<data>")]
+async fn post_prelogin(data: Json<PreloginData>, ip: ClientIp, conn: DbConn) -> JsonResult {
+    prelogin(data, ip, conn).await
 }
 
 pub async fn prelogin(data: Json<PreloginData>, ip: ClientIp, conn: DbConn) -> JsonResult {
     crate::ratelimit::check_limit_unauthenticated(&ip.ip)?;
 
     let data: PreloginData = data.into_inner();
-    // Normalized once, so the lookup and the settings for an unknown email use the same value
-    let email = data.email.trim().to_lowercase();
 
-    let (kdf_type, kdf_iter, kdf_mem, kdf_para) = match User::find_by_mail(&email, &conn).await {
+    let (kdf_type, kdf_iter, kdf_mem, kdf_para) = match User::find_by_mail(&data.email, &conn).await {
         Some(user) => (user.client_kdf_type, user.client_kdf_iter, user.client_kdf_memory, user.client_kdf_parallelism),
-        None => unknown_email_kdf(&email),
+        None => (User::CLIENT_KDF_TYPE_DEFAULT, User::CLIENT_KDF_ITER_DEFAULT, None, None),
     };
 
     Ok(Json(json!({
@@ -2518,7 +2297,7 @@ async fn post_auth_request(
     nt.send_auth_request(&user.uuid, &auth_request.uuid, &device, &conn).await;
 
     log_user_event(
-        EventType::UserRequestedDeviceApproval,
+        EventType::UserRequestedDeviceApproval as i32,
         &user.uuid,
         client_headers.device_type,
         &client_headers.ip.ip,
@@ -2612,7 +2391,7 @@ async fn put_auth_request(
         nt.send_auth_response(&auth_request.user_uuid, &auth_request.uuid, &headers.device, &conn).await;
 
         log_user_event(
-            EventType::OrganizationUserApprovedAuthRequest,
+            EventType::OrganizationUserApprovedAuthRequest as i32,
             &headers.user.uuid,
             headers.device.atype,
             &headers.ip.ip,
@@ -2623,7 +2402,7 @@ async fn put_auth_request(
         // If denied, there's no reason to keep the request
         auth_request.delete(&conn).await?;
         log_user_event(
-            EventType::OrganizationUserRejectedAuthRequest,
+            EventType::OrganizationUserRejectedAuthRequest as i32,
             &headers.user.uuid,
             headers.device.atype,
             &headers.ip.ip,
@@ -2729,62 +2508,3 @@ pub async fn purge_auth_requests(pool: DbPool) {
         error!("Failed to get DB connection while purging auth requests");
     }
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn test_register_data_current_format() {
-        // Web and iOS since the master password authentication/unlock split
-        let data: RegisterData = serde_json::from_str(
-            r#"{
-                "email": "user@example.com",
-                "emailVerificationToken": "token",
-                "userAsymmetricKeys": {"publicKey": "pub", "encryptedPrivateKey": "priv"},
-                "masterPasswordAuthentication": {
-                    "kdf": {"kdfType": 0, "iterations": 600000},
-                    "salt": "user@example.com",
-                    "masterPasswordAuthenticationHash": "hash"
-                },
-                "masterPasswordUnlock": {
-                    "kdf": {"kdfType": 0, "iterations": 600000},
-                    "salt": "user@example.com",
-                    "masterKeyWrappedUserKey": "key"
-                }
-            }"#,
-        )
-        .unwrap();
-
-        assert!(!data.compat.unprocessable(&data.email));
-        assert_eq!(data.compat.hash(), "hash");
-        assert_eq!(data.compat.key(), "key");
-        assert_eq!(data.compat.kdf().kdf_iterations, 600_000);
-        assert!(data.keys.is_some());
-        assert_eq!(data.email_verification_token.as_deref(), Some("token"));
-    }
-
-    #[test]
-    fn test_register_data_flat_format() {
-        // Android before 2026.9.0
-        let data: RegisterData = serde_json::from_str(
-            r#"{
-                "email": "user@example.com",
-                "emailVerificationToken": "token",
-                "masterPasswordHash": "hash",
-                "masterPasswordHint": null,
-                "userSymmetricKey": "key",
-                "userAsymmetricKeys": {"publicKey": "pub", "encryptedPrivateKey": "priv"},
-                "kdf": 0,
-                "kdfIterations": 600000
-            }"#,
-        )
-        .unwrap();
-
-        assert!(!data.compat.unprocessable(&data.email));
-        assert_eq!(data.compat.hash(), "hash");
-        assert_eq!(data.compat.key(), "key");
-        assert_eq!(data.compat.kdf().kdf_iterations, 600_000);
-        assert!(data.keys.is_some());
-    }
-}
diff --git a/src/api/core/ciphers.rs b/src/api/core/ciphers.rs
index 410c7ab5..3ffda3b3 100644
--- a/src/api/core/ciphers.rs
+++ b/src/api/core/ciphers.rs
@@ -13,7 +13,7 @@ use serde_json::Value;
 
 use crate::{
     CONFIG,
-    api::{self, ApiResult, EmptyResult, JsonResult, Notify, PasswordOrOtpData, UpdateType, core::log_event},
+    api::{self, EmptyResult, JsonResult, Notify, PasswordOrOtpData, UpdateType, core::log_event},
     auth::ClientVersion,
     auth::{Headers, OrgIdGuard, OwnerHeaders},
     config::PathType,
@@ -21,16 +21,16 @@ use crate::{
     db::{
         DbConn, DbPool,
         models::{
-            Archive, Attachment, AttachmentId, Cipher, CipherAccessScope, CipherId, Collection, CollectionCipher,
-            CollectionGroup, CollectionId, CollectionUser, EventType, Favorite, Folder, FolderCipher, FolderId, Group,
-            KeyId, Membership, MembershipType, OrgPolicy, OrgPolicyType, OrganizationId, RepromptType, Send, User,
-            UserId, is_data_blob_encrypted,
+            Archive, Attachment, AttachmentId, Cipher, CipherId, Collection, CollectionCipher, CollectionGroup,
+            CollectionId, CollectionUser, EventType, Favorite, Folder, FolderCipher, FolderId, Group, KeyId,
+            Membership, MembershipType, OrgPolicy, OrgPolicyType, OrganizationId, RepromptType, Send, User, UserId,
+            is_data_blob_encrypted,
         },
     },
     util::{NumberOrString, deser_opt_nonempty_str, save_temp_file},
 };
 
-use super::{folders::FolderData, sends::SIZE_525_MB};
+use super::folders::FolderData;
 
 pub fn routes() -> Vec<Route> {
     // Note that many routes have an `admin` variant; this seems to be
@@ -55,7 +55,6 @@ pub fn routes() -> Vec<Route> {
         post_ciphers_create,
         post_ciphers_import,
         get_attachment,
-        get_attachment_admin,
         post_attachment_v2,
         post_attachment_v2_data,
         post_attachment,       // legacy
@@ -191,14 +190,14 @@ async fn sync(data: SyncData, headers: Headers, client_version: Option<ClientVer
             // https://github.com/bitwarden/android/blob/release/2025.12-rc41/network/src/main/kotlin/com/bitwarden/network/model/MasterPasswordUnlockDataJson.kt#L22-L26
             "masterKeyEncryptedUserKey": headers.user.akey,
             "masterKeyWrappedUserKey": headers.user.akey,
-            "salt": headers.user.master_password_salt(),
+            "salt": headers.user.email,
             "containedKeyId": headers.user.key_id,
         })
     } else {
         Value::Null
     };
 
-    // Upstream omits these when unset rather than sending null
+    // Upstream omits these two when unset rather than sending null.
     let mut user_decryption = json!({ "masterPasswordUnlock": master_password_unlock });
     if let Some(key_id) = &headers.user.key_id {
         user_decryption["userKeyId"] = json!(key_id);
@@ -242,12 +241,21 @@ async fn get_ciphers(headers: Headers, conn: DbConn) -> JsonResult {
 
 #[get("/ciphers/<cipher_id>")]
 async fn get_cipher(cipher_id: CipherId, headers: Headers, conn: DbConn) -> JsonResult {
-    get_cipher_impl(cipher_id, &headers, CipherAccessScope::User, &conn).await
+    let Some(cipher) = Cipher::find_by_uuid(&cipher_id, &conn).await else {
+        err!("Cipher doesn't exist")
+    };
+
+    if !cipher.is_accessible_to_user(&headers.user.uuid, &conn).await {
+        err!("Cipher is not owned by user")
+    }
+
+    Ok(Json(cipher.to_json(&headers.host, &headers.user.uuid, None, CipherSyncType::User, &conn).await?))
 }
 
 #[get("/ciphers/<cipher_id>/admin")]
 async fn get_cipher_admin(cipher_id: CipherId, headers: Headers, conn: DbConn) -> JsonResult {
-    get_cipher_impl(cipher_id, &headers, CipherAccessScope::OrganizationAdmin, &conn).await
+    // TODO: Implement this correctly
+    get_cipher(cipher_id, headers, conn).await
 }
 
 #[get("/ciphers/<cipher_id>/details")]
@@ -255,38 +263,6 @@ async fn get_cipher_details(cipher_id: CipherId, headers: Headers, conn: DbConn)
     get_cipher(cipher_id, headers, conn).await
 }
 
-async fn get_cipher_impl(
-    cipher_id: CipherId,
-    headers: &Headers,
-    scope: CipherAccessScope,
-    conn: &DbConn,
-) -> JsonResult {
-    let Some(cipher) = Cipher::find_by_uuid(&cipher_id, conn).await else {
-        err!("Cipher doesn't exist")
-    };
-
-    if !cipher.is_accessible_to_user(&headers.user.uuid, scope, conn).await {
-        err!("Cipher is not owned by user")
-    }
-
-    Ok(Json(cipher_json_for_scope(&cipher, headers, scope, conn).await?))
-}
-
-/// The cipher, as answered to a route authorized with `scope`.
-async fn cipher_json_for_scope(
-    cipher: &Cipher,
-    headers: &Headers,
-    scope: CipherAccessScope,
-    conn: &DbConn,
-) -> Result<Value, crate::Error> {
-    match scope {
-        CipherAccessScope::User => {
-            cipher.to_json(&headers.host, &headers.user.uuid, None, CipherSyncType::User, conn).await
-        }
-        CipherAccessScope::OrganizationAdmin => cipher.to_json_org_admin(&headers.host, &headers.user.uuid, conn).await,
-    }
-}
-
 #[derive(Debug, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct CipherData {
@@ -301,8 +277,7 @@ pub struct CipherData {
 
     key: Option<String>,
 
-    // Added in web-v2025.6.0. Deprecated upstream for `encrypted_by_key_id`, but still checked when sent
-    pub encrypted_for: Option<UserId>,
+    pub encrypted_for: UserId, // Added in web-v2025.6.0
     // Added in web-v2025.8.1, Optional for compat
     pub encrypted_by_key_id: Option<KeyId>,
 
@@ -369,22 +344,12 @@ impl From<CipherValidationError> for crate::Error {
     }
 }
 
-/// The cipher must have been encrypted for the acting user. Only checked when the client sends the field.
+/// A user-owned cipher must be encrypted with the user's current key. Organization ciphers use the
+/// organization key, which has no id yet, and either id may be missing: from a client that predates
+/// the field, or a user whose key id isn't known yet. There is nothing to compare in those cases.
 ///
-/// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Api/Vault/Controllers/CiphersController.cs#L1857-L1870>
-fn validate_encrypted_for_user(data: &CipherData, user_id: &UserId) -> EmptyResult {
-    if data.encrypted_for.as_ref().is_some_and(|encrypted_for| encrypted_for != user_id) {
-        err!("Cipher was not encrypted for the current user. Please try again.")
-    }
-    Ok(())
-}
-
-/// [`validate_encrypted_for_user`], plus the key id of a user-owned cipher, when both ids are known.
-///
-/// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Api/Vault/Controllers/CiphersController.cs#L1886-L1911>
-fn validate_encrypted_by_user(data: &CipherData, user: &User, is_org_cipher: bool) -> EmptyResult {
-    validate_encrypted_for_user(data, &user.uuid)?;
-
+/// Ref: upstream's `CiphersController.ValidateCipherEncryptedByUser`
+fn validate_encrypted_by_user_key(data: &CipherData, user: &User, is_org_cipher: bool) -> EmptyResult {
     if !is_org_cipher
         && let (Some(cipher_key_id), Some(user_key_id)) = (&data.encrypted_by_key_id, &user.key_id)
         && cipher_key_id != user_key_id
@@ -398,34 +363,16 @@ fn validate_encrypted_by_user(data: &CipherData, user: &User, is_org_cipher: boo
 const MAX_CIPHER_DATA_LENGTH: usize = 500_000;
 
 impl CipherData {
-    /// Whether `data` is a blob rather than the per-type fields. Parses `data`, so keep the result.
+    /// Whether the content is a single blob rather than the per-type fields. This parses `data`, so
+    /// callers that need the answer more than once should keep it.
     pub fn is_blob(&self) -> bool {
         self.data.as_deref().is_some_and(is_data_blob_encrypted)
     }
 
-    /// Saving's last checks: a known type, and its data unless it's a blob.
-    pub fn validate_type_data(&self, is_blob: bool) -> EmptyResult {
-        let type_data = match self.r#type {
-            1 => &self.login,
-            2 => &self.secure_note,
-            3 => &self.card,
-            4 => &self.identity,
-            5 => &self.ssh_key,
-            6 => &self.bank_account,
-            7 => &self.drivers_license,
-            8 => &self.passport,
-            _ => err!("Invalid type"),
-        };
-        if !is_blob && type_data.is_none() {
-            err!("Data missing")
-        }
-        Ok(())
-    }
-
-    /// Upstream's model checks that depend on the format: the size of `data`, and a name unless it's a blob.
+    /// Checks the content the way upstream's model validation does, before anything is saved.
+    /// `is_blob` is [`Self::is_blob`].
     ///
-    /// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Api/Vault/Models/Request/CipherRequestModel.cs#L76-L77>
-    /// and <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Api/Vault/Models/Request/CipherRequestModel.cs#L91-L99>
+    /// Ref: <https://github.com/bitwarden/server/blob/main/src/Api/Vault/Models/Request/CipherRequestModel.cs>
     pub fn validate_content(&self, is_blob: bool) -> Result<(), CipherValidationError> {
         if let Some(data) = &self.data
             && data.len() > MAX_CIPHER_DATA_LENGTH
@@ -466,8 +413,7 @@ pub struct Attachments2Data {
 /// Called when an org admin clones an org cipher.
 #[post("/ciphers/admin", data = "<data>")]
 async fn post_ciphers_admin(data: Json<ShareCipherData>, headers: Headers, conn: DbConn, nt: Notify<'_>) -> JsonResult {
-    // The same as /ciphers/create, only answered like the other administrative routes
-    post_ciphers_create_impl(data, headers, CipherAccessScope::OrganizationAdmin, conn, nt).await
+    post_ciphers_create(data, headers, conn, nt).await
 }
 
 /// Called when creating a new org-owned cipher, or cloning a cipher (whether
@@ -479,40 +425,22 @@ async fn post_ciphers_create(
     headers: Headers,
     conn: DbConn,
     nt: Notify<'_>,
-) -> JsonResult {
-    post_ciphers_create_impl(data, headers, CipherAccessScope::User, conn, nt).await
-}
-
-async fn post_ciphers_create_impl(
-    data: Json<ShareCipherData>,
-    headers: Headers,
-    response_scope: CipherAccessScope,
-    conn: DbConn,
-    nt: Notify<'_>,
 ) -> JsonResult {
     let mut data: ShareCipherData = data.into_inner();
 
-    validate_encrypted_by_user(&data.cipher, &headers.user, data.cipher.organization_id.is_some())?;
+    if data.cipher.encrypted_for != headers.user.uuid {
+        err_code!("Invalid user cipher", Status::UnprocessableEntity.code);
+    }
+    validate_encrypted_by_user_key(&data.cipher, &headers.user, data.cipher.organization_id.is_some())?;
 
     // This check is usually only needed in update_cipher_from_data(), but we
     // need it here as well to avoid creating an empty cipher in the call to
     // cipher.save() below.
     enforce_personal_ownership_policy(Some(&data.cipher), &headers, &conn).await?;
 
-    if response_scope == CipherAccessScope::OrganizationAdmin {
-        let Some(org_id) = data.cipher.organization_id.as_ref() else {
-            err!("Cipher is not owned by an organization")
-        };
-        if !Membership::find_confirmed_by_user_and_org(&headers.user.uuid, org_id, &conn)
-            .await
-            .is_some_and(|member| member.can_edit_any_collection())
-        {
-            err!("Cipher is not write accessible")
-        }
-    }
-
-    let mut cipher = Cipher::new(data.cipher.r#type);
+    let mut cipher = Cipher::new(data.cipher.r#type, String::new());
     cipher.user_uuid = Some(headers.user.uuid.clone());
+    cipher.save(&conn).await?;
 
     // When cloning a cipher, the Bitwarden clients seem to set this field
     // based on the cipher being cloned (when creating a new cipher, it's set
@@ -522,7 +450,11 @@ async fn post_ciphers_create_impl(
     // or otherwise), we can just ignore this field entirely.
     data.cipher.last_known_revision_date = None;
 
-    share_cipher_by_uuid(&cipher.uuid.clone(), Some(cipher), data, &headers, response_scope, &conn, &nt, None).await
+    let res = share_cipher_by_uuid(&cipher.uuid, data, &headers, &conn, &nt, None).await;
+    if res.is_err() {
+        cipher.delete(&conn).await?;
+    }
+    res
 }
 
 /// Called when creating a new user-owned cipher.
@@ -530,7 +462,11 @@ async fn post_ciphers_create_impl(
 async fn post_ciphers(data: Json<CipherData>, headers: Headers, conn: DbConn, nt: Notify<'_>) -> JsonResult {
     let mut data: CipherData = data.into_inner();
 
-    validate_encrypted_by_user(&data, &headers.user, data.organization_id.is_some())?;
+    if data.encrypted_for != headers.user.uuid {
+        err_code!("Invalid user cipher", Status::UnprocessableEntity.code);
+    }
+
+    validate_encrypted_by_user_key(&data, &headers.user, data.organization_id.is_some())?;
 
     // The web/browser clients set this field to null as expected, but the
     // mobile clients seem to set the invalid value `0001-01-01T00:00:00`,
@@ -538,8 +474,8 @@ async fn post_ciphers(data: Json<CipherData>, headers: Headers, conn: DbConn, nt
     // needed when creating a new cipher, so just ignore it unconditionally.
     data.last_known_revision_date = None;
 
-    let mut cipher = Cipher::new(data.r#type);
-    update_cipher_from_data(&mut cipher, data, &headers, None, &conn, &nt, UpdateType::SyncCipherCreate, true).await?;
+    let mut cipher = Cipher::new(data.r#type, String::new());
+    update_cipher_from_data(&mut cipher, data, &headers, None, &conn, &nt, UpdateType::SyncCipherCreate).await?;
 
     Ok(Json(cipher.to_json(&headers.host, &headers.user.uuid, None, CipherSyncType::User, &conn).await?))
 }
@@ -562,22 +498,42 @@ async fn enforce_personal_ownership_policy(data: Option<&CipherData>, headers: &
     Ok(())
 }
 
-/// The checks of saving a cipher, for callers that run them before writing anything else
-async fn validate_cipher_update(
-    cipher: &Cipher,
-    data: &CipherData,
+pub async fn update_cipher_from_data(
+    cipher: &mut Cipher,
+    data: CipherData,
     headers: &Headers,
+    shared_to_collections: Option<Vec<CollectionId>>,
     conn: &DbConn,
+    nt: &Notify<'_>,
     ut: UpdateType,
 ) -> EmptyResult {
+    // Cleanup cipher data, like removing the 'Response' key.
+    // This key is somewhere generated during Javascript so no way for us this fix this.
+    // Also, upstream only retrieves keys they actually want to store, and thus skip the 'Response' key.
+    // We do not mind which data is in it, the keep our model more flexible when there are upstream changes.
+    // But, we at least know we do not need to store and return this specific key.
+    fn clean_cipher_data(mut json_data: Value) -> Value {
+        if json_data.is_array() {
+            json_data.as_array_mut().unwrap().iter_mut().for_each(|ref mut f| {
+                f.as_object_mut().unwrap().remove("response");
+            });
+        }
+        json_data
+    }
+
+    enforce_personal_ownership_policy(Some(&data), headers, conn).await?;
+
+    let is_blob = data.is_blob();
+    data.validate_content(is_blob)?;
+
     // Check that the client isn't updating an existing cipher with stale data.
     // And only perform this check when not importing ciphers, else the date/time check will fail.
     if ut != UpdateType::None
-        && let Some(dt) = &data.last_known_revision_date
+        && let Some(dt) = data.last_known_revision_date
     {
-        match NaiveDateTime::parse_from_str(dt, "%+") {
+        match NaiveDateTime::parse_from_str(&dt, "%+") {
             // ISO 8601 format
-            Err(err) => warn!("Error parsing LastKnownRevisionDate '{}': {err}", dt.escape_debug()),
+            Err(err) => warn!("Error parsing LastKnownRevisionDate '{dt}': {err}"),
             Ok(dt) if cipher.updated_at.signed_duration_since(dt).num_seconds() > 1 => {
                 err!("The client copy of this cipher is out of date. Resync the client and try again.")
             }
@@ -585,6 +541,10 @@ async fn validate_cipher_update(
         }
     }
 
+    if cipher.organization_uuid.is_some() && cipher.organization_uuid != data.organization_id {
+        err!("Organization mismatch. Please resync the client before updating the cipher")
+    }
+
     if let Some(note) = &data.notes {
         let max_note_size = CONFIG._max_note_size();
         if note.len() > max_note_size {
@@ -592,90 +552,18 @@ async fn validate_cipher_update(
         }
     }
 
-    if let Some(folder_id) = &data.folder_id
-        && Folder::find_by_uuid_and_user(folder_id, &headers.user.uuid, conn).await.is_none()
-    {
-        err!("Invalid folder", "Folder does not exist or belongs to another user");
-    }
-    Ok(())
-}
-
-#[expect(
-    clippy::too_many_arguments,
-    reason = "Cipher updates need separate access, notification and transaction controls"
-)]
-pub async fn update_cipher_from_data(
-    cipher: &mut Cipher,
-    data: CipherData,
-    headers: &Headers,
-    shared_to_collections: Option<Vec<CollectionId>>,
-    conn: &DbConn,
-    nt: &Notify<'_>,
-    ut: UpdateType,
-    emit_side_effects: bool,
-) -> EmptyResult {
-    enforce_personal_ownership_policy(Some(&data), headers, conn).await?;
-    save_cipher_data(cipher, data, headers, shared_to_collections, conn, nt, ut, emit_side_effects).await
-}
-
-/// [`update_cipher_from_data`] for a rotation: like upstream, the personal ownership policy doesn't apply.
-pub async fn rotate_cipher_data(
-    cipher: &mut Cipher,
-    data: CipherData,
-    headers: &Headers,
-    conn: &DbConn,
-    nt: &Notify<'_>,
-) -> EmptyResult {
-    save_cipher_data(cipher, data, headers, None, conn, nt, UpdateType::None, false).await
-}
-
-/// The checks of [`rotate_cipher_data`] that need the database, to run on every cipher before the first is saved
-pub async fn validate_rotated_cipher(
-    cipher: &Cipher,
-    data: &CipherData,
-    headers: &Headers,
-    conn: &DbConn,
-) -> EmptyResult {
-    validate_cipher_update(cipher, data, headers, conn, UpdateType::None).await
-}
-
-#[expect(
-    clippy::too_many_arguments,
-    reason = "Cipher updates need separate access, notification and transaction controls"
-)]
-async fn save_cipher_data(
-    cipher: &mut Cipher,
-    mut data: CipherData,
-    headers: &Headers,
-    shared_to_collections: Option<Vec<CollectionId>>,
-    conn: &DbConn,
-    nt: &Notify<'_>,
-    ut: UpdateType,
-    emit_side_effects: bool,
-) -> EmptyResult {
-    let is_blob = data.is_blob();
-    data.validate_content(is_blob)?;
-    data.validate_type_data(is_blob)?;
-    validate_cipher_update(cipher, &data, headers, conn, ut).await?;
-
-    if cipher.organization_uuid.is_some() && cipher.organization_uuid != data.organization_id {
-        err!("Organization mismatch. Please resync the client before updating the cipher")
-    }
-
     // Check if this cipher is being transferred from a personal to an organization vault
     let transfer_cipher = cipher.organization_uuid.is_none() && data.organization_id.is_some();
 
-    if let Some(org_id) = data.organization_id.take() {
+    if let Some(org_id) = data.organization_id {
         match Membership::find_confirmed_by_user_and_org(&headers.user.uuid, &org_id, conn).await {
             None => err!("You don't have permission to add item to organization"),
             Some(member) => {
                 // A non-empty list of collections implies the caller already validated the user's write
                 // access to them, so we can move the cipher into the organization on that basis.
-                // Write access to the cipher itself only counts when it already belongs to this organization.
                 if shared_to_collections.as_ref().is_some_and(|cols| !cols.is_empty())
-                    || member.can_edit_any_collection()
-                    || (!transfer_cipher
-                        && cipher.is_write_accessible_to_user(&headers.user.uuid, CipherAccessScope::User, conn).await)
+                    || member.has_full_access()
+                    || cipher.is_write_accessible_to_user(&headers.user.uuid, conn).await
                 {
                     cipher.organization_uuid = Some(org_id);
                     // After some discussion in PR #1329 re-added the user_uuid = None again.
@@ -693,15 +581,21 @@ async fn save_cipher_data(
         cipher.user_uuid = Some(headers.user.uuid.clone());
     }
 
+    if let Some(ref folder_id) = data.folder_id
+        && Folder::find_by_uuid_and_user(folder_id, &headers.user.uuid, conn).await.is_none()
+    {
+        err!("Invalid folder", "Folder does not exist or belongs to another user");
+    }
+
     // Modify attachments name and keys when rotating
-    if let Some(attachments) = data.attachments2.take() {
+    if let Some(attachments) = data.attachments2 {
         for (id, attachment) in attachments {
             let Some(mut saved_att) = Attachment::find_by_id(&id, conn).await else {
                 // Warn and continue here.
                 // A missing attachment means it was removed via an other client.
                 // Also the Desktop Client supports removing attachments and save an update afterwards.
                 // Bitwarden it self ignores these mismatches server side.
-                warn!("Attachment {} doesn't exist", id.escape_debug());
+                warn!("Attachment {id} doesn't exist");
                 continue;
             };
 
@@ -719,7 +613,48 @@ async fn save_cipher_data(
         }
     }
 
-    set_cipher_content(cipher, &mut data)?;
+    let type_data_opt = match data.r#type {
+        1 => data.login,
+        2 => data.secure_note,
+        3 => data.card,
+        4 => data.identity,
+        5 => data.ssh_key,
+        6 => data.bank_account,
+        7 => data.drivers_license,
+        8 => data.passport,
+        _ => err!("Invalid type"),
+    };
+
+    if let Some(blob) = data.data.filter(|_| is_blob) {
+        // A blob holds all of the content, the name included, so nothing is kept outside it. The name
+        // column can't be null, so it's left empty; `to_json` reports it as null, as upstream does.
+        // TODO: Make `ciphers.name` nullable and store `None` here instead.
+        cipher.name = String::new();
+        cipher.notes = None;
+        cipher.fields = None;
+        cipher.password_history = None;
+        cipher.data = blob;
+    } else {
+        let Some(mut type_data) = type_data_opt else {
+            err!("Data missing")
+        };
+        // Remove the 'Response' key from the base object.
+        type_data.as_object_mut().unwrap().remove("response");
+        // Remove the 'Response' key from every Uri.
+        if type_data["uris"].is_array() {
+            type_data["uris"] = clean_cipher_data(type_data["uris"].clone());
+        }
+
+        // `validate_content` made sure there is a name
+        cipher.name = data.name.unwrap_or_default();
+        cipher.notes = data.notes;
+        cipher.fields = data.fields.map(|f| clean_cipher_data(f).to_string());
+        cipher.password_history = data.password_history.map(|f| f.to_string());
+        cipher.data = type_data.to_string();
+    }
+
+    cipher.key = data.key;
+    cipher.reprompt = data.reprompt.filter(|r| *r == RepromptType::None as i32 || *r == RepromptType::Password as i32);
 
     cipher.save(conn).await?;
     cipher.move_to_folder(data.folder_id, &headers.user.uuid, conn).await?;
@@ -728,12 +663,12 @@ async fn save_cipher_data(
     match data.archived_date {
         Some(dt_str) => match NaiveDateTime::parse_from_str(&dt_str, "%+") {
             Ok(dt) => cipher.set_archived_at(dt, &headers.user.uuid, conn).await?,
-            Err(err) => warn!("Error parsing ArchivedDate '{}': {err}", dt_str.escape_debug()),
+            Err(err) => warn!("Error parsing ArchivedDate '{dt_str}': {err}"),
         },
         None => cipher.unarchive(&headers.user.uuid, conn).await?,
     }
 
-    if ut != UpdateType::None && emit_side_effects {
+    if ut != UpdateType::None {
         // Only log events for organizational ciphers
         if let Some(org_id) = &cipher.organization_uuid {
             let event_type = match (&ut, transfer_cipher) {
@@ -758,132 +693,6 @@ async fn save_cipher_data(
     Ok(())
 }
 
-/// The cipher's own content from `data`, which has passed `validate_content` and `validate_type_data`: its type data or
-/// blob, name, notes, fields, password history, key and reprompt.
-fn set_cipher_content(cipher: &mut Cipher, data: &mut CipherData) -> EmptyResult {
-    // Cleanup cipher data, like removing the 'Response' key.
-    // This key is somewhere generated during Javascript so no way for us this fix this.
-    // Also, upstream only retrieves keys they actually want to store, and thus skip the 'Response' key.
-    // We do not mind which data is in it, the keep our model more flexible when there are upstream changes.
-    // But, we at least know we do not need to store and return this specific key.
-    fn clean_cipher_data(mut json_data: Value) -> Value {
-        if let Some(items) = json_data.as_array_mut() {
-            for item in items.iter_mut().filter_map(Value::as_object_mut) {
-                item.remove("response");
-            }
-        }
-        json_data
-    }
-
-    let is_blob = data.is_blob();
-    let type_data_opt = match data.r#type {
-        1 => data.login.take(),
-        2 => data.secure_note.take(),
-        3 => data.card.take(),
-        4 => data.identity.take(),
-        5 => data.ssh_key.take(),
-        6 => data.bank_account.take(),
-        7 => data.drivers_license.take(),
-        8 => data.passport.take(),
-        _ => err!("Invalid type"),
-    };
-
-    if let Some(blob) = data.data.take().filter(|_| is_blob) {
-        // A blob holds everything, the name included; the column can't be null, so it's left empty
-        // TODO: Make `ciphers.name` nullable and store `None` here instead.
-        cipher.name = String::new();
-        cipher.notes = None;
-        cipher.fields = None;
-        cipher.password_history = None;
-        cipher.data = blob;
-    } else {
-        let Some(mut type_data) = type_data_opt else {
-            err!("Data missing")
-        };
-        // Remove the 'Response' key from the base object.
-        if let Some(data_obj) = type_data.as_object_mut() {
-            data_obj.remove("response");
-        }
-        // Remove the 'Response' key from every Uri.
-        if type_data["uris"].is_array() {
-            type_data["uris"] = clean_cipher_data(type_data["uris"].clone());
-        }
-
-        // `validate_content` made sure there is a name
-        cipher.name = data.name.take().unwrap_or_default();
-        cipher.notes = data.notes.take();
-        cipher.fields = data.fields.take().map(|f| clean_cipher_data(f).to_string());
-        cipher.password_history = data.password_history.take().map(|f| f.to_string());
-        cipher.data = type_data.to_string();
-    }
-
-    cipher.key = data.key.take();
-    cipher.reprompt = data.reprompt.filter(|r| *r == RepromptType::None as i32 || *r == RepromptType::Password as i32);
-    Ok(())
-}
-
-/// Stores a personal cipher that is already encrypted, as [`save_cipher_data`] stores it but without its checks, events
-/// and pushes, for the test seeder (`unsafe_test_mode`). `folder_ids` maps the cipher's folder to a seeded one.
-#[cfg(feature = "unsafe_test_mode")]
-pub async fn seed_cipher(
-    encrypted: Value,
-    user_id: &UserId,
-    folder_ids: &HashMap<FolderId, FolderId>,
-    conn: &DbConn,
-) -> ApiResult<CipherId> {
-    // Not in the request model, but a trashed cipher has to stay trashed
-    let deleted_at = encrypted.get("deletedDate").and_then(Value::as_str).map(parse_seed_date).transpose()?;
-    let mut data: CipherData = serde_json::from_value(encrypted)?;
-    let is_blob = data.is_blob();
-    data.validate_content(is_blob)?;
-    data.validate_type_data(is_blob)?;
-
-    let mut cipher = Cipher::new(data.r#type);
-    cipher.user_uuid = Some(user_id.clone());
-    cipher.deleted_at = deleted_at;
-    set_cipher_content(&mut cipher, &mut data)?;
-    cipher.save(conn).await?;
-
-    let folder_id = data.folder_id.and_then(|id| folder_ids.get(&id).cloned());
-    cipher.move_to_folder(folder_id, user_id, conn).await?;
-    cipher.set_favorite(data.favorite, user_id, conn).await?;
-    if let Some(archived_date) = data.archived_date {
-        cipher.set_archived_at(parse_seed_date(&archived_date)?, user_id, conn).await?;
-    }
-
-    // Only the metadata: the files of a seeded cipher's attachments don't exist
-    for attachment in data.attachments.as_ref().and_then(Value::as_array).into_iter().flatten() {
-        let (Some(id), Some(file_name)) = (attachment["id"].as_str(), attachment["fileName"].as_str()) else {
-            err!("A seeded attachment needs an id and a file name")
-        };
-        // Clients send the size as a string
-        let size = match &attachment["size"] {
-            Value::Number(size) => size.as_i64(),
-            Value::String(size) => size.parse().ok(),
-            _ => None,
-        };
-        // Saving is an upsert, and destroying the play deletes the attachment: an id that exists isn't the seeding's
-        if id.is_empty() || !id.bytes().all(|b| b.is_ascii_lowercase() || b.is_ascii_digit() || b == b'-') {
-            err!(format!("Invalid attachment id {}", id.escape_debug()))
-        }
-        let id = AttachmentId(id.to_owned());
-        if Attachment::find_by_id(&id, conn).await.is_some() {
-            err!(format!("An attachment with id {id} already exists"))
-        }
-        let key = attachment["key"].as_str().map(str::to_owned);
-        Attachment::new(id, cipher.uuid.clone(), file_name.to_owned(), size.unwrap_or(0), key).save(conn).await?;
-    }
-    Ok(cipher.uuid)
-}
-
-#[cfg(feature = "unsafe_test_mode")]
-fn parse_seed_date(date: &str) -> ApiResult<NaiveDateTime> {
-    match chrono::DateTime::parse_from_rfc3339(date) {
-        Ok(date) => Ok(date.naive_utc()),
-        Err(e) => err!(format!("Invalid date {}: {e}", date.escape_debug())),
-    }
-}
-
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct ImportData {
@@ -940,12 +749,9 @@ async fn post_ciphers_import(data: Json<ImportData>, headers: Headers, conn: DbC
     for (index, mut cipher_data) in data.ciphers.into_iter().enumerate() {
         let folder_id = relations_map.get(&index).and_then(|i| folders.get(*i).cloned());
         cipher_data.folder_id = folder_id;
-        // A personal import always creates personal ciphers, the organization ID is ignored instead of rejected
-        // Upstream: https://github.com/bitwarden/server/blob/b06b81c1fb33ce9c9872b96397ba2b4d879b66af/src/Api/Tools/Controllers/ImportCiphersController.cs#L58
-        cipher_data.organization_id = None;
 
-        let mut cipher = Cipher::new(cipher_data.r#type);
-        update_cipher_from_data(&mut cipher, cipher_data, &headers, None, &conn, &nt, UpdateType::None, true).await?;
+        let mut cipher = Cipher::new(cipher_data.r#type, String::new());
+        update_cipher_from_data(&mut cipher, cipher_data, &headers, None, &conn, &nt, UpdateType::None).await?;
     }
 
     let mut user = headers.user;
@@ -964,12 +770,7 @@ async fn put_cipher_admin(
     conn: DbConn,
     nt: Notify<'_>,
 ) -> JsonResult {
-    // Only organization ciphers can be edited here, put_cipher() rejects an organization ID that isn't the cipher's
-    if data.organization_id.is_none() {
-        err_code!("Resource not found.", "Cipher is not an organization cipher", Status::NotFound.code);
-    }
-
-    put_cipher_impl(cipher_id, data, headers, CipherAccessScope::OrganizationAdmin, conn, nt).await
+    put_cipher(cipher_id, data, headers, conn, nt).await
 }
 
 #[post("/ciphers/<cipher_id>/admin", data = "<data>")]
@@ -980,7 +781,7 @@ async fn post_cipher_admin(
     conn: DbConn,
     nt: Notify<'_>,
 ) -> JsonResult {
-    put_cipher_admin(cipher_id, data, headers, conn, nt).await
+    post_cipher(cipher_id, data, headers, conn, nt).await
 }
 
 #[post("/ciphers/<cipher_id>", data = "<data>")]
@@ -1001,17 +802,6 @@ async fn put_cipher(
     headers: Headers,
     conn: DbConn,
     nt: Notify<'_>,
-) -> JsonResult {
-    put_cipher_impl(cipher_id, data, headers, CipherAccessScope::User, conn, nt).await
-}
-
-async fn put_cipher_impl(
-    cipher_id: CipherId,
-    data: Json<CipherData>,
-    headers: Headers,
-    scope: CipherAccessScope,
-    conn: DbConn,
-    nt: Notify<'_>,
 ) -> JsonResult {
     let data: CipherData = data.into_inner();
 
@@ -1024,21 +814,15 @@ async fn put_cipher_impl(
     // cipher itself, so the user shouldn't need write access to change these.
     // Interestingly, upstream Bitwarden doesn't properly handle this either.
 
-    if !cipher.is_write_accessible_to_user(&headers.user.uuid, scope, &conn).await {
+    if !cipher.is_write_accessible_to_user(&headers.user.uuid, &conn).await {
         err!("Cipher is not write accessible")
     }
 
-    // Against the cipher we hold rather than the organization the client claims, like upstream
-    validate_encrypted_by_user(&data, &headers.user, cipher.organization_uuid.is_some())?;
+    validate_encrypted_by_user_key(&data, &headers.user, cipher.organization_uuid.is_some())?;
 
-    // Moving a cipher into an organization is only possible through the share endpoints
-    if cipher.organization_uuid != data.organization_id {
-        err!("Organization mismatch. Please resync the client before updating the cipher")
-    }
+    update_cipher_from_data(&mut cipher, data, &headers, None, &conn, &nt, UpdateType::SyncCipherUpdate).await?;
 
-    update_cipher_from_data(&mut cipher, data, &headers, None, &conn, &nt, UpdateType::SyncCipherUpdate, true).await?;
-
-    Ok(Json(cipher_json_for_scope(&cipher, &headers, scope, &conn).await?))
+    Ok(Json(cipher.to_json(&headers.host, &headers.user.uuid, None, CipherSyncType::User, &conn).await?))
 }
 
 #[post("/ciphers/<cipher_id>/partial", data = "<data>")]
@@ -1065,7 +849,7 @@ async fn put_cipher_partial(
         err!("Cipher does not exist")
     };
 
-    if !cipher.is_accessible_to_user(&headers.user.uuid, CipherAccessScope::User, &conn).await {
+    if !cipher.is_accessible_to_user(&headers.user.uuid, &conn).await {
         err!("Cipher does not exist", "Cipher is not accessible for the current user")
     }
 
@@ -1136,7 +920,65 @@ async fn post_collections_update(
     conn: DbConn,
     nt: Notify<'_>,
 ) -> JsonResult {
-    update_collections_by_scope(cipher_id, data.into_inner(), headers, CipherAccessScope::User, conn, nt).await
+    let data: CollectionsAdminData = data.into_inner();
+
+    let Some(cipher) = Cipher::find_by_uuid(&cipher_id, &conn).await else {
+        err!("Cipher doesn't exist")
+    };
+
+    if !cipher.is_in_editable_collection_by_user(&headers.user.uuid, &conn).await {
+        err!("Collection cannot be changed")
+    }
+
+    let Some(ref org_uuid) = cipher.organization_uuid else {
+        err!("Cipher is not owned by an organization")
+    };
+
+    let posted_collections = HashSet::<CollectionId>::from_iter(data.collection_ids);
+    let current_collections =
+        HashSet::<CollectionId>::from_iter(cipher.get_collections(headers.user.uuid.clone(), &conn).await);
+
+    for collection in posted_collections.symmetric_difference(&current_collections) {
+        match Collection::find_by_uuid_and_org(collection, org_uuid, &conn).await {
+            None => err!("Invalid collection ID provided"),
+            Some(collection) => {
+                if collection.is_writable_by_user(&headers.user.uuid, &conn).await {
+                    if posted_collections.contains(&collection.uuid) {
+                        // Add to collection
+                        CollectionCipher::save(&cipher.uuid, &collection.uuid, &conn).await?;
+                    } else {
+                        // Remove from collection
+                        CollectionCipher::delete(&cipher.uuid, &collection.uuid, &conn).await?;
+                    }
+                } else {
+                    err!("No rights to modify the collection")
+                }
+            }
+        }
+    }
+
+    nt.send_cipher_update(
+        UpdateType::SyncCipherUpdate,
+        &cipher,
+        &cipher.update_users_revision(&conn).await,
+        &headers.device,
+        Some(Vec::from_iter(posted_collections)),
+        &conn,
+    )
+    .await;
+
+    log_event(
+        EventType::CipherUpdatedCollections,
+        &cipher.uuid,
+        org_uuid,
+        &headers.user.uuid,
+        headers.device.atype,
+        &headers.ip.ip,
+        &conn,
+    )
+    .await;
+
+    Ok(Json(cipher.to_json(&headers.host, &headers.user.uuid, None, CipherSyncType::User, &conn).await?))
 }
 
 #[put("/ciphers/<cipher_id>/collections-admin", data = "<data>")]
@@ -1158,98 +1000,65 @@ async fn post_collections_admin(
     conn: DbConn,
     nt: Notify<'_>,
 ) -> JsonResult {
-    update_collections_by_scope(cipher_id, data.into_inner(), headers, CipherAccessScope::OrganizationAdmin, conn, nt)
-        .await
-}
+    let data: CollectionsAdminData = data.into_inner();
 
-async fn update_collections_by_scope(
-    cipher_id: CipherId,
-    data: CollectionsAdminData,
-    headers: Headers,
-    scope: CipherAccessScope,
-    conn: DbConn,
-    nt: Notify<'_>,
-) -> JsonResult {
-    let (cipher, posted_collections, org_uuid, affected_users) = conn
-        .transaction(async || {
-            let Some(cipher) = Cipher::find_by_uuid(&cipher_id, &conn).await else {
-                err!("Cipher doesn't exist")
-            };
-            if !cipher.is_in_editable_collection_by_user(&headers.user.uuid, scope, &conn).await {
-                err!("Collection cannot be changed")
-            }
-            let Some(org_uuid) = cipher.organization_uuid.clone() else {
-                err!("Cipher is not owned by an organization")
-            };
-            let posted = HashSet::<CollectionId>::from_iter(data.collection_ids);
-            let current = HashSet::<CollectionId>::from_iter(match scope {
-                CipherAccessScope::User => cipher.get_collections(headers.user.uuid.clone(), &conn).await,
-                CipherAccessScope::OrganizationAdmin => {
-                    cipher.get_admin_collections(headers.user.uuid.clone(), scope, &conn).await
-                }
-            });
-            // The admin route accepts Edit Any for all collections of this cipher's organization.
-            // The personal route keeps the direct/group write check, even for that same member.
-            let admin_edit_any = scope == CipherAccessScope::OrganizationAdmin
-                && Membership::find_confirmed_by_user_and_org(&headers.user.uuid, &org_uuid, &conn)
-                    .await
-                    .is_some_and(|member| member.can_edit_any_collection());
-            for id in &posted {
-                if Collection::find_by_uuid_and_org(id, &org_uuid, &conn).await.is_none() {
-                    err!("Invalid collection ID provided")
-                }
-            }
-            let mut changes = Vec::new();
-            for id in posted.symmetric_difference(&current) {
-                let Some(collection) = Collection::find_by_uuid_and_org(id, &org_uuid, &conn).await else {
-                    err!("Invalid collection ID provided")
-                };
-                if !admin_edit_any && !collection.is_writable_by_user(&headers.user.uuid, &conn).await {
+    let Some(cipher) = Cipher::find_by_uuid(&cipher_id, &conn).await else {
+        err!("Cipher doesn't exist")
+    };
+
+    if !cipher.is_in_editable_collection_by_user(&headers.user.uuid, &conn).await {
+        err!("Collection cannot be changed")
+    }
+
+    let Some(ref org_uuid) = cipher.organization_uuid else {
+        err!("Cipher is not owned by an organization")
+    };
+
+    let posted_collections = HashSet::<CollectionId>::from_iter(data.collection_ids);
+    let current_collections =
+        HashSet::<CollectionId>::from_iter(cipher.get_admin_collections(headers.user.uuid.clone(), &conn).await);
+
+    for collection in posted_collections.symmetric_difference(&current_collections) {
+        match Collection::find_by_uuid_and_org(collection, org_uuid, &conn).await {
+            None => err!("Invalid collection ID provided"),
+            Some(collection) => {
+                if collection.is_writable_by_user(&headers.user.uuid, &conn).await {
+                    if posted_collections.contains(&collection.uuid) {
+                        // Add to collection
+                        CollectionCipher::save(&cipher.uuid, &collection.uuid, &conn).await?;
+                    } else {
+                        // Remove from collection
+                        CollectionCipher::delete(&cipher.uuid, &collection.uuid, &conn).await?;
+                    }
+                } else {
                     err!("No rights to modify the collection")
                 }
-                changes.push((collection.uuid, posted.contains(id)));
             }
-            // Every ID and permission has been checked. A database error rolls back links and revisions.
-            for (id, add) in changes {
-                if add {
-                    CollectionCipher::save(&cipher.uuid, &id, &conn).await?;
-                } else {
-                    CollectionCipher::delete(&cipher.uuid, &id, &conn).await?;
-                }
-            }
-            let affected_users = cipher.update_users_revision(&conn).await;
-            Ok((cipher, posted, org_uuid, affected_users))
-        })
-        .await?;
+        }
+    }
 
     nt.send_cipher_update(
         UpdateType::SyncCipherUpdate,
         &cipher,
-        &affected_users,
+        &cipher.update_users_revision(&conn).await,
         &headers.device,
         Some(Vec::from_iter(posted_collections)),
         &conn,
     )
     .await;
+
     log_event(
         EventType::CipherUpdatedCollections,
         &cipher.uuid,
-        &org_uuid,
+        org_uuid,
         &headers.user.uuid,
         headers.device.atype,
         &headers.ip.ip,
         &conn,
     )
     .await;
-    let response = match scope {
-        CipherAccessScope::User => {
-            cipher.to_json(&headers.host, &headers.user.uuid, None, CipherSyncType::User, &conn).await?
-        }
-        CipherAccessScope::OrganizationAdmin => {
-            cipher.to_json_org_admin_collections(&headers.host, &headers.user.uuid, &conn).await?
-        }
-    };
-    Ok(Json(response))
+
+    Ok(Json(cipher.to_json(&headers.host, &headers.user.uuid, None, CipherSyncType::Organization, &conn).await?))
 }
 
 #[derive(Deserialize)]
@@ -1269,7 +1078,9 @@ async fn post_cipher_share(
     conn: DbConn,
     nt: Notify<'_>,
 ) -> JsonResult {
-    put_cipher_share(cipher_id, data, headers, conn, nt).await
+    let data: ShareCipherData = data.into_inner();
+
+    share_cipher_by_uuid(&cipher_id, data, &headers, &conn, &nt, None).await
 }
 
 #[put("/ciphers/<cipher_id>/share", data = "<data>")]
@@ -1282,22 +1093,7 @@ async fn put_cipher_share(
 ) -> JsonResult {
     let data: ShareCipherData = data.into_inner();
 
-    // Upstream's `PutShare` checks, before anything is written.
-    // Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Api/Vault/Controllers/CiphersController.cs#L899-L912>
-    // and <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Api/Vault/Models/Request/CipherRequestModel.cs#L498-L519>
-    if data.cipher.organization_id.is_none() {
-        err!("Cipher OrganizationId is required.")
-    }
-    if data.collection_ids.is_empty() {
-        err!("You must select at least one collection.")
-    }
-    if !Cipher::find_by_uuid(&cipher_id, &conn).await.is_some_and(|c| c.user_uuid.as_ref() == Some(&headers.user.uuid))
-    {
-        err_code!("Cipher doesn't exist", Status::NotFound.code)
-    }
-    validate_encrypted_for_user(&data.cipher, &headers.user.uuid)?;
-
-    share_cipher_by_uuid(&cipher_id, None, data, &headers, CipherAccessScope::User, &conn, &nt, None).await
+    share_cipher_by_uuid(&cipher_id, data, &headers, &conn, &nt, None).await
 }
 
 #[derive(Deserialize)]
@@ -1307,140 +1103,91 @@ struct ShareSelectedCipherData {
     collection_ids: Vec<CollectionId>,
 }
 
-// A bulk share returns cipherMini models, not the cipherDetails models used by
-// the single-share route. Keep the encrypted legacy fields and a future v2
-// `data` blob, but do not expose details-only fields in this response.
-fn cipher_mini_from_json(mut cipher: Value) -> Value {
-    const FIELDS: &[&str] = &[
-        "id",
-        "organizationId",
-        "type",
-        "data",
-        "partialData",
-        "name",
-        "notes",
-        "login",
-        "card",
-        "identity",
-        "secureNote",
-        "sshKey",
-        "bankAccount",
-        "driversLicense",
-        "passport",
-        "fields",
-        "passwordHistory",
-        "attachments",
-        "organizationUseTotp",
-        "revisionDate",
-        "creationDate",
-        "deletedDate",
-        "reprompt",
-        "key",
-    ];
-
-    let Some(object) = cipher.as_object_mut() else {
-        return json!({ "object": "cipherMini" });
-    };
-    object.retain(|field, _| FIELDS.contains(&field.as_str()));
-    object.insert("object".into(), "cipherMini".into());
-    cipher
-}
-
 #[put("/ciphers/share", data = "<data>")]
 async fn put_cipher_share_selected(
     data: Json<ShareSelectedCipherData>,
     headers: Headers,
     conn: DbConn,
     nt: Notify<'_>,
-) -> JsonResult {
-    let data: ShareSelectedCipherData = data.into_inner();
+) -> EmptyResult {
+    let mut data: ShareSelectedCipherData = data.into_inner();
 
-    // Upstream's `PutShareMany` checks, before anything is written.
-    // Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Api/Vault/Controllers/CiphersController.cs#L1395-L1421>
-    // and <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Api/Vault/Models/Request/CipherRequestModel.cs#L560-L604>
     if data.ciphers.is_empty() {
         err!("You must select at least one cipher.")
     }
-    if data.ciphers.iter().any(|c| c.id.is_none() || c.organization_id.is_none()) {
-        err!("All Ciphers must have an Id and OrganizationId.")
-    }
-    if data.ciphers.iter().map(|c| &c.organization_id).collect::<HashSet<_>>().len() != 1 {
-        err!("All ciphers must be for the same organization.")
-    }
+
     if data.collection_ids.is_empty() {
         err!("You must select at least one collection.")
     }
+
     for cipher in &data.ciphers {
-        let is_blob = cipher.is_blob();
-        cipher.validate_content(is_blob)?;
-        cipher.validate_type_data(is_blob)?;
-    }
-    for cipher in &data.ciphers {
-        validate_encrypted_for_user(cipher, &headers.user.uuid)?;
-    }
-    let owned_ciphers = Cipher::find_owned_by_user(&headers.user.uuid, &conn).await;
-    for cipher_data in &data.ciphers {
-        let Some(cipher) = owned_ciphers.iter().find(|c| cipher_data.id.as_ref() == Some(&c.uuid)) else {
-            err!("Trying to share ciphers that you do not own.")
-        };
-        validate_cipher_update(cipher, cipher_data, &headers, &conn, UpdateType::None).await?;
+        if cipher.id.is_none() {
+            err!("Request missing ids field")
+        }
     }
 
-    let mut responses = Vec::with_capacity(data.ciphers.len());
-    for cipher in data.ciphers {
+    while let Some(cipher) = data.ciphers.pop() {
         let mut shared_cipher_data = ShareCipherData {
             cipher,
             collection_ids: data.collection_ids.clone(),
         };
 
         if let Some(id) = shared_cipher_data.cipher.id.take() {
-            let response = share_cipher_by_uuid(
-                &id,
-                None,
-                shared_cipher_data,
-                &headers,
-                CipherAccessScope::User,
-                &conn,
-                &nt,
-                Some(UpdateType::None),
-            )
-            .await?;
-
-            // Like upstream's VisibleToClient, withhold a cipher if sharing it
-            // removed the user's access to it. Only then include its encrypted
-            // mini response; the full single-share response stays internal.
-            if let Some(shared_cipher) = Cipher::find_by_uuid(&id, &conn).await
-                && shared_cipher.is_accessible_to_user(&headers.user.uuid, CipherAccessScope::User, &conn).await
-            {
-                responses.push(cipher_mini_from_json(response.into_inner()));
-            }
+            share_cipher_by_uuid(&id, shared_cipher_data, &headers, &conn, &nt, Some(UpdateType::None)).await?
         } else {
             err!("Request missing ids field")
-        }
+        };
     }
 
     // Multi share actions do not send out a push for each cipher, we need to send a general sync here
     nt.send_user_update(UpdateType::SyncCiphers, &headers.user, headers.device.push_uuid.as_ref(), &conn).await;
 
-    Ok(Json(json!({
-        "data": responses,
-        "object": "list",
-        "continuationToken": null,
-    })))
+    Ok(())
 }
 
-#[expect(clippy::too_many_arguments, reason = "New and existing ciphers share one atomic validation path")]
 async fn share_cipher_by_uuid(
     cipher_id: &CipherId,
-    new_cipher: Option<Cipher>,
     data: ShareCipherData,
     headers: &Headers,
-    // Only the admin creation route may use organization-wide collection authority.
-    response_scope: CipherAccessScope,
     conn: &DbConn,
     nt: &Notify<'_>,
     override_ut: Option<UpdateType>,
 ) -> JsonResult {
+    let mut cipher = if let Some(cipher) = Cipher::find_by_uuid(cipher_id, conn).await {
+        if cipher.is_write_accessible_to_user(&headers.user.uuid, conn).await {
+            cipher
+        } else {
+            err!("Cipher is not write accessible")
+        }
+    } else {
+        err!("Cipher doesn't exist")
+    };
+
+    // `update_cipher_from_data()` rejects this too, but only after the collections below were
+    // already linked. There are no transactions, so that would leave the cipher linked to a
+    // collection of another organization.
+    if cipher.organization_uuid.is_some() && cipher.organization_uuid != data.cipher.organization_id {
+        err!("Organization mismatch. Please resync the client before updating the cipher")
+    }
+
+    let mut shared_to_collections = vec![];
+
+    if let Some(organization_id) = &data.cipher.organization_id {
+        for col_id in &data.collection_ids {
+            match Collection::find_by_uuid_and_org(col_id, organization_id, conn).await {
+                None => err!("Invalid collection ID provided"),
+                Some(collection) => {
+                    if collection.is_writable_by_user(&headers.user.uuid, conn).await {
+                        CollectionCipher::save(&cipher.uuid, &collection.uuid, conn).await?;
+                        shared_to_collections.push(collection.uuid);
+                    } else {
+                        err!("No rights to modify the collection")
+                    }
+                }
+            }
+        }
+    }
+
     // When LastKnownRevisionDate is None, it is a new cipher, so send CipherCreate.
     // If there is an override, like when handling multiple items, we want to prevent a push notification for every single item
     let ut = if let Some(ut) = override_ut {
@@ -1450,81 +1197,10 @@ async fn share_cipher_by_uuid(
     } else {
         UpdateType::SyncCipherCreate
     };
-    let (cipher, shared_to_collections, transfer_cipher, affected_users) = conn
-        .transaction(async || {
-            let is_new = new_cipher.is_some();
-            let mut cipher = if let Some(cipher) = new_cipher {
-                cipher
-            } else if let Some(cipher) = Cipher::find_by_uuid(cipher_id, conn).await {
-                cipher
-            } else {
-                err!("Cipher doesn't exist")
-            };
-            if !cipher.is_write_accessible_to_user(&headers.user.uuid, CipherAccessScope::User, conn).await {
-                err!("Cipher is not write accessible")
-            }
-            if cipher.organization_uuid.is_some() && cipher.organization_uuid != data.cipher.organization_id {
-                err!("Organization mismatch. Please resync the client before updating the cipher")
-            }
-            let transfer_cipher = cipher.organization_uuid.is_none() && data.cipher.organization_id.is_some();
-            let mut shared_to_collections = Vec::new();
-            if let Some(organization_id) = &data.cipher.organization_id {
-                let admin_edit_any = response_scope == CipherAccessScope::OrganizationAdmin
-                    && Membership::find_confirmed_by_user_and_org(&headers.user.uuid, organization_id, conn)
-                        .await
-                        .is_some_and(|member| member.can_edit_any_collection());
-                if response_scope == CipherAccessScope::OrganizationAdmin && !admin_edit_any {
-                    err!("Cipher is not write accessible")
-                }
-                for col_id in HashSet::<CollectionId>::from_iter(data.collection_ids) {
-                    let Some(collection) = Collection::find_by_uuid_and_org(&col_id, organization_id, conn).await
-                    else {
-                        err!("Invalid collection ID provided")
-                    };
-                    if !admin_edit_any && !collection.is_writable_by_user(&headers.user.uuid, conn).await {
-                        err!("No rights to modify the collection")
-                    }
-                    shared_to_collections.push(collection.uuid);
-                }
-            }
-            if is_new {
-                cipher.save(conn).await?;
-            }
-            // Keep the cipher, collection links and affected revisions in one transaction.
-            // The helper still validates stale writes, ownership, folders and cipher data.
-            update_cipher_from_data(
-                &mut cipher,
-                data.cipher,
-                headers,
-                Some(shared_to_collections.clone()),
-                conn,
-                nt,
-                ut,
-                false,
-            )
-            .await?;
-            for col_id in &shared_to_collections {
-                CollectionCipher::save(&cipher.uuid, col_id, conn).await?;
-            }
-            // Bulk sharing skips per-cipher pushes, but new group-derived recipients still need a revision update.
-            let affected_users = cipher.update_users_revision(conn).await;
-            Ok((cipher, shared_to_collections, transfer_cipher, affected_users))
-        })
-        .await?;
 
-    if ut != UpdateType::None {
-        if let Some(org_id) = &cipher.organization_uuid {
-            let event_type = match (&ut, transfer_cipher) {
-                (UpdateType::SyncCipherCreate, true) => EventType::CipherCreated,
-                (UpdateType::SyncCipherUpdate, true) => EventType::CipherShared,
-                (_, _) => EventType::CipherUpdated,
-            };
-            log_event(event_type, &cipher.uuid, org_id, &headers.user.uuid, headers.device.atype, &headers.ip.ip, conn)
-                .await;
-        }
-        nt.send_cipher_update(ut, &cipher, &affected_users, &headers.device, Some(shared_to_collections), conn).await;
-    }
-    Ok(Json(cipher_json_for_scope(&cipher, headers, response_scope, conn).await?))
+    update_cipher_from_data(&mut cipher, data.cipher, headers, Some(shared_to_collections), conn, nt, ut).await?;
+
+    Ok(Json(cipher.to_json(&headers.host, &headers.user.uuid, None, CipherSyncType::User, conn).await?))
 }
 
 /// v2 API for downloading an attachment. This just redirects the client to
@@ -1539,44 +1215,12 @@ async fn get_attachment(
     attachment_id: AttachmentId,
     headers: Headers,
     conn: DbConn,
-) -> JsonResult {
-    get_attachment_data(cipher_id, attachment_id, headers, CipherAccessScope::User, conn).await
-}
-
-#[get("/ciphers/<cipher_id>/attachment/<attachment_id>/admin")]
-async fn get_attachment_admin(
-    cipher_id: CipherId,
-    attachment_id: AttachmentId,
-    headers: Headers,
-    conn: DbConn,
-) -> JsonResult {
-    get_attachment_data(cipher_id, attachment_id, headers, CipherAccessScope::OrganizationAdmin, conn).await
-}
-
-async fn get_attachment_data(
-    cipher_id: CipherId,
-    attachment_id: AttachmentId,
-    headers: Headers,
-    scope: CipherAccessScope,
-    conn: DbConn,
 ) -> JsonResult {
     let Some(cipher) = Cipher::find_by_uuid(&cipher_id, &conn).await else {
         err!("Cipher doesn't exist")
     };
 
-    if scope == CipherAccessScope::OrganizationAdmin {
-        // NotFound as in Bitwarden, the web vault then falls back to the attachment's own URL
-        let Some(org_id) = cipher.organization_uuid.as_ref() else {
-            err_code!("Cipher is not owned by an organization", Status::NotFound.code)
-        };
-        if !Membership::find_confirmed_by_user_and_org(&headers.user.uuid, org_id, &conn)
-            .await
-            .is_some_and(|member| member.can_edit_any_collection())
-            || !cipher.is_write_accessible_to_user(&headers.user.uuid, scope, &conn).await
-        {
-            err_code!("Cipher is not accessible", Status::NotFound.code)
-        }
-    } else if !cipher.is_accessible_to_user(&headers.user.uuid, scope, &conn).await {
+    if !cipher.is_accessible_to_user(&headers.user.uuid, &conn).await {
         err!("Cipher is not accessible")
     }
 
@@ -1601,40 +1245,6 @@ enum FileUploadType {
     // Azure = 1, // only used upstream
 }
 
-/// Remaining attachment storage in bytes for the cipher's owner, `None` when unlimited.
-/// `size_adjust` credits a v2 attachment whose record already counts as used.
-async fn attachment_size_limit(cipher: &Cipher, size_adjust: i64, conn: &DbConn) -> ApiResult<Option<i64>> {
-    let (limit_kb, already_used) = if let Some(ref user_id) = cipher.user_uuid {
-        let Some(limit_kb) = CONFIG.user_attachment_limit() else {
-            return Ok(None);
-        };
-        (limit_kb, Attachment::size_by_user(user_id, conn).await)
-    } else if let Some(ref org_id) = cipher.organization_uuid {
-        let Some(limit_kb) = CONFIG.org_attachment_limit() else {
-            return Ok(None);
-        };
-        (limit_kb, Attachment::size_by_org(org_id, conn).await)
-    } else {
-        err!("Cipher is neither owned by a user nor an organization");
-    };
-
-    if limit_kb == 0 {
-        err!("Attachments are disabled")
-    }
-
-    let Some(left) =
-        limit_kb.checked_mul(1024).and_then(|l| l.checked_sub(already_used)).and_then(|l| l.checked_add(size_adjust))
-    else {
-        err!("Attachment size overflow");
-    };
-
-    if left <= 0 {
-        err!("Attachment storage limit reached! Delete some attachments to free up space")
-    }
-
-    Ok(Some(left))
-}
-
 /// v2 API for creating an attachment associated with a cipher.
 /// This redirects the client to the API it should use to upload the attachment.
 /// For upstream's cloud-hosted service, it's an Azure object storage API.
@@ -1645,47 +1255,30 @@ async fn post_attachment_v2(
     data: Json<AttachmentRequestData>,
     headers: Headers,
     conn: DbConn,
-    nt: Notify<'_>,
 ) -> JsonResult {
-    let data: AttachmentRequestData = data.into_inner();
-
-    // `adminRequest` picks the check, the administrative one still needs a member who may edit any collection
-    let scope = CipherAccessScope::requested(data.admin_request);
-
     let Some(cipher) = Cipher::find_by_uuid(&cipher_id, &conn).await else {
         err!("Cipher doesn't exist")
     };
 
-    if !cipher.is_write_accessible_to_user(&headers.user.uuid, scope, &conn).await {
+    if !cipher.is_write_accessible_to_user(&headers.user.uuid, &conn).await {
         err!("Cipher is not write accessible")
     }
 
+    let data: AttachmentRequestData = data.into_inner();
     let file_size = data.file_size.into_i64()?;
 
     if file_size < 0 {
         err!("Attachment size can't be negative")
     }
-    // Matches the "file" upload limit in main.rs, nothing larger can be uploaded
-    if file_size > SIZE_525_MB {
-        err!("Max file size is 525 MB.")
-    }
-
-    if let Some(size_limit) = attachment_size_limit(&cipher, 0, &conn).await?
-        && file_size > size_limit
-    {
-        err!("Attachment storage limit exceeded with this file");
-    }
-
     let attachment_id = crypto::generate_attachment_id();
     let attachment =
         Attachment::new(attachment_id.clone(), cipher.uuid.clone(), data.file_name, file_size, Some(data.key));
     attachment.save(&conn).await.expect("Error saving attachment");
-    notify_attachment_created(&cipher, &headers, &conn, &nt).await;
 
     let url = format!("/ciphers/{}/attachment/{attachment_id}", cipher.uuid);
-    let response_key = match scope {
-        CipherAccessScope::OrganizationAdmin => "cipherMiniResponse",
-        CipherAccessScope::User => "cipherResponse",
+    let response_key = match data.admin_request {
+        Some(b) if b => "cipherMiniResponse",
+        _ => "cipherResponse",
     };
 
     Ok(Json(json!({ // AttachmentUploadDataResponseModel
@@ -1693,7 +1286,7 @@ async fn post_attachment_v2(
         "attachmentId": attachment_id,
         "url": url,
         "fileUploadType": FileUploadType::Direct as i32,
-        response_key: cipher_json_for_scope(&cipher, &headers, scope, &conn).await?,
+        response_key: cipher.to_json(&headers.host, &headers.user.uuid, None, CipherSyncType::User, &conn).await?,
     })))
 }
 
@@ -1716,7 +1309,6 @@ async fn save_attachment(
     cipher_id: CipherId,
     data: Form<UploadData<'_>>,
     headers: &Headers,
-    scope: CipherAccessScope,
     conn: DbConn,
     nt: Notify<'_>,
 ) -> Result<(Cipher, DbConn), crate::error::Error> {
@@ -1733,7 +1325,7 @@ async fn save_attachment(
         err!("Cipher doesn't exist")
     };
 
-    if !cipher.is_write_accessible_to_user(&headers.user.uuid, scope, &conn).await {
+    if !cipher.is_write_accessible_to_user(&headers.user.uuid, &conn).await {
         err!("Cipher is not write accessible")
     }
 
@@ -1744,7 +1336,55 @@ async fn save_attachment(
         Some(a) => a.file_size, // v2 API
     };
 
-    if let Some(size_limit) = attachment_size_limit(&cipher, size_adjust, &conn).await?
+    let size_limit = if let Some(ref user_id) = cipher.user_uuid {
+        match CONFIG.user_attachment_limit() {
+            Some(0) => err!("Attachments are disabled"),
+            Some(limit_kb) => {
+                let already_used = Attachment::size_by_user(user_id, &conn).await;
+                let left = limit_kb
+                    .checked_mul(1024)
+                    .and_then(|l| l.checked_sub(already_used))
+                    .and_then(|l| l.checked_add(size_adjust));
+
+                let Some(left) = left else {
+                    err!("Attachment size overflow");
+                };
+
+                if left <= 0 {
+                    err!("Attachment storage limit reached! Delete some attachments to free up space")
+                }
+
+                Some(left)
+            }
+            None => None,
+        }
+    } else if let Some(ref org_id) = cipher.organization_uuid {
+        match CONFIG.org_attachment_limit() {
+            Some(0) => err!("Attachments are disabled"),
+            Some(limit_kb) => {
+                let already_used = Attachment::size_by_org(org_id, &conn).await;
+                let left = limit_kb
+                    .checked_mul(1024)
+                    .and_then(|l| l.checked_sub(already_used))
+                    .and_then(|l| l.checked_add(size_adjust));
+
+                let Some(left) = left else {
+                    err!("Attachment size overflow");
+                };
+
+                if left <= 0 {
+                    err!("Attachment storage limit reached! Delete some attachments to free up space")
+                }
+
+                Some(left)
+            }
+            None => None,
+        }
+    } else {
+        err!("Cipher is neither owned by a user nor an organization");
+    };
+
+    if let Some(size_limit) = size_limit
         && size > size_limit
     {
         err!("Attachment storage limit exceeded with this file");
@@ -1801,23 +1441,13 @@ async fn save_attachment(
 
     save_temp_file(&PathType::Attachments, &format!("{cipher_id}/{file_id}"), data.data, true).await?;
 
-    // With the v2 API, post_attachment_v2() already did this when it created the attachment record
-    if attachment.is_none() {
-        notify_attachment_created(&cipher, headers, &conn, &nt).await;
-    }
-
-    Ok((cipher, conn))
-}
-
-/// Sends the cipher update to the clients and logs the attachment event
-async fn notify_attachment_created(cipher: &Cipher, headers: &Headers, conn: &DbConn, nt: &Notify<'_>) {
     nt.send_cipher_update(
         UpdateType::SyncCipherUpdate,
-        cipher,
-        &cipher.update_users_revision(conn).await,
+        &cipher,
+        &cipher.update_users_revision(&conn).await,
         &headers.device,
         None,
-        conn,
+        &conn,
     )
     .await;
 
@@ -1829,10 +1459,12 @@ async fn notify_attachment_created(cipher: &Cipher, headers: &Headers, conn: &Db
             &headers.user.uuid,
             headers.device.atype,
             &headers.ip.ip,
-            conn,
+            &conn,
         )
         .await;
     }
+
+    Ok((cipher, conn))
 }
 
 /// v2 API for uploading the actual data content of an attachment.
@@ -1854,26 +1486,11 @@ async fn post_attachment_v2_data(
         None => err!("Attachment doesn't exist"),
     };
 
-    // This request does not tell whether it is administrative, the member's own membership decides
-    let Some(cipher) = Cipher::find_by_uuid(&cipher_id, &conn).await else {
-        err!("Cipher doesn't exist")
-    };
-    let scope = cipher_scope_for_member(&cipher, &headers.user.uuid, &conn).await;
-
-    save_attachment(attachment, cipher_id, data, &headers, scope, conn, nt).await?;
+    save_attachment(attachment, cipher_id, data, &headers, conn, nt).await?;
 
     Ok(())
 }
 
-/// The access for a route on `cipher` which does not tell which one it is.
-async fn cipher_scope_for_member(cipher: &Cipher, user_id: &UserId, conn: &DbConn) -> CipherAccessScope {
-    let Some(org_id) = cipher.organization_uuid.as_ref() else {
-        return CipherAccessScope::User;
-    };
-
-    CipherAccessScope::for_member(Membership::find_confirmed_by_user_and_org(user_id, org_id, conn).await.as_ref())
-}
-
 /// Legacy API for creating an attachment associated with a cipher.
 #[post("/ciphers/<cipher_id>/attachment", format = "multipart/form-data", data = "<data>")]
 async fn post_attachment(
@@ -1883,7 +1500,13 @@ async fn post_attachment(
     conn: DbConn,
     nt: Notify<'_>,
 ) -> JsonResult {
-    post_attachment_impl(cipher_id, data, headers, CipherAccessScope::User, conn, nt).await
+    // Setting this as None signifies to save_attachment() that it should create
+    // the attachment database record as well as saving the data to disk.
+    let attachment = None;
+
+    let (cipher, conn) = save_attachment(attachment, cipher_id, data, &headers, conn, nt).await?;
+
+    Ok(Json(cipher.to_json(&headers.host, &headers.user.uuid, None, CipherSyncType::User, &conn).await?))
 }
 
 #[post("/ciphers/<cipher_id>/attachment-admin", format = "multipart/form-data", data = "<data>")]
@@ -1894,24 +1517,7 @@ async fn post_attachment_admin(
     conn: DbConn,
     nt: Notify<'_>,
 ) -> JsonResult {
-    post_attachment_impl(cipher_id, data, headers, CipherAccessScope::OrganizationAdmin, conn, nt).await
-}
-
-async fn post_attachment_impl(
-    cipher_id: CipherId,
-    data: Form<UploadData<'_>>,
-    headers: Headers,
-    scope: CipherAccessScope,
-    conn: DbConn,
-    nt: Notify<'_>,
-) -> JsonResult {
-    // Setting this as None signifies to save_attachment() that it should create
-    // the attachment database record as well as saving the data to disk.
-    let attachment = None;
-
-    let (cipher, conn) = save_attachment(attachment, cipher_id, data, &headers, scope, conn, nt).await?;
-
-    Ok(Json(cipher_json_for_scope(&cipher, &headers, scope, &conn).await?))
+    post_attachment(cipher_id, data, headers, conn, nt).await
 }
 
 #[post("/ciphers/<cipher_id>/attachment/<attachment_id>/share", format = "multipart/form-data", data = "<data>")]
@@ -1923,7 +1529,7 @@ async fn post_attachment_share(
     conn: DbConn,
     nt: Notify<'_>,
 ) -> JsonResult {
-    delete_cipher_attachment_by_id(&cipher_id, &attachment_id, &headers, CipherAccessScope::User, &conn, &nt).await?;
+    delete_cipher_attachment_by_id(&cipher_id, &attachment_id, &headers, &conn, &nt).await?;
     post_attachment(cipher_id, data, headers, conn, nt).await
 }
 
@@ -1935,15 +1541,7 @@ async fn delete_attachment_post_admin(
     conn: DbConn,
     nt: Notify<'_>,
 ) -> JsonResult {
-    delete_cipher_attachment_by_id(
-        &cipher_id,
-        &attachment_id,
-        &headers,
-        CipherAccessScope::OrganizationAdmin,
-        &conn,
-        &nt,
-    )
-    .await
+    delete_attachment(cipher_id, attachment_id, headers, conn, nt).await
 }
 
 #[post("/ciphers/<cipher_id>/attachment/<attachment_id>/delete")]
@@ -1965,7 +1563,7 @@ async fn delete_attachment(
     conn: DbConn,
     nt: Notify<'_>,
 ) -> JsonResult {
-    delete_cipher_attachment_by_id(&cipher_id, &attachment_id, &headers, CipherAccessScope::User, &conn, &nt).await
+    delete_cipher_attachment_by_id(&cipher_id, &attachment_id, &headers, &conn, &nt).await
 }
 
 #[delete("/ciphers/<cipher_id>/attachment/<attachment_id>/admin")]
@@ -1976,77 +1574,42 @@ async fn delete_attachment_admin(
     conn: DbConn,
     nt: Notify<'_>,
 ) -> JsonResult {
-    delete_cipher_attachment_by_id(
-        &cipher_id,
-        &attachment_id,
-        &headers,
-        CipherAccessScope::OrganizationAdmin,
-        &conn,
-        &nt,
-    )
-    .await
+    delete_cipher_attachment_by_id(&cipher_id, &attachment_id, &headers, &conn, &nt).await
 }
 
 #[post("/ciphers/<cipher_id>/delete")]
 async fn delete_cipher_post(cipher_id: CipherId, headers: Headers, conn: DbConn, nt: Notify<'_>) -> EmptyResult {
-    delete_cipher_by_uuid(&cipher_id, &headers, CipherAccessScope::User, &conn, &CipherDeleteOptions::HardSingle, &nt)
-        .await
+    delete_cipher_by_uuid(&cipher_id, &headers, &conn, &CipherDeleteOptions::HardSingle, &nt).await
     // permanent delete
 }
 
 #[post("/ciphers/<cipher_id>/delete-admin")]
 async fn delete_cipher_post_admin(cipher_id: CipherId, headers: Headers, conn: DbConn, nt: Notify<'_>) -> EmptyResult {
-    delete_cipher_by_uuid(
-        &cipher_id,
-        &headers,
-        CipherAccessScope::OrganizationAdmin,
-        &conn,
-        &CipherDeleteOptions::HardSingle,
-        &nt,
-    )
-    .await
+    delete_cipher_by_uuid(&cipher_id, &headers, &conn, &CipherDeleteOptions::HardSingle, &nt).await
     // permanent delete
 }
 
 #[put("/ciphers/<cipher_id>/delete")]
 async fn delete_cipher_put(cipher_id: CipherId, headers: Headers, conn: DbConn, nt: Notify<'_>) -> EmptyResult {
-    delete_cipher_by_uuid(&cipher_id, &headers, CipherAccessScope::User, &conn, &CipherDeleteOptions::SoftSingle, &nt)
-        .await
+    delete_cipher_by_uuid(&cipher_id, &headers, &conn, &CipherDeleteOptions::SoftSingle, &nt).await
     // soft delete
 }
 
 #[put("/ciphers/<cipher_id>/delete-admin")]
 async fn delete_cipher_put_admin(cipher_id: CipherId, headers: Headers, conn: DbConn, nt: Notify<'_>) -> EmptyResult {
-    delete_cipher_by_uuid(
-        &cipher_id,
-        &headers,
-        CipherAccessScope::OrganizationAdmin,
-        &conn,
-        &CipherDeleteOptions::SoftSingle,
-        &nt,
-    )
-    .await
+    delete_cipher_by_uuid(&cipher_id, &headers, &conn, &CipherDeleteOptions::SoftSingle, &nt).await
     // soft delete
 }
 
 #[delete("/ciphers/<cipher_id>")]
 async fn delete_cipher(cipher_id: CipherId, headers: Headers, conn: DbConn, nt: Notify<'_>) -> EmptyResult {
-    delete_cipher_by_uuid(&cipher_id, &headers, CipherAccessScope::User, &conn, &CipherDeleteOptions::HardSingle, &nt)
-        .await
+    delete_cipher_by_uuid(&cipher_id, &headers, &conn, &CipherDeleteOptions::HardSingle, &nt).await
     // permanent delete
 }
 
 #[delete("/ciphers/<cipher_id>/admin")]
 async fn delete_cipher_admin(cipher_id: CipherId, headers: Headers, conn: DbConn, nt: Notify<'_>) -> EmptyResult {
-    delete_cipher_by_uuid(
-        &cipher_id,
-        &headers,
-        CipherAccessScope::OrganizationAdmin,
-        &conn,
-        &CipherDeleteOptions::HardSingle,
-        &nt,
-    )
-    .await
+    delete_cipher_by_uuid(&cipher_id, &headers, &conn, &CipherDeleteOptions::HardSingle, &nt).await
     // permanent delete
 }
 
@@ -2057,7 +1620,7 @@ async fn delete_cipher_selected(
     conn: DbConn,
     nt: Notify<'_>,
 ) -> EmptyResult {
-    delete_multiple_ciphers(data, headers, CipherAccessScope::User, conn, CipherDeleteOptions::HardMulti, nt).await
+    delete_multiple_ciphers(data, headers, conn, CipherDeleteOptions::HardMulti, nt).await
     // permanent delete
 }
 
@@ -2068,7 +1631,7 @@ async fn delete_cipher_selected_post(
     conn: DbConn,
     nt: Notify<'_>,
 ) -> EmptyResult {
-    delete_multiple_ciphers(data, headers, CipherAccessScope::User, conn, CipherDeleteOptions::HardMulti, nt).await
+    delete_multiple_ciphers(data, headers, conn, CipherDeleteOptions::HardMulti, nt).await
     // permanent delete
 }
 
@@ -2079,7 +1642,7 @@ async fn delete_cipher_selected_put(
     conn: DbConn,
     nt: Notify<'_>,
 ) -> EmptyResult {
-    delete_multiple_ciphers(data, headers, CipherAccessScope::User, conn, CipherDeleteOptions::SoftMulti, nt).await
+    delete_multiple_ciphers(data, headers, conn, CipherDeleteOptions::SoftMulti, nt).await
     // soft delete
 }
 
@@ -2090,15 +1653,7 @@ async fn delete_cipher_selected_admin(
     conn: DbConn,
     nt: Notify<'_>,
 ) -> EmptyResult {
-    delete_multiple_ciphers(
-        data,
-        headers,
-        CipherAccessScope::OrganizationAdmin,
-        conn,
-        CipherDeleteOptions::HardMulti,
-        nt,
-    )
-    .await
+    delete_multiple_ciphers(data, headers, conn, CipherDeleteOptions::HardMulti, nt).await
     // permanent delete
 }
 
@@ -2109,15 +1664,7 @@ async fn delete_cipher_selected_post_admin(
     conn: DbConn,
     nt: Notify<'_>,
 ) -> EmptyResult {
-    delete_multiple_ciphers(
-        data,
-        headers,
-        CipherAccessScope::OrganizationAdmin,
-        conn,
-        CipherDeleteOptions::HardMulti,
-        nt,
-    )
-    .await
+    delete_multiple_ciphers(data, headers, conn, CipherDeleteOptions::HardMulti, nt).await
     // permanent delete
 }
 
@@ -2128,26 +1675,18 @@ async fn delete_cipher_selected_put_admin(
     conn: DbConn,
     nt: Notify<'_>,
 ) -> EmptyResult {
-    delete_multiple_ciphers(
-        data,
-        headers,
-        CipherAccessScope::OrganizationAdmin,
-        conn,
-        CipherDeleteOptions::SoftMulti,
-        nt,
-    )
-    .await
+    delete_multiple_ciphers(data, headers, conn, CipherDeleteOptions::SoftMulti, nt).await
     // soft delete
 }
 
 #[put("/ciphers/<cipher_id>/restore")]
 async fn restore_cipher_put(cipher_id: CipherId, headers: Headers, conn: DbConn, nt: Notify<'_>) -> JsonResult {
-    restore_cipher_by_uuid(&cipher_id, &headers, false, CipherAccessScope::User, &conn, &nt).await
+    restore_cipher_by_uuid(&cipher_id, &headers, false, &conn, &nt).await
 }
 
 #[put("/ciphers/<cipher_id>/restore-admin")]
 async fn restore_cipher_put_admin(cipher_id: CipherId, headers: Headers, conn: DbConn, nt: Notify<'_>) -> JsonResult {
-    restore_cipher_by_uuid(&cipher_id, &headers, false, CipherAccessScope::OrganizationAdmin, &conn, &nt).await
+    restore_cipher_by_uuid(&cipher_id, &headers, false, &conn, &nt).await
 }
 
 #[put("/ciphers/restore-admin", data = "<data>")]
@@ -2157,7 +1696,7 @@ async fn restore_cipher_selected_admin(
     conn: DbConn,
     nt: Notify<'_>,
 ) -> JsonResult {
-    restore_multiple_ciphers(data, &headers, CipherAccessScope::OrganizationAdmin, &conn, &nt).await
+    restore_multiple_ciphers(data, &headers, &conn, &nt).await
 }
 
 #[put("/ciphers/restore", data = "<data>")]
@@ -2167,7 +1706,7 @@ async fn restore_cipher_selected(
     conn: DbConn,
     nt: Notify<'_>,
 ) -> JsonResult {
-    restore_multiple_ciphers(data, &headers, CipherAccessScope::User, &conn, &nt).await
+    restore_multiple_ciphers(data, &headers, &conn, &nt).await
 }
 
 #[derive(Deserialize)]
@@ -2201,22 +1740,12 @@ async fn move_cipher_selected(
     // Find all ciphers a user has access to, all others will be ignored
     let accessible_ciphers = Cipher::find_by_user_and_ciphers(user_id, &data.ids, &conn).await;
     let accessible_ciphers_count = accessible_ciphers.len();
-    let mut move_result = Ok(());
     for cipher in accessible_ciphers {
-        move_result = cipher.move_to_folder_without_revision_update(data.folder_id.clone(), user_id, &conn).await;
-        if move_result.is_err() {
-            break;
-        }
+        cipher.move_to_folder(data.folder_id.clone(), user_id, &conn).await?;
         if cipher_count == 1 {
             single_cipher = Some(cipher);
         }
     }
-    // Update the revision once for the whole batch. Also when a move failed halfway,
-    // since the ciphers moved before it are already changed.
-    if accessible_ciphers_count > 0 {
-        User::update_uuid_revision(user_id, &conn).await;
-    }
-    move_result?;
 
     if let Some(cipher) = single_cipher {
         nt.send_cipher_update(
@@ -2368,7 +1897,6 @@ pub enum CipherDeleteOptions {
 async fn delete_cipher_by_uuid(
     cipher_id: &CipherId,
     headers: &Headers,
-    scope: CipherAccessScope,
     conn: &DbConn,
     delete_options: &CipherDeleteOptions,
     nt: &Notify<'_>,
@@ -2377,7 +1905,7 @@ async fn delete_cipher_by_uuid(
         err!("Cipher doesn't exist")
     };
 
-    if !cipher.is_write_accessible_to_user(&headers.user.uuid, scope, conn).await {
+    if !cipher.is_write_accessible_to_user(&headers.user.uuid, conn).await {
         err!("Cipher can't be deleted by user")
     }
 
@@ -2429,13 +1957,12 @@ async fn delete_cipher_by_uuid(
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct CipherIdsData {
-    ids: HashSet<CipherId>,
+    ids: Vec<CipherId>,
 }
 
 async fn delete_multiple_ciphers(
     data: Json<CipherIdsData>,
     headers: Headers,
-    scope: CipherAccessScope,
     conn: DbConn,
     delete_options: CipherDeleteOptions,
     nt: Notify<'_>,
@@ -2443,7 +1970,7 @@ async fn delete_multiple_ciphers(
     let data = data.into_inner();
 
     for cipher_id in data.ids {
-        if let error @ Err(_) = delete_cipher_by_uuid(&cipher_id, &headers, scope, &conn, &delete_options, &nt).await {
+        if let error @ Err(_) = delete_cipher_by_uuid(&cipher_id, &headers, &conn, &delete_options, &nt).await {
             return error;
         }
     }
@@ -2458,7 +1985,6 @@ async fn restore_cipher_by_uuid(
     cipher_id: &CipherId,
     headers: &Headers,
     multi_restore: bool,
-    scope: CipherAccessScope,
     conn: &DbConn,
     nt: &Notify<'_>,
 ) -> JsonResult {
@@ -2466,7 +1992,7 @@ async fn restore_cipher_by_uuid(
         err!("Cipher doesn't exist")
     };
 
-    if !cipher.is_write_accessible_to_user(&headers.user.uuid, scope, conn).await {
+    if !cipher.is_write_accessible_to_user(&headers.user.uuid, conn).await {
         err!("Cipher can't be restored by user")
     }
 
@@ -2498,13 +2024,12 @@ async fn restore_cipher_by_uuid(
         .await;
     }
 
-    Ok(Json(cipher_json_for_scope(&cipher, headers, scope, conn).await?))
+    Ok(Json(cipher.to_json(&headers.host, &headers.user.uuid, None, CipherSyncType::User, conn).await?))
 }
 
 async fn restore_multiple_ciphers(
     data: Json<CipherIdsData>,
     headers: &Headers,
-    scope: CipherAccessScope,
     conn: &DbConn,
     nt: &Notify<'_>,
 ) -> JsonResult {
@@ -2512,7 +2037,7 @@ async fn restore_multiple_ciphers(
 
     let mut ciphers: Vec<Value> = Vec::new();
     for cipher_id in data.ids {
-        match restore_cipher_by_uuid(&cipher_id, headers, true, scope, conn, nt).await {
+        match restore_cipher_by_uuid(&cipher_id, headers, true, conn, nt).await {
             Ok(json) => ciphers.push(json.into_inner()),
             err => return err,
         }
@@ -2532,7 +2057,6 @@ async fn delete_cipher_attachment_by_id(
     cipher_id: &CipherId,
     attachment_id: &AttachmentId,
     headers: &Headers,
-    scope: CipherAccessScope,
     conn: &DbConn,
     nt: &Notify<'_>,
 ) -> JsonResult {
@@ -2548,7 +2072,7 @@ async fn delete_cipher_attachment_by_id(
         err!("Cipher doesn't exist")
     };
 
-    if !cipher.is_write_accessible_to_user(&headers.user.uuid, scope, conn).await {
+    if !cipher.is_write_accessible_to_user(&headers.user.uuid, conn).await {
         err!("Cipher cannot be deleted by user")
     }
 
@@ -2576,7 +2100,7 @@ async fn delete_cipher_attachment_by_id(
         )
         .await;
     }
-    let cipher_json = cipher_json_for_scope(&cipher, headers, scope, conn).await?;
+    let cipher_json = cipher.to_json(&headers.host, &headers.user.uuid, None, CipherSyncType::User, conn).await?;
     Ok(Json(json!({"cipher":cipher_json})))
 }
 
@@ -2591,7 +2115,7 @@ async fn archive_cipher(
         err!("Cipher doesn't exist")
     };
 
-    if !cipher.is_accessible_to_user(&headers.user.uuid, CipherAccessScope::User, conn).await {
+    if !cipher.is_accessible_to_user(&headers.user.uuid, conn).await {
         err!("Cipher is not accessible for the current user")
     }
 
@@ -2623,7 +2147,7 @@ async fn unarchive_cipher(
         err!("Cipher doesn't exist")
     };
 
-    if !cipher.is_accessible_to_user(&headers.user.uuid, CipherAccessScope::User, conn).await {
+    if !cipher.is_accessible_to_user(&headers.user.uuid, conn).await {
         err!("Cipher is not accessible for the current user")
     }
 
@@ -2744,15 +2268,8 @@ impl CipherSyncData {
             }
         }
 
-        // Generate a HashMap with the Organization UUID as key and the Membership record
-        let members: HashMap<OrganizationId, Membership> = Membership::find_confirmed_by_user(user_id, conn)
-            .await
-            .into_iter()
-            .map(|m| (m.org_uuid.clone(), m))
-            .collect();
-
         // Generate a list of Cipher UUID's containing a Vec with one or more Attachment records
-        let orgs: Vec<OrganizationId> = members.keys().cloned().collect();
+        let orgs = Membership::get_orgs_by_user(user_id, conn).await;
         let attachments = Attachment::find_all_by_user_and_orgs(user_id, &orgs, conn).await;
         let mut cipher_attachments: HashMap<CipherId, Vec<Attachment>> = HashMap::with_capacity(attachments.len());
         for attachment in attachments {
@@ -2767,6 +2284,13 @@ impl CipherSyncData {
             cipher_collections.entry(cipher).or_default().push(collection);
         }
 
+        // Generate a HashMap with the Organization UUID as key and the Membership record
+        let members: HashMap<OrganizationId, Membership> = Membership::find_confirmed_by_user(user_id, conn)
+            .await
+            .into_iter()
+            .map(|m| (m.org_uuid.clone(), m))
+            .collect();
+
         // Generate a HashMap with the User_Collections UUID as key and the CollectionUser record
         let user_collections: HashMap<CollectionId, CollectionUser> = CollectionUser::find_by_user(user_id, conn)
             .await
@@ -2815,147 +2339,3 @@ impl CipherSyncData {
         }
     }
 }
-
-#[cfg(all(test, sqlite))]
-mod custom_role_tests {
-    use super::*;
-    use crate::{
-        api::notifications::{WS_USERS, WebSocketUsers},
-        auth::ClientIp,
-        db::{
-            models::{CustomPermission, Device, User},
-            test_db,
-        },
-    };
-    use chrono::Datelike;
-    use diesel::connection::SimpleConnection;
-    use std::sync::Arc;
-
-    #[test]
-    fn bulk_share_preserves_vault_scope_collection_ids_and_user_revisions() {
-        test_db::run(async |db| {
-            let conn = db.conn();
-            let (org, user, mut member) = test_db::custom_member(&conn, CustomPermission::EditAnyCollection).await;
-            let (reader, _) = test_db::member(&conn, &org.uuid, MembershipType::User, &[]).await;
-            let collection = test_db::collection(&conn, &org.uuid).await;
-            let hidden = test_db::collection(&conn, &org.uuid).await;
-            CollectionUser::save(&reader.uuid, &collection.uuid, false, false, false, &conn).await.unwrap();
-            let mut ids = Vec::new();
-            for _ in 0..2 {
-                let mut cipher = Cipher::new(2);
-                cipher.name = "Personal".into();
-                cipher.user_uuid = Some(user.uuid.clone());
-                cipher.save(&conn).await.unwrap();
-                ids.push(cipher.uuid);
-            }
-            let rocket = rocket::build().manage(Arc::clone(&WS_USERS));
-            let notify = rocket.state::<Arc<WebSocketUsers>>().unwrap();
-            for assigned in [false, true] {
-                if assigned {
-                    CollectionUser::save(&user.uuid, &collection.uuid, false, false, true, &conn).await.unwrap();
-                }
-                conn.run(|db| db.batch_execute("UPDATE users SET updated_at='2000-01-01 00:00:00'")).await.unwrap();
-                let ciphers = ids
-                    .iter()
-                    .map(|id| {
-                        serde_json::from_value(json!({
-                            "id": id, "name": "Shared", "type": 2, "organizationId": org.uuid,
-                            "encryptedFor": user.uuid, "secureNote": {"type": 0}
-                        }))
-                        .unwrap()
-                    })
-                    .collect();
-                let headers = Headers {
-                    host: "http://localhost".into(),
-                    device: Device::new("test".to_owned().into(), user.uuid.clone(), "test".into(), 1),
-                    user: User::find_by_uuid(&user.uuid, &conn).await.unwrap(),
-                    ip: ClientIp {
-                        ip: "127.0.0.1".parse().unwrap(),
-                    },
-                };
-                let result = put_cipher_share_selected(
-                    Json(ShareSelectedCipherData {
-                        ciphers,
-                        collection_ids: vec![collection.uuid.clone()],
-                    }),
-                    headers,
-                    db.conn(),
-                    notify.into(),
-                )
-                .await;
-                assert_eq!(result.is_ok(), assigned);
-                if assigned {
-                    let response = result.unwrap().into_inner();
-                    assert_eq!(response["object"], "list");
-                    let ciphers = response["data"].as_array().unwrap();
-                    assert_eq!(ciphers.len(), ids.len());
-                    for cipher in ciphers {
-                        assert_eq!(cipher["object"], "cipherMini");
-                        assert_eq!(cipher["organizationId"], json!(org.uuid));
-                        assert!(cipher.get("collectionIds").is_none());
-                        assert!(cipher.get("edit").is_none());
-                    }
-                }
-                for id in &ids {
-                    let cipher = Cipher::find_by_uuid(id, &conn).await.unwrap();
-                    assert_eq!(cipher.organization_uuid.as_ref(), assigned.then_some(&org.uuid));
-                    assert_eq!(cipher.user_uuid.as_ref(), (!assigned).then_some(&user.uuid));
-                }
-                let revision = User::find_by_uuid(&reader.uuid, &conn).await.unwrap().updated_at;
-                assert_eq!(revision.year() > 2000, assigned);
-            }
-            let mut cipher = Cipher::find_by_uuid(&ids[0], &conn).await.unwrap();
-            CollectionCipher::save(&cipher.uuid, &hidden.uuid, &conn).await.unwrap();
-            let personal =
-                cipher.to_json("http://localhost", &user.uuid, None, CipherSyncType::User, &conn).await.unwrap();
-            let admin = cipher.to_json_org_admin("http://localhost", &member.user_uuid, &conn).await.unwrap();
-            assert_eq!(personal["collectionIds"], json!([collection.uuid]));
-            let admin_ids = admin["collectionIds"].as_array().unwrap();
-            assert_eq!(admin_ids.len(), 2);
-            assert!(admin_ids.contains(&json!(collection.uuid)));
-            assert!(admin_ids.contains(&json!(hidden.uuid)));
-            // Exercise PR2's SQL authorization independently of Custom permission support added in PR3.
-            let sql = format!("DELETE FROM users_collections WHERE user_uuid='{}'", user.uuid);
-            conn.run(move |c| c.batch_execute(&sql)).await.unwrap();
-            let foreign = test_db::organization(&conn).await;
-            let admin_scope = CipherAccessScope::requested(Some(true));
-            assert_eq!(admin_scope, CipherAccessScope::OrganizationAdmin);
-            assert_eq!(CipherAccessScope::for_member(None), CipherAccessScope::User);
-            for request in [None, Some(false)] {
-                assert_eq!(CipherAccessScope::requested(request), CipherAccessScope::User);
-            }
-            for (role, status, all, allowed) in [
-                (MembershipType::User, 2, false, false),
-                (MembershipType::Custom, 2, false, false),
-                (MembershipType::Manager, 2, false, false),
-                (MembershipType::Manager, 2, true, true),
-                (MembershipType::Owner, 2, false, true),
-                (MembershipType::Admin, 2, false, true),
-                (MembershipType::Admin, 1, false, false),
-                (MembershipType::Admin, -126, false, false),
-            ] {
-                member.set_type(role);
-                member.status = status;
-                member.access_all = all;
-                member.save(&conn).await.unwrap();
-                assert_eq!(
-                    CipherAccessScope::for_member(Some(&member)),
-                    if allowed {
-                        admin_scope
-                    } else {
-                        CipherAccessScope::User
-                    }
-                );
-                for org_id in [&org.uuid, &foreign.uuid] {
-                    cipher.organization_uuid = Some(org_id.clone());
-                    for scope in [CipherAccessScope::User, admin_scope] {
-                        assert_eq!(
-                            cipher.is_write_accessible_to_user(&user.uuid, scope, &conn).await,
-                            allowed && org_id == &org.uuid
-                        );
-                    }
-                }
-            }
-        });
-    }
-}
diff --git a/src/api/core/emergency_access.rs b/src/api/core/emergency_access.rs
index 773697e5..2eb95502 100644
--- a/src/api/core/emergency_access.rs
+++ b/src/api/core/emergency_access.rs
@@ -1,4 +1,4 @@
-use chrono::Utc;
+use chrono::{TimeDelta, Utc};
 use rocket::{Route, serde::json::Json};
 use serde_json::Value;
 
@@ -6,17 +6,14 @@ use crate::{
     CONFIG,
     api::{
         EmptyResult, JsonResult,
-        core::{
-            CipherSyncData, CipherSyncType,
-            accounts::{AuthenticationData, UnlockData},
-        },
+        core::{CipherSyncData, CipherSyncType},
     },
     auth::{Headers, decode_emergency_access_invite},
     db::{
         DbConn, DbPool,
         models::{
-            Cipher, EMERGENCY_ACCESS_TIMEOUT_RANGE, EmergencyAccess, EmergencyAccessId, EmergencyAccessStatus,
-            EmergencyAccessType, Invitation, Membership, MembershipType, OrgPolicy, TwoFactor, User, UserId,
+            Cipher, EmergencyAccess, EmergencyAccessId, EmergencyAccessStatus, EmergencyAccessType, Invitation,
+            Membership, MembershipType, OrgPolicy, TwoFactor, User, UserId,
         },
     },
     mail,
@@ -136,21 +133,19 @@ async fn post_emergency_access(
 
     let data: EmergencyAccessUpdateData = data.into_inner();
 
-    let Some(new_type) = EmergencyAccessType::from_str(&data.r#type.into_string()) else {
-        err!("Invalid emergency access type.")
-    };
-
-    if !(EMERGENCY_ACCESS_TIMEOUT_RANGE).contains(&data.wait_time_days) {
-        err!("Emergency access wait time is out-of-bounds!")
-    }
-
     let Some(mut emergency_access) =
         EmergencyAccess::find_by_uuid_and_grantor_uuid(&emer_id, &headers.user.uuid, &conn).await
     else {
         err!("Emergency access not valid.")
     };
 
-    emergency_access.atype = new_type as i32;
+    let new_type = if let Some(new_type) = EmergencyAccessType::from_str(&data.r#type.into_string()) {
+        new_type as i32
+    } else {
+        err!("Invalid emergency access type.")
+    };
+
+    emergency_access.atype = new_type;
     emergency_access.wait_time_days = data.wait_time_days;
     if data.key_encrypted.is_some() {
         emergency_access.key_encrypted = data.key_encrypted;
@@ -212,11 +207,11 @@ async fn send_invite(data: Json<EmergencyAccessInviteData>, headers: Headers, co
     let email = data.email.to_lowercase();
     let wait_time_days = data.wait_time_days;
 
-    if !(EMERGENCY_ACCESS_TIMEOUT_RANGE).contains(&wait_time_days) {
-        err!("Emergency access wait time is out-of-bounds!")
-    }
+    let emergency_access_status = EmergencyAccessStatus::Invited as i32;
 
-    let Some(new_type) = EmergencyAccessType::from_str(&data.r#type.into_string()) else {
+    let new_type = if let Some(new_type) = EmergencyAccessType::from_str(&data.r#type.into_string()) {
+        new_type as i32
+    } else {
         err!("Invalid emergency access type.")
     };
 
@@ -230,7 +225,7 @@ async fn send_invite(data: Json<EmergencyAccessInviteData>, headers: Headers, co
     let (grantee_user, new_user) = match User::find_by_mail(&email, &conn).await {
         None => {
             if !CONFIG.invitations_allowed() {
-                err!(format!("Grantee user does not exist: {}", email.escape_debug()))
+                err!(format!("Grantee user does not exist: {email}"))
             }
 
             if !CONFIG.is_email_domain_allowed(&email) {
@@ -262,8 +257,6 @@ async fn send_invite(data: Json<EmergencyAccessInviteData>, headers: Headers, co
         err!(format!("Grantee user already invited: {}", &grantee_user.email))
     }
 
-    let new_type = new_type as i32;
-    let emergency_access_status = EmergencyAccessStatus::Invited as i32;
     let mut new_emergency_access =
         EmergencyAccess::new(grantor_user.uuid, grantee_user.email, emergency_access_status, new_type, wait_time_days);
     new_emergency_access.save(&conn).await?;
@@ -296,7 +289,7 @@ async fn resend_invite(emer_id: EmergencyAccessId, headers: Headers, conn: DbCon
     };
 
     if emergency_access.status != EmergencyAccessStatus::Invited as i32 {
-        err!("The grantee user is already accepted or confirmed for emergency access");
+        err!("The grantee user is already accepted or confirmed to the organization");
     }
 
     let Some(email) = emergency_access.email.clone() else {
@@ -457,24 +450,11 @@ async fn initiate_emergency_access(emer_id: EmergencyAccessId, headers: Headers,
     let Some(mut emergency_access) =
         EmergencyAccess::find_by_uuid_and_grantee_uuid(&emer_id, &initiating_user.uuid, &conn).await
     else {
-        err!(
-            "Emergency access not valid.",
-            format!("Emergency access '{emer_id}', not found for user '{}'.", initiating_user.email)
-        )
+        err!("Emergency access not valid.")
     };
 
     if emergency_access.status != EmergencyAccessStatus::Confirmed as i32 {
-        err!(
-            "Emergency access not valid.",
-            format!("Emergency access '{emer_id}', not confirmed for user '{}'.", initiating_user.email)
-        )
-    }
-
-    if !EMERGENCY_ACCESS_TIMEOUT_RANGE.contains(&emergency_access.wait_time_days) {
-        err!(
-            "Emergency access not valid.",
-            format!("Emergency access '{emer_id}' timeout range '{}' is invalid", emergency_access.wait_time_days)
-        )
+        err!("Emergency access not valid.")
     }
 
     let Some(grantor_user) = User::find_by_uuid(&emergency_access.grantor_uuid, &conn).await else {
@@ -507,17 +487,11 @@ async fn approve_emergency_access(emer_id: EmergencyAccessId, headers: Headers,
     let Some(mut emergency_access) =
         EmergencyAccess::find_by_uuid_and_grantor_uuid(&emer_id, &headers.user.uuid, &conn).await
     else {
-        err!(
-            "Emergency access not valid.",
-            format!("Emergency access '{emer_id}', not found for user '{}'.", headers.user.email)
-        )
+        err!("Emergency access not valid.")
     };
 
     if emergency_access.status != EmergencyAccessStatus::RecoveryInitiated as i32 {
-        err!(
-            "Emergency access not valid.",
-            format!("Emergency access '{emer_id}', not initiated for user '{}'.", headers.user.email)
-        )
+        err!("Emergency access not valid.")
     }
 
     let Some(grantor_user) = User::find_by_uuid(&headers.user.uuid, &conn).await else {
@@ -641,7 +615,6 @@ async fn takeover_emergency_access(emer_id: EmergencyAccessId, headers: Headers,
         "kdfMemory": grantor_user.client_kdf_memory,
         "kdfParallelism": grantor_user.client_kdf_parallelism,
         "keyEncrypted": &emergency_access.key_encrypted,
-        "salt": grantor_user.master_password_salt(),
         "object": "emergencyAccessTakeover",
     });
 
@@ -651,13 +624,8 @@ async fn takeover_emergency_access(emer_id: EmergencyAccessId, headers: Headers,
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct EmergencyAccessPasswordData {
-    // Legacy payload
-    new_master_password_hash: Option<String>,
-    key: Option<String>,
-
-    // Current payload
-    authentication_data: Option<AuthenticationData>,
-    unlock_data: Option<UnlockData>,
+    new_master_password_hash: String,
+    key: String,
 }
 
 #[post("/emergency-access/<emer_id>/password", data = "<data>")]
@@ -670,6 +638,8 @@ async fn password_emergency_access(
     check_emergency_access_enabled()?;
 
     let data: EmergencyAccessPasswordData = data.into_inner();
+    let new_master_password_hash = &data.new_master_password_hash;
+    //let key = &data.Key;
 
     let requesting_user = headers.user;
     let Some(emergency_access) =
@@ -686,23 +656,8 @@ async fn password_emergency_access(
         err!("Grantor user not found.")
     };
 
-    let (new_master_password_hash, new_key) =
-        if let (Some(authentication_data), Some(unlock_data)) = (data.authentication_data, data.unlock_data) {
-            authentication_data.check(&grantor_user, &unlock_data)?;
-
-            if !authentication_data.kdf.matches_user(&grantor_user) {
-                err!("KDF settings do not match the grantor account")
-            }
-
-            (authentication_data.master_password_authentication_hash, unlock_data.master_key_wrapped_user_key)
-        } else if let (Some(new_master_password_hash), Some(new_key)) = (data.new_master_password_hash, data.key) {
-            (new_master_password_hash, new_key)
-        } else {
-            err!("Invalid request!")
-        };
-
     // change grantor_user password
-    grantor_user.set_password(&new_master_password_hash, Some(new_key), true, None, &conn).await?;
+    grantor_user.set_password(new_master_password_hash, Some(data.key), true, None, &conn).await?;
     grantor_user.save(&conn).await?;
 
     // Disable TwoFactor providers since they will otherwise block logins
@@ -770,71 +725,52 @@ pub async fn emergency_request_timeout_job(pool: DbPool) {
         return;
     }
 
-    let Ok(conn) = pool.get().await else {
-        error!("Failed to get DB connection for emergency time-outs!");
-        return;
-    };
+    if let Ok(conn) = pool.get().await {
+        let emergency_access_list = EmergencyAccess::find_all_recoveries_initiated(&conn).await;
 
-    let emergency_access_list = EmergencyAccess::find_all_recoveries_initiated(&conn).await;
-
-    if emergency_access_list.is_empty() {
-        debug!("No emergency request timeout to approve");
-        return;
-    }
-
-    let now = Utc::now().naive_utc();
-    for mut emer in emergency_access_list {
-        match emer.is_recovery_allowed(&now) {
-            Ok(true) => {} // Recovery is allowed
-            Ok(false) => continue,
-            Err(e) => {
-                error!("Failed to check if recovery is allowed for '{}': {e}", emer.uuid);
-                continue;
-            }
+        if emergency_access_list.is_empty() {
+            debug!("No emergency request timeout to approve");
         }
 
-        // Get grantor user to send Accepted email
-        let Some(grantor_user) = User::find_by_uuid(&emer.grantor_uuid, &conn).await else {
-            error!("Grantor user '{}' not found for emergency access '{}'", emer.grantor_uuid, emer.uuid);
-            continue;
-        };
+        let now = Utc::now().naive_utc();
+        for mut emer in emergency_access_list {
+            // The find_all_recoveries_initiated already checks if the recovery_initiated_at is not null (None)
+            let recovery_allowed_at =
+                emer.recovery_initiated_at.unwrap() + TimeDelta::try_days(i64::from(emer.wait_time_days)).unwrap();
+            if recovery_allowed_at.le(&now) {
+                // Only update the access status
+                // Updating the whole record could cause issues when the emergency_notification_reminder_job is also active
+                emer.update_access_status_and_save(EmergencyAccessStatus::RecoveryApproved as i32, &now, &conn)
+                    .await
+                    .expect("Unable to update emergency access status");
 
-        let Some(grantee_uuid) = emer.grantee_uuid.as_ref() else {
-            error!("Missing grantee for emergency access '{}'", emer.uuid);
-            continue;
-        };
+                if CONFIG.mail_enabled() {
+                    // get grantor user to send Accepted email
+                    let grantor_user =
+                        User::find_by_uuid(&emer.grantor_uuid, &conn).await.expect("Grantor user not found");
 
-        // Get grantee user to send Accepted email
-        let Some(grantee_user) = User::find_by_uuid(grantee_uuid, &conn).await else {
-            error!("Grantee user '{grantee_uuid}' not found for emergency access '{}'", emer.uuid);
-            continue;
-        };
+                    // get grantee user to send Accepted email
+                    let grantee_user =
+                        User::find_by_uuid(&emer.grantee_uuid.clone().expect("Grantee user invalid"), &conn)
+                            .await
+                            .expect("Grantee user not found");
 
-        // Only update the access status
-        // Updating the whole record could cause issues when the emergency_notification_reminder_job is also active
-        let status_initiated = EmergencyAccessStatus::RecoveryInitiated as i32;
-        let status_approved = EmergencyAccessStatus::RecoveryApproved as i32;
-        if let Err(e) = emer.update_access_status_and_save(status_initiated, status_approved, &now, &conn).await {
-            error!("Unable to update emergency access status for '{}': {e}", emer.uuid);
-            continue;
-        }
+                    mail::send_emergency_access_recovery_timed_out(
+                        &grantor_user.email,
+                        &grantee_user.name,
+                        emer.get_type_as_str(),
+                    )
+                    .await
+                    .expect("Error on sending email");
 
-        if CONFIG.mail_enabled() {
-            if let Err(e) = mail::send_emergency_access_recovery_timed_out(
-                &grantor_user.email,
-                &grantee_user.name,
-                emer.get_type_as_str(),
-            )
-            .await
-            {
-                error!("Failed to send emergency access recovery time-out email for '{}': {e}", emer.uuid);
-            }
-
-            if let Err(e) = mail::send_emergency_access_recovery_approved(&grantee_user.email, &grantor_user.name).await
-            {
-                error!("Failed to send emergency access recovery approved email for '{}': {e}", emer.uuid);
+                    mail::send_emergency_access_recovery_approved(&grantee_user.email, &grantor_user.name)
+                        .await
+                        .expect("Error on sending email");
+                }
             }
         }
+    } else {
+        error!("Failed to get DB connection while searching emergency request timed out");
     }
 }
 
@@ -844,85 +780,55 @@ pub async fn emergency_notification_reminder_job(pool: DbPool) {
         return;
     }
 
-    let Ok(conn) = pool.get().await else {
-        error!("Failed to get DB connection for emergency reminders!");
-        return;
-    };
+    if let Ok(conn) = pool.get().await {
+        let emergency_access_list = EmergencyAccess::find_all_recoveries_initiated(&conn).await;
 
-    let emergency_access_list = EmergencyAccess::find_all_recoveries_initiated(&conn).await;
-
-    if emergency_access_list.is_empty() {
-        debug!("No emergency request reminder notification to send");
-        return;
-    }
-
-    let now = Utc::now().naive_utc();
-    for mut emer in emergency_access_list {
-        let Ok(deadline_at) = emer.deadline_at() else {
-            error!("Invalid deadline for emergency access '{}'", emer.uuid);
-            continue;
-        };
-
-        let Some(final_reminder_at) = deadline_at.checked_sub_days(chrono::Days::new(1)) else {
-            error!("Cannot calculate reminder date for emergency access '{}'", emer.uuid);
-            continue;
-        };
-
-        // Only send reminders during the last 24 hours, else continue
-        if now < final_reminder_at || now >= deadline_at {
-            continue;
+        if emergency_access_list.is_empty() {
+            debug!("No emergency request reminder notification to send");
         }
 
-        // Check if we did not sent a recovery mail in the past 24h already, else skip it.
-        // In case something goes wrong with the date calculation or `last_notification_at` is None we use now.
-        // This is to prevent possible missed reminders, this might cause an extra reminder,
-        // but that is better then no reminder at all.
-        let next_reminder_at = if let Some(last_notification_at) = emer.last_notification_at {
-            last_notification_at.checked_add_days(chrono::Days::new(1)).unwrap_or(now)
-        } else {
-            now
-        };
+        let now = Utc::now().naive_utc();
+        for mut emer in emergency_access_list {
+            // The find_all_recoveries_initiated already checks if the recovery_initiated_at is not null (None)
+            // Calculate the day before the recovery will become active
+            let final_recovery_reminder_at =
+                emer.recovery_initiated_at.unwrap() + TimeDelta::try_days(i64::from(emer.wait_time_days - 1)).unwrap();
+            // Calculate if a day has passed since the previous notification, else no notification has been sent before
+            let next_recovery_reminder_at = if let Some(last_notification_at) = emer.last_notification_at {
+                last_notification_at + TimeDelta::try_days(1).unwrap()
+            } else {
+                now
+            };
+            if final_recovery_reminder_at.le(&now) && next_recovery_reminder_at.le(&now) {
+                // Only update the last notification date
+                // Updating the whole record could cause issues when the emergency_request_timeout_job is also active
+                emer.update_last_notification_date_and_save(&now, &conn)
+                    .await
+                    .expect("Unable to update emergency access notification date");
 
-        // Only send a reminder if the `next_reminder_at` is less then or equal to `now`
-        // Else we can skip the current emergency access this run.
-        if next_reminder_at.gt(&now) {
-            continue;
-        }
-
-        // Get grantor user to send Reminder email
-        let Some(grantor_user) = User::find_by_uuid(&emer.grantor_uuid, &conn).await else {
-            error!("Grantor user '{}' not found for emergency access '{}'", emer.grantor_uuid, emer.uuid);
-            continue;
-        };
-
-        let Some(grantee_uuid) = emer.grantee_uuid.as_ref() else {
-            error!("Missing grantee for emergency access '{}'", emer.uuid);
-            continue;
-        };
-
-        // Get grantee user to send Reminder email
-        let Some(grantee_user) = User::find_by_uuid(grantee_uuid, &conn).await else {
-            error!("Grantee user '{grantee_uuid}' not found for emergency access '{}'", emer.uuid);
-            continue;
-        };
-
-        // Only update the last notification date
-        // Updating the whole record could cause issues when the emergency_request_timeout_job is also active
-        if let Err(e) = emer.update_last_notification_date_and_save(&now, &conn).await {
-            error!("Unable to update emergency access reminder date for '{}': {e}", emer.uuid);
-            continue;
-        }
-
-        if CONFIG.mail_enabled()
-            && let Err(e) = mail::send_emergency_access_recovery_reminder(
-                &grantor_user.email,
-                &grantee_user.name,
-                emer.get_type_as_str(),
-                "1", // This notification is only triggered one day before the activation
-            )
-            .await
-        {
-            error!("Failed to send emergency access reminder email for '{}': {e}", emer.uuid);
+                if CONFIG.mail_enabled() {
+                    // get grantor user to send Accepted email
+                    let grantor_user =
+                        User::find_by_uuid(&emer.grantor_uuid, &conn).await.expect("Grantor user not found");
+
+                    // get grantee user to send Accepted email
+                    let grantee_user =
+                        User::find_by_uuid(&emer.grantee_uuid.clone().expect("Grantee user invalid"), &conn)
+                            .await
+                            .expect("Grantee user not found");
+
+                    mail::send_emergency_access_recovery_reminder(
+                        &grantor_user.email,
+                        &grantee_user.name,
+                        emer.get_type_as_str(),
+                        "1", // This notification is only triggered one day before the activation
+                    )
+                    .await
+                    .expect("Error on sending email");
+                }
+            }
         }
+    } else {
+        error!("Failed to get DB connection while searching emergency notification reminder");
     }
 }
diff --git a/src/api/core/events.rs b/src/api/core/events.rs
index a256d854..a5b5b6b1 100644
--- a/src/api/core/events.rs
+++ b/src/api/core/events.rs
@@ -6,15 +6,12 @@ use serde_json::Value;
 
 use crate::{
     CONFIG,
-    api::{ApiResult, EmptyResult, JsonResult},
+    api::{EmptyResult, JsonResult},
     auth::{AdminHeaders, Headers},
     db::{
         DbConn, DbPool,
-        models::{
-            Cipher, CipherAccessScope, CipherId, Event, EventType, Membership, MembershipId, OrganizationId, UserId,
-        },
+        models::{Cipher, CipherId, Event, EventType, Membership, MembershipId, OrganizationId, UserId},
     },
-    error::MapResult,
     util::parse_date,
 };
 
@@ -32,14 +29,6 @@ struct EventRange {
     continuation_token: Option<String>,
 }
 
-impl EventRange {
-    fn date_range(&self) -> ApiResult<(NaiveDateTime, NaiveDateTime)> {
-        let start_date = parse_date(&self.start).map_res("Invalid start date")?;
-        let end_date = parse_date(self.continuation_token.as_ref().unwrap_or(&self.end)).map_res("Invalid end date")?;
-        Ok((start_date, end_date))
-    }
-}
-
 // Upstream: https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Api/AdminConsole/Controllers/EventsController.cs#L87
 #[get("/organizations/<org_id>/events?<data..>")]
 async fn get_org_events(org_id: OrganizationId, data: EventRange, headers: AdminHeaders, conn: DbConn) -> JsonResult {
@@ -50,7 +39,12 @@ async fn get_org_events(org_id: OrganizationId, data: EventRange, headers: Admin
     // Return an empty vec when we org events are disabled.
     // This prevents client errors
     let events_json: Vec<Value> = if CONFIG.org_events_enabled() {
-        let (start_date, end_date) = data.date_range()?;
+        let start_date = parse_date(&data.start);
+        let end_date = if let Some(before_date) = &data.continuation_token {
+            parse_date(before_date)
+        } else {
+            parse_date(&data.end)
+        };
 
         Event::find_by_organization_uuid(&org_id, &start_date, &end_date, &conn)
             .await
@@ -75,7 +69,12 @@ async fn get_cipher_events(cipher_id: CipherId, data: EventRange, headers: Heade
     let events_json: Vec<Value> = if CONFIG.org_events_enabled()
         && Membership::user_has_ge_admin_access_to_cipher(&headers.user.uuid, &cipher_id, &conn).await
     {
-        let (start_date, end_date) = data.date_range()?;
+        let start_date = parse_date(&data.start);
+        let end_date = if let Some(before_date) = &data.continuation_token {
+            parse_date(before_date)
+        } else {
+            parse_date(&data.end)
+        };
 
         Event::find_by_cipher_uuid(&cipher_id, &start_date, &end_date, &conn).await.iter().map(Event::to_json).collect()
     } else {
@@ -103,7 +102,12 @@ async fn get_user_events(
     // Return an empty vec when we org events are disabled.
     // This prevents client errors
     let events_json: Vec<Value> = if CONFIG.org_events_enabled() {
-        let (start_date, end_date) = data.date_range()?;
+        let start_date = parse_date(&data.start);
+        let end_date = if let Some(before_date) = &data.continuation_token {
+            parse_date(before_date)
+        } else {
+            parse_date(&data.end)
+        };
 
         Event::find_by_org_and_member(&org_id, &member_id, &start_date, &end_date, &conn)
             .await
@@ -164,10 +168,9 @@ async fn post_events_collect(data: Json<Vec<EventCollection>>, headers: Headers,
     }
 
     for event in data.iter() {
-        let event_date = parse_date(&event.date).map_res("Invalid event date")?;
-        // Only the event types upstream accepts from clients, the rest are written server-side.
+        let event_date = parse_date(&event.date);
         match event.r#type {
-            t if t == EventType::UserClientExportedVault as i32 => {
+            1000..=1099 => {
                 log_user_event_impl(
                     event.r#type,
                     &headers.user.uuid,
@@ -178,7 +181,7 @@ async fn post_events_collect(data: Json<Vec<EventCollection>>, headers: Headers,
                 )
                 .await;
             }
-            t if t == EventType::OrganizationClientExportedVault as i32 => {
+            1600..=1699 => {
                 // Only allow logging events for an organization the user is actually a member of.
                 if let Some(org_id) = &event.organization_id
                     && Membership::find_confirmed_by_user_and_org(&headers.user.uuid, org_id, &conn).await.is_some()
@@ -216,13 +219,12 @@ async fn post_events_collect(data: Json<Vec<EventCollection>>, headers: Headers,
                     .await;
                 }
             }
-            // Client-side cipher events (viewed, copied, toggled, autofilled, HTTP auth).
-            1107..=1114 | 1117 | 1119..=1133 => {
+            _ => {
                 // The cipher determines the organization the event is logged to, so make sure the
                 // user can actually access it instead of trusting the provided cipher uuid.
                 if let Some(cipher_uuid) = &event.cipher_id
                     && let Some(cipher) = Cipher::find_by_uuid(cipher_uuid, &conn).await
-                    && cipher.is_accessible_to_user(&headers.user.uuid, CipherAccessScope::User, &conn).await
+                    && cipher.is_accessible_to_user(&headers.user.uuid, &conn).await
                     && let Some(org_id) = cipher.organization_uuid
                 {
                     log_event_impl(
@@ -238,17 +240,16 @@ async fn post_events_collect(data: Json<Vec<EventCollection>>, headers: Headers,
                     .await;
                 }
             }
-            _ => {}
         }
     }
     Ok(())
 }
 
-pub async fn log_user_event(event_type: EventType, user_id: &UserId, device_type: i32, ip: &IpAddr, conn: &DbConn) {
+pub async fn log_user_event(event_type: i32, user_id: &UserId, device_type: i32, ip: &IpAddr, conn: &DbConn) {
     if !CONFIG.org_events_enabled() {
         return;
     }
-    log_user_event_impl(event_type as i32, user_id, device_type, None, ip, conn).await;
+    log_user_event_impl(event_type, user_id, device_type, None, ip, conn).await;
 }
 
 async fn log_user_event_impl(
@@ -349,17 +350,14 @@ async fn log_event_impl(
 
 pub async fn event_cleanup_job(pool: DbPool) {
     debug!("Start events cleanup job");
-    if CONFIG.events_days_retain().is_none_or(|d| d == 0) {
-        debug!("events_days_retain is not configured or set to 0, skipping");
+    if CONFIG.events_days_retain().is_none() {
+        debug!("events_days_retain is not configured, abort");
         return;
     }
 
-    let Ok(conn) = pool.get().await else {
+    if let Ok(conn) = pool.get().await {
+        Event::clean_events(&conn).await.ok();
+    } else {
         error!("Failed to get DB connection while trying to cleanup the events table");
-        return;
-    };
-
-    if let Err(e) = Event::clean_events(&conn).await {
-        error!("Failed to cleanup the events table: {e}");
     }
 }
diff --git a/src/api/core/mod.rs b/src/api/core/mod.rs
index 121f20b1..e6a184dd 100644
--- a/src/api/core/mod.rs
+++ b/src/api/core/mod.rs
@@ -14,8 +14,6 @@ pub use ciphers::{CipherData, CipherSyncData, CipherSyncType, purge_trashed_ciph
 pub use emergency_access::{emergency_notification_reminder_job, emergency_request_timeout_job};
 pub use events::{event_cleanup_job, log_event, log_user_event};
 pub use sends::purge_sends;
-#[cfg(feature = "unsafe_test_mode")]
-pub use {ciphers::seed_cipher, sends::seed_send};
 
 use reqwest::Method;
 use rocket::{Catcher, Route, serde::json::Json, serde::json::Value};
@@ -249,7 +247,6 @@ fn config() -> Json<Value> {
           "notifications": format!("{domain}/notifications"),
           "sso": "",
           "cloudRegion": null,
-          "fillAssistRules": CONFIG.fill_assist_rules_url(),
         },
         // Bitwarden uses this for the self-hosted servers to indicate the default push technology
         "push": {
diff --git a/src/api/core/organizations.rs b/src/api/core/organizations.rs
index 2703b9ea..d51eac1a 100644
--- a/src/api/core/organizations.rs
+++ b/src/api/core/organizations.rs
@@ -8,22 +8,17 @@ use crate::{
     CONFIG,
     api::admin::FAKE_ADMIN_UUID,
     api::{
-        ApiResult, EmptyResult, JsonResult, Notify, PasswordOrOtpData, UpdateType,
+        EmptyResult, JsonResult, Notify, PasswordOrOtpData, UpdateType,
         core::{CipherSyncData, CipherSyncType, accept_org_invite, log_event, two_factor},
     },
-    auth::{
-        AdminHeaders, CollectionAction, CollectionDeleteHeaders, CollectionReadHeaders, CollectionUsersReadHeaders,
-        Headers, ManageUsersHeaders, ManagerHeaders, ManagerHeadersLoose, OrgMemberHeaders, OwnerHeaders,
-        custom_member_may, decode_invite,
-    },
+    auth::{AdminHeaders, Headers, ManagerHeaders, ManagerHeadersLoose, OrgMemberHeaders, OwnerHeaders, decode_invite},
     db::{
         DbConn,
         models::{
-            Cipher, CipherAccessScope, CipherId, Collection, CollectionCipher, CollectionGroup, CollectionId,
-            CollectionUser, CustomPermission, Device, EventType, FillAssistPolicyData, Group, GroupId, GroupUser,
-            Invitation, Membership, MembershipId, MembershipStatus, MembershipType, OrgPolicy, OrgPolicyType,
-            Organization, OrganizationApiKey, OrganizationId, TwoFactor, TwoFactorType, User, UserId,
-            custom_roles_enabled,
+            Cipher, CipherId, Collection, CollectionCipher, CollectionGroup, CollectionId, CollectionUser, EventType,
+            Group, GroupId, GroupUser, Invitation, Membership, MembershipId, MembershipStatus, MembershipType,
+            OrgPolicy, OrgPolicyType, Organization, OrganizationApiKey, OrganizationId, TwoFactor, TwoFactorType, User,
+            UserId,
         },
     },
     mail,
@@ -31,13 +26,12 @@ use crate::{
     util::{NumberOrString, convert_json_key_lcase_first},
 };
 
-use super::accounts::{AuthenticationData, UnlockData};
-
 pub fn routes() -> Vec<Route> {
     routes![
         get_organization,
         create_organization,
         delete_organization,
+        post_delete_organization,
         leave_organization,
         get_user_collections,
         get_org_collections,
@@ -45,14 +39,16 @@ pub fn routes() -> Vec<Route> {
         get_org_collection_detail,
         get_collection_users,
         put_organization,
+        post_organization,
         post_organization_collections,
         post_bulk_access_collections,
+        post_organization_collection_update,
         put_organization_collection_update,
         delete_organization_collection,
+        post_organization_collection_delete,
         bulk_delete_organization_collections,
         post_bulk_collections,
         get_org_details,
-        get_assigned_org_details,
         get_org_domain_sso_verified,
         get_members,
         send_invite,
@@ -64,6 +60,7 @@ pub fn routes() -> Vec<Route> {
         get_org_user_mini_details,
         get_user,
         edit_member,
+        put_member,
         delete_member,
         bulk_delete_member,
         post_org_import,
@@ -73,6 +70,7 @@ pub fn routes() -> Vec<Route> {
         get_master_password_policy,
         get_policy,
         put_policy,
+        put_policy_vnext,
         get_plans,
         post_org_keys,
         get_organization_keys,
@@ -88,16 +86,22 @@ pub fn routes() -> Vec<Route> {
         post_groups,
         get_group,
         put_group,
+        post_group,
         get_group_details,
         delete_group,
+        post_delete_group,
         bulk_delete_groups,
         get_group_members,
+        put_group_members,
+        post_delete_group_member,
         put_reset_password_enrollment,
         get_reset_password_details,
+        put_reset_password,
         put_recover_account,
         get_org_export,
         post_api_key,
         rotate_api_key,
+        get_billing_metadata,
         get_billing_warnings,
         get_auto_enroll_status,
         get_self_host_billing_metadata,
@@ -137,16 +141,13 @@ impl FullCollectionData {
         let org_groups = Group::find_by_organization(org_id, conn).await;
         let org_group_ids: HashSet<&GroupId> = org_groups.iter().map(|c| &c.uuid).collect();
         if let Some(e) = self.groups.iter().find(|g| !org_group_ids.contains(&g.id)) {
-            err!("Invalid group", format!("Group {} does not belong to organization {}!", e.id.escape_debug(), org_id))
+            err!("Invalid group", format!("Group {} does not belong to organization {}!", e.id, org_id))
         }
 
         let org_memberships = Membership::find_by_org(org_id, conn).await;
         let org_membership_ids: HashSet<&MembershipId> = org_memberships.iter().map(|m| &m.uuid).collect();
         if let Some(e) = self.users.iter().find(|m| !org_membership_ids.contains(&m.id)) {
-            err!(
-                "Invalid member",
-                format!("Member {} does not belong to organization {}!", e.id.escape_debug(), org_id)
-            )
+            err!("Invalid member", format!("Member {} does not belong to organization {}!", e.id, org_id))
         }
 
         Ok(())
@@ -244,6 +245,16 @@ async fn delete_organization(
     }
 }
 
+#[post("/organizations/<org_id>/delete", data = "<data>")]
+async fn post_delete_organization(
+    org_id: OrganizationId,
+    data: Json<PasswordOrOtpData>,
+    headers: OwnerHeaders,
+    conn: DbConn,
+) -> EmptyResult {
+    delete_organization(org_id, data, headers, conn).await
+}
+
 #[post("/organizations/<org_id>/leave")]
 async fn leave_organization(org_id: OrganizationId, headers: OrgMemberHeaders, conn: DbConn) -> EmptyResult {
     if headers.membership.status != MembershipStatus::Confirmed as i32 {
@@ -289,6 +300,16 @@ async fn put_organization(
     headers: OwnerHeaders,
     data: Json<OrganizationUpdateData>,
     conn: DbConn,
+) -> JsonResult {
+    post_organization(org_id, headers, data, conn).await
+}
+
+#[post("/organizations/<org_id>", data = "<data>")]
+async fn post_organization(
+    org_id: OrganizationId,
+    headers: OwnerHeaders,
+    data: Json<OrganizationUpdateData>,
+    conn: DbConn,
 ) -> JsonResult {
     if org_id != headers.org_id {
         err!("Organization not found", "Organization id's do not match");
@@ -369,24 +390,12 @@ async fn get_org_collections(org_id: OrganizationId, headers: ManagerHeadersLoos
         err!("Organization not found", "Organization id's do not match");
     }
 
-    let collections = if headers.membership.can_view_all_collections() {
-        get_org_collections_impl(&org_id, &conn).await
-    } else if headers.membership.has_type(MembershipType::Custom) {
-        // A Custom member gets the collections they may manage
-        let manageable =
-            Collection::find_explicitly_manageable_by_user(&org_id, &headers.membership.user_uuid, &conn).await;
-        Collection::find_by_organization(&org_id, &conn)
-            .await
-            .iter()
-            .filter(|collection| manageable.contains(&collection.uuid))
-            .map(Collection::to_json)
-            .collect::<Value>()
-    } else {
+    if !headers.membership.has_full_access() {
         err_code!("Resource not found.", "User does not have full access", Status::NotFound.code);
-    };
+    }
 
     Ok(Json(json!({
-        "data": collections,
+        "data": get_org_collections_impl(&org_id, &conn).await,
         "object": "list",
         "continuationToken": null,
     })))
@@ -406,20 +415,12 @@ async fn get_org_collections_details(org_id: OrganizationId, headers: ManagerHea
     let col_users = CollectionUser::find_by_organization_swap_user_uuid_with_member_uuid(&org_id, &conn).await;
     // Generate a HashMap to get the correct MembershipType per user to determine the manage permission
     // We use the uuid instead of the user_uuid here, since that is what is used in CollectionUser
-    // This lists other members for admins, so it must not depend on the membership status
     let membership_type: HashMap<MembershipId, i32> =
-        Membership::find_by_org(&org_id, &conn).await.into_iter().map(|m| (m.uuid, m.atype)).collect();
+        Membership::find_confirmed_by_org(&org_id, &conn).await.into_iter().map(|m| (m.uuid, m.atype)).collect();
 
     // check if current user has full access to the organization (either directly or via any group)
     let has_full_access_to_org = member.has_full_access()
         || (CONFIG.org_groups_enabled() && GroupUser::has_full_access_by_member(&org_id, &member.uuid, &conn).await);
-    // Manage users may read collection access details without editing the collection itself.
-    let custom_collections =
-        if member.has_type(MembershipType::Custom) && !member.can_view_all_collection_access_details() {
-            Some(Collection::find_explicitly_manageable_by_user(&org_id, &member.user_uuid, &conn).await)
-        } else {
-            None
-        };
 
     // Get all admins, owners and managers who can manage/access all
     // Those are currently not listed in the col_users but need to be listed too.
@@ -445,12 +446,7 @@ async fn get_org_collections_details(org_id: OrganizationId, headers: ManagerHea
                 && GroupUser::has_access_to_collection_by_member(&col.uuid, &member.uuid, &conn).await);
 
         // If the user is a manager, and is not assigned to this collection, skip this and continue with the next collection
-        let listed = if member.has_type(MembershipType::Custom) {
-            custom_collections.as_ref().is_none_or(|manageable| manageable.contains(&col.uuid))
-        } else {
-            assigned
-        };
-        if !listed {
+        if !assigned {
             continue;
         }
 
@@ -510,10 +506,7 @@ async fn post_organization_collections(
     let data: FullCollectionData = data.into_inner();
     data.validate(&org_id, &conn).await?;
 
-    if (headers.membership.atype == MembershipType::Manager && !headers.membership.access_all)
-        || (headers.membership.has_type(MembershipType::Custom)
-            && !headers.membership.has_custom_permission(CustomPermission::CreateNewCollections))
-    {
+    if headers.membership.atype == MembershipType::Manager && !headers.membership.access_all {
         err!("You don't have permission to create collections")
     }
 
@@ -588,7 +581,7 @@ async fn post_bulk_access_collections(
     let org_groups = Group::find_by_organization(&org_id, &conn).await;
     let org_group_ids: HashSet<&GroupId> = org_groups.iter().map(|g| &g.uuid).collect();
     if let Some(g) = data.groups.iter().find(|g| !org_group_ids.contains(&g.id)) {
-        err!("Invalid group", format!("Group {} does not belong to organization {}!", g.id.escape_debug(), org_id))
+        err!("Invalid group", format!("Group {} does not belong to organization {}!", g.id, org_id))
     }
 
     for col_id in data.collection_ids {
@@ -596,12 +589,7 @@ async fn post_bulk_access_collections(
             err!("Collection not found")
         };
 
-        let manageable = if headers.membership.has_type(MembershipType::Custom) {
-            custom_member_may(CollectionAction::Edit, &headers.membership, &collection.uuid, &conn).await
-        } else {
-            collection.is_manageable_by_user(&headers.membership.user_uuid, &conn).await
-        };
-        if !manageable {
+        if !collection.is_manageable_by_user(&headers.membership.user_uuid, &conn).await {
             err!("Collection not found", "The current user isn't a manager for this collection")
         }
 
@@ -651,6 +639,17 @@ async fn put_organization_collection_update(
     headers: ManagerHeaders,
     data: Json<FullCollectionData>,
     conn: DbConn,
+) -> JsonResult {
+    post_organization_collection_update(org_id, col_id, headers, data, conn).await
+}
+
+#[post("/organizations/<org_id>/collections/<col_id>", data = "<data>", rank = 2)]
+async fn post_organization_collection_update(
+    org_id: OrganizationId,
+    col_id: CollectionId,
+    headers: ManagerHeaders,
+    data: Json<FullCollectionData>,
+    conn: DbConn,
 ) -> JsonResult {
     if org_id != headers.org_id {
         err!("Organization not found", "Organization id's do not match");
@@ -714,7 +713,7 @@ async fn put_organization_collection_update(
 async fn delete_organization_collection_impl(
     org_id: &OrganizationId,
     col_id: &CollectionId,
-    headers: &CollectionDeleteHeaders,
+    headers: &ManagerHeaders,
     conn: &DbConn,
 ) -> EmptyResult {
     if org_id != &headers.org_id {
@@ -740,7 +739,17 @@ async fn delete_organization_collection_impl(
 async fn delete_organization_collection(
     org_id: OrganizationId,
     col_id: CollectionId,
-    headers: CollectionDeleteHeaders,
+    headers: ManagerHeaders,
+    conn: DbConn,
+) -> EmptyResult {
+    delete_organization_collection_impl(&org_id, &col_id, &headers, &conn).await
+}
+
+#[post("/organizations/<org_id>/collections/<col_id>/delete")]
+async fn post_organization_collection_delete(
+    org_id: OrganizationId,
+    col_id: CollectionId,
+    headers: ManagerHeaders,
     conn: DbConn,
 ) -> EmptyResult {
     delete_organization_collection_impl(&org_id, &col_id, &headers, &conn).await
@@ -766,7 +775,7 @@ async fn bulk_delete_organization_collections(
 
     let collections = data.ids;
 
-    let headers = CollectionDeleteHeaders::from_loose(headers, &collections, &conn).await?;
+    let headers = ManagerHeaders::from_loose(headers, &collections, &conn).await?;
 
     for col_id in collections {
         delete_organization_collection_impl(&org_id, &col_id, &headers, &conn).await?;
@@ -778,28 +787,23 @@ async fn bulk_delete_organization_collections(
 async fn get_org_collection_detail(
     org_id: OrganizationId,
     col_id: CollectionId,
-    headers: CollectionReadHeaders,
+    headers: ManagerHeaders,
     conn: DbConn,
 ) -> JsonResult {
     if org_id != headers.org_id {
         err!("Organization not found", "Organization id's do not match");
     }
-    let Some(member) = Membership::find_by_user_and_org(&headers.user.uuid, &org_id, &conn).await else {
-        err!("User is not part of organization")
-    };
-    // A Custom member may be allowed to read a collection they are not assigned to
-    let collection = if member.has_type(MembershipType::Custom) {
-        Collection::find_by_uuid_and_org(&col_id, &org_id, &conn).await
-    } else {
-        Collection::find_by_uuid_and_user(&col_id, headers.user.uuid.clone(), &conn).await
-    };
-    match collection {
+    match Collection::find_by_uuid_and_user(&col_id, headers.user.uuid.clone(), &conn).await {
         None => err!("Collection not found"),
         Some(collection) => {
             if collection.org_uuid != org_id {
                 err!("Collection is not owned by organization")
             }
 
+            let Some(member) = Membership::find_by_user_and_org(&headers.user.uuid, &org_id, &conn).await else {
+                err!("User is not part of organization")
+            };
+
             let groups: Vec<Value> = if CONFIG.org_groups_enabled() {
                 CollectionGroup::find_by_collection(&collection.uuid, &conn)
                     .await
@@ -814,9 +818,11 @@ async fn get_org_collection_detail(
 
             // Generate a HashMap to get the correct MembershipType per user to determine the manage permission
             // We use the uuid instead of the user_uuid here, since that is what is used in CollectionUser
-            // This lists other members for admins, so it must not depend on the membership status
-            let membership_type: HashMap<MembershipId, i32> =
-                Membership::find_by_org(&org_id, &conn).await.into_iter().map(|m| (m.uuid, m.atype)).collect();
+            let membership_type: HashMap<MembershipId, i32> = Membership::find_confirmed_by_org(&org_id, &conn)
+                .await
+                .into_iter()
+                .map(|m| (m.uuid, m.atype))
+                .collect();
 
             let users: Vec<Value> =
                 CollectionUser::find_by_org_and_coll_swap_user_uuid_with_member_uuid(&org_id, &collection.uuid, &conn)
@@ -848,7 +854,7 @@ async fn get_org_collection_detail(
 async fn get_collection_users(
     org_id: OrganizationId,
     col_id: CollectionId,
-    headers: CollectionUsersReadHeaders,
+    headers: ManagerHeaders,
     conn: DbConn,
 ) -> JsonResult {
     if org_id != headers.org_id {
@@ -884,7 +890,7 @@ async fn get_org_details(data: OrgIdData, headers: ManagerHeadersLoose, conn: Db
         err_code!("Resource not found.", "Organization id's do not match", Status::NotFound.code);
     }
 
-    if !headers.membership.can_edit_any_collection() {
+    if !headers.membership.has_full_access() {
         err_code!("Resource not found.", "User does not have full access", Status::NotFound.code);
     }
 
@@ -902,12 +908,7 @@ async fn get_org_details_impl(
     conn: &DbConn,
 ) -> Result<Value, crate::Error> {
     let ciphers = Cipher::find_by_org(org_id, conn).await;
-    let mut cipher_sync_data = CipherSyncData::new(user_id, CipherSyncType::Organization, conn).await;
-    // Every cipher of the organization is listed, so list every collection of them too
-    cipher_sync_data.cipher_collections = HashMap::new();
-    for (cipher_id, collection_id) in Cipher::get_collections_with_cipher_by_organization(org_id, conn).await {
-        cipher_sync_data.cipher_collections.entry(cipher_id).or_default().push(collection_id);
-    }
+    let cipher_sync_data = CipherSyncData::new(user_id, CipherSyncType::Organization, conn).await;
 
     let mut ciphers_json = Vec::with_capacity(ciphers.len());
     for c in ciphers {
@@ -916,39 +917,6 @@ async fn get_org_details_impl(
     Ok(json!(ciphers_json))
 }
 
-// The Admin Console lists these instead of every cipher of the organization for a member who may not edit every
-// cipher, like a Custom member with Delete any collection only. As in Bitwarden, any confirmed member may list them.
-#[get("/ciphers/organization-details/assigned?<data..>")]
-async fn get_assigned_org_details(data: OrgIdData, headers: Headers, conn: DbConn) -> JsonResult {
-    let Some(member) =
-        Membership::find_confirmed_by_user_and_org(&headers.user.uuid, &data.organization_id, &conn).await
-    else {
-        err_code!("Resource not found.", "User is not a confirmed member of the organization", Status::NotFound.code);
-    };
-
-    let (assigned, unassigned) = Cipher::find_assigned_to_member(&member, &conn).await;
-    let mut ciphers_json = Vec::with_capacity(assigned.len() + unassigned.len());
-    // The ciphers of the member's own vault, as they are there
-    let cipher_sync_data = CipherSyncData::new(&headers.user.uuid, CipherSyncType::User, &conn).await;
-    for cipher in assigned {
-        ciphers_json.push(
-            cipher
-                .to_json(&headers.host, &headers.user.uuid, Some(&cipher_sync_data), CipherSyncType::User, &conn)
-                .await?,
-        );
-    }
-    // The ciphers in no collection, as the member may use them in the Admin Console
-    for cipher in unassigned {
-        ciphers_json.push(cipher.to_json_org_admin(&headers.host, &headers.user.uuid, &conn).await?);
-    }
-
-    Ok(Json(json!({
-        "data": ciphers_json,
-        "object": "list",
-        "continuationToken": null,
-    })))
-}
-
 // Returning a Domain/Organization here allow to prefill it and prevent prompting the user
 // So we return a dummy value, since we only support a single SSO integration, and do not use the response anywhere
 // In use since `v2025.6.0`, appears to use only the first `organizationIdentifier`
@@ -986,16 +954,14 @@ async fn get_members(
         err!("Organization not found", "Organization id's do not match");
     }
 
-    if !headers.membership.has_full_access() && !headers.membership.has_custom_permission(CustomPermission::ManageUsers)
-    {
+    if !headers.membership.has_full_access() {
         err_code!("Resource not found.", "User does not have full access", Status::NotFound.code);
     }
 
     let mut users_json = Vec::new();
     for u in Membership::find_by_org(&org_id, &conn).await {
-        // The user can be a manager instead of an admin, but we've checked above that they have full access
         users_json.push(
-            u.to_json_details_for_admin(
+            u.to_json_user_details(
                 data.include_collections.unwrap_or(false),
                 data.include_groups.unwrap_or(false),
                 &conn,
@@ -1060,80 +1026,24 @@ impl InviteData {
         let org_collections = Collection::find_by_organization(org_id, conn).await;
         let org_collection_ids: HashSet<&CollectionId> = org_collections.iter().map(|c| &c.uuid).collect();
         if let Some(e) = self.collections.iter().flatten().find(|c| !org_collection_ids.contains(&c.id)) {
-            err!(
-                "Invalid collection",
-                format!("Collection {} does not belong to organization {}!", e.id.escape_debug(), org_id)
-            )
+            err!("Invalid collection", format!("Collection {} does not belong to organization {}!", e.id, org_id))
         }
 
         let org_groups = Group::find_by_organization(org_id, conn).await;
         let org_group_ids: HashSet<&GroupId> = org_groups.iter().map(|c| &c.uuid).collect();
         if let Some(e) = self.groups.iter().find(|g| !org_group_ids.contains(g)) {
-            err!("Invalid group", format!("Group {} does not belong to organization {}!", e.escape_debug(), org_id))
+            err!("Invalid group", format!("Group {} does not belong to organization {}!", e, org_id))
         }
 
         Ok(())
     }
 }
 
-/// Whether a Custom member with Manage users may manage the members of `target_type`: only Users and Custom members.
-fn custom_member_manages(target_type: i32) -> bool {
-    target_type == MembershipType::User || target_type == MembershipType::Custom
-}
-
-/// Whether a member of `caller_type` may manage the members of `target_type`, as in Bitwarden: Owners every role,
-/// Admins every role but Owner, and Custom members with Manage users only Users and Custom members.
-fn check_role_manageable(caller_type: MembershipType, target_type: i32) -> EmptyResult {
-    match caller_type {
-        MembershipType::Owner => Ok(()),
-        MembershipType::Admin if target_type != MembershipType::Owner => Ok(()),
-        MembershipType::Custom if custom_member_manages(target_type) => Ok(()),
-        _ if target_type == MembershipType::Owner => err!("Only Owners can manage Owners"),
-        _ => err!("You can only manage Users and Custom members"),
-    }
-}
-
-/// Manage users controls member access to any collection in their organization, separately from editing its metadata.
-fn custom_member_may_assign_collection(caller: &Membership, collection: &Collection) -> bool {
-    caller.org_uuid == collection.org_uuid && caller.has_custom_permission(CustomPermission::ManageUsers)
-}
-
-/// Checks what a Custom member with Manage users gives a member: only permissions they have themselves, and access to
-/// collections and groups in their organization. As in Bitwarden, Manage users may change any group membership.
-async fn check_custom_member_grants(
-    caller: &Membership,
-    permissions: Option<&HashSet<CustomPermission>>,
-    collections: &[&CollectionId],
-    groups: &HashSet<GroupId>,
-    conn: &DbConn,
-) -> EmptyResult {
-    if !caller.has_custom_permission(CustomPermission::ManageUsers) {
-        err!("You need Manage users to change member access")
-    }
-    if permissions.is_some_and(|permissions| permissions.iter().any(|p| !caller.has_custom_permission(*p))) {
-        err!("Custom users can only grant the same custom permissions that they have")
-    }
-    for collection_id in collections {
-        let Some(collection) = Collection::find_by_uuid_and_org(collection_id, &caller.org_uuid, conn).await else {
-            err!("Collection not found in Organization")
-        };
-        if !custom_member_may_assign_collection(caller, &collection) {
-            err!("You can only give access to collections in your organization")
-        }
-    }
-    for group_id in groups {
-        if Group::find_by_uuid_and_org(group_id, &caller.org_uuid, conn).await.is_none() {
-            err!("Group not found in Organization")
-        }
-    }
-    Ok(())
-}
-
 #[post("/organizations/<org_id>/users/invite", data = "<data>")]
 async fn send_invite(
     org_id: OrganizationId,
     data: Json<InviteData>,
-    headers: ManageUsersHeaders,
+    headers: AdminHeaders,
     conn: DbConn,
 ) -> EmptyResult {
     if org_id != headers.org_id {
@@ -1143,33 +1053,24 @@ async fn send_invite(
     data.validate(&org_id, &conn).await?;
 
     // HACK: We need the raw user-type to be sure custom role is selected to determine the access_all permission
-    // Unless Custom roles are enabled, a custom role (4) is converted to a manager role (3)
+    // The from_str() will convert the custom role type into a manager role type
     let raw_type = &data.r#type.into_string();
-    let Some(requested_type) = MembershipType::from_str(raw_type) else {
+    // Membership::from_str will convert custom (4) to manager (3)
+    let new_type = if let Some(new_type) = MembershipType::from_str(raw_type) {
+        new_type as i32
+    } else {
         err!("Invalid type")
     };
-    // Checked before anything is created, so a rejected permission leaves nothing behind
-    let custom_permissions = if requested_type == MembershipType::Custom && custom_roles_enabled() {
-        Some(CustomPermission::requested(&data.permissions)?)
-    } else {
-        None
-    };
-    let new_type = MembershipType::requested(requested_type, None, custom_permissions.as_ref());
 
-    check_role_manageable(headers.membership_type, new_type as i32)?;
-    if headers.membership_type == MembershipType::Custom {
-        let collections: Vec<&CollectionId> = data.collections.iter().flatten().map(|c| &c.id).collect();
-        let groups = data.groups.iter().cloned().collect();
-        check_custom_member_grants(&headers.membership, custom_permissions.as_ref(), &collections, &groups, &conn)
-            .await?;
+    if new_type != MembershipType::User && headers.membership_type != MembershipType::Owner {
+        err!("Only Owners can invite Managers, Admins or Owners")
     }
 
     // HACK: This converts the Custom role which has the `Manage all collections` box checked into an access_all flag
     // Since the parent checkbox is not sent to the server we need to check and verify the child checkboxes
     // If the box is not checked, the user will still be a manager, but not with the access_all permission
     let access_all = new_type >= MembershipType::Admin
-        || (new_type == MembershipType::Manager
-            && raw_type.eq("4")
+        || (raw_type.eq("4")
             && data.permissions.get("editAnyCollection") == Some(&json!(true))
             && data.permissions.get("deleteAnyCollection") == Some(&json!(true))
             && data.permissions.get("createNewCollections") == Some(&json!(true)));
@@ -1180,7 +1081,7 @@ async fn send_invite(
         let user = match User::find_by_mail(email, &conn).await {
             None => {
                 if !CONFIG.invitations_allowed() {
-                    err!(format!("User does not exist: {}", email.escape_debug()))
+                    err!(format!("User does not exist: {email}"))
                 }
 
                 if !CONFIG.is_email_domain_allowed(email) {
@@ -1198,7 +1099,7 @@ async fn send_invite(
             }
             Some(user) => {
                 if Membership::find_by_user_and_org(&user.uuid, &org_id, &conn).await.is_some() {
-                    err!(format!("User already in organization: {}", email.escape_debug()))
+                    err!(format!("User already in organization: {email}"))
                 }
 
                 if !CONFIG.mail_enabled() {
@@ -1215,11 +1116,8 @@ async fn send_invite(
         };
 
         let mut new_member = Membership::new(user.uuid.clone(), org_id.clone(), Some(headers.user.email.clone()));
-        new_member.set_type(new_type);
         new_member.access_all = access_all;
-        if let Some(permissions) = &custom_permissions {
-            new_member.set_custom_permissions(permissions);
-        }
+        new_member.atype = new_type;
         new_member.status = member_status;
         new_member.save(&conn).await?;
 
@@ -1297,7 +1195,7 @@ async fn send_invite(
 async fn bulk_reinvite_members(
     org_id: OrganizationId,
     data: Json<BulkMembershipIds>,
-    headers: ManageUsersHeaders,
+    headers: AdminHeaders,
     conn: DbConn,
 ) -> JsonResult {
     if org_id != headers.org_id {
@@ -1309,10 +1207,7 @@ async fn bulk_reinvite_members(
     for member_id in data.ids {
         let err_msg = match reinvite_member_impl(&org_id, &member_id, &headers.user.email, &conn).await {
             Ok(()) => String::new(),
-            Err(e) => {
-                warn!("Unable to reinvite member {}: {e:?}", member_id.escape_debug());
-                e.message().to_owned()
-            }
+            Err(e) => format!("{e:?}"),
         };
 
         bulk_response.push(json!(
@@ -1335,7 +1230,7 @@ async fn bulk_reinvite_members(
 async fn reinvite_member(
     org_id: OrganizationId,
     member_id: MembershipId,
-    headers: ManageUsersHeaders,
+    headers: AdminHeaders,
     conn: DbConn,
 ) -> EmptyResult {
     if org_id != headers.org_id {
@@ -1466,7 +1361,7 @@ struct BulkConfirmData {
 async fn bulk_confirm_invite(
     org_id: OrganizationId,
     data: Json<BulkConfirmData>,
-    headers: ManageUsersHeaders,
+    headers: AdminHeaders,
     conn: DbConn,
     nt: Notify<'_>,
 ) -> JsonResult {
@@ -1479,16 +1374,11 @@ async fn bulk_confirm_invite(
     match data.keys {
         Some(keys) => {
             for invite in keys {
-                let Some(member_id) = invite.id else {
-                    err!("Member id is required")
-                };
+                let member_id = invite.id.unwrap();
                 let user_key = invite.key.unwrap_or_default();
                 let err_msg = match confirm_invite_impl(&org_id, &member_id, &user_key, &headers, &conn, &nt).await {
                     Ok(()) => String::new(),
-                    Err(e) => {
-                        warn!("Unable to confirm member {}: {e:?}", member_id.escape_debug());
-                        e.message().to_owned()
-                    }
+                    Err(e) => format!("{e:?}"),
                 };
 
                 bulk_response.push(json!(
@@ -1515,7 +1405,7 @@ async fn confirm_invite(
     org_id: OrganizationId,
     member_id: MembershipId,
     data: Json<ConfirmData>,
-    headers: ManageUsersHeaders,
+    headers: AdminHeaders,
     conn: DbConn,
     nt: Notify<'_>,
 ) -> EmptyResult {
@@ -1528,7 +1418,7 @@ async fn confirm_invite_impl(
     org_id: &OrganizationId,
     member_id: &MembershipId,
     key: &str,
-    headers: &ManageUsersHeaders,
+    headers: &AdminHeaders,
     conn: &DbConn,
     nt: &Notify<'_>,
 ) -> EmptyResult {
@@ -1543,7 +1433,9 @@ async fn confirm_invite_impl(
         err!("The specified user isn't a member of the organization")
     };
 
-    // As in Bitwarden, confirming is open to everyone managing the members, whatever the role of the member
+    if member_to_confirm.atype != MembershipType::User && headers.membership_type != MembershipType::Owner {
+        err!("Only Owners can confirm Managers, Admins or Owners")
+    }
 
     if member_to_confirm.status != MembershipStatus::Accepted as i32 {
         err!("User in invalid state")
@@ -1594,11 +1486,6 @@ async fn get_org_user_mini_details(org_id: OrganizationId, headers: ManagerHeade
     if org_id != headers.membership.org_uuid {
         err!("Organization not found", "Organization id's do not match");
     }
-    if headers.membership.has_type(MembershipType::Custom)
-        && !may_assign_collection_access(&headers.membership, &conn).await
-    {
-        err_code!("Resource not found.", "User does not have access", Status::NotFound.code);
-    }
     let mut members_json = Vec::new();
     for m in Membership::find_by_org(&org_id, &conn).await {
         members_json.push(m.to_json_mini_details(&conn).await);
@@ -1616,7 +1503,7 @@ async fn get_user(
     org_id: OrganizationId,
     member_id: MembershipId,
     data: GetOrgUserData,
-    headers: ManageUsersHeaders,
+    headers: AdminHeaders,
     conn: DbConn,
 ) -> JsonResult {
     if org_id != headers.org_id {
@@ -1629,9 +1516,7 @@ async fn get_user(
     // In this case, when groups are requested we also need to include collections.
     // Else these will not be shown in the interface, and could lead to missing collections when saved.
     let include_groups = data.include_groups.unwrap_or(false);
-    Ok(Json(
-        user.to_json_details_for_admin(data.include_collections.unwrap_or(include_groups), include_groups, &conn).await,
-    ))
+    Ok(Json(user.to_json_user_details(data.include_collections.unwrap_or(include_groups), include_groups, &conn).await))
 }
 
 #[derive(Deserialize)]
@@ -1645,11 +1530,22 @@ struct EditUserData {
 }
 
 #[put("/organizations/<org_id>/users/<member_id>", data = "<data>", rank = 1)]
+async fn put_member(
+    org_id: OrganizationId,
+    member_id: MembershipId,
+    data: Json<EditUserData>,
+    headers: AdminHeaders,
+    conn: DbConn,
+) -> EmptyResult {
+    edit_member(org_id, member_id, data, headers, conn).await
+}
+
+#[post("/organizations/<org_id>/users/<member_id>", data = "<data>", rank = 1)]
 async fn edit_member(
     org_id: OrganizationId,
     member_id: MembershipId,
     data: Json<EditUserData>,
-    headers: ManageUsersHeaders,
+    headers: AdminHeaders,
     conn: DbConn,
 ) -> EmptyResult {
     if org_id != headers.org_id {
@@ -1658,43 +1554,36 @@ async fn edit_member(
     let data: EditUserData = data.into_inner();
 
     // HACK: We need the raw user-type to be sure custom role is selected to determine the access_all permission
-    // Unless Custom roles are enabled, a custom role (4) is converted to a manager role (3)
+    // The from_str() will convert the custom role type into a manager role type
     let raw_type = &data.r#type.into_string();
-    let Some(requested_type) = MembershipType::from_str(raw_type) else {
+    // MembershipType::from_str will convert custom (4) to manager (3)
+    let Some(new_type) = MembershipType::from_str(raw_type) else {
         err!("Invalid type")
     };
 
-    let Some(mut member_to_edit) = Membership::find_by_uuid_and_org(&member_id, &org_id, &conn).await else {
-        err!("The specified user isn't member of the organization")
-    };
-    // While Custom roles are disabled, a Custom member keeps their stored permissions untouched
-    let custom_permissions = if requested_type == MembershipType::Custom && custom_roles_enabled() {
-        Some(CustomPermission::requested(&data.permissions)?)
-    } else {
-        None
-    };
-    let new_type = MembershipType::requested(requested_type, Some(&member_to_edit), custom_permissions.as_ref());
-    // A Manager whose permissions are changed only becomes a Custom member if that keeps what they may do
-    if new_type == MembershipType::Custom
-        && let Some(permissions) = &custom_permissions
-        && let Some(loss) = member_to_edit.custom_role_conversion_loss(permissions, &conn).await
-    {
-        err!(loss)
-    }
-
     // HACK: This converts the Custom role which has the `Manage all collections` box checked into an access_all flag
     // Since the parent checkbox is not sent to the server we need to check and verify the child checkboxes
     // If the box is not checked, the user will still be a manager, but not with the access_all permission
     let access_all = new_type >= MembershipType::Admin
-        || (new_type == MembershipType::Manager
-            && raw_type.eq("4")
+        || (raw_type.eq("4")
             && data.permissions.get("editAnyCollection") == Some(&json!(true))
             && data.permissions.get("deleteAnyCollection") == Some(&json!(true))
             && data.permissions.get("createNewCollections") == Some(&json!(true)));
 
-    // Both the current and the requested role must be one the caller may manage
-    check_role_manageable(headers.membership_type, member_to_edit.atype)?;
-    check_role_manageable(headers.membership_type, new_type as i32)?;
+    let Some(mut member_to_edit) = Membership::find_by_uuid_and_org(&member_id, &org_id, &conn).await else {
+        err!("The specified user isn't member of the organization")
+    };
+
+    if new_type != member_to_edit.atype
+        && (member_to_edit.atype >= MembershipType::Admin || new_type >= MembershipType::Admin)
+        && headers.membership_type != MembershipType::Owner
+    {
+        err!("Only Owners can grant and remove Admin or Owner privileges")
+    }
+
+    if member_to_edit.atype == MembershipType::Owner && headers.membership_type != MembershipType::Owner {
+        err!("Only Owners can edit Owner users")
+    }
 
     if member_to_edit.atype == MembershipType::Owner
         && new_type != MembershipType::Owner
@@ -1706,32 +1595,14 @@ async fn edit_member(
         }
     }
 
-    // A Custom member with Manage users only gives what they have themselves. Manage users authorizes member access
-    // to every collection in this organization.
-    if headers.membership_type == MembershipType::Custom {
-        let collections: Vec<&CollectionId> = data.collections.iter().flatten().map(|c| &c.id).collect();
-        let groups = data.groups.iter().flatten().cloned().collect();
-        check_custom_member_grants(
-            &headers.membership,
-            custom_permissions.as_ref().filter(|_| new_type == MembershipType::Custom),
-            &collections,
-            &groups,
-            &conn,
-        )
-        .await?;
-    }
-
-    member_to_edit.set_type(new_type);
     member_to_edit.access_all = access_all;
-    if let Some(permissions) = custom_permissions.as_ref().filter(|_| new_type == MembershipType::Custom) {
-        member_to_edit.set_custom_permissions(permissions);
-    }
+    member_to_edit.atype = new_type as i32;
 
     // This check is also done at accept_invite, _confirm_invite, _activate_member, edit_member, admin::update_membership_type
     // We need to perform the check after changing the type since `admin` is exempt.
     OrgPolicy::check_user_allowed(&member_to_edit, "modify", &conn).await?;
 
-    // Replace the member's direct collection assignments with those in the request.
+    // Delete all the odd collections
     for c in CollectionUser::find_by_organization_and_user_uuid(&org_id, &member_to_edit.user_uuid, &conn).await {
         c.delete(&conn).await?;
     }
@@ -1784,7 +1655,7 @@ async fn edit_member(
 async fn bulk_delete_member(
     org_id: OrganizationId,
     data: Json<BulkMembershipIds>,
-    headers: ManageUsersHeaders,
+    headers: AdminHeaders,
     conn: DbConn,
     nt: Notify<'_>,
 ) -> JsonResult {
@@ -1797,10 +1668,7 @@ async fn bulk_delete_member(
     for member_id in data.ids {
         let err_msg = match delete_member_impl(&org_id, &member_id, &headers, &conn, &nt).await {
             Ok(()) => String::new(),
-            Err(e) => {
-                warn!("Unable to delete member {}: {e:?}", member_id.escape_debug());
-                e.message().to_owned()
-            }
+            Err(e) => format!("{e:?}"),
         };
 
         bulk_response.push(json!(
@@ -1823,7 +1691,7 @@ async fn bulk_delete_member(
 async fn delete_member(
     org_id: OrganizationId,
     member_id: MembershipId,
-    headers: ManageUsersHeaders,
+    headers: AdminHeaders,
     conn: DbConn,
     nt: Notify<'_>,
 ) -> EmptyResult {
@@ -1833,7 +1701,7 @@ async fn delete_member(
 async fn delete_member_impl(
     org_id: &OrganizationId,
     member_id: &MembershipId,
-    headers: &ManageUsersHeaders,
+    headers: &AdminHeaders,
     conn: &DbConn,
     nt: &Notify<'_>,
 ) -> EmptyResult {
@@ -1844,11 +1712,9 @@ async fn delete_member_impl(
         err!("User to delete isn't member of the organization")
     };
 
-    // As in Bitwarden, leaving the organization is its own route
-    if member_to_delete.user_uuid == headers.user.uuid {
-        err!("You cannot remove yourself")
+    if member_to_delete.atype != MembershipType::User && headers.membership_type != MembershipType::Owner {
+        err!("Only Owners can delete Admins or Owners")
     }
-    check_role_manageable(headers.membership_type, member_to_delete.atype)?;
 
     if member_to_delete.atype == MembershipType::Owner && member_to_delete.status == MembershipStatus::Confirmed as i32
     {
@@ -1889,7 +1755,7 @@ async fn delete_member_impl(
 async fn bulk_public_keys(
     org_id: OrganizationId,
     data: Json<BulkMembershipIds>,
-    headers: ManageUsersHeaders,
+    headers: AdminHeaders,
     conn: DbConn,
 ) -> JsonResult {
     if org_id != headers.org_id {
@@ -1956,46 +1822,6 @@ struct RelationsData {
     value: usize,
 }
 
-fn validate_org_import_relationships(data: &ImportData) -> ApiResult<Vec<(usize, usize)>> {
-    let mut relations = Vec::with_capacity(data.collection_relationships.len());
-    let mut seen = HashSet::new();
-    for relation in &data.collection_relationships {
-        if relation.key >= data.ciphers.len() || relation.value >= data.collections.len() {
-            err!(Compact, "Invalid collection relationship")
-        }
-        if seen.insert((relation.key, relation.value)) {
-            relations.push((relation.key, relation.value));
-        }
-    }
-    Ok(relations)
-}
-
-async fn validate_org_import_collections(
-    imported: &[ImportCollectionData],
-    org_id: &OrganizationId,
-    membership: &Membership,
-    conn: &DbConn,
-) -> ApiResult<HashMap<CollectionId, Collection>> {
-    let existing: HashMap<CollectionId, Collection> =
-        Collection::find_by_organization(org_id, conn).await.into_iter().map(|c| (c.uuid.clone(), c)).collect();
-    for col in imported {
-        if let Some(collection) = col.id.as_ref().and_then(|id| existing.get(id)) {
-            if membership.atype < MembershipType::Admin
-                && !membership.can_edit_any_collection()
-                && !collection.is_writable_by_user(&membership.user_uuid, conn).await
-            {
-                err!(Compact, "The current user isn't allowed to manage this collection")
-            }
-        } else if membership.atype <= MembershipType::Manager
-            && !membership.has_full_access()
-            && !membership.has_custom_permission(CustomPermission::CreateNewCollections)
-        {
-            err!(Compact, "The current user isn't allowed to create new collections")
-        }
-    }
-    Ok(existing)
-}
-
 // https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Api/Tools/Controllers/ImportCiphersController.cs#L62
 #[post("/ciphers/import-organization?<query..>", data = "<data>")]
 async fn post_org_import(
@@ -2009,10 +1835,6 @@ async fn post_org_import(
     if org_id != headers.membership.org_uuid {
         err!("Organization not found", "Organization id's do not match");
     }
-    // OrgMemberHeaders also allows invited and accepted members, which are not allowed to import
-    if headers.membership.status != MembershipStatus::Confirmed as i32 {
-        err!("You need to be a Member of the Organization to call this endpoint")
-    }
     let data: ImportData = data.into_inner();
 
     // Validate the import before continuing
@@ -2021,178 +1843,80 @@ async fn post_org_import(
     // TODO: See if we can optimize the whole cipher adding/importing and prevent duplicate code and checks.
     Cipher::validate_cipher_data(&data.ciphers)?;
 
-    let relations = validate_org_import_relationships(&data)?;
-    let ImportData {
-        ciphers: imported_ciphers,
-        collections: imported_collections,
-        ..
-    } = data;
-    let grant_new_collection_manage = headers.membership.has_type(MembershipType::Custom);
-    let importer_uuid = headers.membership.user_uuid.clone();
-    let OrgMemberHeaders {
-        host,
-        device,
-        user,
-        membership,
-        ip,
-    } = headers;
-    let headers = Headers {
-        host,
-        device,
-        user,
-        ip,
-    };
-
-    // Keep authorization and every write on the same connection. A failure at any later cipher or
-    // relationship must also roll back newly created collections and their Manage assignments.
-    conn.transaction(async || {
-        let existing = validate_org_import_collections(&imported_collections, &org_id, &membership, &conn).await?;
-        let mut collections: Vec<CollectionId> = Vec::with_capacity(imported_collections.len());
-        for col in imported_collections {
-            let collection_uuid = if let Some(collection) = col.id.as_ref().and_then(|id| existing.get(id)) {
-                collection.uuid.clone()
-            } else {
-                let new_collection = Collection::new(org_id.clone(), col.name, col.external_id);
-                new_collection.save(&conn).await?;
-                if grant_new_collection_manage {
-                    CollectionUser::save(&importer_uuid, &new_collection.uuid, false, false, true, &conn).await?;
-                }
-                new_collection.uuid
-            };
-            collections.push(collection_uuid);
-        }
-
-        let mut assigned = vec![Vec::<CollectionId>::new(); imported_ciphers.len()];
-        for (cipher_index, collection_index) in relations {
-            assigned[cipher_index].push(collections[collection_index].clone());
-        }
-        for (mut cipher_data, collection_ids) in imported_ciphers.into_iter().zip(assigned) {
-            cipher_data.folder_id = None;
-            // The authenticated membership, rather than the imported file, selects the organization.
-            cipher_data.organization_id = Some(org_id.clone());
-            let mut cipher = Cipher::new(cipher_data.r#type);
-            update_cipher_from_data(
-                &mut cipher,
-                cipher_data,
-                &headers,
-                Some(collection_ids.clone()),
-                &conn,
-                &nt,
-                UpdateType::None,
-                false,
-            )
-            .await?;
-            for collection_id in collection_ids {
-                CollectionCipher::save(&cipher.uuid, &collection_id, &conn).await?;
+    let existing_collections: HashMap<CollectionId, Collection> =
+        Collection::find_by_organization(&org_id, &conn).await.into_iter().map(|c| (c.uuid.clone(), c)).collect();
+    let mut collections: Vec<CollectionId> = Vec::with_capacity(data.collections.len());
+    for col in data.collections {
+        let existing = col.id.as_ref().and_then(|col_id| existing_collections.get(col_id));
+        let collection_uuid = if let Some(collection) = existing {
+            // When not an Owner or Admin, check if the member is allowed to write to the collection.
+            if headers.membership.atype < MembershipType::Admin
+                && !collection.is_writable_by_user(&headers.membership.user_uuid, &conn).await
+            {
+                err!(Compact, "The current user isn't allowed to manage this collection")
             }
-        }
-
-        let mut user = headers.user;
-        user.update_revision(&conn).await
-    })
-    .await
-}
-
-#[cfg(all(test, feature = "sqlite"))]
-mod org_import_tests {
-    use super::*;
-    use crate::{
-        api::notifications::{WS_USERS, WebSocketUsers},
-        db::{models::test_flag, test_db},
-    };
-    use diesel::connection::SimpleConnection;
-    use std::sync::Arc;
-
-    #[test]
-    fn imports_preserve_authorization_atomicity_and_creator_access() {
-        test_db::run(async |db| {
-            let conn = db.conn();
-            for (case, role, permission) in [
-                ("owner", MembershipType::Owner, CustomPermission::CreateNewCollections),
-                ("admin", MembershipType::Admin, CustomPermission::CreateNewCollections),
-                ("cipher", MembershipType::Custom, CustomPermission::CreateNewCollections),
-                ("custom", MembershipType::Custom, CustomPermission::CreateNewCollections),
-                ("legacy", MembershipType::Manager, CustomPermission::CreateNewCollections),
-                ("authorization", MembershipType::Custom, CustomPermission::CreateNewCollections),
-                ("rollback", MembershipType::Custom, CustomPermission::CreateNewCollections),
-                ("index", MembershipType::Custom, CustomPermission::CreateNewCollections),
-                ("disabled", MembershipType::Custom, CustomPermission::CreateNewCollections),
-                ("export", MembershipType::Owner, CustomPermission::CreateNewCollections),
-            ] {
-                test_flag::CUSTOM_ROLES_ENABLED.set(Some(case != "disabled"));
-                let org = test_db::organization(&conn).await;
-                let permissions = if role == MembershipType::Custom {
-                    vec![permission]
-                } else {
-                    vec![]
-                };
-                let (user, mut membership) = test_db::member(&conn, &org.uuid, role, &permissions).await;
-                membership.access_all = role == MembershipType::Manager;
-                membership.save(&conn).await.unwrap();
-                let mut payload = json!({"ciphers":[{"name":"Cipher","type":2,"encryptedFor":user.uuid,"secureNote":{"type":0}}],
-                    "collections":[{"name":"New"}],"collectionRelationships":[{"key":0,"value":0}]});
-                match case {
-                    "authorization" => {
-                        let existing=test_db::collection(&conn,&org.uuid).await;
-                        payload["collections"].as_array_mut().unwrap().push(json!({"name":"Existing","id":existing.uuid}));
-                    }
-                    "cipher" => {
-                        payload["ciphers"].as_array_mut().unwrap().push(json!({"name":"Invalid","type":99,"encryptedFor":user.uuid,"secureNote":{"type":0}}));
-                        payload["collectionRelationships"].as_array_mut().unwrap().push(json!({"key":1,"value":0}));
-                    }
-                    "rollback" => conn.run(|c| c.batch_execute("CREATE TRIGGER reject_link BEFORE INSERT ON ciphers_collections BEGIN SELECT RAISE(ABORT,'test failure'); END")).await.unwrap(),
-                    "index" => payload["collectionRelationships"][0]["value"]=json!(1),
-                    "export" => payload["collectionRelationships"]=json!([]),
-                    _ => {}
-                }
-                let user_id = user.uuid.clone();
-                let headers = OrgMemberHeaders {
-                    host: "http://localhost".into(),
-                    device: Device::new("test".to_owned().into(), user_id.clone(), "test".into(), 1),
-                    user,
-                    membership,
-                    ip: crate::auth::ClientIp {
-                        ip: "127.0.0.1".parse().unwrap(),
-                    },
-                };
-                let rocket = rocket::build().manage(Arc::clone(&WS_USERS));
-                let notify = rocket.state::<Arc<WebSocketUsers>>().unwrap();
-                let result = post_org_import(
-                    OrgIdData {
-                        organization_id: org.uuid.clone(),
-                    },
-                    Json(serde_json::from_value(payload).unwrap()),
-                    headers,
-                    db.conn(),
-                    notify.into(),
-                )
-                .await;
-                conn.run(|c| c.batch_execute("DROP TRIGGER IF EXISTS reject_link")).await.unwrap();
-                let success = matches!(case, "owner" | "admin" | "custom" | "legacy" | "export");
-                assert_eq!(result.is_ok(), success, "{case}");
-                assert_eq!(
-                    Collection::find_by_organization(&org.uuid, &conn).await.len(),
-                    usize::from(success || case == "authorization")
-                );
-                assert_eq!(Cipher::find_by_org(&org.uuid, &conn).await.len(), usize::from(success));
-                assert_eq!(
-                    CollectionUser::find_by_user(&user_id, &conn).await.len(),
-                    usize::from(success && role == MembershipType::Custom)
-                );
-                assert_eq!(
-                    Cipher::get_collections_with_cipher_by_organization(&org.uuid, &conn).await.len(),
-                    usize::from(success && case != "export")
-                );
+            collection.uuid.clone()
+        } else {
+            // We do not allow users or managers which can not manage all collections to create new collections
+            // If there is any collection other than an existing import collection, abort the import.
+            if headers.membership.atype <= MembershipType::Manager && !headers.membership.has_full_access() {
+                err!(Compact, "The current user isn't allowed to create new collections")
             }
-        });
+            let new_collection = Collection::new(org_id.clone(), col.name, col.external_id);
+            new_collection.save(&conn).await?;
+            new_collection.uuid
+        };
+
+        collections.push(collection_uuid);
     }
+
+    // Read the relations between collections and ciphers
+    // Ciphers can be in multiple collections at the same time
+    let mut relations = Vec::with_capacity(data.collection_relationships.len());
+    for relation in data.collection_relationships {
+        relations.push((relation.key, relation.value));
+    }
+
+    let headers: Headers = headers.into();
+
+    let mut ciphers: Vec<CipherId> = Vec::with_capacity(data.ciphers.len());
+    for mut cipher_data in data.ciphers {
+        // Always clear folder_id's via an organization import
+        cipher_data.folder_id = None;
+        // Replace the client-provided, unvalidated organizationId with the real target org
+        cipher_data.organization_id = Some(org_id.clone());
+        let mut cipher = Cipher::new(cipher_data.r#type, String::new());
+        update_cipher_from_data(
+            &mut cipher,
+            cipher_data,
+            &headers,
+            Some(collections.clone()),
+            &conn,
+            &nt,
+            UpdateType::None,
+        )
+        .await
+        .ok();
+        ciphers.push(cipher.uuid);
+    }
+
+    // Assign the collections
+    for (cipher_index, col_index) in relations {
+        let (Some(cipher_id), Some(col_id)) = (ciphers.get(cipher_index), collections.get(col_index)) else {
+            err!(Compact, "Invalid collection relationship")
+        };
+        CollectionCipher::save(cipher_id, col_id, &conn).await?;
+    }
+
+    let mut user = headers.user;
+    user.update_revision(&conn).await
 }
 
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct BulkCollectionsData {
     organization_id: OrganizationId,
-    cipher_ids: HashSet<CipherId>,
+    cipher_ids: Vec<CipherId>,
     collection_ids: HashSet<CollectionId>,
     remove_collections: bool,
 }
@@ -2203,37 +1927,29 @@ struct BulkCollectionsData {
 async fn post_bulk_collections(data: Json<BulkCollectionsData>, headers: Headers, conn: DbConn) -> EmptyResult {
     let data: BulkCollectionsData = data.into_inner();
 
-    let Some(member) =
-        Membership::find_confirmed_by_user_and_org(&headers.user.uuid, &data.organization_id, &conn).await
-    else {
+    if Membership::find_confirmed_by_user_and_org(&headers.user.uuid, &data.organization_id, &conn).await.is_none() {
         err!("You need to be a Member of the Organization to call this endpoint")
-    };
-    // A member who may edit any collection may use every collection of the organization
-    let can_edit_any_collection = member.can_edit_any_collection();
+    }
 
     // Get all the collection available to the user in one query
     // Also filter based upon the provided collections
-    let collections = if can_edit_any_collection {
-        Collection::find_by_organization(&data.organization_id, &conn).await
-    } else {
-        Collection::find_by_organization_and_user_uuid(&data.organization_id, &headers.user.uuid, &conn).await
-    };
-    let user_collections: HashMap<CollectionId, Collection> = collections
-        .into_iter()
-        .filter_map(|c| {
-            if data.collection_ids.contains(&c.uuid) {
-                Some((c.uuid.clone(), c))
-            } else {
-                None
-            }
-        })
-        .collect();
+    let user_collections: HashMap<CollectionId, Collection> =
+        Collection::find_by_organization_and_user_uuid(&data.organization_id, &headers.user.uuid, &conn)
+            .await
+            .into_iter()
+            .filter_map(|c| {
+                if data.collection_ids.contains(&c.uuid) {
+                    Some((c.uuid.clone(), c))
+                } else {
+                    None
+                }
+            })
+            .collect();
 
     // Verify if all the collections requested exists and are writable for the user, else abort
     for collection_uuid in &data.collection_ids {
         match user_collections.get(collection_uuid) {
-            Some(collection)
-                if can_edit_any_collection || collection.is_writable_by_user(&headers.user.uuid, &conn).await => {}
+            Some(collection) if collection.is_writable_by_user(&headers.user.uuid, &conn).await => (),
             _ => err_code!("Resource not found", "User does not have access to a collection", 404),
         }
     }
@@ -2242,7 +1958,7 @@ async fn post_bulk_collections(data: Json<BulkCollectionsData>, headers: Headers
         // Only act on existing cipher uuid's
         // Do not abort the operation just ignore it, it could be a cipher was just deleted for example
         if let Some(cipher) = Cipher::find_by_uuid_and_org(cipher_id, &data.organization_id, &conn).await
-            && cipher.is_write_accessible_to_user(&headers.user.uuid, CipherAccessScope::OrganizationAdmin, &conn).await
+            && cipher.is_write_accessible_to_user(&headers.user.uuid, &conn).await
         {
             // When selecting a specific collection from the left filter list, and use the bulk option, you can remove an item from that collection
             // In these cases the client will call this endpoint twice, once for adding the new collections and a second for deleting.
@@ -2377,29 +2093,6 @@ async fn put_policy(
         err!("Invalid or unsupported policy type")
     };
 
-    let current_policy = OrgPolicy::find_by_org_and_type(&org_id, pol_type_enum, &conn).await;
-    let is_currently_enabled = current_policy.as_ref().is_some_and(|policy| policy.enabled);
-
-    // Fill Assist depends on Single Organization. Match Bitwarden's dependency checks by only checking when the
-    // policy changes state.
-    if pol_type_enum == OrgPolicyType::FillAssist && data.enabled && !is_currently_enabled {
-        let single_org_policy_enabled =
-            OrgPolicy::find_by_org_and_type(&org_id, OrgPolicyType::SingleOrg, &conn).await.is_some_and(|p| p.enabled);
-
-        if !single_org_policy_enabled {
-            err!("Turn on the Single organization policy because it is required for the Activate fill assist policy.")
-        }
-    }
-
-    if pol_type_enum == OrgPolicyType::SingleOrg && !data.enabled && is_currently_enabled {
-        let fill_assist_policy_enabled =
-            OrgPolicy::find_by_org_and_type(&org_id, OrgPolicyType::FillAssist, &conn).await.is_some_and(|p| p.enabled);
-
-        if fill_assist_policy_enabled {
-            err!("Turn off the Activate fill assist policy because it requires the Single organization policy.")
-        }
-    }
-
     // Bitwarden only allows the Reset Password policy when Single Org policy is enabled
     // Vaultwarden encouraged to use multiple orgs instead of groups because groups were not available in the past
     // Now that groups are available we can enforce this option when wanted.
@@ -2432,37 +2125,6 @@ async fn put_policy(
         }
     }
 
-    if pol_type_enum == OrgPolicyType::FillAssist {
-        let fill_assist_data = match data.data.as_ref() {
-            None | Some(Value::Null) => FillAssistPolicyData {
-                rules_url: None,
-            },
-            Some(data) => {
-                let Ok(data) = serde_json::from_value::<FillAssistPolicyData>(data.clone()) else {
-                    err!("Invalid data for FillAssist policy: rulesUrl has an invalid value.")
-                };
-                data
-            }
-        };
-
-        if data.enabled {
-            let Some(rules_url) = fill_assist_data.rules_url.filter(|url| !url.trim().is_empty()) else {
-                err!("The RulesUrl field is required.")
-            };
-            let Ok(rules_url) = url::Url::parse(&rules_url) else {
-                err!("The RulesUrl field is not a valid fully-qualified http, https, or ftp URL.")
-            };
-
-            if !rules_url.has_host() || !matches!(rules_url.scheme(), "http" | "https" | "ftp") {
-                err!("The RulesUrl field is not a valid fully-qualified http, https, or ftp URL.")
-            }
-
-            if rules_url.scheme() != "https" {
-                err!("RulesUrl must use HTTPS.")
-            }
-        }
-    }
-
     // When enabling the TwoFactorAuthentication policy, revoke all members that do not have 2FA
     if pol_type_enum == OrgPolicyType::TwoFactorAuthentication && data.enabled {
         two_factor::enforce_2fa_policy_for_org(
@@ -2494,7 +2156,7 @@ async fn put_policy(
                 }
 
                 log_event(
-                    EventType::OrganizationUserRevokedSingleOrganizationNonCompliance,
+                    EventType::OrganizationUserRemoved,
                     &member.uuid,
                     &org_id,
                     &headers.user.uuid,
@@ -2510,7 +2172,7 @@ async fn put_policy(
         }
     }
 
-    let mut policy = match current_policy {
+    let mut policy = match OrgPolicy::find_by_org_and_type(&org_id, pol_type_enum, &conn).await {
         Some(p) => p,
         None => OrgPolicy::new(org_id.clone(), pol_type_enum, false, "{}".to_owned()),
     };
@@ -2533,6 +2195,18 @@ async fn put_policy(
     Ok(Json(policy.to_json()))
 }
 
+// Deprecated with client v2026.5.0
+#[put("/organizations/<org_id>/policies/<pol_type>/vnext", data = "<data>")]
+async fn put_policy_vnext(
+    org_id: OrganizationId,
+    pol_type: i32,
+    data: Json<PutPolicy>,
+    headers: AdminHeaders,
+    conn: DbConn,
+) -> JsonResult {
+    put_policy(org_id, pol_type, data, headers, conn).await
+}
+
 #[get("/plans")]
 fn get_plans() -> Json<Value> {
     // Respond with a minimal json just enough to allow the creation of an new organization.
@@ -2561,6 +2235,12 @@ fn get_plans() -> Json<Value> {
     }))
 }
 
+#[get("/organizations/<_org_id>/billing/metadata")]
+fn get_billing_metadata(_org_id: OrganizationId, _headers: OrgMemberHeaders) -> Json<Value> {
+    // Prevent a 404 error, which also causes Javascript errors.
+    Json(empty_data_json())
+}
+
 #[get("/organizations/<_org_id>/billing/vnext/warnings")]
 fn get_billing_warnings(_org_id: OrganizationId, _headers: OrgMemberHeaders) -> Json<Value> {
     Json(json!({
@@ -2580,6 +2260,14 @@ fn get_self_host_billing_metadata(_org_id: OrganizationId, _headers: OrgMemberHe
     }))
 }
 
+fn empty_data_json() -> Value {
+    json!({
+        "object": "list",
+        "data": [],
+        "continuationToken": null
+    })
+}
+
 #[derive(Deserialize, Debug)]
 #[serde(rename_all = "camelCase")]
 struct BulkRevokeMembershipIds {
@@ -2590,7 +2278,7 @@ struct BulkRevokeMembershipIds {
 async fn revoke_member(
     org_id: OrganizationId,
     member_id: MembershipId,
-    headers: ManageUsersHeaders,
+    headers: AdminHeaders,
     conn: DbConn,
 ) -> EmptyResult {
     revoke_member_impl(&org_id, &member_id, &headers, &conn).await
@@ -2600,7 +2288,7 @@ async fn revoke_member(
 async fn bulk_revoke_members(
     org_id: OrganizationId,
     data: Json<BulkRevokeMembershipIds>,
-    headers: ManageUsersHeaders,
+    headers: AdminHeaders,
     conn: DbConn,
 ) -> JsonResult {
     if org_id != headers.org_id {
@@ -2614,10 +2302,7 @@ async fn bulk_revoke_members(
             for member_id in members {
                 let err_msg = match revoke_member_impl(&org_id, &member_id, &headers, &conn).await {
                     Ok(()) => String::new(),
-                    Err(e) => {
-                        warn!("Unable to revoke member {}: {e:?}", member_id.escape_debug());
-                        e.message().to_owned()
-                    }
+                    Err(e) => format!("{e:?}"),
                 };
 
                 bulk_response.push(json!(
@@ -2642,7 +2327,7 @@ async fn bulk_revoke_members(
 async fn revoke_member_impl(
     org_id: &OrganizationId,
     member_id: &MembershipId,
-    headers: &ManageUsersHeaders,
+    headers: &AdminHeaders,
     conn: &DbConn,
 ) -> EmptyResult {
     if org_id != &headers.org_id {
@@ -2656,9 +2341,6 @@ async fn revoke_member_impl(
             if member.atype == MembershipType::Owner && headers.membership_type != MembershipType::Owner {
                 err!("Only owners can revoke other owners")
             }
-            if headers.membership_type == MembershipType::Custom && !custom_member_manages(member.atype) {
-                err!("You can only manage Users and Custom members")
-            }
             if member.atype == MembershipType::Owner
                 && Membership::count_confirmed_by_org_and_type(org_id, MembershipType::Owner, conn).await <= 1
             {
@@ -2689,7 +2371,7 @@ async fn revoke_member_impl(
 async fn restore_member_vnext(
     org_id: OrganizationId,
     member_id: MembershipId,
-    headers: ManageUsersHeaders,
+    headers: AdminHeaders,
     conn: DbConn,
 ) -> EmptyResult {
     // Vaultwarden does not (yet) support the per User Collection linked to the `Enforce organization data ownership` policy.
@@ -2701,7 +2383,7 @@ async fn restore_member_vnext(
 async fn restore_member(
     org_id: OrganizationId,
     member_id: MembershipId,
-    headers: ManageUsersHeaders,
+    headers: AdminHeaders,
     conn: DbConn,
 ) -> EmptyResult {
     restore_member_impl(&org_id, &member_id, &headers, &conn).await
@@ -2711,7 +2393,7 @@ async fn restore_member(
 async fn bulk_restore_members(
     org_id: OrganizationId,
     data: Json<BulkMembershipIds>,
-    headers: ManageUsersHeaders,
+    headers: AdminHeaders,
     conn: DbConn,
 ) -> JsonResult {
     if org_id != headers.org_id {
@@ -2723,10 +2405,7 @@ async fn bulk_restore_members(
     for member_id in data.ids {
         let err_msg = match restore_member_impl(&org_id, &member_id, &headers, &conn).await {
             Ok(()) => String::new(),
-            Err(e) => {
-                warn!("Unable to restore member {}: {e:?}", member_id.escape_debug());
-                e.message().to_owned()
-            }
+            Err(e) => format!("{e:?}"),
         };
 
         bulk_response.push(json!(
@@ -2748,7 +2427,7 @@ async fn bulk_restore_members(
 async fn restore_member_impl(
     org_id: &OrganizationId,
     member_id: &MembershipId,
-    headers: &ManageUsersHeaders,
+    headers: &AdminHeaders,
     conn: &DbConn,
 ) -> EmptyResult {
     if org_id != &headers.org_id {
@@ -2762,9 +2441,6 @@ async fn restore_member_impl(
             if member.atype == MembershipType::Owner && headers.membership_type != MembershipType::Owner {
                 err!("Only owners can restore other owners")
             }
-            if headers.membership_type == MembershipType::Custom && !custom_member_manages(member.atype) {
-                err!("You can only manage Users and Custom members")
-            }
 
             member.restore();
             // This check is also done at accept_invite, _confirm_invite, _activate_member, edit_member, admin::update_membership_type
@@ -2789,15 +2465,6 @@ async fn restore_member_impl(
     Ok(())
 }
 
-/// Whether a member may give others access to collections, and so needs to see the members and groups: by seeing
-/// or creating any collection, by managing the members, or by the manage option on a collection.
-async fn may_assign_collection_access(member: &Membership, conn: &DbConn) -> bool {
-    member.can_view_all_collections()
-        || member.has_custom_permission(CustomPermission::CreateNewCollections)
-        || member.has_custom_permission(CustomPermission::ManageUsers)
-        || Collection::has_manageable_collection_by_user(&member.org_uuid, &member.user_uuid, conn).await
-}
-
 async fn get_groups_data(
     details: bool,
     org_id: OrganizationId,
@@ -2811,15 +2478,14 @@ async fn get_groups_data(
     // The details view (group→collection/user mappings) needs full org access; the plain list only
     // needs manage access to a collection, so a manager of a collection (directly or via a group)
     // can load it to assign groups.
-    // A group with access to all collections gives a Custom member access to them, but not to the Admin Console.
     let has_full_access = headers.membership.has_full_access()
         || (CONFIG.org_groups_enabled()
-            && !headers.membership.has_type(MembershipType::Custom)
             && GroupUser::has_full_access_by_member(&org_id, &headers.membership.uuid, &conn).await);
     let allowed = if details {
-        has_full_access || headers.membership.has_custom_permission(CustomPermission::ManageUsers)
+        has_full_access
     } else {
-        has_full_access || may_assign_collection_access(&headers.membership, &conn).await
+        has_full_access
+            || Collection::has_manageable_collection_by_user(&org_id, &headers.membership.user_uuid, &conn).await
     };
     if !allowed {
         err_code!("Resource not found.", "User does not have access", Status::NotFound.code);
@@ -2892,16 +2558,13 @@ impl GroupRequest {
         let org_collections = Collection::find_by_organization(org_id, conn).await;
         let org_collection_ids: HashSet<&CollectionId> = org_collections.iter().map(|c| &c.uuid).collect();
         if let Some(e) = self.collections.iter().find(|c| !org_collection_ids.contains(&c.id)) {
-            err!(
-                "Invalid collection",
-                format!("Collection {} does not belong to organization {}!", e.id.escape_debug(), org_id)
-            )
+            err!("Invalid collection", format!("Collection {} does not belong to organization {}!", e.id, org_id))
         }
 
         let org_memberships = Membership::find_by_org(org_id, conn).await;
         let org_membership_ids: HashSet<&MembershipId> = org_memberships.iter().map(|m| &m.uuid).collect();
         if let Some(e) = self.users.iter().find(|m| !org_membership_ids.contains(m)) {
-            err!("Invalid member", format!("Member {} does not belong to organization {}!", e.escape_debug(), org_id))
+            err!("Invalid member", format!("Member {} does not belong to organization {}!", e, org_id))
         }
 
         Ok(())
@@ -2923,6 +2586,17 @@ impl CollectionData {
     }
 }
 
+#[post("/organizations/<org_id>/groups/<group_id>", data = "<data>")]
+async fn post_group(
+    org_id: OrganizationId,
+    group_id: GroupId,
+    data: Json<GroupRequest>,
+    headers: AdminHeaders,
+    conn: DbConn,
+) -> JsonResult {
+    put_group(org_id, group_id, data, headers, conn).await
+}
+
 #[post("/organizations/<org_id>/groups", data = "<data>")]
 async fn post_groups(
     org_id: OrganizationId,
@@ -3032,6 +2706,7 @@ async fn add_update_group(
         "id": group.uuid,
         "organizationId": group.organizations_uuid,
         "name": group.name,
+        "accessAll": group.access_all,
         "externalId": group.external_id,
         "object": "group"
     })))
@@ -3058,6 +2733,16 @@ async fn get_group_details(
     Ok(Json(group.to_json_details(&conn).await))
 }
 
+#[post("/organizations/<org_id>/groups/<group_id>/delete")]
+async fn post_delete_group(
+    org_id: OrganizationId,
+    group_id: GroupId,
+    headers: AdminHeaders,
+    conn: DbConn,
+) -> EmptyResult {
+    delete_group_impl(&org_id, &group_id, &headers, &conn).await
+}
+
 #[delete("/organizations/<org_id>/groups/<group_id>")]
 async fn delete_group(org_id: OrganizationId, group_id: GroupId, headers: AdminHeaders, conn: DbConn) -> EmptyResult {
     delete_group_impl(&org_id, &group_id, &headers, &conn).await
@@ -3159,6 +2844,90 @@ async fn get_group_members(
     Ok(Json(json!(group_members)))
 }
 
+#[put("/organizations/<org_id>/groups/<group_id>/users", data = "<data>")]
+async fn put_group_members(
+    org_id: OrganizationId,
+    group_id: GroupId,
+    headers: AdminHeaders,
+    data: Json<Vec<MembershipId>>,
+    conn: DbConn,
+) -> EmptyResult {
+    if org_id != headers.org_id {
+        err!("Organization not found", "Organization id's do not match");
+    }
+    if !CONFIG.org_groups_enabled() {
+        err!("Group support is disabled");
+    }
+
+    if Group::find_by_uuid_and_org(&group_id, &org_id, &conn).await.is_none() {
+        err!("Group could not be found!", "Group uuid is invalid or does not belong to the organization")
+    }
+
+    let assigned_members = data.into_inner();
+
+    let org_memberships = Membership::find_by_org(&org_id, &conn).await;
+    let org_membership_ids: HashSet<&MembershipId> = org_memberships.iter().map(|m| &m.uuid).collect();
+    if let Some(e) = assigned_members.iter().find(|m| !org_membership_ids.contains(m)) {
+        err!("Invalid member", format!("Member {} does not belong to organization {}!", e, org_id))
+    }
+
+    GroupUser::delete_all_by_group(&group_id, &org_id, &conn).await?;
+    for assigned_member in assigned_members {
+        let mut user_entry = GroupUser::new(group_id.clone(), assigned_member.clone());
+        user_entry.save(&conn).await?;
+
+        log_event(
+            EventType::OrganizationUserUpdatedGroups,
+            &assigned_member,
+            &org_id,
+            &headers.user.uuid,
+            headers.device.atype,
+            &headers.ip.ip,
+            &conn,
+        )
+        .await;
+    }
+
+    Ok(())
+}
+
+#[post("/organizations/<org_id>/groups/<group_id>/delete-user/<member_id>")]
+async fn post_delete_group_member(
+    org_id: OrganizationId,
+    group_id: GroupId,
+    member_id: MembershipId,
+    headers: AdminHeaders,
+    conn: DbConn,
+) -> EmptyResult {
+    if org_id != headers.org_id {
+        err!("Organization not found", "Organization id's do not match");
+    }
+    if !CONFIG.org_groups_enabled() {
+        err!("Group support is disabled");
+    }
+
+    if Membership::find_by_uuid_and_org(&member_id, &org_id, &conn).await.is_none() {
+        err!("User could not be found or does not belong to the organization.");
+    }
+
+    if Group::find_by_uuid_and_org(&group_id, &org_id, &conn).await.is_none() {
+        err!("Group could not be found or does not belong to the organization.");
+    }
+
+    log_event(
+        EventType::OrganizationUserUpdatedGroups,
+        &member_id,
+        &org_id,
+        &headers.user.uuid,
+        headers.device.atype,
+        &headers.ip.ip,
+        &conn,
+    )
+    .await;
+
+    GroupUser::delete_by_group_and_member(&group_id, &member_id, &conn).await
+}
+
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct OrganizationUserResetPasswordEnrollmentRequest {
@@ -3170,14 +2939,9 @@ struct OrganizationUserResetPasswordEnrollmentRequest {
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct OrganizationUserRecoverAccountRequest {
-    // Legacy payload
     new_master_password_hash: Option<String>,
     key: Option<String>,
 
-    // Current payload
-    authentication_data: Option<AuthenticationData>,
-    unlock_data: Option<UnlockData>,
-
     #[serde(default)]
     reset_master_password: bool,
     #[serde(default)]
@@ -3188,26 +2952,8 @@ struct OrganizationUserRecoverAccountRequest {
 // But the clients do not seem to use this at all
 // Just add it here in case they will
 #[get("/organizations/<org_id>/public-key")]
-async fn get_organization_public_key(
-    org_id: OrganizationId,
-    headers: Headers,
-    member: Result<OrgMemberHeaders, &'static str>,
-    conn: DbConn,
-) -> JsonResult {
-    // SSO users without an org get the fake one, whose key the v2 JIT password flow fetches anyway
-    if org_id.eq_ignore_ascii_case(FAKE_SSO_IDENTIFIER) && headers.user.private_key.is_none() {
-        return Ok(Json(json!({
-            "object": "organizationPublicKey",
-            "publicKey": fake_sso_org_public_key().await?,
-        })));
-    }
-    let member = match member {
-        Ok(member) => member,
-        // The guard already logged it
-        Err(e) => return Err(crate::error::Error::new_msg(e).with_code(Status::Unauthorized.code)),
-    };
-
-    if org_id != member.membership.org_uuid {
+async fn get_organization_public_key(org_id: OrganizationId, headers: OrgMemberHeaders, conn: DbConn) -> JsonResult {
+    if org_id != headers.membership.org_uuid {
         err!("Organization not found", "Organization id's do not match");
     }
     let Some(org) = Organization::find_by_uuid(&org_id, &conn).await else {
@@ -3220,30 +2966,11 @@ async fn get_organization_public_key(
     })))
 }
 
-/// The SDK only uses this key to wrap an account recovery key that it never sends for the fake org,
-/// so it is made once and its private half dropped.
-async fn fake_sso_org_public_key() -> ApiResult<String> {
-    static PUBLIC_KEY: std::sync::LazyLock<Option<String>> = std::sync::LazyLock::new(|| {
-        let der = openssl::rsa::Rsa::generate(2048).and_then(|rsa| rsa.public_key_to_der()).ok()?;
-        Some(data_encoding::BASE64.encode(&der))
-    });
-
-    let Ok(Some(public_key)) = tokio::task::spawn_blocking(|| PUBLIC_KEY.clone()).await else {
-        err!("Failed to generate the organization key")
-    };
-    Ok(public_key)
-}
-
 // Obsolete - Renamed to public-key (2023.8), left for backwards compatibility with older clients
 // https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Api/AdminConsole/Controllers/OrganizationsController.cs#L487-L492
 #[get("/organizations/<org_id>/keys")]
-async fn get_organization_keys(
-    org_id: OrganizationId,
-    headers: Headers,
-    member: Result<OrgMemberHeaders, &'static str>,
-    conn: DbConn,
-) -> JsonResult {
-    get_organization_public_key(org_id, headers, member, conn).await
+async fn get_organization_keys(org_id: OrganizationId, headers: OrgMemberHeaders, conn: DbConn) -> JsonResult {
+    get_organization_public_key(org_id, headers, conn).await
 }
 
 // Will allow to reset 2FA too
@@ -3260,6 +2987,19 @@ async fn put_recover_account(
     recover_account(org_id, member_id, headers, data.into_inner(), conn, nt).await
 }
 
+// Deprecated since `v2026.4.2`
+#[put("/organizations/<org_id>/users/<member_id>/reset-password", data = "<data>")]
+async fn put_reset_password(
+    org_id: OrganizationId,
+    member_id: MembershipId,
+    headers: AdminHeaders,
+    data: Json<OrganizationUserRecoverAccountRequest>,
+    conn: DbConn,
+    nt: Notify<'_>,
+) -> EmptyResult {
+    recover_account(org_id, member_id, headers, data.into_inner(), conn, nt).await
+}
+
 async fn recover_account(
     org_id: OrganizationId,
     member_id: MembershipId,
@@ -3292,33 +3032,10 @@ async fn recover_account(
         err!("Organization user must be confirmed for password reset functionality");
     }
 
-    let fallback_2fa_email = req.reset_two_factor
-        && CONFIG.mail_enabled()
-        && CONFIG.email_2fa_auto_fallback()
-        && user.verified()
-        && TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Email, &conn).await.is_none();
-
-    // Check the new password before the email below, so that a rejected request doesn't tell the user
-    // their password was reset
-    let new_password = if req.reset_master_password {
-        let (new_master_password_hash, new_key) = if let (Some(authentication_data), Some(unlock_data)) =
-            (req.authentication_data, req.unlock_data)
-        {
-            authentication_data.check(&user, &unlock_data)?;
-
-            if !authentication_data.kdf.matches_user(&user) {
-                err!("KDF settings do not match the user account")
-            }
-
-            (authentication_data.master_password_authentication_hash, unlock_data.master_key_wrapped_user_key)
-        } else if let (Some(new_master_password_hash), Some(new_key)) = (req.new_master_password_hash, req.key) {
-            (new_master_password_hash, new_key)
-        } else {
-            err_code!("Unprocessable request", "Missing fields to reset password", Status::UnprocessableEntity.code);
-        };
-        Some((new_master_password_hash, new_key))
+    let fallback_2fa_email = if req.reset_two_factor && CONFIG.email_2fa_auto_fallback() {
+        TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Email as i32, &conn).await.is_none()
     } else {
-        None
+        false
     };
 
     // Sending email first ensure working email configuration and the resulting user notification.
@@ -3336,13 +3053,18 @@ async fn recover_account(
         err!(format!("Error sending user reset password email: {e:#?}"));
     }
 
-    if let Some((new_master_password_hash, new_key)) = new_password {
-        user.set_password(&new_master_password_hash, Some(new_key), true, None, &conn).await?;
+    if req.reset_master_password {
+        if let Some(key) = req.key
+            && let Some(hash) = req.new_master_password_hash
+        {
+            user.set_password(hash.as_str(), Some(key), true, None, &conn).await?;
+        } else {
+            err_code!("Unprocessable request", "Missing fields to reset password", Status::UnprocessableEntity.code);
+        }
     }
 
     if req.reset_two_factor {
         TwoFactor::delete_all_by_user(&user.uuid, &conn).await?;
-        Device::clear_twofactor_remember_by_user(&user.uuid, &conn).await?;
         if !fallback_2fa_email || two_factor::email::find_and_activate_email_2fa(&user.uuid, &conn).await.is_err() {
             two_factor::enforce_2fa_policy(&user, &headers.user.uuid, headers.device.atype, &headers.ip.ip, &conn)
                 .await?;
@@ -3396,7 +3118,6 @@ async fn get_reset_password_details(
         "kdfIterations": user.client_kdf_iter,
         "kdfMemory": user.client_kdf_memory,
         "kdfParallelism": user.client_kdf_parallelism,
-        "masterPasswordSalt": user.master_password_salt(),
         "resetPasswordKey": member.reset_password_key,
         "encryptedPrivateKey": org.private_key,
     })))
@@ -3512,7 +3233,7 @@ async fn api_key(
     org_id: &OrganizationId,
     data: Json<PasswordOrOtpData>,
     rotate: bool,
-    headers: OwnerHeaders,
+    headers: AdminHeaders,
     conn: DbConn,
 ) -> JsonResult {
     if org_id != &headers.org_id {
@@ -3521,7 +3242,7 @@ async fn api_key(
     let data: PasswordOrOtpData = data.into_inner();
     let user = headers.user;
 
-    // Validate the owner users password/otp
+    // Validate the admin users password/otp
     data.validate(&user, true, &conn).await?;
 
     let org_api_key = if let Some(mut org_api_key) = OrganizationApiKey::find_by_org_uuid(org_id, &conn).await {
@@ -3549,7 +3270,7 @@ async fn api_key(
 async fn post_api_key(
     org_id: OrganizationId,
     data: Json<PasswordOrOtpData>,
-    headers: OwnerHeaders,
+    headers: AdminHeaders,
     conn: DbConn,
 ) -> JsonResult {
     api_key(&org_id, data, false, headers, conn).await
@@ -3559,111 +3280,8 @@ async fn post_api_key(
 async fn rotate_api_key(
     org_id: OrganizationId,
     data: Json<PasswordOrOtpData>,
-    headers: OwnerHeaders,
+    headers: AdminHeaders,
     conn: DbConn,
 ) -> JsonResult {
     api_key(&org_id, data, true, headers, conn).await
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    #[cfg(sqlite)]
-    use crate::db::{models::test_flag, test_db};
-
-    #[test]
-    fn custom_members_manage_users_and_custom_members_only() {
-        for role in [0, 1, 2, 3, 4, 99, -1] {
-            assert_eq!(custom_member_manages(role), matches!(role, 2 | 4));
-        }
-    }
-
-    #[cfg(sqlite)]
-    #[test]
-    fn manage_users_grants_are_confined_to_permission_and_organization() {
-        test_db::run(async |db| {
-            let conn = db.conn();
-            let (org, _, mut member) = test_db::custom_member(&conn, CustomPermission::ManageUsers).await;
-            let foreign = test_db::organization(&conn).await;
-            for org_id in [&org.uuid, &foreign.uuid] {
-                let collection = test_db::collection(&conn, org_id).await;
-                let mut group = Group::new(org_id.clone(), "Group".into(), true, None);
-                group.save(&conn).await.unwrap();
-                let empty = HashSet::new();
-                for (collections, groups) in [
-                    (&[&collection.uuid][..], empty.clone()),
-                    (&[][..], HashSet::from([group.uuid.clone()])),
-                    (&[&collection.uuid][..], HashSet::from([group.uuid])),
-                ] {
-                    // A group with access to all collections may be given as well, as in Bitwarden
-                    assert_eq!(
-                        check_custom_member_grants(&member, None, collections, &groups, &conn).await.is_ok(),
-                        org_id == &org.uuid
-                    );
-                }
-            }
-            let collection = test_db::collection(&conn, &org.uuid).await;
-            assert!(!Collection::can_access_collection(&member, &collection.uuid, &conn).await);
-            let escalated = HashSet::from([CustomPermission::EditAnyCollection]);
-            let empty = HashSet::new();
-            for (enabled, status) in [(true, 2), (true, 1), (true, -126), (false, 2)] {
-                test_flag::CUSTOM_ROLES_ENABLED.set(Some(enabled));
-                member.status = status;
-                assert_eq!(
-                    custom_member_may(CollectionAction::Read, &member, &collection.uuid, &conn).await,
-                    enabled && status == 2
-                );
-                assert!(!custom_member_may(CollectionAction::Edit, &member, &collection.uuid, &conn).await);
-                assert!(!custom_member_may(CollectionAction::ReadAccess, &member, &collection.uuid, &conn).await);
-                assert_eq!(
-                    check_custom_member_grants(&member, None, &[], &empty, &conn).await.is_ok(),
-                    enabled && status == 2
-                );
-                assert!(check_custom_member_grants(&member, Some(&escalated), &[], &empty, &conn).await.is_err());
-            }
-        });
-    }
-
-    #[cfg(sqlite)]
-    async fn users_headers(member: &Membership, conn: &DbConn) -> ManageUsersHeaders {
-        ManageUsersHeaders {
-            device: Device::new("test".to_owned().into(), member.user_uuid.clone(), "test".into(), 1),
-            user: User::find_by_uuid(&member.user_uuid, conn).await.unwrap(),
-            membership: Membership::find_by_uuid(&member.uuid, conn).await.unwrap(),
-            membership_type: MembershipType::Custom,
-            org_id: member.org_uuid.clone(),
-            ip: crate::auth::ClientIp {
-                ip: "127.0.0.1".parse().unwrap(),
-            },
-        }
-    }
-
-    #[cfg(sqlite)]
-    #[test]
-    fn manage_users_can_reinvite_and_confirm_higher_role_members() {
-        use crate::api::notifications::{WS_USERS, WebSocketUsers};
-        use std::sync::Arc;
-        test_db::run(async |db| {
-            let conn = db.conn();
-            let (org, _, actor) = test_db::custom_member(&conn, CustomPermission::ManageUsers).await;
-            let (_, mut target) = test_db::member(&conn, &org.uuid, MembershipType::Owner, &[]).await;
-            target.status = MembershipStatus::Invited as i32;
-            target.save(&conn).await.unwrap();
-            let headers = users_headers(&actor, &conn).await;
-            reinvite_member_impl(&org.uuid, &target.uuid, &headers.user.email, &conn).await.unwrap();
-            assert!(
-                Membership::find_by_uuid(&target.uuid, &conn).await.unwrap().has_status(MembershipStatus::Accepted)
-            );
-            let rocket = rocket::build().manage(Arc::clone(&WS_USERS));
-            let notify = rocket.state::<Arc<WebSocketUsers>>().unwrap();
-            confirm_invite_impl(&org.uuid, &target.uuid, "encrypted-key", &headers, &conn, &notify.into())
-                .await
-                .unwrap();
-            let after = Membership::find_by_uuid(&target.uuid, &conn).await.unwrap();
-            assert_eq!(
-                (after.status, after.atype, after.akey.as_str()),
-                (2, MembershipType::Owner as i32, "encrypted-key")
-            );
-        });
-    }
-}
diff --git a/src/api/core/public.rs b/src/api/core/public.rs
index 1ee80515..3db25df9 100644
--- a/src/api/core/public.rs
+++ b/src/api/core/public.rs
@@ -58,13 +58,25 @@ async fn ldap_import(data: Json<OrgImportData>, token: PublicToken, conn: DbConn
     let org_id = token.0;
     let data = data.into_inner();
 
-    // Like upstream, the import never removes Owners, so it doesn't revoke or restore them either.
     for user_data in &data.members {
         let mut user_created: bool = false;
         if user_data.deleted {
             // If user is marked for deletion and it exists, revoke it
             if let Some(mut member) = Membership::find_by_email_and_org(&user_data.email, &org_id, &conn).await {
-                let revoked = member.atype != MembershipType::Owner && member.revoke();
+                // Only revoke a user if it is not the last confirmed owner
+                let revoked = if member.atype == MembershipType::Owner
+                    && member.status == MembershipStatus::Confirmed as i32
+                {
+                    if Membership::count_confirmed_by_org_and_type(&org_id, MembershipType::Owner, &conn).await <= 1 {
+                        warn!("Can't revoke the last owner");
+                        false
+                    } else {
+                        member.revoke()
+                    }
+                } else {
+                    member.revoke()
+                };
+
                 let ext_modified = member.set_external_id(Some(user_data.external_id.clone()));
                 if revoked || ext_modified {
                     member.save(&conn).await?;
@@ -72,7 +84,7 @@ async fn ldap_import(data: Json<OrgImportData>, token: PublicToken, conn: DbConn
             }
         // If user is part of the organization, restore it
         } else if let Some(mut member) = Membership::find_by_email_and_org(&user_data.email, &org_id, &conn).await {
-            let mut restored = member.atype != MembershipType::Owner && member.restore();
+            let mut restored = member.restore();
             let ext_modified = member.set_external_id(Some(user_data.external_id.clone()));
             // Enforce org policies as every other restore path does.
             // If the user is not allowed, we revoke again and continue so the external_id is still updated.
@@ -137,13 +149,9 @@ async fn ldap_import(data: Json<OrgImportData>, token: PublicToken, conn: DbConn
 
     if CONFIG.org_groups_enabled() {
         for group_data in &data.groups {
-            let group_uuid = if let Some(mut group) =
+            let group_uuid = if let Some(group) =
                 Group::find_by_external_id_and_org(&group_data.external_id, &org_id, &conn).await
             {
-                if group.name != group_data.name {
-                    group.name = group_data.name.clone();
-                    group.save(&conn).await?;
-                }
                 group.uuid
             } else {
                 let mut group =
@@ -172,8 +180,14 @@ async fn ldap_import(data: Json<OrgImportData>, token: PublicToken, conn: DbConn
         for member in Membership::find_by_org(&org_id, &conn).await {
             if let Some(ref user_external_id) = member.external_id
                 && !sync_members.contains(user_external_id)
-                && member.atype != MembershipType::Owner
             {
+                if member.atype == MembershipType::Owner && member.status == MembershipStatus::Confirmed as i32 {
+                    // Removing owner, check that there is at least one other confirmed owner
+                    if Membership::count_confirmed_by_org_and_type(&org_id, MembershipType::Owner, &conn).await <= 1 {
+                        warn!("Can't delete the last owner");
+                        continue;
+                    }
+                }
                 member.delete(&conn).await?;
             }
         }
diff --git a/src/api/core/sends.rs b/src/api/core/sends.rs
index 97d68731..042ce95b 100644
--- a/src/api/core/sends.rs
+++ b/src/api/core/sends.rs
@@ -12,7 +12,7 @@ use serde_json::Value;
 use crate::{
     CONFIG,
     api::{ApiResult, EmptyResult, JsonResult, Notify, UpdateType},
-    auth::{Headers, Host, SendHeaders},
+    auth::{ClientIp, Headers, Host, SendHeaders},
     config::PathType,
     db::{
         DbConn, DbPool,
@@ -23,7 +23,7 @@ use crate::{
 
 const SEND_INACCESSIBLE_MSG: &str = "Send does not exist or is no longer available";
 static ANON_PUSH_DEVICE: LazyLock<Device> = LazyLock::new(|| {
-    let dt = DateTime::UNIX_EPOCH.naive_utc();
+    let dt = crate::util::parse_date("1970-01-01T00:00:00.000000Z");
     Device {
         uuid: String::from("00000000-0000-0000-0000-000000000000").into(),
         created_at: dt,
@@ -39,15 +39,18 @@ static ANON_PUSH_DEVICE: LazyLock<Device> = LazyLock::new(|| {
 });
 
 // The max file size allowed by Bitwarden clients and add an extra 5% to avoid issues
-pub(crate) const SIZE_525_MB: i64 = 550_502_400;
+const SIZE_525_MB: i64 = 550_502_400;
 
 pub fn routes() -> Vec<rocket::Route> {
     routes![
         get_sends,
         get_send,
         post_send,
+        post_send_file,
         post_access,
+        post_access_legacy,
         post_access_file,
+        post_access_file_legacy,
         put_send,
         delete_send,
         put_remove_password,
@@ -70,7 +73,7 @@ pub async fn purge_sends(pool: DbPool) {
 #[serde(rename_all = "camelCase")]
 pub struct SendData {
     r#type: i32,
-    pub key: String,
+    key: String,
     password: Option<String>,
     max_access_count: Option<NumberOrString>,
     expiration_date: Option<DateTime<Utc>>,
@@ -126,23 +129,6 @@ async fn enforce_disable_hide_email_policy(data: &SendData, headers: &Headers, c
     Ok(())
 }
 
-/// Stores a text Send that is already encrypted, as [`create_send`] does, for the test seeder (`unsafe_test_mode`).
-/// Its deletion date becomes a week from now: a recorded one can be years ahead, more than a Send may be.
-#[cfg(feature = "unsafe_test_mode")]
-pub async fn seed_send(mut encrypted: Value, user_id: &UserId, conn: &DbConn) -> ApiResult<SendId> {
-    let Some(fields) = encrypted.as_object_mut() else {
-        err!("A seeded Send has to be a JSON object")
-    };
-    fields.insert("deletionDate".to_owned(), serde_json::to_value(Utc::now() + TimeDelta::try_days(7).unwrap())?);
-    let data: SendData = serde_json::from_value(encrypted)?;
-    if data.r#type != SendType::Text as i32 {
-        err!("Only text Sends can be seeded: a file Send needs its file")
-    }
-    let mut send = create_send(data, user_id.clone())?;
-    send.save(conn).await?;
-    Ok(send.uuid)
-}
-
 fn create_send(data: SendData, user_id: UserId) -> ApiResult<Send> {
     let data_val = if data.r#type == SendType::Text as i32 {
         data.text
@@ -215,7 +201,7 @@ async fn post_send(data: Json<SendData>, headers: Headers, conn: DbConn, nt: Not
     enforce_disable_hide_email_policy(&data, &headers, &conn).await?;
 
     if data.r#type == SendType::File as i32 {
-        err!("File sends should use /api/sends/file/v2")
+        err!("File sends should use /api/sends/file")
     }
 
     let mut send = create_send(data, headers.user.uuid)?;
@@ -232,11 +218,93 @@ async fn post_send(data: Json<SendData>, headers: Headers, conn: DbConn, nt: Not
     Ok(Json(send.to_json()))
 }
 
+#[derive(FromForm)]
+struct UploadData<'f> {
+    model: Json<SendData>,
+    data: TempFile<'f>,
+}
+
 #[derive(FromForm)]
 struct UploadDataV2<'f> {
     data: TempFile<'f>,
 }
 
+// @deprecated Mar 25 2021: This method has been deprecated in favor of direct uploads (v2).
+// This method still exists to support older clients, probably need to remove it sometime.
+// Upstream: https://github.com/bitwarden/server/blob/d0c793c95181dfb1b447eb450f85ba0bfd7ef643/src/Api/Controllers/SendsController.cs#L164-L167
+// 2025: This endpoint doesn't seem to exists anymore in the latest version
+// See: https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Api/Tools/Controllers/SendsController.cs
+#[post("/sends/file", format = "multipart/form-data", data = "<data>")]
+async fn post_send_file(data: Form<UploadData<'_>>, headers: Headers, conn: DbConn, nt: Notify<'_>) -> JsonResult {
+    enforce_disable_send_policy(&headers, &conn).await?;
+
+    let UploadData {
+        model,
+        data,
+    } = data.into_inner();
+    let model = model.into_inner();
+
+    let Some(size) = data.len().to_i64() else {
+        err!("Invalid send size");
+    };
+    if size < 0 {
+        err!("Send size can't be negative")
+    }
+
+    enforce_disable_hide_email_policy(&model, &headers, &conn).await?;
+
+    let size_limit = match CONFIG.user_send_limit() {
+        Some(0) => err!("File uploads are disabled"),
+        Some(limit_kb) => {
+            let Some(already_used) = Send::size_by_user(&headers.user.uuid, &conn).await else {
+                err!("Existing sends overflow")
+            };
+            let Some(left) = limit_kb.checked_mul(1024).and_then(|l| l.checked_sub(already_used)) else {
+                err!("Send size overflow");
+            };
+            if left <= 0 {
+                err!("Send storage limit reached! Delete some sends to free up space")
+            }
+            i64::clamp(left, 0, SIZE_525_MB)
+        }
+        None => SIZE_525_MB,
+    };
+
+    if size > size_limit {
+        err!("Send storage limit exceeded with this file");
+    }
+
+    let mut send = create_send(model, headers.user.uuid)?;
+    if send.atype != SendType::File as i32 {
+        err!("Send content is not a file");
+    }
+
+    let file_id = crate::crypto::generate_send_file_id();
+
+    save_temp_file(&PathType::Sends, &format!("{}/{file_id}", send.uuid), data, true).await?;
+
+    let mut data_value: Value = serde_json::from_str(&send.data)?;
+    if let Some(o) = data_value.as_object_mut() {
+        o.insert(String::from("id"), Value::String(file_id));
+        o.insert(String::from("size"), Value::Number(size.into()));
+        o.insert(String::from("sizeName"), Value::String(crate::util::get_display_size(size)));
+    }
+    send.data = serde_json::to_string(&data_value)?;
+
+    // Save the changes in the database
+    send.save(&conn).await?;
+    nt.send_send_update(
+        UpdateType::SyncSendCreate,
+        &send,
+        &send.update_users_revision(&conn).await,
+        &headers.device,
+        &conn,
+    )
+    .await;
+
+    Ok(Json(send.to_json()))
+}
+
 // Upstream: https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Api/Tools/Controllers/SendsController.cs#L165
 #[post("/sends/file/v2", data = "<data>")]
 async fn post_send_file_v2(data: Json<SendData>, headers: Headers, conn: DbConn) -> JsonResult {
@@ -285,12 +353,11 @@ async fn post_send_file_v2(data: Json<SendData>, headers: Headers, conn: DbConn)
     let file_id = crate::crypto::generate_send_file_id();
 
     let mut data_value: Value = serde_json::from_str(&send.data)?;
-    let Some(o) = data_value.as_object_mut() else {
-        err!("Invalid Send file data")
-    };
-    o.insert(String::from("id"), Value::String(file_id.clone()));
-    o.insert(String::from("size"), Value::Number(file_length.into()));
-    o.insert(String::from("sizeName"), Value::String(crate::util::get_display_size(file_length)));
+    if let Some(o) = data_value.as_object_mut() {
+        o.insert(String::from("id"), Value::String(file_id.clone()));
+        o.insert(String::from("size"), Value::Number(file_length.into()));
+        o.insert(String::from("sizeName"), Value::String(crate::util::get_display_size(file_length)));
+    }
     send.data = serde_json::to_string(&data_value)?;
     send.save(&conn).await?;
 
@@ -346,8 +413,8 @@ async fn post_send_file_v2_data(
             "Send file name does not match.",
             format!(
                 "Expected file name '{}' got '{}'",
-                send_data.fileName.escape_debug(),
-                raw_file_name.dangerous_unsafe_unsanitized_raw().as_str().escape_debug()
+                send_data.fileName,
+                raw_file_name.dangerous_unsafe_unsanitized_raw()
             )
         ),
         _ => err!("Send file name does not match or is not provided."),
@@ -383,16 +450,63 @@ async fn post_send_file_v2_data(
 
 #[post("/sends/access")]
 async fn post_access(headers: SendHeaders, conn: DbConn, nt: Notify<'_>) -> JsonResult {
-    let Some(mut send) = Send::find_by_uuid(&headers.send_id, &conn).await else {
+    let Some(send) = Send::find_by_uuid(&headers.send_id, &conn).await else {
         err_code!(SEND_INACCESSIBLE_MSG, 404)
     };
     if !send.is_accessible() {
         err_code!(SEND_INACCESSIBLE_MSG, 404)
     }
-    // Files are incremented during the download
-    if send.atype == SendType::Text as i32 && !send.register_access(&conn).await? {
+    process_access(send, conn, nt).await
+}
+
+#[derive(Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SendAccessData {
+    pub password: Option<String>,
+}
+
+// Legacy since web-2026.6.0
+#[post("/sends/access/<access_id>", data = "<data>")]
+async fn post_access_legacy(
+    access_id: &str,
+    data: Json<SendAccessData>,
+    conn: DbConn,
+    ip: ClientIp,
+    nt: Notify<'_>,
+) -> JsonResult {
+    crate::ratelimit::check_limit_unauthenticated(&ip.ip)?;
+
+    let Some(mut send) = Send::find_by_access_id(access_id, &conn).await else {
+        err_code!(SEND_INACCESSIBLE_MSG, 404)
+    };
+
+    if let Some(max_access_count) = send.max_access_count
+        && send.access_count >= max_access_count
+    {
+        err_code!(SEND_INACCESSIBLE_MSG, 404);
+    }
+
+    if !send.is_accessible() {
         err_code!(SEND_INACCESSIBLE_MSG, 404)
     }
+
+    if send.password_hash.is_some() {
+        match data.into_inner().password {
+            Some(ref p) if send.check_password(p) => { /* Nothing to do here */ }
+            Some(_) => err!("Invalid password", format!("IP: {}.", ip.ip)),
+            None => err_code!("Password not provided", format!("IP: {}.", ip.ip), 401),
+        }
+    }
+
+    // Files are incremented during the download
+    if send.atype == SendType::Text as i32 {
+        if !send.register_access(&conn).await? {
+            err_code!(SEND_INACCESSIBLE_MSG, 404)
+        }
+    } else {
+        send.save(&conn).await?;
+    }
+
     process_access(send, conn, nt).await
 }
 
@@ -417,27 +531,55 @@ async fn post_access_file(
     conn: DbConn,
     nt: Notify<'_>,
 ) -> JsonResult {
-    let Some(mut send) = Send::find_by_uuid(&headers.send_id, &conn).await else {
+    let Some(send) = Send::find_by_uuid(&headers.send_id, &conn).await else {
         err_code!(SEND_INACCESSIBLE_MSG, 404)
     };
     if !send.is_accessible() {
         err_code!(SEND_INACCESSIBLE_MSG, 404)
     }
-    check_send_file_id(&send, &file_id)?;
-    if !send.register_access(&conn).await? {
-        err_code!(SEND_INACCESSIBLE_MSG, 404)
-    }
     process_access_file(send, file_id, host, conn, nt).await
 }
 
-fn check_send_file_id(send: &Send, file_id: &SendFileId) -> EmptyResult {
-    if send.atype != SendType::File as i32 {
-        err!("Send is not a file type send.");
+// Legacy since web-2026.6.0
+#[post("/sends/<send_id>/access/file/<file_id>", data = "<data>")]
+async fn post_access_file_legacy(
+    send_id: SendId,
+    file_id: SendFileId,
+    data: Json<SendAccessData>,
+    host: Host,
+    conn: DbConn,
+    ip: ClientIp,
+    nt: Notify<'_>,
+) -> JsonResult {
+    crate::ratelimit::check_limit_unauthenticated(&ip.ip)?;
+
+    let Some(mut send) = Send::find_by_uuid(&send_id, &conn).await else {
+        err_code!(SEND_INACCESSIBLE_MSG, 404)
+    };
+
+    if let Some(max_access_count) = send.max_access_count
+        && send.access_count >= max_access_count
+    {
+        err_code!(SEND_INACCESSIBLE_MSG, 404)
     }
-    match serde_json::from_str::<SendFileData>(&send.data) {
-        Ok(data) if &data.id == file_id => Ok(()),
-        _ => err_code!(SEND_INACCESSIBLE_MSG, 404),
+
+    if !send.is_accessible() {
+        err_code!(SEND_INACCESSIBLE_MSG, 404)
     }
+
+    if send.password_hash.is_some() {
+        match data.into_inner().password {
+            Some(ref p) if send.check_password(p) => { /* Nothing to do here */ }
+            Some(_) => err!("Invalid password."),
+            None => err_code!("Password not provided", 401),
+        }
+    }
+
+    if !send.register_access(&conn).await? {
+        err_code!(SEND_INACCESSIBLE_MSG, 404)
+    }
+
+    process_access_file(send, file_id, host, conn, nt).await
 }
 
 async fn process_access_file(send: Send, file_id: SendFileId, host: Host, conn: DbConn, nt: Notify<'_>) -> JsonResult {
@@ -500,7 +642,7 @@ async fn put_send(send_id: SendId, data: Json<SendData>, headers: Headers, conn:
     Ok(Json(send.to_json()))
 }
 
-async fn update_send_from_data(
+pub async fn update_send_from_data(
     send: &mut Send,
     data: SendData,
     headers: &Headers,
diff --git a/src/api/core/two_factor/authenticator.rs b/src/api/core/two_factor/authenticator.rs
index 55984443..692e8248 100644
--- a/src/api/core/two_factor/authenticator.rs
+++ b/src/api/core/two_factor/authenticator.rs
@@ -3,7 +3,7 @@ use rocket::{Route, serde::json::Json};
 
 use crate::{
     api::{EmptyResult, JsonResult, PasswordOrOtpData, core::log_user_event, core::two_factor::generate_recover_code},
-    auth::{ClientIp, Headers, two_factor},
+    auth::{ClientIp, Headers},
     crypto,
     db::{
         DbConn,
@@ -20,23 +20,27 @@ pub fn routes() -> Vec<Route> {
 
 #[post("/two-factor/get-authenticator", data = "<data>")]
 async fn generate_authenticator(data: Json<PasswordOrOtpData>, headers: Headers, conn: DbConn) -> JsonResult {
+    let data: PasswordOrOtpData = data.into_inner();
     let user = headers.user;
 
     data.validate(&user, false, &conn).await?;
 
-    let twofactor = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Authenticator, &conn).await;
+    let type_ = TwoFactorType::Authenticator as i32;
+    let twofactor = TwoFactor::find_by_user_and_type(&user.uuid, type_, &conn).await;
 
     let (enabled, key) = match twofactor {
         Some(tf) => (true, tf.data),
         _ => (false, crypto::encode_random_bytes::<20>(&BASE32)),
     };
 
+    // Upstream seems to also return `userVerificationToken`, but doesn't seem to be used at all.
+    // It should help prevent TOTP disclosure if someone keeps their vault unlocked.
+    // Since it doesn't seem to be used, and also does not cause any issues, lets leave it out of the response.
+    // See: https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Api/Auth/Controllers/TwoFactorController.cs#L94
     Ok(Json(json!({
-        "authenticator": json!({
-            "enabled": enabled,
-            "key": key,
-        }),
-        "userVerificationToken": two_factor::authenticator_token(user.uuid, key, enabled),
+        "enabled": enabled,
+        "key": key,
+        "object": "twoFactorAuthenticator"
     })))
 }
 
@@ -45,7 +49,8 @@ async fn generate_authenticator(data: Json<PasswordOrOtpData>, headers: Headers,
 struct EnableAuthenticatorData {
     key: String,
     token: NumberOrString,
-    user_verification_token: String,
+    master_password_hash: Option<String>,
+    otp: Option<String>,
 }
 
 #[post("/two-factor/authenticator", data = "<data>")]
@@ -56,7 +61,12 @@ async fn activate_authenticator(data: Json<EnableAuthenticatorData>, headers: He
 
     let mut user = headers.user;
 
-    two_factor::validate_authenticator(&data.user_verification_token, &user.uuid, &key, false)?;
+    PasswordOrOtpData {
+        master_password_hash: data.master_password_hash,
+        otp: data.otp,
+    }
+    .validate(&user, true, &conn)
+    .await?;
 
     // Validate key as base32 and 20 bytes length
     let decoded_key: Vec<u8> = if let Ok(decoded) = BASE32.decode(key.as_bytes()) {
@@ -74,13 +84,12 @@ async fn activate_authenticator(data: Json<EnableAuthenticatorData>, headers: He
 
     generate_recover_code(&mut user, &conn).await;
 
-    log_user_event(EventType::UserUpdated2fa, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
+    log_user_event(EventType::UserUpdated2fa as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
 
     Ok(Json(json!({
-        "authenticator": json!({
-            "enabled": true,
-            "key": key,
-        }),
+        "enabled": true,
+        "key": key,
+        "object": "twoFactorAuthenticator"
     })))
 }
 
@@ -116,7 +125,8 @@ pub async fn validate_totp_code(
         err!("Invalid TOTP secret")
     };
 
-    let mut twofactor = match TwoFactor::find_by_user_and_type(user_id, TwoFactorType::Authenticator, conn).await {
+    let mut twofactor = match TwoFactor::find_by_user_and_type(user_id, TwoFactorType::Authenticator as i32, conn).await
+    {
         Some(tf) => tf,
         _ => TwoFactor::new(user_id.clone(), TwoFactorType::Authenticator, secret.to_owned()),
     };
@@ -174,25 +184,36 @@ pub async fn validate_totp_code(
 #[serde(rename_all = "camelCase")]
 struct DisableAuthenticatorData {
     key: String,
-    user_verification_token: String,
+    master_password_hash: String,
+    r#type: NumberOrString,
 }
 
 #[delete("/two-factor/authenticator", data = "<data>")]
-async fn disable_authenticator(data: Json<DisableAuthenticatorData>, headers: Headers, conn: DbConn) -> EmptyResult {
+async fn disable_authenticator(data: Json<DisableAuthenticatorData>, headers: Headers, conn: DbConn) -> JsonResult {
     let user = headers.user;
+    let type_ = data.r#type.into_i32()?;
 
-    two_factor::validate_authenticator(&data.user_verification_token, &user.uuid, &data.key, true)?;
+    if !user.check_valid_password(&data.master_password_hash) {
+        err!("Invalid password");
+    }
 
-    if let Some(twofactor) = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Authenticator, &conn).await {
+    if let Some(twofactor) = TwoFactor::find_by_user_and_type(&user.uuid, type_, &conn).await {
         if twofactor.data == data.key {
             twofactor.delete(&conn).await?;
-            log_user_event(EventType::UserDisabled2fa, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
+            log_user_event(EventType::UserDisabled2fa as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn)
+                .await;
         } else {
             err!(format!("TOTP key for user {} does not match recorded value, cannot deactivate", &user.email));
         }
     }
 
-    super::check_2fa_state(&user, headers.device.atype, &headers.ip.ip, &conn).await?;
+    if TwoFactor::find_by_user(&user.uuid, &conn).await.is_empty() {
+        super::enforce_2fa_policy(&user, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await?;
+    }
 
-    Ok(())
+    Ok(Json(json!({
+        "enabled": false,
+        "keys": type_,
+        "object": "twoFactorProvider"
+    })))
 }
diff --git a/src/api/core/two_factor/duo.rs b/src/api/core/two_factor/duo.rs
index 23116b2c..ed112eb9 100644
--- a/src/api/core/two_factor/duo.rs
+++ b/src/api/core/two_factor/duo.rs
@@ -1,13 +1,14 @@
 use chrono::Utc;
+use data_encoding::BASE64;
 use rocket::{Route, serde::json::Json};
 
 use crate::{
+    CONFIG,
     api::{
-        ApiResult, EmptyResult, JsonResult, PasswordOrOtpData,
-        core::log_user_event,
-        core::two_factor::{VerificationTokenData, generate_recover_code},
+        ApiResult, EmptyResult, JsonResult, PasswordOrOtpData, core::log_user_event,
+        core::two_factor::generate_recover_code,
     },
-    auth::{Headers, two_factor, two_factor::DuoData},
+    auth::Headers,
     crypto,
     db::{
         DbConn,
@@ -18,7 +19,55 @@ use crate::{
 };
 
 pub fn routes() -> Vec<Route> {
-    routes![get_duo, activate_duo, activate_duo_put, disable_duo,]
+    routes![get_duo, activate_duo, activate_duo_put,]
+}
+
+#[derive(Serialize, Deserialize)]
+struct DuoData {
+    host: String, // Duo API hostname
+    ik: String,   // client id
+    sk: String,   // client secret
+}
+
+impl DuoData {
+    fn global() -> Option<Self> {
+        match (CONFIG._enable_duo(), CONFIG.duo_host()) {
+            (true, Some(host)) => Some(Self {
+                host,
+                ik: CONFIG.duo_ikey().unwrap(),
+                sk: CONFIG.duo_skey().unwrap(),
+            }),
+            _ => None,
+        }
+    }
+    fn msg(s: &str) -> Self {
+        Self {
+            host: s.into(),
+            ik: s.into(),
+            sk: s.into(),
+        }
+    }
+    fn secret() -> Self {
+        Self::msg("<global_secret>")
+    }
+    fn obscure(self) -> Self {
+        let mut host = self.host;
+        let mut ik = self.ik;
+        let mut sk = self.sk;
+
+        let digits = 4;
+        let replaced = "************";
+
+        host.replace_range(digits.., replaced);
+        ik.replace_range(digits.., replaced);
+        sk.replace_range(digits.., replaced);
+
+        Self {
+            host,
+            ik,
+            sk,
+        }
+    }
 }
 
 enum DuoStatus {
@@ -47,19 +96,22 @@ async fn get_duo(data: Json<PasswordOrOtpData>, headers: Headers, conn: DbConn)
 
     data.validate(&user, false, &conn).await?;
 
-    let (enabled, duo) = match get_user_duo_data(&user.uuid, &conn).await {
+    let data = get_user_duo_data(&user.uuid, &conn).await;
+
+    let (enabled, data) = match data {
         DuoStatus::Global(_) => (true, Some(DuoData::secret())),
         DuoStatus::User(data) => (true, Some(data.obscure())),
         DuoStatus::Disabled(true) => (false, Some(DuoData::msg(DISABLED_MESSAGE_DEFAULT))),
         DuoStatus::Disabled(false) => (false, None),
     };
 
-    let duo_json = if let Some(data) = duo.as_ref() {
+    let json = if let Some(data) = data {
         json!({
             "enabled": enabled,
             "host": data.host,
             "clientSecret": data.sk,
             "clientId": data.ik,
+            "object": "twoFactorDuo"
         })
     } else {
         json!({
@@ -67,13 +119,11 @@ async fn get_duo(data: Json<PasswordOrOtpData>, headers: Headers, conn: DbConn)
             "host": null,
             "clientSecret": null,
             "clientId": null,
+            "object": "twoFactorDuo"
         })
     };
 
-    Ok(Json(rocket::serde::json::json!({
-        "duo": duo_json,
-        "userVerificationToken": two_factor::duo_token(user.uuid, duo, enabled),
-    })))
+    Ok(Json(json))
 }
 
 #[derive(Deserialize)]
@@ -82,7 +132,8 @@ struct EnableDuoData {
     host: String,
     client_secret: String,
     client_id: String,
-    user_verification_token: String,
+    master_password_hash: Option<String>,
+    otp: Option<String>,
 }
 
 impl From<EnableDuoData> for DuoData {
@@ -109,7 +160,12 @@ async fn activate_duo(data: Json<EnableDuoData>, headers: Headers, conn: DbConn)
     let data: EnableDuoData = data.into_inner();
     let mut user = headers.user;
 
-    two_factor::validate_duo(&data.user_verification_token, &user.uuid, None, false)?;
+    PasswordOrOtpData {
+        master_password_hash: data.master_password_hash.clone(),
+        otp: data.otp.clone(),
+    }
+    .validate(&user, true, &conn)
+    .await?;
 
     let (data, data_str) = if check_duo_fields_custom(&data) {
         let data_req: DuoData = data.into();
@@ -126,15 +182,14 @@ async fn activate_duo(data: Json<EnableDuoData>, headers: Headers, conn: DbConn)
 
     generate_recover_code(&mut user, &conn).await;
 
-    log_user_event(EventType::UserUpdated2fa, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
+    log_user_event(EventType::UserUpdated2fa as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
 
     Ok(Json(json!({
-        "duo": json!({
-            "enabled": true,
-            "host": data.host,
-            "clientSecret": data.sk,
-            "clientId": data.ik,
-        }),
+        "enabled": true,
+        "host": data.host,
+        "clientSecret": data.sk,
+        "clientId": data.ik,
+        "object": "twoFactorDuo"
     })))
 }
 
@@ -143,29 +198,6 @@ async fn activate_duo_put(data: Json<EnableDuoData>, headers: Headers, conn: DbC
     activate_duo(data, headers, conn).await
 }
 
-#[delete("/two-factor/duo", data = "<data>")]
-async fn disable_duo(data: Json<VerificationTokenData>, headers: Headers, conn: DbConn) -> EmptyResult {
-    let user = headers.user;
-
-    if let Some(twofactor) = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Duo, &conn).await {
-        // Apply the same transformation than in `get_duo` to check we are disabling the correct one
-        let duo = match to_user_duo_data(&twofactor) {
-            DuoStatus::Global(_) => Some(DuoData::secret()),
-            DuoStatus::User(data) => Some(data.obscure()),
-            DuoStatus::Disabled(_) => None,
-        };
-
-        two_factor::validate_duo(&data.user_verification_token, &user.uuid, duo.as_ref(), true)?;
-
-        twofactor.delete(&conn).await?;
-        log_user_event(EventType::UserDisabled2fa, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
-    }
-
-    super::check_2fa_state(&user, headers.device.atype, &headers.ip.ip, &conn).await?;
-
-    Ok(())
-}
-
 async fn duo_api_request(method: &str, path: &str, params: &str, data: &DuoData) -> EmptyResult {
     use reqwest::{Method, header};
     use std::str::FromStr;
@@ -190,16 +222,21 @@ async fn duo_api_request(method: &str, path: &str, params: &str, data: &DuoData)
     Ok(())
 }
 
+const DUO_EXPIRE: i64 = 300;
+const APP_EXPIRE: i64 = 3600;
+
+const AUTH_PREFIX: &str = "AUTH";
+const DUO_PREFIX: &str = "TX";
+const APP_PREFIX: &str = "APP";
+
 async fn get_user_duo_data(user_id: &UserId, conn: &DbConn) -> DuoStatus {
+    let type_ = TwoFactorType::Duo as i32;
+
     // If the user doesn't have an entry, disabled
-    let Some(twofactor) = TwoFactor::find_by_user_and_type(user_id, TwoFactorType::Duo, conn).await else {
+    let Some(twofactor) = TwoFactor::find_by_user_and_type(user_id, type_, conn).await else {
         return DuoStatus::Disabled(DuoData::global().is_some());
     };
 
-    to_user_duo_data(&twofactor)
-}
-
-fn to_user_duo_data(twofactor: &TwoFactor) -> DuoStatus {
     // If the user has the required values, we use those
     if let Ok(data) = serde_json::from_str(&twofactor.data) {
         return DuoStatus::User(data);
@@ -214,13 +251,118 @@ fn to_user_duo_data(twofactor: &TwoFactor) -> DuoStatus {
     DuoStatus::Disabled(false)
 }
 
-// let (ik, sk, host) = get_duo_keys_email();
-pub(crate) async fn get_duo_keys_email(email: &str, conn: &DbConn) -> ApiResult<(String, String, String)> {
+// let (ik, sk, ak, host) = get_duo_keys();
+pub(crate) async fn get_duo_keys_email(email: &str, conn: &DbConn) -> ApiResult<(String, String, String, String)> {
     let data = match User::find_by_mail(email, conn).await {
         Some(u) => get_user_duo_data(&u.uuid, conn).await.data(),
         _ => DuoData::global(),
     }
     .map_res("Can't fetch Duo Keys")?;
 
-    Ok((data.ik, data.sk, data.host))
+    Ok((data.ik, data.sk, CONFIG.get_duo_akey().await, data.host))
+}
+
+pub async fn generate_duo_signature(email: &str, conn: &DbConn) -> ApiResult<(String, String)> {
+    let now = Utc::now().timestamp();
+
+    let (ik, sk, ak, host) = get_duo_keys_email(email, conn).await?;
+
+    let duo_sign = sign_duo_values(&sk, email, &ik, DUO_PREFIX, now + DUO_EXPIRE);
+    let app_sign = sign_duo_values(&ak, email, &ik, APP_PREFIX, now + APP_EXPIRE);
+
+    Ok((format!("{duo_sign}:{app_sign}"), host))
+}
+
+fn sign_duo_values(key: &str, email: &str, ikey: &str, prefix: &str, expire: i64) -> String {
+    let val = format!("{email}|{ikey}|{expire}");
+    let cookie = format!("{prefix}|{}", BASE64.encode(val.as_bytes()));
+
+    format!("{cookie}|{}", crypto::hmac_sign(key, &cookie))
+}
+
+pub async fn validate_duo_login(email: &str, response: &str, conn: &DbConn) -> EmptyResult {
+    let split: Vec<&str> = response.split(':').collect();
+    if split.len() != 2 {
+        err!(
+            "Invalid response length",
+            ErrorEvent {
+                event: EventType::UserFailedLogIn2fa
+            }
+        );
+    }
+
+    let auth_sig = split[0];
+    let app_sig = split[1];
+
+    let now = Utc::now().timestamp();
+
+    let (ik, sk, ak, _host) = get_duo_keys_email(email, conn).await?;
+
+    let auth_user = parse_duo_values(&sk, auth_sig, &ik, AUTH_PREFIX, now)?;
+    let app_user = parse_duo_values(&ak, app_sig, &ik, APP_PREFIX, now)?;
+
+    if !crypto::ct_eq(&auth_user, app_user) || !crypto::ct_eq(&auth_user, email) {
+        err!(
+            "Error validating duo authentication",
+            ErrorEvent {
+                event: EventType::UserFailedLogIn2fa
+            }
+        )
+    }
+
+    Ok(())
+}
+
+fn parse_duo_values(key: &str, val: &str, ikey: &str, prefix: &str, time: i64) -> ApiResult<String> {
+    let split: Vec<&str> = val.split('|').collect();
+    if split.len() != 3 {
+        err!("Invalid value length")
+    }
+
+    let u_prefix = split[0];
+    let u_b64 = split[1];
+    let u_sig = split[2];
+
+    let sig = crypto::hmac_sign(key, &format!("{u_prefix}|{u_b64}"));
+
+    if !crypto::ct_eq(crypto::hmac_sign(key, &sig), crypto::hmac_sign(key, u_sig)) {
+        err!("Duo signatures don't match")
+    }
+
+    if u_prefix != prefix {
+        err!("Prefixes don't match")
+    }
+
+    let Ok(cookie_vec) = BASE64.decode(u_b64.as_bytes()) else {
+        err!("Invalid Duo cookie encoding")
+    };
+
+    let Ok(cookie) = String::from_utf8(cookie_vec) else {
+        err!("Invalid Duo cookie encoding")
+    };
+
+    let cookie_split: Vec<&str> = cookie.split('|').collect();
+    if cookie_split.len() != 3 {
+        err!("Invalid cookie length")
+    }
+
+    let username = cookie_split[0];
+    let u_ikey = cookie_split[1];
+    let expire = cookie_split[2];
+
+    if !crypto::ct_eq(ikey, u_ikey) {
+        err!("Invalid ikey")
+    }
+
+    let expire: i64 = if let Ok(e) = expire.parse() {
+        e
+    } else {
+        err!("Invalid expire time")
+    };
+
+    if time >= expire {
+        err!("Expired authorization")
+    }
+
+    Ok(username.into())
 }
diff --git a/src/api/core/two_factor/duo_oidc.rs b/src/api/core/two_factor/duo_oidc.rs
index e5e1df0f..adb030af 100644
--- a/src/api/core/two_factor/duo_oidc.rs
+++ b/src/api/core/two_factor/duo_oidc.rs
@@ -383,7 +383,7 @@ pub async fn get_duo_auth_url(
     device_identifier: &DeviceId,
     conn: &DbConn,
 ) -> Result<String, Error> {
-    let (ik, sk, host) = get_duo_keys_email(email, conn).await?;
+    let (ik, sk, _, host) = get_duo_keys_email(email, conn).await?;
 
     let callback_url = match make_callback_url(client_id) {
         Ok(url) => url,
@@ -435,7 +435,7 @@ pub async fn validate_duo_login(
     let code = split[0];
     let state = split[1];
 
-    let (ik, sk, host) = get_duo_keys_email(email, conn).await?;
+    let (ik, sk, _, host) = get_duo_keys_email(email, conn).await?;
 
     // Get the context by the state reported by the client. If we don't have one,
     // it means the context is either missing or expired.
diff --git a/src/api/core/two_factor/email.rs b/src/api/core/two_factor/email.rs
index 15bfdbc3..3667b871 100644
--- a/src/api/core/two_factor/email.rs
+++ b/src/api/core/two_factor/email.rs
@@ -5,26 +5,20 @@ use crate::{
     CONFIG,
     api::{
         EmptyResult, JsonResult, PasswordOrOtpData,
-        core::{
-            log_user_event,
-            two_factor::{VerificationTokenData, generate_recover_code},
-        },
+        core::{log_user_event, two_factor::generate_recover_code},
     },
-    auth::{ClientHeaders, Headers, two_factor},
+    auth::{ClientHeaders, Headers},
     crypto,
     db::{
         DbConn,
-        models::{
-            AuthRequest, AuthRequestId, DeviceId, EventType, TwoFactor, TwoFactorIncomplete, TwoFactorType, User,
-            UserId,
-        },
+        models::{AuthRequest, AuthRequestId, DeviceId, EventType, TwoFactor, TwoFactorType, User, UserId},
     },
     error::{Error, MapResult},
     mail,
 };
 
 pub fn routes() -> Vec<Route> {
-    routes![get_email, send_email_login, send_email, email, disable_email]
+    routes![get_email, send_email_login, send_email, email,]
 }
 
 #[derive(Deserialize)]
@@ -71,7 +65,7 @@ async fn send_email_login(data: Json<SendEmailLoginData>, client_headers: Client
         let Some(user) = User::find_by_mail(email, &conn).await else {
             err!(
                 "Username or password is incorrect. Try again",
-                format!("IP: {}. Username: {}.", client_headers.ip.ip, email.escape_debug())
+                format!("IP: {}. Username: {email}.", client_headers.ip.ip)
             )
         };
 
@@ -80,45 +74,23 @@ async fn send_email_login(data: Json<SendEmailLoginData>, client_headers: Client
             if !user.check_valid_password(master_password_hash) {
                 err!(
                     "Username or password is incorrect. Try again",
-                    format!("IP: {}. Username: {}.", client_headers.ip.ip, email.escape_debug())
+                    format!("IP: {}. Username: {email}.", client_headers.ip.ip)
                 )
             }
         } else if let Some(auth_request_id) = auth_request_id {
+            let Some(auth_request) = AuthRequest::find_by_uuid(auth_request_id, &conn).await else {
+                err!("AuthRequest doesn't exist", "User not found")
+            };
             let Some(code) = &data.auth_request_access_code else {
                 err!("no auth request access code")
             };
-            let Some(auth_request) = AuthRequest::find_by_uuid_and_user(auth_request_id, &user.uuid, &conn).await
-            else {
-                err!("AuthRequest doesn't exist", "Invalid auth request or does not belong to user")
-            };
 
-            let request_expired = Utc::now().naive_utc() >= auth_request.creation_date + TimeDelta::minutes(5);
-            if !auth_request.approved.unwrap_or(false)
-                || auth_request.authentication_date.is_some()
-                || request_expired
-                || auth_request.device_type != client_headers.device_type
+            if auth_request.device_type != client_headers.device_type
                 || auth_request.request_ip != client_headers.ip.ip.to_string()
                 || !auth_request.check_access_code(code)
             {
-                err!(
-                    "AuthRequest doesn't exist",
-                    "Auth request not approved, already used or expired, or invalid device, IP or code"
-                )
+                err!("AuthRequest doesn't exist", "Invalid device, IP or code")
             }
-        } else if let Some(device_identifier) = &data.device_identifier {
-            // iOS/Android SSO logins send the email and device id but no password hash,
-            // so accept a device that has a pending 2FA login for this user
-            if TwoFactorIncomplete::find_by_user_and_device(&user.uuid, device_identifier, &conn).await.is_none() {
-                err!(
-                    "Username or password is incorrect. Try again",
-                    format!("IP: {}. Username: {}.", client_headers.ip.ip, email.escape_debug())
-                )
-            }
-            debug!(
-                "Email 2FA fallback: pending login. Username: {}. Device: {}.",
-                user.email,
-                device_identifier.to_string().escape_debug()
-            );
         } else {
             err!("No password hash has been submitted.")
         }
@@ -132,7 +104,7 @@ async fn send_email_login(data: Json<SendEmailLoginData>, client_headers: Client
         let Some(user) = User::find_by_device_for_email2fa(device_identifier, &conn).await else {
             err!(
                 "Username or password is incorrect. Try again",
-                format!("IP: {}. Device: {}.", client_headers.ip.ip, device_identifier.to_string().escape_debug())
+                format!("IP: {}. Device: {device_identifier}.", client_headers.ip.ip)
             )
         };
 
@@ -144,8 +116,8 @@ async fn send_email_login(data: Json<SendEmailLoginData>, client_headers: Client
 
 /// Generate the token, save the data for later verification and send email to user
 pub async fn send_token(user_id: &UserId, conn: &DbConn) -> EmptyResult {
-    let mut twofactor =
-        TwoFactor::find_by_user_and_type(user_id, TwoFactorType::Email, conn).await.map_res("Two factor not found")?;
+    let type_ = TwoFactorType::Email as i32;
+    let mut twofactor = TwoFactor::find_by_user_and_type(user_id, type_, conn).await.map_res("Two factor not found")?;
 
     let generated_token = crypto::generate_email_token(CONFIG.email_token_size());
 
@@ -168,19 +140,18 @@ async fn get_email(data: Json<PasswordOrOtpData>, headers: Headers, conn: DbConn
     data.validate(&user, false, &conn).await?;
 
     let (enabled, mfa_email) =
-        if let Some(x) = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Email, &conn).await {
-            let twofactor_data = EmailTokenData::from_json(&x.data)?;
-            (true, Some(twofactor_data.email))
-        } else {
-            (false, None)
+        match TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Email as i32, &conn).await {
+            Some(x) => {
+                let twofactor_data = EmailTokenData::from_json(&x.data)?;
+                (true, json!(twofactor_data.email))
+            }
+            _ => (false, serde_json::value::Value::Null),
         };
 
-    Ok(Json(rocket::serde::json::json!({
-        "email": rocket::serde::json::json!({
-            "enabled": enabled,
-            "email": mfa_email,
-        }),
-        "userVerificationToken": two_factor::email_token(user.uuid, mfa_email, enabled),
+    Ok(Json(json!({
+        "email": mfa_email,
+        "enabled": enabled,
+        "object": "twoFactorEmail"
     })))
 }
 
@@ -189,36 +160,43 @@ async fn get_email(data: Json<PasswordOrOtpData>, headers: Headers, conn: DbConn
 struct SendEmailData {
     /// Email where 2FA codes will be sent to, can be different than user email account.
     email: String,
-    user_verification_token: String,
+    master_password_hash: Option<String>,
+    otp: Option<String>,
 }
 
 /// Send a verification email to the specified email address to check whether it exists/belongs to user.
 #[post("/two-factor/send-email", data = "<data>")]
-async fn send_email(data: Json<SendEmailData>, headers: Headers, conn: DbConn) -> JsonResult {
+async fn send_email(data: Json<SendEmailData>, headers: Headers, conn: DbConn) -> EmptyResult {
     let data: SendEmailData = data.into_inner();
     let user = headers.user;
 
-    two_factor::validate_email(&data.user_verification_token, &user.uuid, data.email.clone(), false)?;
+    PasswordOrOtpData {
+        master_password_hash: data.master_password_hash,
+        otp: data.otp,
+    }
+    .validate(&user, false, &conn)
+    .await?;
 
     if !CONFIG._enable_email_2fa() {
         err!("Email 2FA is disabled")
     }
 
-    if let Some(tf) = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Email, &conn).await {
+    let type_ = TwoFactorType::Email as i32;
+
+    if let Some(tf) = TwoFactor::find_by_user_and_type(&user.uuid, type_, &conn).await {
         tf.delete(&conn).await?;
     }
 
     let generated_token = crypto::generate_email_token(CONFIG.email_token_size());
-    let twofactor_data = EmailTokenData::new(data.email, Some(generated_token));
+    let twofactor_data = EmailTokenData::new(data.email, generated_token);
 
     // Uses EmailVerificationChallenge as type to show that it's not verified yet.
-    let twofactor =
-        TwoFactor::new(user.uuid.clone(), TwoFactorType::EmailVerificationChallenge, twofactor_data.to_json());
+    let twofactor = TwoFactor::new(user.uuid, TwoFactorType::EmailVerificationChallenge, twofactor_data.to_json());
     twofactor.save(&conn).await?;
 
     mail::send_token(&twofactor_data.email, &twofactor_data.last_token.map_res("Token is empty")?).await?;
 
-    Ok(Json(json!({})))
+    Ok(())
 }
 
 #[derive(Deserialize, Serialize)]
@@ -226,7 +204,8 @@ async fn send_email(data: Json<SendEmailData>, headers: Headers, conn: DbConn) -
 struct EmailData {
     email: String,
     token: String,
-    user_verification_token: String,
+    master_password_hash: Option<String>,
+    otp: Option<String>,
 }
 
 /// Verify email belongs to user and can be used for 2FA email codes.
@@ -235,11 +214,17 @@ async fn email(data: Json<EmailData>, headers: Headers, conn: DbConn) -> JsonRes
     let data: EmailData = data.into_inner();
     let mut user = headers.user;
 
-    two_factor::validate_email(&data.user_verification_token, &user.uuid, data.email, false)?;
+    // This is the last step in the verification process, delete the otp directly afterwards
+    PasswordOrOtpData {
+        master_password_hash: data.master_password_hash,
+        otp: data.otp,
+    }
+    .validate(&user, true, &conn)
+    .await?;
 
-    let mut twofactor = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::EmailVerificationChallenge, &conn)
-        .await
-        .map_res("Two factor not found")?;
+    let type_ = TwoFactorType::EmailVerificationChallenge as i32;
+    let mut twofactor =
+        TwoFactor::find_by_user_and_type(&user.uuid, type_, &conn).await.map_res("Two factor not found")?;
 
     let mut email_data = EmailTokenData::from_json(&twofactor.data)?;
 
@@ -258,26 +243,13 @@ async fn email(data: Json<EmailData>, headers: Headers, conn: DbConn) -> JsonRes
 
     generate_recover_code(&mut user, &conn).await;
 
-    log_user_event(EventType::UserUpdated2fa, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
+    log_user_event(EventType::UserUpdated2fa as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
 
-    Ok(Json(json!({})))
-}
-
-#[delete("/two-factor/email", data = "<data>")]
-async fn disable_email(data: Json<VerificationTokenData>, headers: Headers, conn: DbConn) -> EmptyResult {
-    let user = headers.user;
-
-    if let Some(twofactor) = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Email, &conn).await {
-        let twofactor_data = EmailTokenData::from_json(&twofactor.data)?;
-        two_factor::validate_email(&data.user_verification_token, &user.uuid, twofactor_data.email, true)?;
-
-        twofactor.delete(&conn).await?;
-        log_user_event(EventType::UserDisabled2fa, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
-    }
-
-    super::check_2fa_state(&user, headers.device.atype, &headers.ip.ip, &conn).await?;
-
-    Ok(())
+    Ok(Json(json!({
+        "email": email_data.email,
+        "enabled": "true",
+        "object": "twoFactorEmail"
+    })))
 }
 
 /// Validate the email code when used as TwoFactor token mechanism
@@ -289,8 +261,9 @@ pub async fn validate_email_code_str(
     conn: &DbConn,
 ) -> EmptyResult {
     let mut email_data = EmailTokenData::from_json(data)?;
-    let mut twofactor =
-        TwoFactor::find_by_user_and_type(user_id, TwoFactorType::Email, conn).await.map_res("Two factor not found")?;
+    let mut twofactor = TwoFactor::find_by_user_and_type(user_id, TwoFactorType::Email as i32, conn)
+        .await
+        .map_res("Two factor not found")?;
     let Some(issued_token) = &email_data.last_token else {
         err!(
             format!("No token available! IP: {ip}"),
@@ -302,7 +275,7 @@ pub async fn validate_email_code_str(
 
     if !crypto::ct_eq(issued_token, token) {
         email_data.add_attempt();
-        if email_data.attempts >= u64::from(CONFIG.email_attempts_limit()) {
+        if email_data.attempts >= CONFIG.email_attempts_limit() {
             email_data.reset_token();
         }
         twofactor.data = email_data.to_json();
@@ -321,7 +294,7 @@ pub async fn validate_email_code_str(
     twofactor.save(conn).await?;
 
     let dt = DateTime::from_timestamp(email_data.token_sent, 0).expect("Email token timestamp invalid.").naive_utc();
-    let max_time = i64::from(CONFIG.email_expiration_time());
+    let max_time = CONFIG.email_expiration_time().cast_signed();
     if dt + TimeDelta::try_seconds(max_time).unwrap() < Utc::now().naive_utc() {
         err!(
             "Token has expired",
@@ -349,10 +322,10 @@ pub struct EmailTokenData {
 }
 
 impl EmailTokenData {
-    pub fn new(email: String, token: Option<String>) -> EmailTokenData {
+    pub fn new(email: String, token: String) -> EmailTokenData {
         EmailTokenData {
             email,
-            last_token: token,
+            last_token: Some(token),
             token_sent: Utc::now().timestamp(),
             attempts: 0,
         }
@@ -390,8 +363,7 @@ pub async fn activate_email_2fa(user: &User, conn: &DbConn) -> EmptyResult {
     if user.verified_at.is_none() {
         err!("Auto-enabling of email 2FA failed because the users email address has not been verified!");
     }
-    // The token is set when the first code is sent
-    let twofactor_data = EmailTokenData::new(user.email.clone(), None);
+    let twofactor_data = EmailTokenData::new(user.email.clone(), String::new());
     let twofactor = TwoFactor::new(user.uuid.clone(), TwoFactorType::Email, twofactor_data.to_json());
     twofactor.save(conn).await
 }
diff --git a/src/api/core/two_factor/mod.rs b/src/api/core/two_factor/mod.rs
index cfec98c7..0eb6563e 100644
--- a/src/api/core/two_factor/mod.rs
+++ b/src/api/core/two_factor/mod.rs
@@ -7,7 +7,10 @@ use serde_json::Value;
 
 use crate::{
     CONFIG,
-    api::{EmptyResult, JsonResult, PasswordOrOtpData, core::log_event},
+    api::{
+        EmptyResult, JsonResult, PasswordOrOtpData,
+        core::{log_event, log_user_event},
+    },
     auth::Headers,
     crypto,
     db::{
@@ -18,6 +21,7 @@ use crate::{
         },
     },
     mail,
+    util::NumberOrString,
 };
 
 pub mod authenticator;
@@ -65,7 +69,13 @@ pub fn is_twofactor_provider_usable(provider_type: &TwoFactorType, provider_data
 }
 
 pub fn routes() -> Vec<Route> {
-    let mut routes = routes![get_twofactor, get_recover, get_device_verification_settings];
+    let mut routes = routes![
+        get_twofactor,
+        get_recover,
+        disable_twofactor,
+        disable_twofactor_put,
+        get_device_verification_settings,
+    ];
 
     routes.append(&mut authenticator::routes());
     routes.append(&mut duo::routes());
@@ -77,12 +87,6 @@ pub fn routes() -> Vec<Route> {
     routes
 }
 
-#[derive(Debug, Deserialize)]
-#[serde(rename_all = "camelCase")]
-struct VerificationTokenData {
-    user_verification_token: String,
-}
-
 #[get("/two-factor")]
 async fn get_twofactor(headers: Headers, conn: DbConn) -> Json<Value> {
     let twofactors = TwoFactor::find_by_user(&headers.user.uuid, &conn).await;
@@ -122,14 +126,50 @@ async fn generate_recover_code(user: &mut User, conn: &DbConn) {
     }
 }
 
-/// Call after a 2FA provider, or one of its keys, was removed. No remembered device may keep skipping
-/// the providers that are left, and once every provider is gone the 2FA policy applies.
-pub async fn check_2fa_state(user: &User, device_type: i32, ip: &std::net::IpAddr, conn: &DbConn) -> EmptyResult {
-    Device::clear_twofactor_remember_by_user(&user.uuid, conn).await?;
-    if TwoFactor::find_by_user(&user.uuid, conn).await.is_empty() {
-        enforce_2fa_policy(user, &user.uuid, device_type, ip, conn).await?;
+#[derive(Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct DisableTwoFactorData {
+    master_password_hash: Option<String>,
+    otp: Option<String>,
+    r#type: NumberOrString,
+}
+
+#[post("/two-factor/disable", data = "<data>")]
+async fn disable_twofactor(data: Json<DisableTwoFactorData>, headers: Headers, conn: DbConn) -> JsonResult {
+    let data: DisableTwoFactorData = data.into_inner();
+    let user = headers.user;
+
+    // Delete directly after a valid token has been provided
+    PasswordOrOtpData {
+        master_password_hash: data.master_password_hash,
+        otp: data.otp,
     }
-    Ok(())
+    .validate(&user, true, &conn)
+    .await?;
+
+    let type_ = data.r#type.into_i32()?;
+
+    if let Some(twofactor) = TwoFactor::find_by_user_and_type(&user.uuid, type_, &conn).await {
+        twofactor.delete(&conn).await?;
+        Device::clear_twofactor_remember_by_user(&user.uuid, &conn).await?;
+        log_user_event(EventType::UserDisabled2fa as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn)
+            .await;
+    }
+
+    if TwoFactor::find_by_user(&user.uuid, &conn).await.is_empty() {
+        enforce_2fa_policy(&user, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await?;
+    }
+
+    Ok(Json(json!({
+        "enabled": false,
+        "type": type_,
+        "object": "twoFactorProvider"
+    })))
+}
+
+#[put("/two-factor/disable", data = "<data>")]
+async fn disable_twofactor_put(data: Json<DisableTwoFactorData>, headers: Headers, conn: DbConn) -> JsonResult {
+    disable_twofactor(data, headers, conn).await
 }
 
 pub async fn enforce_2fa_policy(
@@ -151,7 +191,7 @@ pub async fn enforce_2fa_policy(
             member.save(conn).await?;
 
             log_event(
-                EventType::OrganizationUserRevokedTwoFactorNonCompliance,
+                EventType::OrganizationUserRevoked,
                 &member.uuid,
                 &member.org_uuid,
                 act_user_id,
@@ -185,16 +225,8 @@ pub async fn enforce_2fa_policy_for_org(
             member.revoke();
             member.save(conn).await?;
 
-            log_event(
-                EventType::OrganizationUserRevokedTwoFactorNonCompliance,
-                &member.uuid,
-                org_id,
-                act_user_id,
-                device_type,
-                ip,
-                conn,
-            )
-            .await;
+            log_event(EventType::OrganizationUserRevoked, &member.uuid, org_id, act_user_id, device_type, ip, conn)
+                .await;
         }
     }
 
@@ -204,7 +236,7 @@ pub async fn enforce_2fa_policy_for_org(
 pub async fn send_incomplete_2fa_notifications(pool: DbPool) {
     debug!("Sending notifications for incomplete 2FA logins");
 
-    if CONFIG.incomplete_2fa_time_limit() == 0 || !CONFIG.mail_enabled() {
+    if CONFIG.incomplete_2fa_time_limit() <= 0 || !CONFIG.mail_enabled() {
         return;
     }
 
@@ -214,21 +246,11 @@ pub async fn send_incomplete_2fa_notifications(pool: DbPool) {
     };
 
     let now = Utc::now().naive_utc();
-    let Some(time_limit) = TimeDelta::try_minutes(i64::from(CONFIG.incomplete_2fa_time_limit())) else {
-        error!("Failed to calculate the time limit for sending incomplete 2fa attempts");
-        return;
-    };
-    let Some(time_before) = now.checked_sub_signed(time_limit) else {
-        error!("Failed to calculate the timestamp for sending incomplete 2fa attempts");
-        return;
-    };
-
+    let time_limit = TimeDelta::try_minutes(CONFIG.incomplete_2fa_time_limit()).unwrap();
+    let time_before = now - time_limit;
     let incomplete_logins = TwoFactorIncomplete::find_logins_before(&time_before, &conn).await;
     for login in incomplete_logins {
-        let Some(user) = User::find_by_uuid(&login.user_uuid, &conn).await else {
-            error!("User '{}', not found!", login.user_uuid);
-            continue;
-        };
+        let user = User::find_by_uuid(&login.user_uuid, &conn).await.expect("User not found");
         info!(
             "User {} did not complete a 2FA login within the configured time limit. IP: {}",
             user.email, login.ip_address
diff --git a/src/api/core/two_factor/protected_actions.rs b/src/api/core/two_factor/protected_actions.rs
index bf757d14..c0c1b5e8 100644
--- a/src/api/core/two_factor/protected_actions.rs
+++ b/src/api/core/two_factor/protected_actions.rs
@@ -72,7 +72,8 @@ async fn request_otp(headers: Headers, conn: DbConn) -> EmptyResult {
     let user = headers.user;
 
     // Only one Protected Action per user is allowed to take place, delete the previous one
-    if let Some(pa) = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::ProtectedActions, &conn).await {
+    if let Some(pa) = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::ProtectedActions as i32, &conn).await
+    {
         let pa_data = ProtectedActionData::from_json(&pa.data)?;
         let elapsed = pa_data.time_since_sent().num_seconds();
         let delay = 30;
@@ -124,28 +125,27 @@ pub async fn validate_protected_action_otp(
     delete_if_valid: bool,
     conn: &DbConn,
 ) -> EmptyResult {
-    let mut pa = TwoFactor::find_by_user_and_type(user_id, TwoFactorType::ProtectedActions, conn)
+    let mut pa = TwoFactor::find_by_user_and_type(user_id, TwoFactorType::ProtectedActions as i32, conn)
         .await
         .map_res("Protected action token not found, try sending the code again or restart the process")?;
     let mut pa_data = ProtectedActionData::from_json(&pa.data)?;
+    pa_data.add_attempt();
+    pa.data = pa_data.to_json();
 
     // Fail after x attempts if the token has been used too many times.
     // Don't delete it, as we use it to keep track of attempts.
-    if pa_data.attempts >= u64::from(CONFIG.email_attempts_limit()) {
+    if pa_data.attempts >= CONFIG.email_attempts_limit() {
         err!("Token has expired")
     }
 
     // Check if the token has expired (Using the email 2fa expiration time)
-    let max_time = i64::from(CONFIG.email_expiration_time());
+    let max_time = CONFIG.email_expiration_time().cast_signed();
     if pa_data.time_since_sent().num_seconds() > max_time {
         pa.delete(conn).await?;
         err!("Token has expired")
     }
 
     if !crypto::ct_eq(&pa_data.token, otp) {
-        pa_data.add_attempt();
-        pa.data = pa_data.to_json();
-
         pa.save(conn).await?;
         err!("Token is invalid")
     }
diff --git a/src/api/core/two_factor/webauthn.rs b/src/api/core/two_factor/webauthn.rs
index 7eab5546..07b964e5 100644
--- a/src/api/core/two_factor/webauthn.rs
+++ b/src/api/core/two_factor/webauthn.rs
@@ -1,4 +1,4 @@
-use std::{collections::HashSet, str::FromStr, sync::LazyLock, time::Duration};
+use std::{str::FromStr, sync::LazyLock, time::Duration};
 
 use rocket::{Route, serde::json::Json};
 use serde_json::Value;
@@ -18,18 +18,16 @@ use crate::{
     CONFIG,
     api::{
         EmptyResult, JsonResult, PasswordOrOtpData,
-        core::{
-            log_user_event,
-            two_factor::{VerificationTokenData, generate_recover_code},
-        },
+        core::{log_user_event, two_factor::generate_recover_code},
     },
-    auth::{Headers, two_factor},
+    auth::Headers,
     crypto::ct_eq,
     db::{
         DbConn,
         models::{EventType, TwoFactor, TwoFactorType, UserId},
     },
     error::Error,
+    util::NumberOrString,
 };
 
 static WEBAUTHN: LazyLock<Webauthn> = LazyLock::new(|| {
@@ -47,14 +45,7 @@ static WEBAUTHN: LazyLock<Webauthn> = LazyLock::new(|| {
 });
 
 pub fn routes() -> Vec<Route> {
-    routes![
-        get_webauthn,
-        generate_webauthn_challenge,
-        activate_webauthn,
-        activate_webauthn_put,
-        delete_webauthn,
-        delete_webauthns
-    ]
+    routes![get_webauthn, generate_webauthn_challenge, activate_webauthn, activate_webauthn_put, delete_webauthn,]
 }
 
 // Some old u2f structs still needed for migrating from u2f to WebAuthn
@@ -128,36 +119,34 @@ async fn get_webauthn(data: Json<PasswordOrOtpData>, headers: Headers, conn: DbC
     data.validate(&user, false, &conn).await?;
 
     let (enabled, registrations) = get_webauthn_registrations(&user.uuid, &conn).await?;
-    let keys: Vec<i32> = registrations.iter().map(|r| r.id).collect();
     let registrations_json: Vec<Value> = registrations.iter().map(WebauthnRegistration::to_json).collect();
 
     Ok(Json(json!({
-        "webAuthn": json!({
-            "enabled": enabled,
-            "keys": registrations_json,
-        }),
-        "userVerificationToken": two_factor::webauthn_token(user.uuid, keys, enabled),
+        "enabled": enabled,
+        "keys": registrations_json,
+        "object": "twoFactorWebAuthn"
     })))
 }
 
 #[post("/two-factor/get-webauthn-challenge", data = "<data>")]
-async fn generate_webauthn_challenge(data: Json<VerificationTokenData>, headers: Headers, conn: DbConn) -> JsonResult {
+async fn generate_webauthn_challenge(data: Json<PasswordOrOtpData>, headers: Headers, conn: DbConn) -> JsonResult {
+    let data: PasswordOrOtpData = data.into_inner();
     let user = headers.user;
 
-    let (enabled, registrations) = get_webauthn_registrations(&user.uuid, &conn).await?;
-    let keys: Vec<i32> = registrations.iter().map(|r| r.id).collect();
-    let creds = registrations
+    data.validate(&user, false, &conn).await?;
+
+    let registrations = get_webauthn_registrations(&user.uuid, &conn)
+        .await?
+        .1
         .into_iter()
         .map(|r| r.credential.cred_id().to_owned()) // We return the credentialIds to the clients to avoid double registering
         .collect();
 
-    two_factor::validate_webauthn(&data.user_verification_token, &user.uuid, &keys, enabled)?;
-
     let (mut challenge, state) = WEBAUTHN.start_passkey_registration(
         Uuid::from_str(&user.uuid).expect("Failed to parse UUID"), // Should never fail
         &user.email,
         user.display_name(),
-        Some(creds),
+        Some(registrations),
     )?;
 
     let mut state = serde_json::to_value(&state)?;
@@ -177,19 +166,17 @@ async fn generate_webauthn_challenge(data: Json<VerificationTokenData>, headers:
     let mut challenge_value = serde_json::to_value(challenge.public_key)?;
     challenge_value["status"] = "ok".into();
     challenge_value["errorMessage"] = "".into();
-
-    Ok(Json(json!({
-        "options": challenge_value
-    })))
+    Ok(Json(challenge_value))
 }
 
 #[derive(Debug, Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct EnableWebauthnData {
-    id: i32,
+    id: NumberOrString, // 1..5
     name: String,
     device_response: RegisterPublicKeyCredentialCopy,
-    user_verification_token: String,
+    master_password_hash: Option<String>,
+    otp: Option<String>,
 }
 
 #[derive(Debug, Deserialize)]
@@ -270,14 +257,16 @@ async fn activate_webauthn(data: Json<EnableWebauthnData>, headers: Headers, con
     let data: EnableWebauthnData = data.into_inner();
     let mut user = headers.user;
 
-    let mut registrations: Vec<_> = get_webauthn_registrations(&user.uuid, &conn).await?.1;
-    let keys: Vec<i32> = registrations.iter().map(|r| r.id).collect();
-    two_factor::validate_webauthn(&data.user_verification_token, &user.uuid, &keys, !keys.is_empty())?;
+    PasswordOrOtpData {
+        master_password_hash: data.master_password_hash,
+        otp: data.otp,
+    }
+    .validate(&user, true, &conn)
+    .await?;
 
     // Retrieve and delete the saved challenge state
-    let state = if let Some(tf) =
-        TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::WebauthnRegisterChallenge, &conn).await
-    {
+    let type_ = TwoFactorType::WebauthnRegisterChallenge as i32;
+    let state = if let Some(tf) = TwoFactor::find_by_user_and_type(&user.uuid, type_, &conn).await {
         let state: PasskeyRegistration = serde_json::from_str(&tf.data)?;
         tf.delete(&conn).await?;
         state
@@ -288,9 +277,10 @@ async fn activate_webauthn(data: Json<EnableWebauthnData>, headers: Headers, con
     // Verify the credentials with the saved state
     let credential = WEBAUTHN.finish_passkey_registration(&data.device_response.into(), &state)?;
 
+    let mut registrations: Vec<_> = get_webauthn_registrations(&user.uuid, &conn).await?.1;
     // TODO: Check for repeated ID's
     registrations.push(WebauthnRegistration {
-        id: data.id,
+        id: data.id.into_i32()?,
         name: data.name,
         migrated: false,
 
@@ -303,13 +293,13 @@ async fn activate_webauthn(data: Json<EnableWebauthnData>, headers: Headers, con
         .await?;
     generate_recover_code(&mut user, &conn).await;
 
-    log_user_event(EventType::UserUpdated2fa, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
+    log_user_event(EventType::UserUpdated2fa as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
 
+    let keys_json: Vec<Value> = registrations.iter().map(WebauthnRegistration::to_json).collect();
     Ok(Json(json!({
-        "webAuthn": json!({
-            "enabled": true,
-            "keys": registrations.iter().map(WebauthnRegistration::to_json).collect::<Vec<Value>>(),
-        }),
+        "enabled": true,
+        "keys": keys_json,
+        "object": "twoFactorU2f"
     })))
 }
 
@@ -320,87 +310,57 @@ async fn activate_webauthn_put(data: Json<EnableWebauthnData>, headers: Headers,
 
 #[derive(Debug, Deserialize)]
 #[serde(rename_all = "camelCase")]
-struct DeleteWebauthnData {
-    id: i32,
-    user_verification_token: String,
+struct DeleteU2FData {
+    id: NumberOrString,
+    master_password_hash: String,
 }
 
 #[delete("/two-factor/webauthn", data = "<data>")]
-async fn delete_webauthn(data: Json<DeleteWebauthnData>, headers: Headers, conn: DbConn) -> JsonResult {
-    inner_delete_webauthns(&data.user_verification_token, |key| key.id != data.id, headers, &conn).await
-}
+async fn delete_webauthn(data: Json<DeleteU2FData>, headers: Headers, conn: DbConn) -> JsonResult {
+    let id = data.id.into_i32()?;
+    if !headers.user.check_valid_password(&data.master_password_hash) {
+        err!("Invalid password");
+    }
 
-#[delete("/two-factor/webauthn/all", data = "<data>")]
-async fn delete_webauthns(data: Json<VerificationTokenData>, headers: Headers, conn: DbConn) -> JsonResult {
-    inner_delete_webauthns(&data.user_verification_token, |_| false, headers, &conn).await
-}
-
-async fn inner_delete_webauthns(
-    token: &str,
-    retain: impl Fn(&WebauthnRegistration) -> bool,
-    headers: Headers,
-    conn: &DbConn,
-) -> JsonResult {
-    let user = headers.user;
-
-    let Some(mut tf) = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Webauthn, conn).await else {
+    let Some(mut tf) =
+        TwoFactor::find_by_user_and_type(&headers.user.uuid, TwoFactorType::Webauthn as i32, &conn).await
+    else {
         err!("Webauthn data not found!")
     };
 
-    let mut keys: Vec<WebauthnRegistration> = serde_json::from_str(&tf.data)?;
-    let keys_id: Vec<i32> = keys.iter().map(|r| r.id).collect();
+    let mut data: Vec<WebauthnRegistration> = serde_json::from_str(&tf.data)?;
 
-    two_factor::validate_webauthn(token, &user.uuid, &keys_id, true)?;
-
-    let mut removed: HashSet<Vec<u8>> = HashSet::new();
-    let mut migrated = false;
-
-    keys.retain(|key| {
-        let retained = retain(key);
-        if !retained {
-            removed.insert(key.credential.cred_id().to_vec());
-            migrated = migrated || key.migrated;
-        }
-        retained
-    });
-
-    if removed.is_empty() {
+    let Some(item_pos) = data.iter().position(|r| r.id == id) else {
         err!("Webauthn entry not found")
-    }
+    };
 
-    if keys.is_empty() {
-        tf.delete(conn).await?;
-        log_user_event(EventType::UserDisabled2fa, &user.uuid, headers.device.atype, &headers.ip.ip, conn).await;
-    } else {
-        tf.data = serde_json::to_string(&keys)?;
-        tf.save(conn).await?;
-        drop(tf);
-    }
+    let removed_item = data.remove(item_pos);
+    tf.data = serde_json::to_string(&data)?;
+    tf.save(&conn).await?;
+    drop(tf);
 
     // If entry is migrated from u2f, delete the u2f entry as well
-    if migrated && let Some(mut u2f) = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::U2f, conn).await {
-        let Ok(mut data) = serde_json::from_str::<Vec<U2FRegistration>>(&u2f.data) else {
+    if let Some(mut u2f) = TwoFactor::find_by_user_and_type(&headers.user.uuid, TwoFactorType::U2f as i32, &conn).await
+    {
+        let mut data: Vec<U2FRegistration> = if let Ok(d) = serde_json::from_str(&u2f.data) {
+            d
+        } else {
             err!("Error parsing U2F data")
         };
 
-        data.retain(|old| !removed.contains(&old.reg.key_handle));
+        data.retain(|r| r.reg.key_handle != removed_item.credential.cred_id().as_slice());
+        let new_data_str = serde_json::to_string(&data)?;
 
-        if data.is_empty() {
-            u2f.delete(conn).await?;
-        } else {
-            let new_data_str = serde_json::to_string(&data)?;
-            u2f.data = new_data_str;
-            u2f.save(conn).await?;
-        }
+        u2f.data = new_data_str;
+        u2f.save(&conn).await?;
     }
 
-    super::check_2fa_state(&user, headers.device.atype, &headers.ip.ip, conn).await?;
+    let keys_json: Vec<Value> = data.iter().map(WebauthnRegistration::to_json).collect();
 
     Ok(Json(json!({
-        "webAuthn": json!({
-            "enabled": !keys.is_empty(),
-            "keys": keys.iter().map(WebauthnRegistration::to_json).collect::<Vec<Value>>(),
-        }),
+        "enabled": true,
+        "keys": keys_json,
+        "object": "twoFactorU2f"
     })))
 }
 
@@ -408,7 +368,8 @@ pub async fn get_webauthn_registrations(
     user_id: &UserId,
     conn: &DbConn,
 ) -> Result<(bool, Vec<WebauthnRegistration>), Error> {
-    match TwoFactor::find_by_user_and_type(user_id, TwoFactorType::Webauthn, conn).await {
+    let type_ = TwoFactorType::Webauthn as i32;
+    match TwoFactor::find_by_user_and_type(user_id, type_, conn).await {
         Some(tf) => Ok((tf.enabled, serde_json::from_str(&tf.data)?)),
         None => Ok((false, Vec::new())), // If no data, return empty list
     }
@@ -455,9 +416,8 @@ pub async fn generate_webauthn_login(user_id: &UserId, conn: &DbConn) -> JsonRes
 }
 
 pub async fn validate_webauthn_login(user_id: &UserId, response: &str, conn: &DbConn) -> EmptyResult {
-    let mut state = if let Some(tf) =
-        TwoFactor::find_by_user_and_type(user_id, TwoFactorType::WebauthnLoginChallenge, conn).await
-    {
+    let type_ = TwoFactorType::WebauthnLoginChallenge as i32;
+    let mut state = if let Some(tf) = TwoFactor::find_by_user_and_type(user_id, type_, conn).await {
         let state: PasskeyAuthentication = serde_json::from_str(&tf.data)?;
         tf.delete(conn).await?;
         state
diff --git a/src/api/core/two_factor/yubikey.rs b/src/api/core/two_factor/yubikey.rs
index 17c4e9a0..eb3d6dfd 100644
--- a/src/api/core/two_factor/yubikey.rs
+++ b/src/api/core/two_factor/yubikey.rs
@@ -10,12 +10,9 @@ use crate::{
     CONFIG,
     api::{
         EmptyResult, JsonResult, PasswordOrOtpData,
-        core::{
-            log_user_event,
-            two_factor::{VerificationTokenData, generate_recover_code},
-        },
+        core::{log_user_event, two_factor::generate_recover_code},
     },
-    auth::{Headers, two_factor},
+    auth::Headers,
     db::{
         DbConn,
         models::{EventType, TwoFactor, TwoFactorType},
@@ -25,7 +22,7 @@ use crate::{
 };
 
 pub fn routes() -> Vec<Route> {
-    routes![generate_yubikey, activate_yubikey, activate_yubikey_put, delete_yubikeys,]
+    routes![generate_yubikey, activate_yubikey, activate_yubikey_put,]
 }
 
 struct HttpClientTransport {
@@ -63,7 +60,8 @@ struct EnableYubikeyData {
     key4: Option<String>,
     key5: Option<String>,
     nfc: bool,
-    user_verification_token: String,
+    master_password_hash: Option<String>,
+    otp: Option<String>,
 }
 
 #[derive(Deserialize, Serialize, Debug)]
@@ -127,47 +125,55 @@ async fn generate_yubikey(data: Json<PasswordOrOtpData>, headers: Headers, conn:
     data.validate(&user, false, &conn).await?;
 
     let user_id = &user.uuid;
+    let yubikey_type = TwoFactorType::YubiKey as i32;
 
-    let (enabled, keys, yubikey_json) =
-        if let Some(r) = TwoFactor::find_by_user_and_type(user_id, TwoFactorType::YubiKey, &conn).await {
-            let yubikey_metadata: YubikeyMetadata = serde_json::from_str(&r.data)?;
-            let enabled = !yubikey_metadata.keys.is_empty();
-            let mut result = jsonify_yubikeys(yubikey_metadata.keys.clone());
-            result["enabled"] = Value::Bool(enabled);
-            result["nfc"] = Value::Bool(yubikey_metadata.nfc);
-            (enabled, yubikey_metadata.keys, result)
-        } else {
-            (false, Vec::new(), json!({"enabled": false}))
-        };
-    Ok(Json(json!({
-        "yubiKey": yubikey_json,
-        "userVerificationToken": two_factor::yubikey_token(user.uuid, keys, enabled),
-    })))
+    let r = TwoFactor::find_by_user_and_type(user_id, yubikey_type, &conn).await;
+
+    if let Some(r) = r {
+        let yubikey_metadata: YubikeyMetadata = serde_json::from_str(&r.data)?;
+
+        let mut result = jsonify_yubikeys(yubikey_metadata.keys);
+
+        result["enabled"] = Value::Bool(true);
+        result["nfc"] = Value::Bool(yubikey_metadata.nfc);
+        result["object"] = Value::String("twoFactorU2f".to_owned());
+
+        Ok(Json(result))
+    } else {
+        Ok(Json(json!({
+            "enabled": false,
+            "object": "twoFactorU2f",
+        })))
+    }
 }
 
 #[post("/two-factor/yubikey", data = "<data>")]
 async fn activate_yubikey(data: Json<EnableYubikeyData>, headers: Headers, conn: DbConn) -> JsonResult {
     let data: EnableYubikeyData = data.into_inner();
-    let yubikeys = parse_yubikeys(&data);
     let mut user = headers.user;
 
+    PasswordOrOtpData {
+        master_password_hash: data.master_password_hash.clone(),
+        otp: data.otp.clone(),
+    }
+    .validate(&user, true, &conn)
+    .await?;
+
+    // Check if we already have some data
+    let mut yubikey_data =
+        match TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::YubiKey as i32, &conn).await {
+            Some(data) => data,
+            None => TwoFactor::new(user.uuid.clone(), TwoFactorType::YubiKey, String::new()),
+        };
+
+    let yubikeys = parse_yubikeys(&data);
+
     if yubikeys.is_empty() {
         // Return an error to prevent saving empty keys which would cause users not being able to login anymore.
         // To remove all keys users should click the `Deactivate all keys` button
         err!("A key is required.");
     }
 
-    // Check if we already have some data
-    let mut yubikey_data =
-        if let Some(yd) = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::YubiKey, &conn).await {
-            let ym: YubikeyMetadata = serde_json::from_str(&yd.data)?;
-            two_factor::validate_yubikey(&data.user_verification_token, &user.uuid, &ym.keys, !ym.keys.is_empty())?;
-            yd
-        } else {
-            two_factor::validate_yubikey(&data.user_verification_token, &user.uuid, &Vec::new(), false)?;
-            TwoFactor::new(user.uuid.clone(), TwoFactorType::YubiKey, String::new())
-        };
-
     // Ensure they are valid OTPs
     for yubikey in &yubikeys {
         if yubikey.is_empty() || yubikey.len() == 12 {
@@ -189,12 +195,15 @@ async fn activate_yubikey(data: Json<EnableYubikeyData>, headers: Headers, conn:
 
     generate_recover_code(&mut user, &conn).await;
 
-    log_user_event(EventType::UserUpdated2fa, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
+    log_user_event(EventType::UserUpdated2fa as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
 
     let mut result = jsonify_yubikeys(yubikey_metadata.keys);
+
     result["enabled"] = Value::Bool(true);
     result["nfc"] = Value::Bool(yubikey_metadata.nfc);
-    Ok(Json(json!({"yubiKey": result})))
+    result["object"] = Value::String("twoFactorU2f".to_owned());
+
+    Ok(Json(result))
 }
 
 #[put("/two-factor/yubikey", data = "<data>")]
@@ -202,32 +211,13 @@ async fn activate_yubikey_put(data: Json<EnableYubikeyData>, headers: Headers, c
     activate_yubikey(data, headers, conn).await
 }
 
-#[delete("/two-factor/yubikey", data = "<data>")]
-async fn delete_yubikeys(data: Json<VerificationTokenData>, headers: Headers, conn: DbConn) -> EmptyResult {
-    let user = headers.user;
-
-    if let Some(r) = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::YubiKey, &conn).await {
-        let yubikey_metadata: YubikeyMetadata = serde_json::from_str(&r.data)?;
-        two_factor::validate_yubikey(&data.user_verification_token, &user.uuid, &yubikey_metadata.keys, true)?;
-
-        r.delete(&conn).await?;
-        log_user_event(EventType::UserDisabled2fa, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
-    }
-
-    super::check_2fa_state(&user, headers.device.atype, &headers.ip.ip, &conn).await?;
-
-    Ok(())
-}
-
 pub async fn validate_yubikey_login(response: &str, twofactor_data: &str) -> EmptyResult {
     if response.len() != 44 {
         err!("Invalid Yubikey OTP length");
     }
 
     let yubikey_metadata: YubikeyMetadata = serde_json::from_str(twofactor_data).expect("Can't parse Yubikey Metadata");
-    let Some(response_id) = response.get(..12) else {
-        err!("Invalid Yubikey OTP");
-    };
+    let response_id = &response[..12];
 
     if !yubikey_metadata.keys.contains(&response_id.to_owned()) {
         err!("Given Yubikey is not registered");
diff --git a/src/api/icons.rs b/src/api/icons.rs
index 1c7b2a57..8f3e730b 100644
--- a/src/api/icons.rs
+++ b/src/api/icons.rs
@@ -62,7 +62,7 @@ static CLIENT: LazyLock<Client> = LazyLock::new(|| {
     // Generate the cookie store
     let cookie_store = Arc::new(Jar::default());
 
-    let icon_download_timeout = Duration::from_secs(u64::from(CONFIG.icon_download_timeout()));
+    let icon_download_timeout = Duration::from_secs(CONFIG.icon_download_timeout());
     let pool_idle_timeout = Duration::from_secs(10);
     // Reuse the client between requests
     get_reqwest_client_builder(true)
@@ -85,7 +85,7 @@ static ICON_SIZE_REGEX: LazyLock<Regex> = LazyLock::new(|| Regex::new(r"(?x)(\d+
 #[get("/<host>/icon.png")]
 fn icon_external(host: &str) -> Cached<Option<Redirect>> {
     let Ok(host) = get_valid_host(host) else {
-        warn!("Invalid host: {}", host.escape_debug());
+        warn!("Invalid host: {host}");
         return Cached::ttl(None, CONFIG.icon_cache_negttl(), true);
     };
 
@@ -113,7 +113,7 @@ async fn icon_internal(host: &str) -> Cached<(ContentType, Vec<u8>)> {
     const FALLBACK_ICON: &[u8] = include_bytes!("../static/images/fallback-icon.png");
 
     let Ok(host) = get_valid_host(host) else {
-        warn!("Invalid host: {}", host.escape_debug());
+        warn!("Invalid host: {host}");
         return Cached::ttl(
             (ContentType::new("image", "png"), FALLBACK_ICON.to_vec()),
             CONFIG.icon_cache_negttl(),
@@ -193,14 +193,14 @@ async fn get_cached_icon(path: &str) -> Option<Vec<u8>> {
     None
 }
 
-async fn file_is_expired(path: &str, ttl: u32) -> Result<bool, Error> {
+async fn file_is_expired(path: &str, ttl: u64) -> Result<bool, Error> {
     let operator = CONFIG.opendal_operator_for_path_type(&PathType::IconCache)?;
     let meta = operator.stat(path).await?;
     let modified =
         meta.last_modified().ok_or_else(|| std::io::Error::other(format!("No last modified time for `{path}`")))?;
     let age = SystemTime::now().duration_since(modified.into())?;
 
-    Ok(ttl > 0 && u64::from(ttl) <= age.as_secs())
+    Ok(ttl > 0 && ttl <= age.as_secs())
 }
 
 async fn icon_is_negcached(path: &str) -> bool {
@@ -264,7 +264,7 @@ fn get_favicons_node(dom: Tokenizer<StringReader<'_>, FaviconEmitter>, icons: &m
             TAG_BASE => {
                 base_url = if let Some(href) = token.tag.attributes.get(ATTR_HREF) {
                     let href = std::str::from_utf8(href).unwrap_or_default();
-                    debug!("Found base href: {}", href.escape_debug());
+                    debug!("Found base href: {href}");
                     match base_url.join(href) {
                         Ok(inner_url) => inner_url,
                         _ => continue,
@@ -524,7 +524,7 @@ async fn download_icon(domain: &str) -> Result<(Bytes, Option<&str>), Error> {
                 Ok(())
             }) {
                 Ok(_) => {
-                    // Also check if the size is at least 67 bytes, which seems to be the smallest png I could create
+                    // Also check if the size is atleast 67 bytes, which seems to be the smallest png i could create
                     if body.len() >= 67 {
                         // Check if the icon type is allowed, else try an icon from the list.
                         icon_type = get_icon_type(&body);
@@ -663,17 +663,6 @@ impl reqwest::cookie::CookieStore for Jar {
         use time::Duration;
 
         let mut cookie_store = self.0.write().unwrap();
-
-        // The store only skips expired cookies when reading them, so remove them here or they are kept forever
-        let expired: Vec<_> = cookie_store
-            .iter_any()
-            .filter(|c| c.is_expired())
-            .map(|c| (String::from(&c.domain), String::from(&c.path), c.name().to_owned()))
-            .collect();
-        for (domain, path, name) in expired {
-            cookie_store.remove(&domain, &path, &name);
-        }
-
         let cookies = cookie_headers.filter_map(|val| {
             std::str::from_utf8(val.as_bytes())
                 .map_err(RawCookieParseError::from)
diff --git a/src/api/identity.rs b/src/api/identity.rs
index d7ae5068..1237a8de 100644
--- a/src/api/identity.rs
+++ b/src/api/identity.rs
@@ -17,19 +17,20 @@ use crate::{
             accounts::{PreloginData, RegisterData, kdf_upgrade, prelogin, register},
             log_user_event,
             two_factor::{
-                authenticator, duo_oidc, email, enforce_2fa_policy, is_twofactor_provider_usable, webauthn, yubikey,
+                authenticator, duo, duo_oidc, email, enforce_2fa_policy, is_twofactor_provider_usable, webauthn,
+                yubikey,
             },
         },
-        identity_master_password_policy,
+        master_password_policy,
         push::register_push_device,
     },
     auth,
-    auth::{AuthMethod, ClientHeaders, ClientIp, Secure, generate_organization_api_key_login_claims},
+    auth::{AuthMethod, ClientHeaders, ClientIp, ClientVersion, Secure, generate_organization_api_key_login_claims},
     crypto,
     db::{
         DbConn,
         models::{
-            AuthRequest, AuthRequestId, Device, DeviceId, DeviceType, EventType, Invitation, OIDCCodeResponseError,
+            AuthRequest, AuthRequestId, Device, DeviceId, EventType, Invitation, OIDCCodeResponseError,
             OrganizationApiKey, OrganizationId, SendId, SsoAuth, SsoUser, TwoFactor, TwoFactorIncomplete,
             TwoFactorType, User, UserId,
         },
@@ -45,8 +46,8 @@ pub fn routes() -> Vec<Route> {
         login,
         post_prelogin,
         prelogin_password,
+        identity_register,
         register_verification_email,
-        register_verification_email_clicked,
         register_finish,
         prevalidate,
         authorize,
@@ -56,7 +57,12 @@ pub fn routes() -> Vec<Route> {
 }
 
 #[post("/connect/token", data = "<data>")]
-async fn login(data: Form<ConnectData>, client_header: ClientHeaders, conn: DbConn) -> JsonResult {
+async fn login(
+    data: Form<ConnectData>,
+    client_header: ClientHeaders,
+    client_version: Option<ClientVersion>,
+    conn: DbConn,
+) -> JsonResult {
     let data: ConnectData = data.into_inner();
 
     let mut user_id: Option<UserId> = None;
@@ -77,14 +83,18 @@ async fn login(data: Form<ConnectData>, client_header: ClientHeaders, conn: DbCo
             check_is_some(data.device_name.as_ref(), "device_name cannot be blank")?;
             check_is_some(data.device_type.as_ref(), "device_type cannot be blank")?;
 
-            password_login(data, &mut user_id, &conn, &client_header).await
+            password_login(data, &mut user_id, &conn, &client_header.ip, client_version.as_ref()).await
         }
         "client_credentials" => {
             check_is_some(data.client_id.as_ref(), "client_id cannot be blank")?;
             check_is_some(data.client_secret.as_ref(), "client_secret cannot be blank")?;
             check_is_some(data.scope.as_ref(), "scope cannot be blank")?;
 
-            api_key_login(data, &mut user_id, &conn, &client_header).await
+            check_is_some(data.device_identifier.as_ref(), "device_identifier cannot be blank")?;
+            check_is_some(data.device_name.as_ref(), "device_name cannot be blank")?;
+            check_is_some(data.device_type.as_ref(), "device_type cannot be blank")?;
+
+            api_key_login(data, &mut user_id, &conn, &client_header.ip).await
         }
         "authorization_code" if CONFIG.sso_enabled() => {
             check_is_some(data.client_id.as_ref(), "client_id cannot be blank")?;
@@ -95,7 +105,7 @@ async fn login(data: Form<ConnectData>, client_header: ClientHeaders, conn: DbCo
             check_is_some(data.device_name.as_ref(), "device_name cannot be blank")?;
             check_is_some(data.device_type.as_ref(), "device_type cannot be blank")?;
 
-            sso_login(data, &mut user_id, &conn, &client_header).await
+            sso_login(data, &mut user_id, &conn, &client_header.ip, client_version.as_ref()).await
         }
         "authorization_code" => err!("SSO sign-in is not available"),
         "send_access" => {
@@ -112,14 +122,14 @@ async fn login(data: Form<ConnectData>, client_header: ClientHeaders, conn: DbCo
             .await?;
             Ok(Json(tokens.to_json()))
         }
-        t => err!("Invalid type", t.escape_debug().to_string()),
+        t => err!("Invalid type", t),
     };
 
     if let Some(user_id) = user_id {
         match &login_result {
             Ok(_) => {
                 log_user_event(
-                    EventType::UserLoggedIn,
+                    EventType::UserLoggedIn as i32,
                     &user_id,
                     client_header.device_type,
                     &client_header.ip.ip,
@@ -129,7 +139,8 @@ async fn login(data: Form<ConnectData>, client_header: ClientHeaders, conn: DbCo
             }
             Err(e) => {
                 if let Some(ev) = e.get_event() {
-                    log_user_event(ev.event, &user_id, client_header.device_type, &client_header.ip.ip, &conn).await;
+                    log_user_event(ev.event as i32, &user_id, client_header.device_type, &client_header.ip.ip, &conn)
+                        .await;
                 }
             }
         }
@@ -183,9 +194,9 @@ async fn sso_login(
     data: ConnectData,
     user_id: &mut Option<UserId>,
     conn: &DbConn,
-    client_header: &ClientHeaders,
+    ip: &ClientIp,
+    client_version: Option<&ClientVersion>,
 ) -> JsonResult {
-    let ip = &client_header.ip;
     AuthMethod::Sso.check_scope(data.scope.as_ref())?;
 
     // Ratelimit the login
@@ -323,8 +334,6 @@ async fn sso_login(
             }
 
             let mut user = User::new(&user_infos.email, user_infos.user_name.clone());
-            // Before saving, so that a client that can't log in doesn't create the account
-            check_client_version(&user, client_header)?;
             user.verified_at = Some(now);
             user.save(conn).await?;
 
@@ -333,8 +342,6 @@ async fn sso_login(
             (user, device, None, None)
         }
         Some((user, _)) if !user.enabled => {
-            // Set in both arms, not only after the match, so that their failed logins are logged
-            *user_id = Some(user.uuid.clone());
             err!(
                 "This user has been disabled",
                 format!("IP: {}. Username: {}.", ip.ip, user.email),
@@ -344,12 +351,9 @@ async fn sso_login(
             )
         }
         Some((mut user, sso_user)) => {
-            *user_id = Some(user.uuid.clone());
-            check_client_version(&user, client_header)?;
-
             let mut device = get_device(&data, conn, &user).await?;
 
-            let twofactor_token = twofactor_auth(&mut user, &data, &mut device, ip, conn).await?;
+            let twofactor_token = twofactor_auth(&mut user, &data, &mut device, ip, client_version, conn).await?;
 
             if user.private_key.is_none() {
                 // User was invited a stub was created
@@ -385,9 +389,9 @@ async fn password_login(
     data: ConnectData,
     user_id: &mut Option<UserId>,
     conn: &DbConn,
-    client_header: &ClientHeaders,
+    ip: &ClientIp,
+    client_version: Option<&ClientVersion>,
 ) -> JsonResult {
-    let ip = &client_header.ip;
     // Validate scope
     AuthMethod::Password.check_scope(data.scope.as_ref())?;
 
@@ -396,14 +400,24 @@ async fn password_login(
 
     // Get the user
     let username = data.username.as_ref().unwrap().trim();
-    let log_username = username.escape_debug();
     let Some(mut user) = User::find_by_mail(username, conn).await else {
-        err!("Username or password is incorrect. Try again", format!("IP: {}. Username: {log_username}.", ip.ip))
+        err!("Username or password is incorrect. Try again", format!("IP: {}. Username: {username}.", ip.ip))
     };
 
     // Set the user_id here to be passed back used for event logging.
     *user_id = Some(user.uuid.clone());
 
+    // Check if the user is disabled
+    if !user.enabled {
+        err!(
+            "This user has been disabled",
+            format!("IP: {}. Username: {username}.", ip.ip),
+            ErrorEvent {
+                event: EventType::UserFailedLogIn
+            }
+        )
+    }
+
     let password = data.password.as_ref().unwrap();
 
     // If we get an auth request, we don't check the user's password, but the access code of the auth request
@@ -411,7 +425,7 @@ async fn password_login(
         let Some(auth_request) = AuthRequest::find_by_uuid_and_user(auth_request_id, &user.uuid, conn).await else {
             err!(
                 "Auth request not found. Try again.",
-                format!("IP: {}. Username: {log_username}.", ip.ip),
+                format!("IP: {}. Username: {username}.", ip.ip),
                 ErrorEvent {
                     event: EventType::UserFailedLogIn,
                 }
@@ -423,14 +437,13 @@ async fn password_login(
 
         if auth_request.user_uuid != user.uuid
             || !auth_request.approved.unwrap_or(false)
-            || auth_request.authentication_date.is_some()
             || request_expired
             || ip.ip.to_string() != auth_request.request_ip
             || !auth_request.check_access_code(password)
         {
             err!(
                 "Username or access code is incorrect. Try again",
-                format!("IP: {}. Username: {log_username}.", ip.ip),
+                format!("IP: {}. Username: {username}.", ip.ip),
                 ErrorEvent {
                     event: EventType::UserFailedLogIn,
                 }
@@ -439,26 +452,13 @@ async fn password_login(
     } else if !user.check_valid_password(password) {
         err!(
             "Username or password is incorrect. Try again",
-            format!("IP: {}. Username: {log_username}.", ip.ip),
+            format!("IP: {}. Username: {username}.", ip.ip),
             ErrorEvent {
                 event: EventType::UserFailedLogIn,
             }
         )
     }
 
-    // Check if the user is disabled
-    if !user.enabled {
-        err!(
-            "This user has been disabled",
-            format!("IP: {}. Username: {log_username}.", ip.ip),
-            ErrorEvent {
-                event: EventType::UserFailedLogIn
-            }
-        )
-    }
-
-    check_client_version(&user, client_header)?;
-
     // Change the KDF Iterations (only when not logging in with an auth request)
     if data.auth_request.is_none() {
         kdf_upgrade(&mut user, password, conn).await?;
@@ -469,9 +469,9 @@ async fn password_login(
     if user.verified_at.is_none() && CONFIG.mail_enabled() && CONFIG.signups_verify() {
         if user.last_verifying_at.is_none()
             || now.signed_duration_since(user.last_verifying_at.unwrap()).num_seconds()
-                > i64::from(CONFIG.signups_verify_resend_time())
+                > CONFIG.signups_verify_resend_time().cast_signed()
         {
-            let resend_limit = i32::from(CONFIG.signups_verify_resend_limit());
+            let resend_limit = CONFIG.signups_verify_resend_limit().cast_signed();
             if resend_limit == 0 || user.login_verify_count < resend_limit {
                 // We want to send another email verification if we require signups to verify
                 // their email address, and we haven't sent them a reminder in a while...
@@ -491,7 +491,7 @@ async fn password_login(
         // We still want the login to fail until they actually verified the email address
         err!(
             "Please verify your email before trying again.",
-            format!("IP: {}. Username: {log_username}.", ip.ip),
+            format!("IP: {}. Username: {username}.", ip.ip),
             ErrorEvent {
                 event: EventType::UserFailedLogIn
             }
@@ -500,86 +500,13 @@ async fn password_login(
 
     let mut device = get_device(&data, conn, &user).await?;
 
-    let twofactor_token = twofactor_auth(&mut user, &data, &mut device, ip, conn).await?;
-
-    // Like upstream, an auth request can be used for one login only. Marked after 2FA so a 2FA prompt doesn't use it up.
-    if let Some(ref auth_request_id) = data.auth_request
-        && !AuthRequest::set_authentication_date(auth_request_id, conn).await?
-    {
-        err!(
-            "Username or access code is incorrect. Try again",
-            format!("IP: {}. Username: {log_username}.", ip.ip),
-            ErrorEvent {
-                event: EventType::UserFailedLogIn,
-            }
-        )
-    }
+    let twofactor_token = twofactor_auth(&mut user, &data, &mut device, ip, client_version, conn).await?;
 
     let auth_tokens = auth::AuthTokens::new(&device, &user, AuthMethod::Password, data.client_id);
 
     authenticated_response(&user, &mut device, auth_tokens, twofactor_token, conn, ip).await
 }
 
-/// Like upstream's `ClientVersionValidator`, every login needs the `Bitwarden-Client-Version` header, and a V2 account
-/// ([`User::has_v2_encryption`]) a client of at least 2026.10.1 (2026.10.2 for the desktop app). Called right after the
-/// credentials are checked, like upstream, so that it doesn't tell anyone else which accounts are V2.
-///
-/// Ref: <https://github.com/bitwarden/server/blob/15c94ac58bf361a162381749c146d254a21b2098/src/Identity/IdentityServer/RequestValidators/ClientVersionValidator.cs#L33-L79>
-/// Ref: <https://github.com/bitwarden/server/blob/15c94ac58bf361a162381749c146d254a21b2098/src/Core/KeyManagement/Constants.cs#L5-L6>
-fn check_client_version(user: &User, client_header: &ClientHeaders) -> EmptyResult {
-    let Some((error, description)) = client_version_error(
-        user.has_v2_encryption(),
-        client_header.client_version.as_ref(),
-        client_header.device_type,
-    ) else {
-        return Ok(());
-    };
-    Err(crate::error::Error::from((
-        // Escaped: on a first SSO login the email comes from the provider and isn't validated yet
-        format!("IP: {}. Username: {}. {error}", client_header.ip.ip, user.email.escape_debug()),
-        json!({
-            "error": error,
-            "error_description": description,
-            "ErrorModel": { "Message": description, "Object": "error" },
-        }),
-    ))
-    .with_event(crate::error::ErrorEvent {
-        event: EventType::UserFailedLogIn,
-    }))
-}
-
-/// The error id and message of [`check_client_version`], `None` when the client may log in.
-fn client_version_error(
-    is_v2: bool,
-    client_version: Option<&semver::Version>,
-    device_type: i32,
-) -> Option<(&'static str, &'static str)> {
-    const MIN_V2_CLIENT: semver::Version = semver::Version::new(2026, 10, 1);
-    const MIN_V2_DESKTOP_CLIENT: semver::Version = semver::Version::new(2026, 10, 2);
-
-    let Some(version) = client_version else {
-        return Some((
-            "version_header_missing",
-            "No client version header found, required to prevent encryption errors. Please confirm your client is supplying the header: \"Bitwarden-Client-Version\"",
-        ));
-    };
-    if !is_v2 {
-        return None;
-    }
-    // Upstream's desktop device types
-    // Ref: <https://github.com/bitwarden/server/blob/15c94ac58bf361a162381749c146d254a21b2098/src/Libraries/Clients/DeviceTypes.cs#L14-L20>
-    let is_desktop = matches!(
-        DeviceType::from_i32(device_type),
-        DeviceType::WindowsDesktop | DeviceType::MacOsDesktop | DeviceType::LinuxDesktop | DeviceType::Uwp
-    );
-    let min_version = if is_desktop {
-        &MIN_V2_DESKTOP_CLIENT
-    } else {
-        &MIN_V2_CLIENT
-    };
-    (version < min_version).then_some(("invalid_client_version", "Please update your app to continue using Bitwarden"))
-}
-
 async fn authenticated_response(
     user: &User,
     device: &mut Device,
@@ -612,7 +539,7 @@ async fn authenticated_response(
     // Save to update `device.updated_at` to track usage and toggle new status
     device.save(true, conn).await?;
 
-    let master_password_policy = identity_master_password_policy(user, conn).await;
+    let master_password_policy = master_password_policy(user, conn).await;
 
     let has_master_password = !user.password_hash.is_empty();
     let master_password_unlock = if has_master_password {
@@ -627,7 +554,7 @@ async fn authenticated_response(
             // https://github.com/bitwarden/android/blob/release/2025.12-rc41/network/src/main/kotlin/com/bitwarden/network/model/MasterPasswordUnlockDataJson.kt#L22-L26
             "MasterKeyEncryptedUserKey": user.akey,
             "MasterKeyWrappedUserKey": user.akey,
-            "Salt": user.master_password_salt()
+            "Salt": user.email
         })
     } else {
         Value::Null
@@ -645,6 +572,7 @@ async fn authenticated_response(
         "KdfIterations": user.client_kdf_iter,
         "KdfMemory": user.client_kdf_memory,
         "KdfParallelism": user.client_kdf_parallelism,
+        "ResetMasterPassword": false, // TODO: Same as above
         "ForcePasswordReset": false,
         "MasterPasswordPolicy": master_password_policy,
         "scope": auth_tokens.scope(),
@@ -668,26 +596,13 @@ async fn authenticated_response(
     Ok(Json(result))
 }
 
-async fn api_key_login(
-    data: ConnectData,
-    user_id: &mut Option<UserId>,
-    conn: &DbConn,
-    client_header: &ClientHeaders,
-) -> JsonResult {
-    let ip = &client_header.ip;
+async fn api_key_login(data: ConnectData, user_id: &mut Option<UserId>, conn: &DbConn, ip: &ClientIp) -> JsonResult {
     // Ratelimit the login
     crate::ratelimit::check_limit_login(&ip.ip)?;
 
     // Validate scope
     match data.scope.as_ref() {
-        Some(scope) if scope == &AuthMethod::UserApiKey.scope() => {
-            // Like upstream, only the user API key logs in a device
-            check_is_some(data.device_identifier.as_ref(), "device_identifier cannot be blank")?;
-            check_is_some(data.device_name.as_ref(), "device_name cannot be blank")?;
-            check_is_some(data.device_type.as_ref(), "device_type cannot be blank")?;
-
-            user_api_key_login(data, user_id, conn, client_header).await
-        }
+        Some(scope) if scope == &AuthMethod::UserApiKey.scope() => user_api_key_login(data, user_id, conn, ip).await,
         Some(scope) if scope == &AuthMethod::OrgApiKey.scope() => organization_api_key_login(data, conn, ip).await,
         _ => err!("Scope not supported"),
     }
@@ -697,9 +612,8 @@ async fn user_api_key_login(
     data: ConnectData,
     user_id: &mut Option<UserId>,
     conn: &DbConn,
-    client_header: &ClientHeaders,
+    ip: &ClientIp,
 ) -> JsonResult {
-    let ip = &client_header.ip;
     // Get the user via the client_id
     let client_id = data.client_id.as_ref().unwrap();
     let Some(client_user_id) = client_id.strip_prefix("user.") else {
@@ -736,8 +650,6 @@ async fn user_api_key_login(
         )
     }
 
-    check_client_version(&user, client_header)?;
-
     let mut device = get_device(&data, conn, &user).await?;
 
     if CONFIG.mail_enabled() && device.is_new() {
@@ -782,7 +694,7 @@ async fn user_api_key_login(
             // https://github.com/bitwarden/android/blob/release/2025.12-rc41/network/src/main/kotlin/com/bitwarden/network/model/MasterPasswordUnlockDataJson.kt#L22-L26
             "MasterKeyEncryptedUserKey": user.akey,
             "MasterKeyWrappedUserKey": user.akey,
-            "Salt": user.master_password_salt()
+            "Salt": user.email
         })
     } else {
         Value::Null
@@ -803,6 +715,7 @@ async fn user_api_key_login(
         "KdfIterations": user.client_kdf_iter,
         "KdfMemory": user.client_kdf_memory,
         "KdfParallelism": user.client_kdf_parallelism,
+        "ResetMasterPassword": false, // TODO: according to official server seems something like: user.password_hash.is_empty(), but would need testing
         "ForcePasswordReset": false,
         "scope": AuthMethod::UserApiKey.scope(),
         "AccountKeys": account_keys,
@@ -868,6 +781,7 @@ async fn twofactor_auth(
     data: &ConnectData,
     device: &mut Device,
     ip: &ClientIp,
+    client_version: Option<&ClientVersion>,
     conn: &DbConn,
 ) -> ApiResult<Option<String>> {
     let twofactors = TwoFactor::find_by_user(&user.uuid, conn).await;
@@ -896,12 +810,17 @@ async fn twofactor_auth(
     if ![TwoFactorType::Remember as i32, TwoFactorType::RecoveryCode as i32].contains(&selected_id)
         && !twofactor_ids.contains(&selected_id)
     {
-        err_json!(json_err_twofactor(&twofactor_ids, user, data, conn).await?, "Invalid two factor provider")
+        err_json!(
+            json_err_twofactor(&twofactor_ids, &user.uuid, data, client_version, conn).await?,
+            "Invalid two factor provider"
+        )
     }
 
-    // Like upstream, a blank token counts as not provided
-    let Some(twofactor_code) = data.two_factor_token.as_deref().filter(|t| !t.trim().is_empty()) else {
-        err_json!(json_err_twofactor(&twofactor_ids, user, data, conn).await?, "2FA token not provided")
+    let Some(ref twofactor_code) = data.two_factor_token else {
+        err_json!(
+            json_err_twofactor(&twofactor_ids, &user.uuid, data, client_version, conn).await?,
+            "2FA token not provided"
+        )
     };
 
     let selected_twofactor = twofactors.into_iter().find(|tf| tf.atype == selected_id && tf.enabled);
@@ -915,14 +834,20 @@ async fn twofactor_auth(
         Some(TwoFactorType::Webauthn) => webauthn::validate_webauthn_login(&user.uuid, twofactor_code, conn).await?,
         Some(TwoFactorType::YubiKey) => yubikey::validate_yubikey_login(twofactor_code, &selected_data?).await?,
         Some(TwoFactorType::Duo) => {
-            duo_oidc::validate_duo_login(
-                &user.email,
-                twofactor_code,
-                data.client_id.as_ref().unwrap(),
-                data.device_identifier.as_ref().unwrap(),
-                conn,
-            )
-            .await?;
+            if CONFIG.duo_use_iframe() {
+                // Legacy iframe prompt flow
+                duo::validate_duo_login(&user.email, twofactor_code, conn).await?;
+            } else {
+                // OIDC based flow
+                duo_oidc::validate_duo_login(
+                    &user.email,
+                    twofactor_code,
+                    data.client_id.as_ref().unwrap(),
+                    data.device_identifier.as_ref().unwrap(),
+                    conn,
+                )
+                .await?;
+            }
         }
         Some(TwoFactorType::Email) => {
             email::validate_email_code_str(&user.uuid, twofactor_code, &selected_data?, &ip.ip, conn).await?;
@@ -944,22 +869,16 @@ async fn twofactor_auth(
                         device.save(true, conn).await?;
                     }
                     err_json!(
-                        json_err_twofactor(&twofactor_ids, user, data, conn).await?,
+                        json_err_twofactor(&twofactor_ids, &user.uuid, data, client_version, conn).await?,
                         "2FA Remember token not provided or expired"
                     )
                 }
             }
         }
         Some(TwoFactorType::RecoveryCode) => {
-            // Like upstream, spaces and case don't matter
-            let recovery_code = twofactor_code.replace(' ', "").trim().to_lowercase();
-            if !user.check_valid_recovery_code(&recovery_code) {
-                err!(
-                    "Two-step token is invalid. Try again.",
-                    ErrorEvent {
-                        event: EventType::UserFailedLogIn2fa
-                    }
-                )
+            // Check if recovery code is correct
+            if !user.check_valid_recovery_code(twofactor_code) {
+                err!("Recovery code is incorrect. Try again.")
             }
 
             // Remove all twofactors from the user
@@ -972,14 +891,7 @@ async fn twofactor_auth(
 
             enforce_2fa_policy(user, &user.uuid, device.atype, &ip.ip, conn).await?;
 
-            log_user_event(EventType::UserRecovered2fa, &user.uuid, device.atype, &ip.ip, conn).await;
-
-            if CONFIG.mail_enabled()
-                && let Err(e) =
-                    mail::send_recover_twofactor(&user.email, &ip.ip.to_string(), &Utc::now().naive_utc()).await
-            {
-                error!("Error sending two-step login recovered email: {e:#?}");
-            }
+            log_user_event(EventType::UserRecovered2fa as i32, &user.uuid, device.atype, &ip.ip, conn).await;
 
             // Remove the recovery code, not needed without twofactors
             user.totp_recover = None;
@@ -1008,14 +920,21 @@ fn selected_data(tf: Option<TwoFactor>) -> ApiResult<String> {
     tf.map(|t| t.data).map_res("Two factor doesn't exist")
 }
 
-async fn json_err_twofactor(providers: &[i32], user: &User, data: &ConnectData, conn: &DbConn) -> ApiResult<Value> {
-    let user_id = &user.uuid;
+async fn json_err_twofactor(
+    providers: &[i32],
+    user_id: &UserId,
+    data: &ConnectData,
+    client_version: Option<&ClientVersion>,
+    conn: &DbConn,
+) -> ApiResult<Value> {
     let mut result = json!({
         "error" : "invalid_grant",
         "error_description" : "Two factor required.",
         "TwoFactorProviders" : providers.iter().map(ToString::to_string).collect::<Vec<String>>(),
         "TwoFactorProviders2" : {}, // { "0" : null }
-        "MasterPasswordPolicy": identity_master_password_policy(user, conn).await,
+        "MasterPasswordPolicy": {
+            "Object": "masterPasswordPolicy"
+        }
     });
 
     for provider in providers {
@@ -1028,21 +947,37 @@ async fn json_err_twofactor(providers: &[i32], user: &User, data: &ConnectData,
             }
 
             Some(TwoFactorType::Duo) => {
-                let auth_url = duo_oidc::get_duo_auth_url(
-                    &user.email,
-                    data.client_id.as_ref().unwrap(),
-                    data.device_identifier.as_ref().unwrap(),
-                    conn,
-                )
-                .await?;
+                let email = if let Some(u) = User::find_by_uuid(user_id, conn).await {
+                    u.email
+                } else {
+                    err!("User does not exist")
+                };
 
-                result["TwoFactorProviders2"][provider.to_string()] = json!({
-                    "AuthUrl": auth_url,
-                });
+                if CONFIG.duo_use_iframe() {
+                    // Legacy iframe prompt flow
+                    let (signature, host) = duo::generate_duo_signature(&email, conn).await?;
+                    result["TwoFactorProviders2"][provider.to_string()] = json!({
+                        "Host": host,
+                        "Signature": signature,
+                    });
+                } else {
+                    // OIDC based flow
+                    let auth_url = duo_oidc::get_duo_auth_url(
+                        &email,
+                        data.client_id.as_ref().unwrap(),
+                        data.device_identifier.as_ref().unwrap(),
+                        conn,
+                    )
+                    .await?;
+
+                    result["TwoFactorProviders2"][provider.to_string()] = json!({
+                        "AuthUrl": auth_url,
+                    });
+                }
             }
 
             Some(tf_type @ TwoFactorType::YubiKey) => {
-                let Some(twofactor) = TwoFactor::find_by_user_and_type(user_id, tf_type, conn).await else {
+                let Some(twofactor) = TwoFactor::find_by_user_and_type(user_id, tf_type as i32, conn).await else {
                     err!("No YubiKey devices registered")
                 };
 
@@ -1054,10 +989,23 @@ async fn json_err_twofactor(providers: &[i32], user: &User, data: &ConnectData,
             }
 
             Some(tf_type @ TwoFactorType::Email) => {
-                let Some(twofactor) = TwoFactor::find_by_user_and_type(user_id, tf_type, conn).await else {
+                let Some(twofactor) = TwoFactor::find_by_user_and_type(user_id, tf_type as i32, conn).await else {
                     err!("No twofactor email registered")
                 };
 
+                // Starting with version 2025.5.0 the client will call `/api/two-factor/send-email-login`.
+                let disabled_send = if let Some(cv) = client_version {
+                    let ver_match = semver::VersionReq::parse(">=2025.5.0").unwrap();
+                    ver_match.matches(&cv.0)
+                } else {
+                    false
+                };
+
+                // Send email immediately if email is the only 2FA option.
+                if providers.len() == 1 && !disabled_send {
+                    email::send_token(user_id, conn).await?;
+                }
+
                 let email_data = email::EmailTokenData::from_json(&twofactor.data)?;
                 result["TwoFactorProviders2"][provider.to_string()] = json!({
                     "Email": email::obscure_email(&email_data.email),
@@ -1095,6 +1043,11 @@ async fn prelogin_password(data: Json<PreloginData>, ip: ClientIp, conn: DbConn)
     prelogin(data, ip, conn).await
 }
 
+#[post("/accounts/register", data = "<data>")]
+async fn identity_register(data: Json<RegisterData>, conn: DbConn) -> JsonResult {
+    register(data, false, conn).await
+}
+
 #[derive(Debug, Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct RegisterVerificationData {
@@ -1103,13 +1056,6 @@ struct RegisterVerificationData {
     // receiveMarketingEmails: bool,
 }
 
-#[derive(Debug, Deserialize)]
-#[serde(rename_all = "camelCase")]
-struct RegisterVerificationEmailClickedData {
-    email: String,
-    email_verification_token: String,
-}
-
 #[derive(rocket::Responder)]
 enum RegisterVerificationResponse {
     #[response(status = 204)]
@@ -1172,29 +1118,9 @@ async fn register_verification_email(
     }
 }
 
-#[post("/accounts/register/verification-email-clicked", data = "<data>")]
-async fn register_verification_email_clicked(
-    data: Json<RegisterVerificationEmailClickedData>,
-    conn: DbConn,
-) -> EmptyResult {
-    let data = data.into_inner();
-    let token_valid = auth::decode_register_verify(&data.email_verification_token)
-        .is_ok_and(|claims| claims.verified && claims.sub.eq_ignore_ascii_case(&data.email));
-    let user_exists = User::find_by_mail(&data.email, &conn)
-        .await
-        .is_some_and(|user| !user.password_hash.is_empty() || user.private_key.is_some());
-
-    if !token_valid || user_exists {
-        err!("Expired link. Please restart registration or try logging in. You may already have an account")
-    }
-
-    Ok(())
-}
-
 #[post("/accounts/register/finish", data = "<data>")]
-async fn register_finish(data: Json<RegisterData>, ip: ClientIp, conn: DbConn) -> JsonResult {
-    crate::ratelimit::check_limit_unauthenticated(&ip.ip)?;
-    register(data, conn).await
+async fn register_finish(data: Json<RegisterData>, conn: DbConn) -> JsonResult {
+    register(data, true, conn).await
 }
 
 // https://github.com/bitwarden/jslib/blob/master/common/src/models/request/tokenRequest.ts
@@ -1324,7 +1250,7 @@ async fn oidcsignin_redirect(
     let state = sso::decode_state(&base64_state)?;
 
     let Some(mut sso_auth) = SsoAuth::find(&state, conn).await else {
-        err!(format!("Cannot retrieve sso_auth for {}", state.escape_debug()))
+        err!(format!("Cannot retrieve sso_auth for {state}"))
     };
 
     // Browser-binding check
@@ -1333,7 +1259,7 @@ async fn oidcsignin_redirect(
     let provided_hash = cookie_value.as_deref().map(|v| crypto::sha256_hex(v.as_bytes()));
     match (sso_auth.binding_hash.as_deref(), provided_hash.as_deref()) {
         (Some(expected), Some(actual)) if crypto::ct_eq(expected, actual) => {}
-        _ => err!(format!("SSO session binding mismatch for {}", state.escape_debug())),
+        _ => err!(format!("SSO session binding mismatch for {state}")),
     }
     cookies
         .remove(Cookie::build(SSO_BINDING_COOKIE).path(format!("{}/identity/connect/", CONFIG.domain_path())).build());
@@ -1419,33 +1345,3 @@ async fn authorize(data: AuthorizeData, cookies: &CookieJar<'_>, secure: Secure,
 
     Ok(Redirect::temporary(String::from(auth_url)))
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn test_client_version_error() {
-        let version = |v| semver::Version::parse(v).unwrap();
-        let web = DeviceType::ChromeBrowser as i32;
-        let desktop = DeviceType::WindowsDesktop as i32;
-        // Every login needs the header
-        assert_eq!(client_version_error(false, None, web).map(|e| e.0), Some("version_header_missing"));
-        assert_eq!(client_version_error(true, None, desktop).map(|e| e.0), Some("version_header_missing"));
-        // V1 accounts log in from any version
-        assert_eq!(client_version_error(false, Some(&version("2024.1.0")), web), None);
-        assert_eq!(client_version_error(false, Some(&version("2024.1.0")), desktop), None);
-        // V2 accounts need 2026.10.1, and 2026.10.2 for the desktop app
-        assert_eq!(
-            client_version_error(true, Some(&version("2026.10.0")), web).map(|e| e.0),
-            Some("invalid_client_version")
-        );
-        assert_eq!(client_version_error(true, Some(&version("2026.10.1")), web), None);
-        assert_eq!(
-            client_version_error(true, Some(&version("2026.10.1")), desktop).map(|e| e.0),
-            Some("invalid_client_version")
-        );
-        assert_eq!(client_version_error(true, Some(&version("2026.10.2")), DeviceType::Uwp as i32), None);
-        assert_eq!(client_version_error(true, Some(&version("2026.11.0")), desktop), None);
-    }
-}
diff --git a/src/api/mod.rs b/src/api/mod.rs
index 4c10f10b..57899219 100644
--- a/src/api/mod.rs
+++ b/src/api/mod.rs
@@ -4,13 +4,8 @@ mod icons;
 mod identity;
 mod notifications;
 mod push;
-#[cfg(feature = "unsafe_test_mode")]
-mod test_seeder;
 mod web;
 
-#[cfg(feature = "unsafe_test_mode")]
-pub use test_seeder::routes as test_seeder_routes;
-
 use rocket::serde::json::Json;
 use serde_json::Value;
 
@@ -30,12 +25,12 @@ pub use crate::api::{
     notifications::routes as notifications_routes,
     notifications::{AnonymousNotify, LogOutReason, Notify, UpdateType, WS_ANONYMOUS_SUBSCRIPTIONS, WS_USERS},
     push::{
-        push_cipher_update, push_folder_update, push_logout, push_logout_to_relay, push_send_update, push_user_update,
-        register_push_device, unregister_push_device,
+        push_cipher_update, push_folder_update, push_logout, push_send_update, push_user_update, register_push_device,
+        unregister_push_device,
     },
     web::catchers as web_catchers,
     web::routes as web_routes,
-    web::{STATIC_FILES, invalidate_css_cache},
+    web::{invalidate_css_cache, static_files},
 };
 use crate::{
     CONFIG,
@@ -51,7 +46,7 @@ pub type JsonResult = ApiResult<Json<Value>>;
 pub type EmptyResult = ApiResult<()>;
 
 // Common structs representing JSON data received
-#[derive(Debug, Deserialize)]
+#[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct PasswordOrOtpData {
     #[serde(alias = "MasterPasswordHash")]
@@ -129,21 +124,3 @@ async fn master_password_policy(user: &User, conn: &DbConn) -> Value {
     mpp_json["Object"] = json!("masterPasswordPolicy");
     mpp_json
 }
-
-// Identity responses use PascalCase keys like upstream, some clients (Android) only read those
-async fn identity_master_password_policy(user: &User, conn: &DbConn) -> Value {
-    match master_password_policy(user, conn).await {
-        Value::Object(policy) => Value::Object(
-            policy
-                .into_iter()
-                .map(|(mut key, value)| {
-                    if let Some(first) = key.get_mut(..1) {
-                        first.make_ascii_uppercase();
-                    }
-                    (key, value)
-                })
-                .collect(),
-        ),
-        policy => policy,
-    }
-}
diff --git a/src/api/notifications.rs b/src/api/notifications.rs
index 304ce447..55688ff9 100644
--- a/src/api/notifications.rs
+++ b/src/api/notifications.rs
@@ -1,7 +1,7 @@
 use std::{
     net::IpAddr,
     sync::{Arc, LazyLock},
-    time::{Duration, Instant},
+    time::Duration,
 };
 
 use chrono::{NaiveDateTime, Utc};
@@ -41,14 +41,6 @@ pub static WS_ANONYMOUS_SUBSCRIPTIONS: LazyLock<Arc<AnonymousWebSocketSubscripti
 /// One connection is needed per pending login request, several at once are only expected behind NAT.
 const MAX_ANONYMOUS_CONNECTIONS_PER_IP: u32 = 25;
 
-/// How often a Ping is sent to the client.
-const WS_PING_INTERVAL: Duration = Duration::from_secs(15);
-
-/// Close the connection if nothing, not even a Pong, was received from the client for this long.
-/// Otherwise half-open connections (client gone without a FIN, e.g. behind a proxy or NAT) are kept forever.
-/// Same as the default `ClientTimeoutInterval` of ASP.NET Core SignalR, which the official server uses.
-const WS_CLIENT_TIMEOUT: Duration = Duration::from_secs(30);
-
 static NOTIFICATIONS_DISABLED: LazyLock<bool> = LazyLock::new(|| !CONFIG.enable_websocket() && !CONFIG.push_enabled());
 
 pub fn routes() -> Vec<Route> {
@@ -164,16 +156,12 @@ fn websockets_hub<'r>(
         rocket_ws::Stream! { ws => {
             let mut ws = ws;
             let _guard = guard;
-            let mut interval = tokio::time::interval(WS_PING_INTERVAL);
-            let mut last_received = Instant::now();
+            let mut interval = tokio::time::interval(Duration::from_secs(15));
             loop {
                 tokio::select! {
                     res = ws.next() =>  {
                         match res {
                             Some(Ok(message)) => {
-                                // Any message, including a Pong, means the client is still there
-                                last_received = Instant::now();
-
                                 match message {
                                     // Respond to any pings
                                     Message::Ping(ping) => yield Message::Pong(ping),
@@ -207,13 +195,7 @@ fn websockets_hub<'r>(
                         }
                     }
 
-                    _ = interval.tick() => {
-                        // The client stopped responding without closing the connection, drop it
-                        if last_received.elapsed() > WS_CLIENT_TIMEOUT {
-                            break;
-                        }
-                        yield Message::Ping(PING.to_vec());
-                    }
+                    _ = interval.tick() => yield Message::Ping(create_ping())
                 }
             }
         }}
@@ -247,16 +229,12 @@ fn anonymous_websockets_hub<'r>(ws: WebSocket, token: String, ip: ClientIp) -> R
         rocket_ws::Stream! { ws => {
             let mut ws = ws;
             let _guard = guard;
-            let mut interval = tokio::time::interval(WS_PING_INTERVAL);
-            let mut last_received = Instant::now();
+            let mut interval = tokio::time::interval(Duration::from_secs(15));
             loop {
                 tokio::select! {
                     res = ws.next() =>  {
                         match res {
                             Some(Ok(message)) => {
-                                // Any message, including a Pong, means the client is still there
-                                last_received = Instant::now();
-
                                 match message {
                                     // Respond to any pings
                                     Message::Ping(ping) => yield Message::Pong(ping),
@@ -290,13 +268,7 @@ fn anonymous_websockets_hub<'r>(ws: WebSocket, token: String, ip: ClientIp) -> R
                         }
                     }
 
-                    _ = interval.tick() => {
-                        // The client stopped responding without closing the connection, drop it
-                        if last_received.elapsed() > WS_CLIENT_TIMEOUT {
-                            break;
-                        }
-                        yield Message::Ping(PING.to_vec());
-                    }
+                    _ = interval.tick() => yield Message::Ping(create_ping())
                 }
             }
         }}
@@ -359,7 +331,6 @@ fn convert_option<T: Into<Value>>(option: Option<T>) -> Value {
 
 const RECORD_SEPARATOR: u8 = 0x1e;
 const INITIAL_RESPONSE: [u8; 3] = [0x7b, 0x7d, RECORD_SEPARATOR]; // {, }, <RS>
-const PING: [u8; 3] = [0x02, 0x91, 0x06];
 
 #[derive(Deserialize, Copy, Clone, Eq, PartialEq)]
 struct InitialMessage<'a> {
@@ -415,7 +386,8 @@ impl WebSocketUsers {
         self.send_logout_with_reason(user, acting_device, None, conn).await;
     }
 
-    /// A logout that clients may handle differently depending on `reason`
+    /// A logout that clients may handle differently depending on `reason`, e.g. syncing instead of
+    /// logging out after a key rotation that kept the sessions alive.
     pub async fn send_logout_with_reason(
         &self,
         user: &User,
@@ -704,9 +676,14 @@ fn create_anonymous_update(payload: Vec<(Value, Value)>, ut: UpdateType, user_id
     serialize(&value)
 }
 
-/// Why a logout was pushed, absent for a plain one. `KdfChange` isn't sent yet.
+fn create_ping() -> Vec<u8> {
+    serialize(&Value::Array(vec![6.into()]))
+}
+
+/// Why a logout was pushed. Absent for a plain logout.
 ///
-/// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Core/Enums/PushNotificationLogOutReason.cs#L3-L7>
+/// Ref: <https://github.com/bitwarden/server/blob/main/src/Core/Enums/PushNotificationLogOutReason.cs>
+/// (`KdfChange = 0` is not sent by vaultwarden yet.)
 #[derive(Copy, Clone, Eq, PartialEq)]
 pub enum LogOutReason {
     KeyRotation = 1,
diff --git a/src/api/push.rs b/src/api/push.rs
index dab31c22..323d1310 100644
--- a/src/api/push.rs
+++ b/src/api/push.rs
@@ -139,25 +139,21 @@ pub async fn unregister_push_device(push_id: Option<&PushId>) -> EmptyResult {
     if !CONFIG.push_enabled() || push_id.is_none() {
         return Ok(());
     }
-    let data = json!({
-        "id": push_id.as_ref().unwrap(),
-    });
-
     let auth_api_token = get_auth_api_token().await?;
+
     let auth_header = format!("Bearer {auth_api_token}");
 
-    if let Err(e) = make_http_request(Method::POST, &(CONFIG.push_relay_uri() + "/push/delete"))?
-        .header(CONTENT_TYPE, "application/json")
-        .header(ACCEPT, "application/json")
-        .header(AUTHORIZATION, auth_header)
-        .json(&data)
-        .send()
-        .await?
-        .error_for_status()
+    match make_http_request(
+        Method::POST,
+        &format!("{}/push/delete/{}", CONFIG.push_relay_uri(), push_id.as_ref().unwrap()),
+    )?
+    .header(AUTHORIZATION, auth_header)
+    .send()
+    .await
     {
-        err!(format!("An error occurred during device unregistration: {e}"));
-    }
-
+        Ok(r) => r,
+        Err(e) => err!(format!("An error occurred during device unregistration: {e}")),
+    };
     Ok(())
 }
 
@@ -194,27 +190,21 @@ pub async fn push_cipher_update(ut: UpdateType, cipher: &Cipher, device: &Device
 
 pub async fn push_logout(user: &User, acting_device: Option<&Device>, reason: Option<LogOutReason>, conn: &DbConn) {
     if Device::check_user_has_push_device(&user.uuid, conn).await {
-        push_logout_to_relay(user, acting_device, reason);
-    }
-}
-
-// Sends the logout without checking for push devices first.
-// Needed after deleting a user, when the devices are already gone from the database.
-pub fn push_logout_to_relay(user: &User, acting_device: Option<&Device>, reason: Option<LogOutReason>) {
-    tokio::task::spawn(send_to_push_relay(json!({
-        "userId": user.uuid,
-        "organizationId": (),
-        "deviceId": acting_device.and_then(|d| d.push_uuid.as_ref()),
-        "identifier": acting_device.map(|d| &d.uuid),
-        "type": UpdateType::LogOut as i32,
-        "payload": {
+        tokio::task::spawn(send_to_push_relay(json!({
             "userId": user.uuid,
-            "date": format_date(&user.updated_at),
-            "reason": reason.map(|r| r as i32),
-        },
-        "clientType": null,
-        "installationId": null
-    })));
+            "organizationId": (),
+            "deviceId": acting_device.and_then(|d| d.push_uuid.as_ref()),
+            "identifier": acting_device.map(|d| &d.uuid),
+            "type": UpdateType::LogOut as i32,
+            "payload": {
+                "userId": user.uuid,
+                "date": format_date(&user.updated_at),
+                "reason": reason.map(|r| r as i32),
+            },
+            "clientType": null,
+            "installationId": null
+        })));
+    }
 }
 
 pub async fn push_user_update(ut: UpdateType, user: &User, push_uuid: Option<&PushId>, conn: &DbConn) {
diff --git a/src/api/test_seeder.rs b/src/api/test_seeder.rs
deleted file mode 100644
index f02298db..00000000
--- a/src/api/test_seeder.rs
+++ /dev/null
@@ -1,511 +0,0 @@
-//! A seeder API for the end-to-end tests, only in builds with the `unsafe_test_mode` feature: it creates accounts with
-//! no checks at all, so it must never be in a release or a deployment.
-//!
-//! It answers the calls the SDK's live tests make to upstream's `util/SeederApi` (`POST /seed` with a scene,
-//! `DELETE /seed/{playId}`), under `/test/seeder`. Each request needs HTTP basic auth with `TEST_SEEDER_USERNAME` and
-//! `TEST_SEEDER_PASSWORD` from the environment; without both, every route answers 404. Seeding needs an `X-Play-Id`
-//! header, and destroying a play deletes the accounts seeded under it. Plays are kept in memory, which is enough for a
-//! test server that starts on an empty database.
-//!
-//! Scenes:
-//! - `SingleUserScene`: a V1 account for an email and password, under a mangled address like upstream's, with
-//!   PBKDF2 at upstream's default of 5000 iterations.
-//! - `TestVectorUserScene`: one of the SDK's user test vectors (`test-vectors/users/*.json`), stored as it is: the
-//!   account and its vault are already encrypted. Unlike upstream, the address isn't mangled, since our master
-//!   password salt is the email, so a vector can be seeded once at a time. Text Sends are stored too.
-//!
-//! Ref: <https://github.com/bitwarden/server/blob/15c94ac58bf361a162381749c146d254a21b2098/util/SeederApi/Controllers/SeedController.cs#L11-L107>
-//! Ref: <https://github.com/bitwarden/server/blob/15c94ac58bf361a162381749c146d254a21b2098/util/Seeder/Scenes/SingleUserScene.cs#L38-L154>
-
-use std::{
-    collections::HashMap,
-    num::NonZeroU32,
-    sync::{LazyLock, Mutex},
-};
-
-use chrono::Utc;
-use data_encoding::{BASE64, HEXLOWER};
-use openssl::{
-    pkey::PKey,
-    rsa::Rsa,
-    symm::{Cipher, encrypt},
-};
-use ring::{hkdf, hmac, pbkdf2};
-use rocket::{
-    Request, Route,
-    http::Status,
-    request::{FromRequest, Outcome},
-    serde::json::Json,
-};
-use serde_json::{Value, json};
-
-use crate::{
-    api::{
-        ApiResult, JsonResult,
-        core::{seed_cipher, seed_send},
-    },
-    crypto,
-    db::{
-        DbConn,
-        models::{Folder, FolderId, KeyId, SignatureAlgorithm, User, UserId, UserKdfType, UserSignatureKeyPair},
-    },
-};
-
-pub fn routes() -> Vec<Route> {
-    routes![seed, destroy_play]
-}
-
-/// The accounts seeded under each play id.
-static PLAYS: LazyLock<Mutex<HashMap<String, Vec<UserId>>>> = LazyLock::new(Mutex::default);
-
-/// HTTP basic auth with `TEST_SEEDER_USERNAME` and `TEST_SEEDER_PASSWORD`.
-struct SeederAuth;
-
-#[rocket::async_trait]
-impl<'r> FromRequest<'r> for SeederAuth {
-    type Error = &'static str;
-
-    async fn from_request(request: &'r Request<'_>) -> Outcome<Self, Self::Error> {
-        let (Ok(username), Ok(password)) =
-            (std::env::var("TEST_SEEDER_USERNAME"), std::env::var("TEST_SEEDER_PASSWORD"))
-        else {
-            return Outcome::Error((Status::NotFound, "The test seeder is off"));
-        };
-        if username.is_empty() || password.is_empty() {
-            return Outcome::Error((Status::NotFound, "The test seeder is off"));
-        }
-        let expected = format!("Basic {}", BASE64.encode(format!("{username}:{password}").as_bytes()));
-        match request.headers().get_one("Authorization") {
-            Some(given) if crypto::ct_eq(given, expected) => Outcome::Success(Self),
-            _ => Outcome::Error((Status::Unauthorized, "Invalid test seeder credentials")),
-        }
-    }
-}
-
-/// The `X-Play-Id` header, which names the play a seeding belongs to.
-struct PlayId(String);
-
-#[rocket::async_trait]
-impl<'r> FromRequest<'r> for PlayId {
-    type Error = &'static str;
-
-    async fn from_request(request: &'r Request<'_>) -> Outcome<Self, Self::Error> {
-        match request.headers().get_one("X-Play-Id").map(str::trim) {
-            Some(play_id) if !play_id.is_empty() => Outcome::Success(Self(play_id.to_owned())),
-            _ => Outcome::Error((Status::BadRequest, "Seeding needs an X-Play-Id header")),
-        }
-    }
-}
-
-#[derive(Deserialize)]
-#[serde(rename_all = "camelCase")]
-struct SeedRequest {
-    template: String,
-    arguments: Option<Value>,
-}
-
-#[post("/seed", data = "<data>")]
-async fn seed(data: Json<SeedRequest>, _auth: SeederAuth, play: PlayId, conn: DbConn) -> JsonResult {
-    let data = data.into_inner();
-    let arguments = data.arguments.unwrap_or(Value::Null);
-    let response = match data.template.as_str() {
-        "SingleUserScene" => single_user_scene(serde_json::from_value(arguments)?, &play.0, &conn).await?,
-        "TestVectorUserScene" => test_vector_user_scene(serde_json::from_value(arguments)?, &play.0, &conn).await?,
-        other => err_code!(format!("Unknown scene {}", other.escape_debug()), Status::NotFound.code),
-    };
-    Ok(Json(response))
-}
-
-/// Records an account in its play as soon as it's saved, so that destroying the play removes it even when the rest of
-/// the seeding fails.
-fn track(play: &str, user_id: &UserId) {
-    PLAYS.lock().unwrap().entry(play.to_owned()).or_default().push(user_id.clone());
-}
-
-/// Deletes the accounts seeded under `play_id`; an unknown play is a no-op, like upstream.
-#[delete("/seed/<play_id>")]
-async fn destroy_play(play_id: &str, _auth: SeederAuth, conn: DbConn) -> JsonResult {
-    let user_ids = PLAYS.lock().unwrap().remove(play_id).unwrap_or_default();
-    let mut remaining = Vec::new();
-    let mut error = None;
-    for user_id in &user_ids {
-        let Some(user) = User::find_by_uuid(user_id, &conn).await else {
-            continue;
-        };
-        if let Err(e) = user.delete(&conn).await {
-            remaining.push(user_id.clone());
-            error.get_or_insert(e);
-        }
-    }
-    if let Some(error) = error {
-        // Kept in the play, so that destroying it again retries them
-        PLAYS.lock().unwrap().entry(play_id.to_owned()).or_default().extend(remaining);
-        return Err(error);
-    }
-    Ok(Json(json!({ "userIds": user_ids })))
-}
-
-#[derive(Deserialize)]
-#[serde(rename_all = "camelCase")]
-struct SingleUserRequest {
-    email: String,
-    password: String,
-    #[serde(default)]
-    email_verified: bool,
-    kdf_iterations: Option<u32>,
-    #[serde(default)]
-    enroll_in_email2_fa: bool,
-    #[serde(default)]
-    corrupt_private_key: bool,
-}
-
-/// Ref: <https://github.com/bitwarden/server/blob/15c94ac58bf361a162381749c146d254a21b2098/util/Seeder/Models/UserSeed.cs#L55>
-const DEFAULT_KDF_ITERATIONS: u32 = 5_000;
-
-async fn single_user_scene(request: SingleUserRequest, play: &str, conn: &DbConn) -> ApiResult<Value> {
-    if request.enroll_in_email2_fa || request.corrupt_private_key {
-        err!("enrollInEmail2Fa and corruptPrivateKey aren't supported")
-    }
-    let iterations = request.kdf_iterations.unwrap_or(DEFAULT_KDF_ITERATIONS);
-    if !(5_000..=2_000_000).contains(&iterations) {
-        err!("kdfIterations must be between 5000 and 2000000")
-    }
-    let Some((local, domain)) = request.email.split_once('@') else {
-        err!("The email has no @")
-    };
-    // Like upstream's ManglerService: unique addresses for every seeding
-    let mangled = format!("{}+{local}@{domain}", HEXLOWER.encode(&crypto::get_random_bytes::<4>()));
-
-    let mut user = User::new(&mangled, None);
-    let keys = V1Keys::new(&request.password, &user.master_password_salt(), iterations)?;
-    user.client_kdf_type = UserKdfType::Pbkdf2 as i32;
-    user.client_kdf_iter = iterations.cast_signed();
-    user.client_kdf_memory = None;
-    user.client_kdf_parallelism = None;
-    user.private_key = Some(keys.private_key.clone());
-    user.public_key = Some(keys.public_key.clone());
-    if request.email_verified {
-        user.verified_at = Some(Utc::now().naive_utc());
-    }
-    user.set_password(&keys.master_password_hash, Some(keys.wrapped_user_key.clone()), false, None, conn).await?;
-    user.save(conn).await?;
-    track(play, &user.uuid);
-
-    let response = json!({
-        "mangleMap": mangle_map(&request.email, &user.email),
-        "result": {
-            "userId": user.uuid,
-            "kdf": "PBKDF2_SHA256",
-            "kdfIterations": iterations,
-            "key": keys.wrapped_user_key,
-            "publicKey": keys.public_key,
-            "privateKey": keys.private_key,
-        },
-    });
-    Ok(response)
-}
-
-/// What a V1 client makes when it registers, from the master password.
-struct V1Keys {
-    /// The master password authentication hash, which the client logs in with.
-    master_password_hash: String,
-    /// The user key, wrapped by the stretched master key.
-    wrapped_user_key: String,
-    /// The PKCS#8 RSA private key, wrapped by the user key.
-    private_key: String,
-    /// The SPKI RSA public key.
-    public_key: String,
-}
-
-impl V1Keys {
-    fn new(password: &str, salt: &str, iterations: u32) -> ApiResult<Self> {
-        let master_key = pbkdf2_sha256(password.as_bytes(), salt.as_bytes(), iterations);
-        let master_password_hash = BASE64.encode(&pbkdf2_sha256(&master_key, password.as_bytes(), 1));
-        let stretched_enc = hkdf_expand(&master_key, b"enc");
-        let stretched_mac = hkdf_expand(&master_key, b"mac");
-
-        let user_key = crypto::get_random_bytes::<64>();
-        let wrapped_user_key = enc_string(&user_key, &stretched_enc, &stretched_mac)?;
-
-        let key_pair = PKey::from_rsa(Rsa::generate(2048)?)?;
-        let private_key = enc_string(&key_pair.private_key_to_pkcs8()?, &user_key[..32], &user_key[32..])?;
-        let public_key = BASE64.encode(&key_pair.public_key_to_der()?);
-
-        Ok(Self {
-            master_password_hash,
-            wrapped_user_key,
-            private_key,
-            public_key,
-        })
-    }
-}
-
-fn pbkdf2_sha256(secret: &[u8], salt: &[u8], iterations: u32) -> [u8; 32] {
-    let mut out = [0u8; 32];
-    let iterations = NonZeroU32::new(iterations).expect("iterations aren't zero");
-    pbkdf2::derive(pbkdf2::PBKDF2_HMAC_SHA256, iterations, salt, secret, &mut out);
-    out
-}
-
-/// HKDF-Expand with `key` as the pseudorandom key, as clients stretch the master key.
-fn hkdf_expand(key: &[u8; 32], info: &[u8]) -> [u8; 32] {
-    let mut out = [0u8; 32];
-    hkdf::Prk::new_less_safe(hkdf::HKDF_SHA256, key)
-        .expand(&[info], hkdf::HKDF_SHA256)
-        .and_then(|okm| okm.fill(&mut out))
-        .expect("32 bytes is a valid HKDF-SHA256 length");
-    out
-}
-
-/// An `AesCbc256_HmacSha256_B64` (type 2) EncString.
-fn enc_string(plaintext: &[u8], enc_key: &[u8], mac_key: &[u8]) -> ApiResult<String> {
-    let iv = crypto::get_random_bytes::<16>();
-    let ciphertext = encrypt(Cipher::aes_256_cbc(), enc_key, Some(&iv), plaintext)?;
-    let mac = hmac::sign(&hmac::Key::new(hmac::HMAC_SHA256, mac_key), &[iv.as_slice(), &ciphertext].concat());
-    Ok(format!("2.{}|{}|{}", BASE64.encode(&iv), BASE64.encode(&ciphertext), BASE64.encode(mac.as_ref())))
-}
-
-/// A user test vector; only what a server holds is read from it.
-///
-/// Ref: <https://github.com/bitwarden/sdk-internal/blob/ee307a55d5604e96b983595c6379cc9f76ca2f87/e2e/wasm/vectors/load.ts>
-#[derive(Deserialize)]
-#[serde(rename_all = "camelCase")]
-struct TestVector {
-    name: String,
-    account: VectorAccount,
-    unlock_methods: Vec<Value>,
-    master_password_authentication_hash: Option<String>,
-    raw_cryptographic_state: VectorRawCryptographicState,
-    #[serde(default)]
-    vault: VectorVault,
-}
-
-#[derive(Deserialize)]
-#[serde(rename_all = "camelCase")]
-struct VectorAccount {
-    email: String,
-    security_version: Option<i32>,
-    account_cryptographic_state: Value,
-}
-
-/// The public halves the vector records; its private halves are never read.
-#[derive(Deserialize)]
-#[serde(rename_all = "camelCase")]
-struct VectorRawCryptographicState {
-    public_key: String,
-    verifying_key: Option<String>,
-    user_key_id: Option<String>,
-}
-
-#[derive(Default, Deserialize)]
-struct VectorVault {
-    #[serde(default)]
-    ciphers: Vec<VectorItem>,
-    #[serde(default)]
-    folders: Vec<VectorItem>,
-    #[serde(default)]
-    sends: Vec<VectorItem>,
-}
-
-#[derive(Deserialize)]
-struct VectorItem {
-    id: String,
-    encrypted: Value,
-}
-
-/// Upstream's scene, not merged there yet:
-/// <https://github.com/bitwarden/server/blob/9614f3f54f78ad57090a1fd5228f9c2fac5cbfe2/util/Seeder/Scenes/TestVectorUserScene.cs#L43-L361>
-async fn test_vector_user_scene(vector: TestVector, play: &str, conn: &DbConn) -> ApiResult<Value> {
-    let Some(unlock) =
-        vector.unlock_methods.iter().find_map(|m| m.pointer("/masterPasswordUnlock/master_password_unlock"))
-    else {
-        err!(format!("Vector {} has no master password unlock method", vector.name.escape_debug()))
-    };
-    let Some(hash) = vector.master_password_authentication_hash.as_deref() else {
-        err!(format!("Vector {} records no master password authentication hash", vector.name.escape_debug()))
-    };
-    let (Some(wrapped_user_key), Some(salt)) = (unlock["masterKeyWrappedUserKey"].as_str(), unlock["salt"].as_str())
-    else {
-        err!("The master password unlock method has no wrapped user key or salt")
-    };
-
-    let mut user = User::new(&vector.account.email, Some(vector.name.clone()));
-    if user.master_password_salt() != salt {
-        err!("The vector's master password salt isn't its email, which is the only salt Vaultwarden supports")
-    }
-    if User::find_by_mail(&user.email, conn).await.is_some() {
-        err!("This vector is already seeded: destroy its play first, its address can't be mangled")
-    }
-
-    apply_kdf(&mut user, &unlock["kdf"])?;
-    let state = &vector.account.account_cryptographic_state;
-    let (v2, private_key) = match (state.get("V1"), state.get("V2")) {
-        (Some(v1), None) => (None, &v1["private_key"]),
-        (None, Some(v2)) => (Some(v2), &v2["private_key"]),
-        _ => err!("The account cryptographic state is neither V1 nor V2"),
-    };
-    user.private_key = Some(json_str(private_key, "private_key")?);
-    user.public_key = Some(vector.raw_cryptographic_state.public_key.clone());
-    let key_id = vector.raw_cryptographic_state.user_key_id.as_deref().or_else(|| unlock["containedKeyId"].as_str());
-    user.key_id = key_id.map(|id| serde_json::from_value::<KeyId>(json!(id))).transpose()?;
-    let signature_key_pair = match v2 {
-        Some(v2) => {
-            user.signed_public_key = Some(json_str(&v2["signed_public_key"], "signed_public_key")?);
-            user.security_state = Some(json_str(&v2["security_state"], "security_state")?);
-            user.security_version = Some(vector.account.security_version.unwrap_or(2));
-            let Some(verifying_key) = vector.raw_cryptographic_state.verifying_key.clone() else {
-                err!("A V2 vector needs its verifying key")
-            };
-            let algorithm = cose_signature_algorithm(&verifying_key)?;
-            Some((algorithm, json_str(&v2["signing_key"], "signing_key")?, verifying_key))
-        }
-        None => None,
-    };
-    user.verified_at = Some(Utc::now().naive_utc());
-    user.set_password(hash, Some(wrapped_user_key.to_owned()), false, None, conn).await?;
-    user.save(conn).await?;
-    track(play, &user.uuid);
-    if let Some((algorithm, signing_key, verifying_key)) = signature_key_pair {
-        UserSignatureKeyPair::new(user.uuid.clone(), algorithm, signing_key, verifying_key).save(conn).await?;
-    }
-
-    // The vault, already encrypted, under fresh ids
-    let mut folder_ids = HashMap::new();
-    let mut folder_ids_by_vector_id = serde_json::Map::new();
-    for folder in &vector.vault.folders {
-        let mut saved = Folder::new(user.uuid.clone(), json_str(&folder.encrypted["name"], "name")?);
-        saved.save(conn).await?;
-        folder_ids.insert(serde_json::from_value::<FolderId>(json!(folder.id))?, saved.uuid.clone());
-        folder_ids_by_vector_id.insert(folder.id.clone(), json!(saved.uuid));
-    }
-    let mut cipher_ids = serde_json::Map::new();
-    for cipher in vector.vault.ciphers {
-        let cipher_id = seed_cipher(cipher.encrypted, &user.uuid, &folder_ids, conn).await?;
-        cipher_ids.insert(cipher.id, json!(cipher_id));
-    }
-    for send in vector.vault.sends {
-        seed_send(send.encrypted, &user.uuid, conn).await?;
-    }
-
-    let response = json!({
-        "mangleMap": mangle_map(&vector.account.email, &user.email),
-        "result": {
-            "userId": user.uuid,
-            "email": user.email,
-            "cipherIds": cipher_ids,
-            "folderIds": folder_ids_by_vector_id,
-        },
-    });
-    Ok(response)
-}
-
-/// The vector's KDF: `{"pBKDF2": {"iterations"}}` or `{"argon2id": {"iterations", "memory", "parallelism"}}`.
-fn apply_kdf(user: &mut User, kdf: &Value) -> ApiResult<()> {
-    let int = |value: &Value| value.as_i64().and_then(|v| i32::try_from(v).ok());
-    if let Some(iterations) = kdf.pointer("/pBKDF2/iterations").and_then(int) {
-        user.client_kdf_type = UserKdfType::Pbkdf2 as i32;
-        user.client_kdf_iter = iterations;
-        user.client_kdf_memory = None;
-        user.client_kdf_parallelism = None;
-    } else if let Some(argon2) = kdf.get("argon2id") {
-        let Some(iterations) = int(&argon2["iterations"]) else {
-            err!("The Argon2id KDF has no iterations")
-        };
-        user.client_kdf_type = UserKdfType::Argon2id as i32;
-        user.client_kdf_iter = iterations;
-        user.client_kdf_memory = int(&argon2["memory"]);
-        user.client_kdf_parallelism = int(&argon2["parallelism"]);
-    } else {
-        err!("Unknown KDF")
-    }
-    Ok(())
-}
-
-/// The signature algorithm a COSE verifying key names in its `alg` (label 3) entry.
-fn cose_signature_algorithm(verifying_key: &str) -> ApiResult<SignatureAlgorithm> {
-    const ALG: i128 = 3;
-    const EDDSA: i128 = -8;
-    const ML_DSA_44: i128 = -48;
-
-    let Ok(bytes) = BASE64.decode(verifying_key.as_bytes()) else {
-        err!("The verifying key isn't base64")
-    };
-    let Ok(serde_cbor_2::Value::Map(entries)) = serde_cbor_2::from_slice::<serde_cbor_2::Value>(&bytes) else {
-        err!("The verifying key isn't a COSE key")
-    };
-    match entries.get(&serde_cbor_2::Value::Integer(ALG)) {
-        Some(serde_cbor_2::Value::Integer(EDDSA)) => Ok(SignatureAlgorithm::Ed25519),
-        Some(serde_cbor_2::Value::Integer(ML_DSA_44)) => Ok(SignatureAlgorithm::MlDsa44),
-        _ => err!("The verifying key's algorithm isn't Ed25519 or ML-DSA-44"),
-    }
-}
-
-/// Upstream's map from the address a scene was asked for to the one it stored.
-fn mangle_map(requested: &str, stored: &str) -> Value {
-    let mut map = serde_json::Map::new();
-    map.insert(requested.to_owned(), json!(stored));
-    Value::Object(map)
-}
-
-fn json_str(value: &Value, field: &str) -> ApiResult<String> {
-    let Some(value) = value.as_str() else {
-        err!(format!("The vector's {field} is missing"))
-    };
-    Ok(value.to_owned())
-}
-
-#[cfg(test)]
-mod tests {
-    use openssl::symm::decrypt;
-
-    use super::*;
-
-    // From sdk-internal's `test-vectors/users/v1-pbkdf2-min-iterations.json` (d9119f7af)
-    const EMAIL: &str = "v1-pbkdf2-min-iterations@test.bitwarden.com";
-    const PASSWORD: &str = "password-v1-pbkdf2-min-iterations";
-    const ITERATIONS: u32 = 5_000;
-    const AUTHENTICATION_HASH: &str = "4HcwTg4bQKEbuINCJGMqrij1yipl63Ugu/RazH2y7Qw=";
-    const WRAPPED_USER_KEY: &str = "2.tl+DrZdn+fVyBVu+0c/Gvg==|9ivOLNtKbvirNaUnkGsEtysp9de53ibTSu88HLkDOGLig3t8nhvK5JIqxSY1/ukcr2Y/Ly9OJ12tXUGjIlJ/PtIEIdYj3gZDwhAflPUwtW8=|FD5WuIvviib3yWYcI3slmqBSqMf38Z0CMwttPG1w5DY=";
-    const USER_KEY: &str = "49LghK4AVIybWSZFikb4nAn/BofxxBIoXv83EJWOP4taVMbR5XCfrbF2m/eUmfZdeFW7VybPYSGT/bmv5eeMBg==";
-
-    /// Decrypts a type 2 EncString, checking its MAC.
-    fn dec_string(enc_string: &str, enc_key: &[u8], mac_key: &[u8]) -> Vec<u8> {
-        let parts: Vec<Vec<u8>> = enc_string
-            .strip_prefix("2.")
-            .unwrap()
-            .split('|')
-            .map(|part| BASE64.decode(part.as_bytes()).unwrap())
-            .collect();
-        let [iv, ciphertext, mac] = parts.as_slice() else {
-            panic!("not three parts")
-        };
-        let key = hmac::Key::new(hmac::HMAC_SHA256, mac_key);
-        hmac::verify(&key, &[iv.as_slice(), ciphertext].concat(), mac).unwrap();
-        decrypt(Cipher::aes_256_cbc(), enc_key, Some(iv), ciphertext).unwrap()
-    }
-
-    #[test]
-    fn derives_the_vectors_keys() {
-        let master_key = pbkdf2_sha256(PASSWORD.as_bytes(), EMAIL.as_bytes(), ITERATIONS);
-        assert_eq!(BASE64.encode(&pbkdf2_sha256(&master_key, PASSWORD.as_bytes(), 1)), AUTHENTICATION_HASH);
-
-        let user_key =
-            dec_string(WRAPPED_USER_KEY, &hkdf_expand(&master_key, b"enc"), &hkdf_expand(&master_key, b"mac"));
-        assert_eq!(BASE64.encode(&user_key), USER_KEY);
-    }
-
-    #[test]
-    fn makes_keys_a_client_can_open() {
-        let keys = V1Keys::new(PASSWORD, EMAIL, ITERATIONS).unwrap();
-        assert_eq!(keys.master_password_hash, AUTHENTICATION_HASH);
-
-        let master_key = pbkdf2_sha256(PASSWORD.as_bytes(), EMAIL.as_bytes(), ITERATIONS);
-        let user_key =
-            dec_string(&keys.wrapped_user_key, &hkdf_expand(&master_key, b"enc"), &hkdf_expand(&master_key, b"mac"));
-        assert_eq!(user_key.len(), 64);
-
-        let pkcs8 = dec_string(&keys.private_key, &user_key[..32], &user_key[32..]);
-        let private_key = PKey::private_key_from_pkcs8(&pkcs8).unwrap();
-        assert_eq!(BASE64.encode(&private_key.public_key_to_der().unwrap()), keys.public_key);
-    }
-}
diff --git a/src/api/web.rs b/src/api/web.rs
index 2818b5b7..d6d8d62c 100644
--- a/src/api/web.rs
+++ b/src/api/web.rs
@@ -1,14 +1,13 @@
 use std::{
-    collections::HashMap,
     path::{Path, PathBuf},
-    sync::{Arc, LazyLock, RwLock},
+    sync::{Arc, RwLock},
 };
 
 use rocket::{
     Catcher, Route,
     fs::NamedFile,
     http::ContentType,
-    response::{Redirect, content::RawHtml as Html},
+    response::{Redirect, content::RawCss as Css, content::RawHtml as Html},
     serde::json::Json,
 };
 use serde_json::Value;
@@ -20,7 +19,7 @@ use crate::{
     crypto::sha256_hex,
     db::{
         DbConn,
-        models::{AttachmentId, CipherId, custom_roles_enabled},
+        models::{AttachmentId, CipherId},
     },
     error::Error,
     util::{Cached, EtagCached},
@@ -80,18 +79,16 @@ pub fn invalidate_css_cache() {
 }
 
 #[get("/css/vaultwarden.css")]
-fn vaultwarden_css() -> EtagCached<String> {
+fn vaultwarden_css() -> EtagCached<Css<String>> {
     // If reload_templates is false, and we already have the CSS Cached, return this
     if !CONFIG.reload_templates()
         && let Some(cached) = CSS_CACHE.read().unwrap().as_ref()
     {
-        return EtagCached::new(cached.css.clone(), ContentType::CSS, &cached.etag);
+        return EtagCached::new(Css(cached.css.clone()), &cached.etag);
     }
 
     // Else, there is either no cache, or reload_templates is true and we need to rebuild the CSS
     let css_options = json!({
-        "custom_roles_enabled": custom_roles_enabled(),
-        "email_change_allowed": CONFIG.email_change_allowed(),
         "emergency_access_allowed": CONFIG.emergency_access_allowed(),
         "load_user_scss": true,
         "mail_2fa_enabled": CONFIG._enable_email_2fa(),
@@ -149,7 +146,7 @@ fn vaultwarden_css() -> EtagCached<String> {
     }
 
     // Etag Caching will let the browser send us an etag to verify and send new content if needed
-    EtagCached::new(cached.css.clone(), ContentType::CSS, &cached.etag)
+    EtagCached::new(Css(cached.css.clone()), &cached.etag)
 }
 
 #[get("/")]
@@ -258,7 +255,7 @@ fn alive_head(_conn: DbConn) -> EmptyResult {
 // This endpoint/function is used during development and development only.
 // It allows to easily develop the admin interface by always loading the files from disk instead from a slice of bytes
 // This will only be active during a debug build and only when `RELOAD_TEMPLATES` is set to `true`
-// NOTE: Do not forget to add any new files added to the `STATIC_FILES` HashMap below!
+// NOTE: Do not forget to add any new files added to the `static_files` function below!
 #[cfg(debug_assertions)]
 #[get("/vw_static/<filename>", rank = 1)]
 pub async fn static_files_dev(filename: PathBuf) -> Option<NamedFile> {
@@ -278,61 +275,32 @@ pub async fn static_files_dev(filename: PathBuf) -> Option<NamedFile> {
     None
 }
 
-pub struct StaticFile {
-    pub content_type: ContentType,
-    pub bytes: &'static [u8],
-    pub etag: String,
-}
-
-pub static STATIC_FILES: LazyLock<HashMap<&'static str, StaticFile>> = LazyLock::new(|| {
-    [
-        ("404.png", ContentType::PNG, &include_bytes!("../static/images/404.png")[..]),
-        ("mail-github.png", ContentType::PNG, &include_bytes!("../static/images/mail-github.png")[..]),
-        ("logo-gray.png", ContentType::PNG, &include_bytes!("../static/images/logo-gray.png")[..]),
-        ("error-x.svg", ContentType::SVG, &include_bytes!("../static/images/error-x.svg")[..]),
-        ("hibp.png", ContentType::PNG, &include_bytes!("../static/images/hibp.png")[..]),
-        ("vaultwarden-icon.png", ContentType::PNG, &include_bytes!("../static/images/vaultwarden-icon.png")[..]),
-        ("vaultwarden-favicon.png", ContentType::PNG, &include_bytes!("../static/images/vaultwarden-favicon.png")[..]),
-        ("404.css", ContentType::CSS, &include_bytes!("../static/scripts/404.css")[..]),
-        ("admin.css", ContentType::CSS, &include_bytes!("../static/scripts/admin.css")[..]),
-        ("admin.js", ContentType::JavaScript, &include_bytes!("../static/scripts/admin.js")[..]),
-        ("admin_settings.js", ContentType::JavaScript, &include_bytes!("../static/scripts/admin_settings.js")[..]),
-        ("admin_users.js", ContentType::JavaScript, &include_bytes!("../static/scripts/admin_users.js")[..]),
-        (
-            "admin_organizations.js",
-            ContentType::JavaScript,
-            &include_bytes!("../static/scripts/admin_organizations.js")[..],
-        ),
-        (
-            "admin_diagnostics.js",
-            ContentType::JavaScript,
-            &include_bytes!("../static/scripts/admin_diagnostics.js")[..],
-        ),
-        ("bootstrap.css", ContentType::CSS, &include_bytes!("../static/scripts/bootstrap.css")[..]),
-        ("bootstrap.bundle.js", ContentType::JavaScript, &include_bytes!("../static/scripts/bootstrap.bundle.js")[..]),
-        ("jdenticon-3.3.0.js", ContentType::JavaScript, &include_bytes!("../static/scripts/jdenticon-3.3.0.js")[..]),
-        ("datatables.js", ContentType::JavaScript, &include_bytes!("../static/scripts/datatables.js")[..]),
-        ("datatables.css", ContentType::CSS, &include_bytes!("../static/scripts/datatables.css")[..]),
-    ]
-    .into_iter()
-    .map(|(name, content_type, bytes)| {
-        (
-            name,
-            StaticFile {
-                content_type,
-                bytes,
-                etag: sha256_hex(bytes),
-            },
-        )
-    })
-    .collect()
-});
-
 #[get("/vw_static/<filename>", rank = 2)]
-pub fn static_files(filename: &str) -> Result<EtagCached<&'static [u8]>, Error> {
-    if let Some(file) = STATIC_FILES.get(filename) {
-        Ok(EtagCached::new(file.bytes, file.content_type.clone(), &file.etag))
-    } else {
-        err!(format!("Static file not found: {}", filename.escape_debug()))
+pub fn static_files(filename: &str) -> Result<(ContentType, &'static [u8]), Error> {
+    match filename {
+        "404.png" => Ok((ContentType::PNG, include_bytes!("../static/images/404.png"))),
+        "mail-github.png" => Ok((ContentType::PNG, include_bytes!("../static/images/mail-github.png"))),
+        "logo-gray.png" => Ok((ContentType::PNG, include_bytes!("../static/images/logo-gray.png"))),
+        "error-x.svg" => Ok((ContentType::SVG, include_bytes!("../static/images/error-x.svg"))),
+        "hibp.png" => Ok((ContentType::PNG, include_bytes!("../static/images/hibp.png"))),
+        "vaultwarden-icon.png" => Ok((ContentType::PNG, include_bytes!("../static/images/vaultwarden-icon.png"))),
+        "vaultwarden-favicon.png" => Ok((ContentType::PNG, include_bytes!("../static/images/vaultwarden-favicon.png"))),
+        "404.css" => Ok((ContentType::CSS, include_bytes!("../static/scripts/404.css"))),
+        "admin.css" => Ok((ContentType::CSS, include_bytes!("../static/scripts/admin.css"))),
+        "admin.js" => Ok((ContentType::JavaScript, include_bytes!("../static/scripts/admin.js"))),
+        "admin_settings.js" => Ok((ContentType::JavaScript, include_bytes!("../static/scripts/admin_settings.js"))),
+        "admin_users.js" => Ok((ContentType::JavaScript, include_bytes!("../static/scripts/admin_users.js"))),
+        "admin_organizations.js" => {
+            Ok((ContentType::JavaScript, include_bytes!("../static/scripts/admin_organizations.js")))
+        }
+        "admin_diagnostics.js" => {
+            Ok((ContentType::JavaScript, include_bytes!("../static/scripts/admin_diagnostics.js")))
+        }
+        "bootstrap.css" => Ok((ContentType::CSS, include_bytes!("../static/scripts/bootstrap.css"))),
+        "bootstrap.bundle.js" => Ok((ContentType::JavaScript, include_bytes!("../static/scripts/bootstrap.bundle.js"))),
+        "jdenticon-3.3.0.js" => Ok((ContentType::JavaScript, include_bytes!("../static/scripts/jdenticon-3.3.0.js"))),
+        "datatables.js" => Ok((ContentType::JavaScript, include_bytes!("../static/scripts/datatables.js"))),
+        "datatables.css" => Ok((ContentType::CSS, include_bytes!("../static/scripts/datatables.css"))),
+        _ => err!(format!("Static file not found: {filename}")),
     }
 }
diff --git a/src/auth.rs b/src/auth.rs
index fec9bad6..8f4d0ada 100644
--- a/src/auth.rs
+++ b/src/auth.rs
@@ -1,6 +1,3 @@
-#[path = "auth/two_factor.rs"]
-pub mod two_factor;
-
 #[path = "auth/send.rs"]
 pub mod send;
 pub type SendTokens = send::SendTokens;
@@ -17,7 +14,6 @@ use ipnet::IpNet;
 use jsonwebtoken::{Algorithm, DecodingKey, EncodingKey, Header, errors::ErrorKind};
 use num_traits::FromPrimitive;
 use openssl::rsa::Rsa;
-use ring::hmac;
 use serde::{de::DeserializeOwned, ser::Serialize};
 
 use rocket::{
@@ -32,9 +28,9 @@ use crate::{
     db::{
         DbConn,
         models::{
-            AttachmentId, CipherId, Collection, CollectionId, CustomPermission, Device, DeviceId, DeviceType,
-            EmergencyAccessId, EventType, Membership, MembershipId, MembershipStatus, MembershipType, OrgApiKeyId,
-            OrganizationId, SendFileId, SendId, User, UserId, custom_roles_enabled,
+            AttachmentId, CipherId, Collection, CollectionId, Device, DeviceId, DeviceType, EmergencyAccessId,
+            EventType, Membership, MembershipId, MembershipStatus, MembershipType, OrgApiKeyId, OrganizationId,
+            SendFileId, SendId, User, UserId,
         },
     },
     error::Error,
@@ -69,7 +65,6 @@ static JWT_2FA_REMEMBER_ISSUER: LazyLock<String> = LazyLock::new(|| format!("{}|
 
 static PRIVATE_RSA_KEY: OnceLock<EncodingKey> = OnceLock::new();
 static PUBLIC_RSA_KEY: OnceLock<DecodingKey> = OnceLock::new();
-static PRELOGIN_KDF_KEY: OnceLock<hmac::Key> = OnceLock::new();
 
 pub async fn initialize_keys() -> Result<(), Error> {
     use std::io::Error as IoError;
@@ -104,22 +99,9 @@ pub async fn initialize_keys() -> Result<(), Error> {
     if PUBLIC_RSA_KEY.set(dec).is_err() {
         err!("PUBLIC_RSA_KEY must only be initialized once")
     }
-
-    // Derived from the RSA key, so it stays the same across restarts without storing another secret
-    let prelogin_kdf_key = hmac::sign(&hmac::Key::new(hmac::HMAC_SHA256, &priv_key_buffer), b"prelogin-kdf");
-    if PRELOGIN_KDF_KEY.set(hmac::Key::new(hmac::HMAC_SHA256, prelogin_kdf_key.as_ref())).is_err() {
-        err!("PRELOGIN_KDF_KEY must only be initialized once")
-    }
     Ok(())
 }
 
-/// Returns an index in `0..len` derived from the email, the same for every request
-pub fn prelogin_kdf_index(email: &str, len: usize) -> usize {
-    let tag = hmac::sign(PRELOGIN_KDF_KEY.wait(), email.as_bytes());
-    let tag = tag.as_ref();
-    usize::from(u16::from_be_bytes([tag[0], tag[1]])) % len
-}
-
 pub fn encode_jwt<T: Serialize>(claims: &T) -> String {
     match jsonwebtoken::encode(&JWT_HEADER, claims, PRIVATE_RSA_KEY.wait()) {
         Ok(token) => token,
@@ -271,7 +253,7 @@ impl LoginJwtClaims {
             premium: true,
             name: user.name.clone(),
             email: user.email.clone(),
-            email_verified: user.verified(),
+            email_verified: !CONFIG.mail_enabled() || user.verified_at.is_some(),
 
             // ---
             // Disabled these keys to be added to the JWT since they could cause the JWT to get too large
@@ -314,17 +296,6 @@ impl LoginJwtClaims {
     }
 }
 
-fn calculate_invite_expire_hours(now: &DateTime<Utc>) -> Result<DateTime<Utc>, Error> {
-    let expire_hours = i64::from(CONFIG.invitation_expiration_hours());
-    let Some(hours_delta) = TimeDelta::try_hours(expire_hours) else {
-        err!("Unable to calculate time delta for invite expire hours. Check `INVITATION_EXPIRATION_HOURS`.");
-    };
-    let Some(exp) = now.checked_add_signed(hours_delta) else {
-        err!("Unable to calculate invitation expire date. Check `INVITATION_EXPIRATION_HOURS`.");
-    };
-    Ok(exp)
-}
-
 #[derive(Debug, Serialize, Deserialize)]
 pub struct InviteJwtClaims {
     // Not before
@@ -348,19 +319,19 @@ pub fn generate_invite_claims(
     org_id: OrganizationId,
     member_id: MembershipId,
     invited_by_email: Option<String>,
-) -> Result<InviteJwtClaims, Error> {
+) -> InviteJwtClaims {
     let time_now = Utc::now();
-    let exp = calculate_invite_expire_hours(&time_now)?;
-    Ok(InviteJwtClaims {
+    let expire_hours = i64::from(CONFIG.invitation_expiration_hours());
+    InviteJwtClaims {
         nbf: time_now.timestamp(),
-        exp: exp.timestamp(),
+        exp: (time_now + TimeDelta::try_hours(expire_hours).unwrap()).timestamp(),
         iss: JWT_INVITE_ISSUER.to_string(),
         sub: user_id,
         email,
         org_id,
         member_id,
         invited_by_email,
-    })
+    }
 }
 
 #[derive(Debug, Serialize, Deserialize)]
@@ -386,19 +357,19 @@ pub fn generate_emergency_access_invite_claims(
     emer_id: EmergencyAccessId,
     grantor_name: String,
     grantor_email: String,
-) -> Result<EmergencyAccessInviteJwtClaims, Error> {
+) -> EmergencyAccessInviteJwtClaims {
     let time_now = Utc::now();
-    let exp = calculate_invite_expire_hours(&time_now)?;
-    Ok(EmergencyAccessInviteJwtClaims {
+    let expire_hours = i64::from(CONFIG.invitation_expiration_hours());
+    EmergencyAccessInviteJwtClaims {
         nbf: time_now.timestamp(),
-        exp: exp.timestamp(),
+        exp: (time_now + TimeDelta::try_hours(expire_hours).unwrap()).timestamp(),
         iss: JWT_EMERGENCY_ACCESS_INVITE_ISSUER.to_string(),
         sub: user_id,
         email,
         emer_id,
         grantor_name,
         grantor_email,
-    })
+    }
 }
 
 #[derive(Debug, Serialize, Deserialize)]
@@ -451,7 +422,7 @@ pub fn generate_file_download_claims(cipher_id: CipherId, file_id: AttachmentId)
     let time_now = Utc::now();
     FileDownloadClaims {
         nbf: time_now.timestamp(),
-        exp: (time_now + TimeDelta::try_minutes(1).unwrap()).timestamp(),
+        exp: (time_now + TimeDelta::try_minutes(5).unwrap()).timestamp(),
         iss: JWT_FILE_DOWNLOAD_ISSUER.to_string(),
         sub: cipher_id,
         file_id,
@@ -503,17 +474,13 @@ pub fn generate_2fa_remember_claims(device_uuid: DeviceId, user_uuid: UserId) ->
     let time_now = Utc::now();
     TwoFactorRememberClaims {
         nbf: time_now.timestamp(),
-        exp: two_factor_remember_expiration(time_now, CONFIG.two_factor_remember_days()),
+        exp: (time_now + TimeDelta::try_days(30).unwrap()).timestamp(),
         iss: JWT_2FA_REMEMBER_ISSUER.to_string(),
         sub: device_uuid,
         user_uuid,
     }
 }
 
-fn two_factor_remember_expiration(time_now: DateTime<Utc>, remember_days: i64) -> i64 {
-    (time_now + TimeDelta::try_days(remember_days).expect("TWO_FACTOR_REMEMBER_DAYS is validated")).timestamp()
-}
-
 #[derive(Debug, Serialize, Deserialize)]
 pub struct BasicJwtClaims {
     // Not before
@@ -536,43 +503,36 @@ impl BasicJwtClaims {
     }
 }
 
-pub fn generate_delete_claims(uuid: String) -> Result<BasicJwtClaims, Error> {
+pub fn generate_delete_claims(uuid: String) -> BasicJwtClaims {
     let time_now = Utc::now();
-    let exp = calculate_invite_expire_hours(&time_now)?;
-    Ok(BasicJwtClaims {
+    let expire_hours = i64::from(CONFIG.invitation_expiration_hours());
+    BasicJwtClaims {
         nbf: time_now.timestamp(),
-        exp: exp.timestamp(),
+        exp: (time_now + TimeDelta::try_hours(expire_hours).unwrap()).timestamp(),
         iss: JWT_DELETE_ISSUER.to_string(),
         sub: uuid,
-    })
+    }
 }
 
-pub fn generate_verify_email_claims(user_id: &UserId) -> Result<BasicJwtClaims, Error> {
+pub fn generate_verify_email_claims(user_id: &UserId) -> BasicJwtClaims {
     let time_now = Utc::now();
-    let exp = calculate_invite_expire_hours(&time_now)?;
-    Ok(BasicJwtClaims {
+    let expire_hours = i64::from(CONFIG.invitation_expiration_hours());
+    BasicJwtClaims {
         nbf: time_now.timestamp(),
-        exp: exp.timestamp(),
+        exp: (time_now + TimeDelta::try_hours(expire_hours).unwrap()).timestamp(),
         iss: JWT_VERIFYEMAIL_ISSUER.to_string(),
         sub: user_id.to_string(),
-    })
+    }
 }
 
-pub fn generate_admin_claims() -> Result<BasicJwtClaims, Error> {
+pub fn generate_admin_claims() -> BasicJwtClaims {
     let time_now = Utc::now();
-    let lifetime_minutes = i64::from(CONFIG.admin_session_lifetime());
-    let Some(minutes_delta) = TimeDelta::try_minutes(lifetime_minutes) else {
-        err!("Unable to calculate time delta for admin session lifetime. Check `ADMIN_SESSION_LIFETIME`.");
-    };
-    let Some(exp) = time_now.checked_add_signed(minutes_delta) else {
-        err!("Unable to calculate admin session lifetime. Check `ADMIN_SESSION_LIFETIME`.");
-    };
-    Ok(BasicJwtClaims {
+    BasicJwtClaims {
         nbf: time_now.timestamp(),
-        exp: exp.timestamp(),
+        exp: (time_now + TimeDelta::try_minutes(CONFIG.admin_session_lifetime()).unwrap()).timestamp(),
         iss: JWT_ADMIN_ISSUER.to_string(),
         sub: "admin_panel".to_owned(),
-    })
+    }
 }
 
 pub fn generate_send_claims(send_id: &SendId, file_id: &SendFileId) -> BasicJwtClaims {
@@ -632,9 +592,6 @@ impl<'r> FromRequest<'r> for Host {
 pub struct ClientHeaders {
     pub device_type: i32,
     pub ip: ClientIp,
-    /// `Bitwarden-Client-Version`, `None` when missing or not a version. Unlike the [`ClientVersion`] guard, this
-    /// doesn't log an error, as not every client sends it.
-    pub client_version: Option<semver::Version>,
 }
 
 #[rocket::async_trait]
@@ -651,13 +608,10 @@ impl<'r> FromRequest<'r> for ClientHeaders {
             .get_one("device-type")
             .and_then(|d| d.parse().ok())
             .unwrap_or(DeviceType::UnknownBrowser as i32);
-        let client_version =
-            request.headers().get_one("Bitwarden-Client-Version").and_then(|v| semver::Version::parse(v).ok());
 
         Outcome::Success(ClientHeaders {
             device_type,
             ip,
-            client_version,
         })
     }
 }
@@ -717,7 +671,8 @@ impl<'r> FromRequest<'r> for Headers {
                 err_handler!("Error getting current route for stamp exception")
             };
 
-            // Expired exceptions are only dropped on reset; writing them back here could undo a newer reset
+            // Expired exceptions are dropped the next time the stamp is reset, not here: writing them
+            // back from this request could undo a reset made since the user was read.
             if !user.stamp_exceptions().iter().any(|e| e.allows(&claims.sstamp, current_route)) {
                 err_handler!("Invalid security stamp")
             }
@@ -757,12 +712,6 @@ impl OrgHeaders {
     fn is_confirmed_and_owner(&self) -> bool {
         self.membership_status == MembershipStatus::Confirmed && self.membership_type == MembershipType::Owner
     }
-    // A Custom member, while Custom roles are enabled. What they may do depends on their permissions.
-    fn is_confirmed_and_custom(&self) -> bool {
-        self.membership_status == MembershipStatus::Confirmed
-            && self.membership_type == MembershipType::Custom
-            && custom_roles_enabled()
-    }
 }
 
 // org_id is usually the second path param ("/organizations/<org_id>"),
@@ -882,51 +831,6 @@ impl<'r> FromRequest<'r> for AdminHeaders {
     }
 }
 
-/// Generates the request guard of the routes a Custom member may use with a permission. Like AdminHeaders it lets a
-/// confirmed Owner or Admin through, and a confirmed Custom member holding the permission.
-macro_rules! permission_headers {
-    ($(#[$doc:meta])* $name:ident, $permission:expr) => {
-        $(#[$doc])*
-        pub struct $name {
-            pub device: Device,
-            pub user: User,
-            pub membership_type: MembershipType,
-            pub membership: Membership,
-            pub ip: ClientIp,
-            pub org_id: OrganizationId,
-        }
-
-        #[rocket::async_trait]
-        impl<'r> FromRequest<'r> for $name {
-            type Error = &'static str;
-
-            async fn from_request(request: &'r Request<'_>) -> Outcome<Self, Self::Error> {
-                let headers = try_outcome!(OrgHeaders::from_request(request).await);
-                if headers.is_confirmed_and_admin() || headers.membership.has_custom_permission($permission) {
-                    Outcome::Success(Self {
-                        device: headers.device,
-                        user: headers.user,
-                        membership_type: headers.membership_type,
-                        org_id: headers.membership.org_uuid.clone(),
-                        membership: headers.membership,
-                        ip: headers.ip,
-                    })
-                } else {
-                    // Forbidden as in Bitwarden's permission requirements
-                    error!(target: "auth", "The current user is missing the permission for this endpoint");
-                    Outcome::Error((rocket::http::Status::Forbidden, "You don't have permission to call this endpoint"))
-                }
-            }
-        }
-    };
-}
-
-permission_headers!(
-    /// For the routes that manage the members of an organization.
-    ManageUsersHeaders,
-    CustomPermission::ManageUsers
-);
-
 // col_id is usually the fourth path param ("/organizations/<org_id>/collections/<col_id>"),
 // but there could be cases where it is a query value.
 // First check the path, if this is not a valid uuid, try the query values.
@@ -946,143 +850,62 @@ fn get_col_id(request: &Request<'_>) -> Option<CollectionId> {
     None
 }
 
-/// What a collection route does with its collection, which decides what a Custom member needs for it.
-#[derive(Clone, Copy)]
-pub enum CollectionAction {
-    Edit,
-    Read,
-    ReadAccess,
-    Delete,
+/// The ManagerHeaders are used to check if you are at least a Manager
+/// and have access to the specific collection provided via the <col_id>/collections/collectionId.
+/// This does strict checking on the collection_id, ManagerHeadersLoose does not.
+pub struct ManagerHeaders {
+    pub host: String,
+    pub device: Device,
+    pub user: User,
+    pub ip: ClientIp,
+    pub org_id: OrganizationId,
 }
 
-/// Whether `member`, a confirmed Custom member, may `action` the collection `col_id` of their organization.
-///
-/// Deleting needs Delete any collection: the clients are told collection deletion is limited, so the manage option
-/// on a collection is no permission to delete it. Editing is open with Edit any collection, reading also with Delete
-/// any collection, and otherwise both need the manage option on the collection itself. Neither the role nor any
-/// `access_all` counts as that.
-pub async fn custom_member_may(
-    action: CollectionAction,
-    member: &Membership,
-    col_id: &CollectionId,
-    conn: &DbConn,
-) -> bool {
-    if !(member.has_type(MembershipType::Custom)
-        && member.has_status(MembershipStatus::Confirmed)
-        && custom_roles_enabled())
-    {
-        return false;
-    }
-    match action {
-        CollectionAction::Delete => member.has_custom_permission(CustomPermission::DeleteAnyCollection),
-        CollectionAction::Edit if member.can_edit_any_collection() => true,
-        // Individual access details may be read with Manage users. The separate /users route follows
-        // Bitwarden's ReadAccess operation, which does not grant that permission on its own.
-        CollectionAction::Read if member.can_view_all_collection_access_details() => true,
-        CollectionAction::ReadAccess if member.can_view_all_collections() => true,
-        CollectionAction::Edit | CollectionAction::Read | CollectionAction::ReadAccess => {
-            Collection::find_explicitly_manageable_by_user(&member.org_uuid, &member.user_uuid, conn)
-                .await
-                .contains(col_id)
-        }
-    }
-}
+#[rocket::async_trait]
+impl<'r> FromRequest<'r> for ManagerHeaders {
+    type Error = &'static str;
 
-/// Checks a collection route for the collection provided via the <col_id>/collections/collectionId: a Manager, Admin
-/// or Owner needs to be able to manage the collection, a Custom member is checked for the `action`.
-async fn collection_headers(request: &Request<'_>, action: CollectionAction) -> Outcome<OrgHeaders, &'static str> {
-    let headers = try_outcome!(OrgHeaders::from_request(request).await);
-    let is_custom = headers.is_confirmed_and_custom();
-    if !headers.is_confirmed_and_manager() && !is_custom {
-        err_handler!("You need to be a Manager, Admin or Owner to call this endpoint")
-    }
+    async fn from_request(request: &'r Request<'_>) -> Outcome<Self, Self::Error> {
+        let headers = try_outcome!(OrgHeaders::from_request(request).await);
+        if headers.is_confirmed_and_manager() {
+            if let Some(col_id) = get_col_id(request) {
+                let Outcome::Success(conn) = DbConn::from_request(request).await else {
+                    err_handler!("Error getting DB")
+                };
 
-    let Some(col_id) = get_col_id(request) else {
-        err_handler!("Error getting the collection id")
-    };
-    let Outcome::Success(conn) = DbConn::from_request(request).await else {
-        err_handler!("Error getting DB")
-    };
-
-    let allowed = if is_custom {
-        custom_member_may(action, &headers.membership, &col_id, &conn).await
-    } else {
-        Collection::is_coll_manageable_by_user(&col_id, &headers.membership.user_uuid, &conn).await
-    };
-    if !allowed {
-        // NotFound as in Bitwarden, the web vault logs the user out on a 401
-        error!(target: "auth", "Collection not found. The current user isn't a manager for this collection");
-        return Outcome::Error((rocket::http::Status::NotFound, "Collection not found"));
-    }
-    Outcome::Success(headers)
-}
-
-macro_rules! collection_headers {
-    ($(#[$doc:meta])* $name:ident, $action:expr) => {
-        $(#[$doc])*
-        pub struct $name {
-            pub host: String,
-            pub device: Device,
-            pub user: User,
-            pub ip: ClientIp,
-            pub org_id: OrganizationId,
-        }
-
-        #[rocket::async_trait]
-        impl<'r> FromRequest<'r> for $name {
-            type Error = &'static str;
-
-            async fn from_request(request: &'r Request<'_>) -> Outcome<Self, Self::Error> {
-                let headers = try_outcome!(collection_headers(request, $action).await);
-                Outcome::Success(Self {
-                    host: headers.host,
-                    device: headers.device,
-                    user: headers.user,
-                    ip: headers.ip,
-                    org_id: headers.membership.org_uuid,
-                })
-            }
-        }
-
-        impl From<$name> for Headers {
-            fn from(h: $name) -> Headers {
-                Headers {
-                    host: h.host,
-                    device: h.device,
-                    user: h.user,
-                    ip: h.ip,
+                if !Collection::is_coll_manageable_by_user(&col_id, &headers.membership.user_uuid, &conn).await {
+                    err_handler!("The current user isn't a manager for this collection")
                 }
+            } else {
+                err_handler!("Error getting the collection id")
             }
+
+            Outcome::Success(Self {
+                host: headers.host,
+                device: headers.device,
+                user: headers.user,
+                ip: headers.ip,
+                org_id: headers.membership.org_uuid,
+            })
+        } else {
+            err_handler!("You need to be a Manager, Admin or Owner to call this endpoint")
         }
-    };
+    }
 }
 
-collection_headers!(
-    /// The ManagerHeaders are used to check if you are at least a Manager
-    /// and have access to the specific collection provided via the <col_id>/collections/collectionId.
-    /// This does strict checking on the collection_id, ManagerHeadersLoose does not.
-    ManagerHeaders,
-    CollectionAction::Edit
-);
-collection_headers!(
-    /// The same as ManagerHeaders, for the routes which only read the collection and its access.
-    CollectionReadHeaders,
-    CollectionAction::Read
-);
-collection_headers!(
-    /// The collection's /users route has narrower access than its /details route.
-    CollectionUsersReadHeaders,
-    CollectionAction::ReadAccess
-);
-collection_headers!(
-    /// The same as ManagerHeaders, for the routes which delete the collection.
-    CollectionDeleteHeaders,
-    CollectionAction::Delete
-);
+impl From<ManagerHeaders> for Headers {
+    fn from(h: ManagerHeaders) -> Headers {
+        Headers {
+            host: h.host,
+            device: h.device,
+            user: h.user,
+            ip: h.ip,
+        }
+    }
+}
 
 /// The ManagerHeadersLoose is used when you at least need to be a Manager,
 /// but there is no collection_id sent with the request (either in the path or as form data).
-/// A Custom member is let through as well, the routes check what their permissions allow.
 pub struct ManagerHeadersLoose {
     pub host: String,
     pub device: Device,
@@ -1097,7 +920,7 @@ impl<'r> FromRequest<'r> for ManagerHeadersLoose {
 
     async fn from_request(request: &'r Request<'_>) -> Outcome<Self, Self::Error> {
         let headers = try_outcome!(OrgHeaders::from_request(request).await);
-        if headers.is_confirmed_and_manager() || headers.is_confirmed_and_custom() {
+        if headers.is_confirmed_and_manager() {
             Outcome::Success(Self {
                 host: headers.host,
                 device: headers.device,
@@ -1122,29 +945,22 @@ impl From<ManagerHeadersLoose> for Headers {
     }
 }
 
-impl CollectionDeleteHeaders {
+impl ManagerHeaders {
     pub async fn from_loose(
         h: ManagerHeadersLoose,
         collections: &Vec<CollectionId>,
         conn: &DbConn,
-    ) -> Result<CollectionDeleteHeaders, Error> {
-        let is_custom = h.membership.has_type(MembershipType::Custom) && custom_roles_enabled();
+    ) -> Result<ManagerHeaders, Error> {
         for col_id in collections {
             if uuid::Uuid::parse_str(col_id.as_ref()).is_err() {
                 err!("Collection Id is malformed!");
             }
-            let allowed = if is_custom {
-                Collection::find_by_uuid_and_org(col_id, &h.membership.org_uuid, conn).await.is_some()
-                    && custom_member_may(CollectionAction::Delete, &h.membership, col_id, conn).await
-            } else {
-                Collection::is_coll_manageable_by_user(col_id, &h.membership.user_uuid, conn).await
-            };
-            if !allowed {
+            if !Collection::is_coll_manageable_by_user(col_id, &h.membership.user_uuid, conn).await {
                 err!("Collection not found", "The current user isn't a manager for this collection")
             }
         }
 
-        Ok(CollectionDeleteHeaders {
+        Ok(ManagerHeaders {
             host: h.host,
             device: h.device,
             user: h.user,
@@ -1257,31 +1073,6 @@ fn ip_header_is_trusted(remote: Option<IpAddr>) -> bool {
     trusted.split(',').filter_map(parse_trusted_proxy).any(|net| net.contains(&remote))
 }
 
-/// Each proxy appends the address it received the request from to a list header (`X-Forwarded-For: client, proxy1`).
-/// Like ASP.NET's ForwardedHeaders, walk the entries of every occurrence of the header from the right and take the
-/// first one that isn't a trusted proxy. If they all are, the leftmost one is the client.
-fn client_ip_from_header(req: &Request<'_>, header: &str, is_trusted: impl Fn(IpAddr) -> bool) -> Option<IpAddr> {
-    let values: Vec<&str> = req.headers().get(header).collect();
-    client_ip_from_header_values(&values, header, is_trusted)
-}
-
-fn client_ip_from_header_values(values: &[&str], header: &str, is_trusted: impl Fn(IpAddr) -> bool) -> Option<IpAddr> {
-    let entries: Vec<&str> = values.iter().flat_map(|value| value.split(',')).map(str::trim).collect();
-
-    let mut client_ip = None;
-    for entry in entries.into_iter().rev() {
-        let Ok(ip) = entry.parse() else {
-            warn!("'{header}' header is malformed: {entry}");
-            break;
-        };
-        client_ip = Some(ip);
-        if !is_trusted(ip) {
-            break;
-        }
-    }
-    client_ip
-}
-
 #[rocket::async_trait]
 impl<'r> FromRequest<'r> for ClientIp {
     type Error = ();
@@ -1290,7 +1081,15 @@ impl<'r> FromRequest<'r> for ClientIp {
         let remote = req.remote().map(|r| r.ip());
 
         let ip = if CONFIG._ip_header_enabled() && ip_header_is_trusted(remote) {
-            client_ip_from_header(req, &CONFIG.ip_header(), |ip| ip_header_is_trusted(Some(ip)))
+            req.headers().get_one(&CONFIG.ip_header()).and_then(|ip| {
+                match ip.find(',') {
+                    Some(idx) => &ip[..idx],
+                    None => ip,
+                }
+                .parse()
+                .map_err(|_| warn!("'{}' header is malformed: {ip}", CONFIG.ip_header()))
+                .ok()
+            })
         } else {
             if CONFIG._ip_header_enabled() && req.headers().get_one(&CONFIG.ip_header()).is_some() {
                 // Log the canonical IP, which is what the user filter will need to match against
@@ -1409,7 +1208,7 @@ impl AuthMethod {
         match scope {
             None => err!("Missing scope"),
             Some(scope) if scope == &method_scope => Ok(method_scope),
-            Some(scope) => err!(format!("Scope ({}) not supported", scope.escape_debug())),
+            Some(scope) => err!(format!("Scope ({scope}) not supported")),
         }
     }
 }
@@ -1528,52 +1327,3 @@ pub async fn refresh_tokens(
 
     Ok((device, auth_tokens))
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn client_ip(values: &[&str]) -> Option<IpAddr> {
-        let is_trusted = |ip: IpAddr| match ip {
-            IpAddr::V4(v4) => v4.is_private() || v4.is_loopback(),
-            IpAddr::V6(v6) => v6.is_loopback(),
-        };
-        client_ip_from_header_values(values, "X-Forwarded-For", is_trusted)
-    }
-
-    fn ip(s: &str) -> Option<IpAddr> {
-        Some(s.parse().unwrap())
-    }
-
-    #[test]
-    fn ip_header_single_value() {
-        assert_eq!(client_ip(&["203.0.113.5"]), ip("203.0.113.5"));
-        assert_eq!(client_ip(&["10.0.0.7"]), ip("10.0.0.7"));
-        assert_eq!(client_ip(&["2001:db8::1"]), ip("2001:db8::1"));
-    }
-
-    #[test]
-    fn ip_header_uses_rightmost_untrusted_entry() {
-        // Entries already in the request come before the one the proxy appended
-        assert_eq!(client_ip(&["198.51.100.1, 203.0.113.5"]), ip("203.0.113.5"));
-        // Trusted proxies on the right are skipped
-        assert_eq!(client_ip(&["198.51.100.1, 203.0.113.5, 10.0.0.2, 127.0.0.1"]), ip("203.0.113.5"));
-        // All trusted, so the leftmost entry is the client
-        assert_eq!(client_ip(&["192.168.1.10, 10.0.0.2"]), ip("192.168.1.10"));
-    }
-
-    #[test]
-    fn ip_header_reads_every_occurrence() {
-        assert_eq!(client_ip(&["198.51.100.1", "203.0.113.5"]), ip("203.0.113.5"));
-        assert_eq!(client_ip(&["198.51.100.1", "203.0.113.5, 10.0.0.2"]), ip("203.0.113.5"));
-    }
-
-    #[test]
-    fn ip_header_malformed_entries() {
-        assert_eq!(client_ip(&[]), None);
-        assert_eq!(client_ip(&[""]), None);
-        assert_eq!(client_ip(&["203.0.113.5, not-an-ip"]), None);
-        // Stops at the malformed entry and keeps the closest proxy
-        assert_eq!(client_ip(&["not-an-ip, 10.0.0.2"]), ip("10.0.0.2"));
-    }
-}
diff --git a/src/auth/send.rs b/src/auth/send.rs
index 85b91d99..2554488a 100644
--- a/src/auth/send.rs
+++ b/src/auth/send.rs
@@ -72,14 +72,10 @@ impl SendTokens {
         conn: &DbConn,
     ) -> ApiResult<SendTokens> {
         let Some(send_id) = Self::as_send_id(access_id) else {
-            return Self::invalid_error(
-                &format!("Can't convert {}", access_id.escape_debug()),
-                "send_id_invalid",
-                false,
-            );
+            return Self::invalid_error(&format!("Can't convert {access_id}"), "send_id_invalid", false);
         };
 
-        let Some(send) = Send::find_by_uuid(&send_id, conn).await else {
+        let Some(mut send) = Send::find_by_uuid(&send_id, conn).await else {
             return Self::invalid_error(&format!("Can't find {send_id}"), "send_id_invalid", false);
         };
 
@@ -107,6 +103,10 @@ impl SendTokens {
             }
         }
 
+        if !send.register_access(conn).await? {
+            return Self::invalid_error(&format!("Send {send_id}, max access reached"), "send_id_invalid", true);
+        }
+
         Ok(Self {
             access_claims: generate_send_access_claims(&send_id),
         })
diff --git a/src/auth/two_factor.rs b/src/auth/two_factor.rs
deleted file mode 100644
index 533c0cf4..00000000
--- a/src/auth/two_factor.rs
+++ /dev/null
@@ -1,281 +0,0 @@
-use chrono::{TimeDelta, Utc};
-use serde::{de::DeserializeOwned, ser::Serialize};
-use std::sync::LazyLock;
-
-use crate::{
-    CONFIG,
-    api::{ApiResult, EmptyResult},
-    auth::{decode_jwt, encode_jwt},
-    db::models::UserId,
-};
-
-static JWT_2FA_AUTH_ISSUER: LazyLock<String> = LazyLock::new(|| format!("{}|api.2fa", CONFIG.domain_origin()));
-
-#[derive(Serialize, Deserialize)]
-pub struct TwoFactorClaims<T> {
-    // Not before
-    pub nbf: i64,
-    // Expiration time
-    pub exp: i64,
-    // Issuer
-    pub iss: String,
-    // Subject
-    pub sub: UserId,
-
-    pub enabled: bool,
-
-    pub claims: T,
-}
-
-#[derive(Serialize, Deserialize)]
-#[serde(deny_unknown_fields)]
-pub struct AuthenticatorClaims {
-    #[serde(rename = "authenticator_key")]
-    pub key: String,
-}
-
-#[derive(Serialize, Deserialize)]
-#[serde(deny_unknown_fields)]
-pub struct DuoClaims {
-    #[serde(rename = "duo_data")]
-    pub data: Option<DuoData>,
-}
-
-#[derive(Serialize, Deserialize)]
-#[serde(deny_unknown_fields)]
-pub struct WebauthnClaims {
-    #[serde(rename = "webauthn_keys")]
-    pub keys: Vec<i32>,
-}
-
-#[derive(Serialize, Deserialize)]
-#[serde(deny_unknown_fields)]
-pub struct YubikeyClaims {
-    #[serde(rename = "yubi_keys")]
-    pub keys: Vec<String>,
-}
-
-#[derive(Serialize, Deserialize, PartialEq)]
-pub struct DuoData {
-    pub host: String, // Duo API hostname
-    pub ik: String,   // client id
-    pub sk: String,   // client secret
-}
-
-impl DuoData {
-    pub fn global() -> Option<Self> {
-        match (CONFIG._enable_duo(), CONFIG.duo_host()) {
-            (true, Some(host)) => Some(Self {
-                host,
-                ik: CONFIG.duo_ikey().unwrap(),
-                sk: CONFIG.duo_skey().unwrap(),
-            }),
-            _ => None,
-        }
-    }
-    pub fn msg(s: &str) -> Self {
-        Self {
-            host: s.into(),
-            ik: s.into(),
-            sk: s.into(),
-        }
-    }
-    pub fn secret() -> Self {
-        Self::msg("<global_secret>")
-    }
-    pub fn obscure(self) -> Self {
-        let mut host = self.host;
-        let mut ik = self.ik;
-        let mut sk = self.sk;
-
-        let digits = 4;
-        let replaced = "************";
-
-        host.replace_range(digits.., replaced);
-        ik.replace_range(digits.., replaced);
-        sk.replace_range(digits.., replaced);
-
-        Self {
-            host,
-            ik,
-            sk,
-        }
-    }
-}
-
-#[derive(Serialize, Deserialize)]
-#[serde(deny_unknown_fields)]
-pub struct EmailClaims {
-    pub email: Option<String>,
-}
-
-fn token<T: Serialize>(user_id: UserId, enabled: bool, claims: T) -> String {
-    let time_now = Utc::now();
-    let claims = TwoFactorClaims {
-        nbf: time_now.timestamp(),
-        exp: (time_now + TimeDelta::try_minutes(5).unwrap()).timestamp(),
-        iss: JWT_2FA_AUTH_ISSUER.to_string(),
-        sub: user_id,
-        enabled,
-        claims,
-    };
-    encode_jwt(&claims)
-}
-
-fn validate<T: DeserializeOwned>(token: &str, user_id: &UserId, enabled: bool) -> ApiResult<T> {
-    match decode_jwt::<TwoFactorClaims<T>>(token, JWT_2FA_AUTH_ISSUER.to_string()) {
-        Ok(claims) => {
-            if claims.sub != *user_id {
-                err!("Invalid verification token: Invalid user");
-            }
-            if claims.enabled != enabled {
-                err!("Invalid verification token: Invalid state");
-            }
-            Ok(claims.claims)
-        }
-        Err(err) => err!(format!("Failed to decode verification token: {err}")),
-    }
-}
-
-pub fn authenticator_token(user_id: UserId, key: String, enabled: bool) -> String {
-    token(
-        user_id,
-        enabled,
-        AuthenticatorClaims {
-            key,
-        },
-    )
-}
-
-pub fn validate_authenticator(token: &str, user_id: &UserId, key: &str, enabled: bool) -> EmptyResult {
-    let claims = validate::<AuthenticatorClaims>(token, user_id, enabled)?;
-    if claims.key != key {
-        err!("Invalid verification token: Invalid key");
-    }
-    Ok(())
-}
-
-pub fn duo_token(user_id: UserId, data: Option<DuoData>, enabled: bool) -> String {
-    token(
-        user_id,
-        enabled,
-        DuoClaims {
-            data,
-        },
-    )
-}
-
-// When disabling we check that it's the correct data
-pub fn validate_duo(token: &str, user_id: &UserId, data: Option<&DuoData>, enabled: bool) -> EmptyResult {
-    let claims = validate::<DuoClaims>(token, user_id, enabled)?;
-    if enabled && claims.data.as_ref() != data {
-        err!("Invalid verification token: Invalid duo data");
-    }
-    Ok(())
-}
-
-pub fn email_token(user_id: UserId, email: Option<String>, enabled: bool) -> String {
-    token(
-        user_id,
-        enabled,
-        EmailClaims {
-            email,
-        },
-    )
-}
-
-// When disabling we check that it's the correct `email`
-pub fn validate_email(token: &str, user_id: &UserId, email: String, enabled: bool) -> EmptyResult {
-    let claims = validate::<EmailClaims>(token, user_id, enabled)?;
-    if enabled && claims.email != Some(email) {
-        err!("Invalid verification token: Invalid email");
-    }
-    Ok(())
-}
-
-pub fn webauthn_token(user_id: UserId, keys: Vec<i32>, enabled: bool) -> String {
-    token(
-        user_id,
-        enabled,
-        WebauthnClaims {
-            keys,
-        },
-    )
-}
-
-pub fn validate_webauthn(token: &str, user_id: &UserId, keys: &[i32], enabled: bool) -> EmptyResult {
-    let claims = validate::<WebauthnClaims>(token, user_id, enabled)?;
-    if keys != claims.keys {
-        err!("Invalid verification token: Invalid keys");
-    }
-    Ok(())
-}
-
-pub fn yubikey_token(user_id: UserId, keys: Vec<String>, enabled: bool) -> String {
-    token(
-        user_id,
-        enabled,
-        YubikeyClaims {
-            keys,
-        },
-    )
-}
-
-pub fn validate_yubikey(token: &str, user_id: &UserId, keys: &Vec<String>, enabled: bool) -> EmptyResult {
-    let claims = validate::<YubikeyClaims>(token, user_id, enabled)?;
-    if *keys != claims.keys {
-        err!("Invalid verification token: Invalid keys");
-    }
-    Ok(())
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use serde_json::{Value, from_value, to_value};
-
-    fn token<T: Serialize>(claims: T) -> Value {
-        to_value(TwoFactorClaims {
-            nbf: 0,
-            exp: 0,
-            iss: String::new(),
-            sub: UserId::from(String::from("4ff0f0a4-0aa4-4c1d-9d43-1f2bd4d5e8b1")),
-            enabled: false,
-            claims,
-        })
-        .unwrap()
-    }
-
-    #[test]
-    fn claims_only_parse_as_their_own_provider() {
-        let tokens = [
-            token(AuthenticatorClaims {
-                key: String::from("JBSWY3DPEHPK3PXP"),
-            }),
-            token(DuoClaims {
-                data: None,
-            }),
-            token(WebauthnClaims {
-                keys: vec![1],
-            }),
-            token(YubikeyClaims {
-                keys: Vec::new(),
-            }),
-            token(EmailClaims {
-                email: None,
-            }),
-        ];
-        for (issued, token) in tokens.iter().enumerate() {
-            let parsed = [
-                from_value::<TwoFactorClaims<AuthenticatorClaims>>(token.clone()).is_ok(),
-                from_value::<TwoFactorClaims<DuoClaims>>(token.clone()).is_ok(),
-                from_value::<TwoFactorClaims<WebauthnClaims>>(token.clone()).is_ok(),
-                from_value::<TwoFactorClaims<YubikeyClaims>>(token.clone()).is_ok(),
-                from_value::<TwoFactorClaims<EmailClaims>>(token.clone()).is_ok(),
-            ];
-            for (checked, ok) in parsed.into_iter().enumerate() {
-                assert_eq!(ok, issued == checked, "token {issued} parsed as {checked}");
-            }
-        }
-    }
-}
diff --git a/src/config.rs b/src/config.rs
index 165ead41..fd03342d 100644
--- a/src/config.rs
+++ b/src/config.rs
@@ -111,7 +111,6 @@ macro_rules! make_config {
             _usr: ConfigBuilder,
 
             _overrides: Vec<&'static str>,
-            _config_file_status: ConfigFileStatus,
         }
 
         // Custom Deserialize for ConfigBuilder, mainly based upon https://serde.rs/deserialize-struct.html
@@ -260,22 +259,11 @@ macro_rules! make_config {
                 builder
             }
 
-            async fn from_file() -> Result<Option<Self>, Error> {
-                // The Fs operator would create the folder if it doesn't exist, which we never want
-                if !CONFIG_FILE_PARENT_DIR.starts_with("s3://") && !std::path::Path::new(&*CONFIG_FILE_PARENT_DIR).is_dir() {
-                    return Ok(None);
-                }
+            async fn from_file() -> Result<Self, Error> {
                 let operator = storage::operator_for_path(&CONFIG_FILE_PARENT_DIR)?;
-                let config_bytes = match operator.read(&CONFIG_FILENAME).await {
-                    Ok(bytes) => bytes,
-                    // No config file is fine, should not return any error
-                    Err(e) if e.kind() == opendal::ErrorKind::NotFound => return Ok(None),
-                    // Any other error might be an issue and should be passed back to the caller
-                    Err(e) => return Err(e.into()),
-                };
-                let builder = serde_json::from_slice(&config_bytes.to_vec())?;
+                let config_bytes = operator.read(&CONFIG_FILENAME).await?;
                 println!("[INFO] Using saved config from `{}` for configuration.\n", *CONFIG_FILE);
-                Ok(Some(builder))
+                serde_json::from_slice(&config_bytes.to_vec()).map_err(Into::into)
             }
 
             fn clear_non_editable(&mut self) {
@@ -452,8 +440,6 @@ macro_rules! make_config {
                     "domain_origin",
                     "domain_path",
                     "domain",
-                    "duo_ikey",
-                    "duo_host",
                     "helo_name",
                     "org_creation_users",
                     "signups_domains_whitelist",
@@ -465,8 +451,6 @@ macro_rules! make_config {
                     "sso_authority",
                     "sso_callback_path",
                     "sso_client_id",
-                    "yubico_client_id",
-                    "yubico_server",
                 ];
 
                 let cfg = {
@@ -499,10 +483,6 @@ macro_rules! make_config {
                 };
                 overrides
             }
-
-            pub fn get_config_file_status(&self) -> ConfigFileStatus {
-                self.inner.read().unwrap()._config_file_status
-            }
         }
     };
 }
@@ -559,7 +539,7 @@ make_config! {
     jobs {
         /// Job scheduler poll interval |> How often the job scheduler thread checks for jobs to run.
         /// Set to 0 to globally disable scheduled jobs.
-        job_poll_interval_ms:   u32,    false,  def,    30_000;
+        job_poll_interval_ms:   u64,    false,  def,    30_000;
         /// Send purge schedule |> Cron schedule of the job that checks for Sends past their deletion date.
         /// Defaults to hourly. Set blank to disable this job.
         send_purge_schedule:    String, false,  def,    "0 5 * * * *".to_owned();
@@ -581,7 +561,7 @@ make_config! {
         /// Auth Request cleanup schedule |> Cron schedule of the job that cleans old auth requests from the auth request.
         /// Defaults to every minute. Set blank to disable this job.
         auth_request_purge_schedule:   String, false,  def,    "30 * * * * *".to_owned();
-        /// Duo Auth context cleanup schedule |> Cron schedule of the job that cleans expired Duo contexts from the database. Does nothing if Duo MFA is disabled.
+        /// Duo Auth context cleanup schedule |> Cron schedule of the job that cleans expired Duo contexts from the database. Does nothing if Duo MFA is disabled or set to use the legacy iframe prompt.
         /// Defaults to once every minute. Set blank to disable this job.
         duo_context_purge_schedule:   String, false,  def,    "30 * * * * *".to_owned();
         /// Purge incomplete SSO auth. |> Cron schedule of the job that cleans leftover auth in db due to incomplete SSO login.
@@ -607,9 +587,6 @@ make_config! {
         /// This setting applies globally to all users. To control this on a per-org basis instead, use the "Disable Send" org policy.
         sends_allowed:          bool,   true,   def,    true;
 
-        /// Fill Assist Rules URL |> HTTPS URL for the server-wide Fill Assist rules feed base directory.
-        fill_assist_rules_url: String, true, def, "https://fillassist.bitwarden.com".to_owned();
-
         /// HIBP Api Key |> HaveIBeenPwned API Key, request it here: https://haveibeenpwned.com/API/Key
         hibp_api_key:           Pass,   true,   option;
 
@@ -618,19 +595,19 @@ make_config! {
         /// Per-organization attachment storage limit (KB) |> Max kilobytes of attachment storage allowed per org. When this limit is reached, org members will not be allowed to upload further attachments for ciphers owned by that org.
         org_attachment_limit:   i64,    true,   option;
         /// Per-user send storage limit (KB) |> Max kilobytes of sends storage allowed per user. When this limit is reached, the user will not be allowed to upload further sends.
-        user_send_limit:        i64,    true,   option;
+        user_send_limit:   i64,    true,   option;
 
         /// Trash auto-delete days |> Number of days to wait before auto-deleting a trashed item.
-        /// If unset or 0, trashed items are not auto-deleted. This setting applies globally, so make
+        /// If unset, trashed items are not auto-deleted. This setting applies globally, so make
         /// sure to inform all users of any changes to this setting.
-        trash_auto_delete_days: u16,    true,   option;
+        trash_auto_delete_days: i64,    true,   option;
 
         /// Incomplete 2FA time limit |> Number of minutes to wait before a 2FA-enabled login is
         /// considered incomplete, resulting in an email notification. An incomplete 2FA login is one
         /// where the correct master password was provided but the required 2FA step was not completed,
         /// which potentially indicates a master password compromise. Set to 0 to disable this check.
         /// This setting applies globally to all users.
-        incomplete_2fa_time_limit: u16, true,   def,    3;
+        incomplete_2fa_time_limit: i64, true,   def,    3;
 
         /// Disable icon downloads |> Set to true to disable icon downloading in the internal icon service.
         /// This still serves existing icons from $ICON_CACHE_FOLDER, without generating any external
@@ -643,9 +620,9 @@ make_config! {
         /// this will prevent logins from succeeding until the address has been verified
         signups_verify:         bool,   true,   def,    false;
         /// If signups require email verification, automatically re-send verification email if it hasn't been sent for a while (in seconds)
-        signups_verify_resend_time: u32, true,  def,    3_600;
+        signups_verify_resend_time: u64, true,  def,    3_600;
         /// If signups require email verification, limit how many emails are automatically sent when login is attempted (0 means no limit)
-        signups_verify_resend_limit: u16, true, def,    6;
+        signups_verify_resend_limit: u32, true, def,    6;
         /// Email domain whitelist |> Allow signups only from this list of comma-separated domains, even when signups are otherwise disabled
         signups_domains_whitelist: String, true, def,   String::new();
         /// Enable event logging |> Enables event logging for organizations.
@@ -657,7 +634,7 @@ make_config! {
         invitations_allowed:    bool,   true,   def,    true;
         /// Invitation token expiration time (in hours) |> The number of hours after which an organization invite token, emergency access invite token,
         /// email verification token and deletion request token will expire (must be at least 1)
-        invitation_expiration_hours: u16, false, def, 120;
+        invitation_expiration_hours: u32, false, def, 120;
         /// Enable emergency access |> Controls whether users can enable emergency access to their accounts. This setting applies globally to all users.
         emergency_access_allowed:    bool,   true,   def,    true;
         /// Allow email change |> Controls whether users can change their email. This setting applies globally to all users.
@@ -678,8 +655,8 @@ make_config! {
         /// Invitation organization name |> Name shown in the invitation emails that don't come from a specific organization
         invitation_org_name:    String, true,   def,    "Vaultwarden".to_owned();
 
-        /// Events days retain |> Number of days to retain events stored in the database. If unset or 0, events are kept indefinitely.
-        events_days_retain:     u16,    false,   option;
+        /// Events days retain |> Number of days to retain events stored in the database. If unset, events are kept indefinitely.
+        events_days_retain:     i64,    false,   option;
     },
 
     client {
@@ -698,8 +675,7 @@ make_config! {
         /// other address use the remote IP instead, so a client can't spoof the header.
         /// Either the string "local" (the default, any non-global address, which covers a reverse proxy
         /// running on the same host or container network), the string "all" to accept it from anywhere,
-        /// or a comma separated list of IPs and CIDR ranges. For a list header like X-Forwarded-For, the
-        /// client IP is the rightmost address that isn't a trusted proxy, so list every proxy in the chain.
+        /// or a comma separated list of IPs and CIDR ranges.
         ip_header_trusted_proxies: String, true, def,    "local".to_owned();
         /// Icon service |> The predefined icon services are: internal, bitwarden, duckduckgo, google.
         /// To specify a custom icon service, set a URL template with exactly one instance of `{}`,
@@ -717,13 +693,13 @@ make_config! {
         /// Temporary redirects are useful while testing different icon services, but once a service
         /// has been decided on, consider using permanent redirects for cacheability. The legacy codes
         /// are currently better supported by the Bitwarden clients.
-        icon_redirect_code:     u16,    true,   def,    302;
+        icon_redirect_code:     u32,    true,   def,    302;
         /// Positive icon cache expiry |> Number of seconds to consider that an already cached icon is fresh. After this period, the icon will be refreshed
-        icon_cache_ttl:         u32,    true,   def,    2_592_000;
+        icon_cache_ttl:         u64,    true,   def,    2_592_000;
         /// Negative icon cache expiry |> Number of seconds before trying to download an icon that failed again.
-        icon_cache_negttl:      u32,    true,   def,    259_200;
+        icon_cache_negttl:      u64,    true,   def,    259_200;
         /// Icon download timeout |> Number of seconds when to stop attempting to download an icon.
-        icon_download_timeout:  u16,    true,   def,    10;
+        icon_download_timeout:  u64,    true,   def,    10;
 
         /// [Deprecated] Icon blacklist Regex |> Use `http_request_block_regex` instead
         icon_blacklist_regex:   String, false,   option;
@@ -740,8 +716,6 @@ make_config! {
         /// Disable Two-Factor remember |> Enabling this would force the users to use a second factor to login every time.
         /// Note that the checkbox would still be present, but ignored.
         disable_2fa_remember:   bool,   true,   def,    false;
-        /// Two-Factor remember duration |> Number of days before a remembered Two-Factor login expires (min: 1, max: 90).
-        two_factor_remember_days: i64,  true,   def,    30;
 
         /// Disable authenticator time drifted codes to be valid |> Enabling this only allows the current TOTP code to be valid
         /// TOTP codes of the previous and next 30 seconds will be invalid.
@@ -776,11 +750,11 @@ make_config! {
         /// Max database connection retries |> Number of times to retry the database connection during startup, with 1 second between each retry, set to 0 to retry indefinitely
         db_connection_retries:  u32,    false,  def,    15;
 
-        /// Timeout in seconds when acquiring database connection
-        database_timeout:       u32,    false,  def,    30;
+        /// Timeout when acquiring database connection
+        database_timeout:       u64,    false,  def,    30;
 
         /// Timeout in seconds before idle connections to the database are closed
-        database_idle_timeout:  u32,    false, def,     600;
+        database_idle_timeout:  u64,    false, def,     600;
 
         /// Database connection max pool size
         database_max_conns:     u32,    false,  def,    10;
@@ -797,34 +771,30 @@ make_config! {
         /// Allowed iframe ancestors (Know the risks!) |> Allows other domains to embed the web vault into an iframe, useful for embedding into secure intranets
         allowed_iframe_ancestors: String, true, def,    String::new();
 
-        /// Allowed connect-src (Know the risks!) |> Allows other domains for URLs which can be loaded using script interfaces like the Forwarded email alias feature
+        /// Allowed connect-src (Know the risks!) |> Allows other domains to URLs which can be loaded using script interfaces like the Forwarded email alias feature
         allowed_connect_src:      String, true, def,    String::new();
 
         /// Seconds between login requests |> Number of seconds, on average, between login and 2FA requests from the same IP address before rate limiting kicks in
-        login_ratelimit_seconds:       u16, false, def, 60;
+        login_ratelimit_seconds:       u64, false, def, 60;
         /// Max burst size for login requests |> Allow a burst of requests of up to this size, while maintaining the average indicated by `login_ratelimit_seconds`. Note that this applies to both the login and the 2FA, so it's recommended to allow a burst size of at least 2
-        login_ratelimit_max_burst:     u16, false, def, 10;
+        login_ratelimit_max_burst:     u32, false, def, 10;
 
         /// Seconds between unauthenticated requests |> Number of seconds, on average, between requests from the same IP address to any of the rate limited unauthenticated endpoints
-        unauthenticated_ratelimit_seconds:   u16, false, def, 60;
+        unauthenticated_ratelimit_seconds:   u64, false, def, 60;
         /// Max burst size for unauthenticated requests |> Allow a burst of requests of up to this size, while maintaining the average indicated by `unauthenticated_ratelimit_seconds`. This is shared between several endpoints, so it needs to be more lenient than the login one
-        unauthenticated_ratelimit_max_burst: u16, false, def, 50;
+        unauthenticated_ratelimit_max_burst: u32, false, def, 50;
 
         /// Seconds between admin login requests |> Number of seconds, on average, between admin requests from the same IP address before rate limiting kicks in
-        admin_ratelimit_seconds:       u16, false, def, 300;
+        admin_ratelimit_seconds:       u64, false, def, 300;
         /// Max burst size for admin login requests |> Allow a burst of requests of up to this size, while maintaining the average indicated by `admin_ratelimit_seconds`
-        admin_ratelimit_max_burst:     u16, false, def, 3;
+        admin_ratelimit_max_burst:     u32, false, def, 3;
 
         /// Admin session lifetime |> Set the lifetime of admin sessions to this value (in minutes).
-        admin_session_lifetime:        u32, true,  def, 20;
+        admin_session_lifetime:        i64, true,  def, 20;
 
         /// Enable groups (BETA!) (Know the risks!) |> Enables groups support for organizations (Currently contains known issues!).
         org_groups_enabled:            bool, false, def, false;
 
-        /// Enable Custom roles (EXPERIMENTAL!) (Know the risks!) |> Enables the in-development Custom member role with granular permissions for organizations.
-        /// Only the permissions this version enforces can be granted. Disabling it again keeps the stored Custom roles, but they grant nothing until it is re-enabled.
-        experimental_custom_roles:     bool, false, def, false;
-
         /// Increase note size limit (Know the risks!) |> Sets the secure note size limit to 100_000 instead of the default 10_000.
         /// WARNING: This could cause issues with clients. Also exports will not work on Bitwarden servers!
         increase_note_size_limit:      bool,  true,  def, false;
@@ -873,8 +843,8 @@ make_config! {
         sso_master_password_policy:     String, true,  option;
         /// Use SSO only for auth not the session lifecycle |> Use default Vaultwarden session lifecycle (Idle refresh token valid for 30days)
         sso_auth_only_not_session:      bool,   true,   def,    false;
-        /// Client cache for discovery endpoint. |> Duration in seconds (0 to disable). More details: https://github.com/dani-garcia/vaultwarden/wiki/Enabling-SSO-support-using-OpenId-Connect#client-cache
-        sso_client_cache_expiration:    u32,    true,   def,    0;
+        /// Client cache for discovery endpoint. |> Duration in seconds (0 or less to disable). More details: https://github.com/dani-garcia/vaultwarden/wiki/Enabling-SSO-support-using-OpenId-Connect#client-cache
+        sso_client_cache_expiration:    u64,    true,   def,    0;
         /// Log all tokens |> `LOG_LEVEL=debug` or `LOG_LEVEL=info,vaultwarden::sso=debug` is required
         sso_debug_tokens:               bool,   true,   def,    false;
     },
@@ -895,12 +865,16 @@ make_config! {
     duo: _enable_duo {
         /// Enabled
         _enable_duo:            bool,   true,   def,     true;
+        /// Attempt to use deprecated iframe-based Traditional Prompt (Duo WebSDK 2)
+        duo_use_iframe:         bool,   false,  def,     false;
         /// Client Id
         duo_ikey:               String, true,   option;
         /// Client Secret
         duo_skey:               Pass,   true,   option;
         /// Host
         duo_host:               String, true,   option;
+        /// Application Key (generated automatically)
+        _duo_akey:              Pass,   false,  option;
     },
 
     /// SMTP Email Settings
@@ -932,11 +906,11 @@ make_config! {
         /// SMTP Auth mechanism |> Defaults for SSL is "Plain" and "Login" and nothing for Non-SSL connections. Possible values: ["Plain", "Login", "Xoauth2"]. Multiple options need to be separated by a comma ','.
         smtp_auth_mechanism:           String, true,   option;
         /// SMTP connection timeout |> Number of seconds when to stop trying to connect to the SMTP server
-        smtp_timeout:                  u16,    true,   def,     15;
+        smtp_timeout:                  u64,    true,   def,     15;
         /// Server name sent during HELO |> By default this value should be the machine's hostname, but might need to be changed in case it trips some anti-spam filters
         helo_name:                     String, true,   option;
         /// Embed images as email attachments.
-        smtp_embed_images:             bool,   true,   def,     true;
+        smtp_embed_images:             bool, true, def, true;
         /// _smtp_img_src
         _smtp_img_src:                 String, false, generated, |c| generate_smtp_img_src(c.smtp_embed_images, &c.domain);
         /// Enable SMTP debugging (Know the risks!) |> DANGEROUS: Enabling this will output very detailed SMTP messages. This could contain sensitive information like passwords and usernames! Only enable this during troubleshooting!
@@ -954,9 +928,9 @@ make_config! {
         /// Email token size |> Number of digits in an email 2FA token (min: 6, max: 255). Note that the Bitwarden clients are hardcoded to mention 6 digit codes regardless of this setting.
         email_token_size:       u8,     true,   def,      6;
         /// Token expiration time |> Maximum time in seconds a token is valid. The time the user has to open email client and copy token.
-        email_expiration_time:  u32,    true,   def,      600;
+        email_expiration_time:  u64,    true,   def,      600;
         /// Maximum attempts |> Maximum attempts before an email token is reset and a new email will need to be sent
-        email_attempts_limit:   u8,     true,   def,      3;
+        email_attempts_limit:   u64,    true,   def,      3;
         /// Setup email 2FA at signup |> Setup email 2FA provider on registration regardless of any organization policy
         email_2fa_enforce_on_verified_invite: bool,   true,   def,      false;
         /// Auto-enable 2FA (Know the risks!) |> Automatically setup email 2FA as fallback provider when needed
@@ -1012,15 +986,7 @@ fn validate_config(cfg: &ConfigItems, on_update: bool) -> Result<(), Error> {
     }
 
     if cfg.database_min_conns > cfg.database_max_conns {
-        err!("`DATABASE_MIN_CONNS` must be less than or equal to `DATABASE_MAX_CONNS`.");
-    }
-
-    if cfg.database_timeout < 1 {
-        err!("`DATABASE_TIMEOUT` must be at least 1 second");
-    }
-
-    if cfg.database_idle_timeout < 1 {
-        err!("`DATABASE_IDLE_TIMEOUT` must be at least 1 second");
+        err!("`DATABASE_MIN_CONNS` must be smaller than or equal to `DATABASE_MAX_CONNS`.");
     }
 
     if let Some(log_file) = &cfg.log_file
@@ -1036,21 +1002,6 @@ fn validate_config(cfg: &ConfigItems, on_update: bool) -> Result<(), Error> {
         );
     }
 
-    let valid_fill_assist_rules_url = Url::parse(&cfg.fill_assist_rules_url).is_ok_and(|url| {
-        url.scheme() == "https"
-            && url.has_host()
-            && url.username().is_empty()
-            && url.password().is_none()
-            && url.query().is_none()
-            && url.fragment().is_none()
-            && cfg.fill_assist_rules_url.trim() == cfg.fill_assist_rules_url
-    });
-    if !valid_fill_assist_rules_url {
-        err!(
-            "`FILL_ASSIST_RULES_URL` must be a valid HTTPS URL without credentials, query parameters, fragments, or surrounding whitespace."
-        );
-    }
-
     let connect_src = cfg.allowed_connect_src.to_lowercase();
     for url in connect_src.split_whitespace() {
         if !url.starts_with("https://") || Url::parse(url).is_err() {
@@ -1285,10 +1236,6 @@ fn validate_config(cfg: &ConfigItems, on_update: bool) -> Result<(), Error> {
         err!("`INVITATION_EXPIRATION_HOURS` has a minimum duration of 1 hour")
     }
 
-    if !(1..=90).contains(&cfg.two_factor_remember_days) {
-        err!("`TWO_FACTOR_REMEMBER_DAYS` must be between 1 and 90 days")
-    }
-
     // Validate schedule crontab format
     if !cfg.send_purge_schedule.is_empty() && cfg.send_purge_schedule.parse::<Schedule>().is_err() {
         err!("`SEND_PURGE_SCHEDULE` is not a valid cron expression")
@@ -1322,38 +1269,6 @@ fn validate_config(cfg: &ConfigItems, on_update: bool) -> Result<(), Error> {
         err!("`AUTH_REQUEST_PURGE_SCHEDULE` is not a valid cron expression")
     }
 
-    if !cfg.duo_context_purge_schedule.is_empty() && cfg.duo_context_purge_schedule.parse::<Schedule>().is_err() {
-        err!("`DUO_CONTEXT_PURGE_SCHEDULE` is not a valid cron expression")
-    }
-
-    if !cfg.purge_incomplete_sso_auth.is_empty() && cfg.purge_incomplete_sso_auth.parse::<Schedule>().is_err() {
-        err!("`PURGE_INCOMPLETE_SSO_AUTH` is not a valid cron expression")
-    }
-
-    if cfg.login_ratelimit_seconds < 1 {
-        err!("`LOGIN_RATELIMIT_SECONDS` must be at least 1 second");
-    }
-
-    if cfg.login_ratelimit_max_burst < 1 {
-        err!("`LOGIN_RATELIMIT_MAX_BURST` must be at least 1");
-    }
-
-    if cfg.admin_ratelimit_seconds < 1 {
-        err!("`ADMIN_RATELIMIT_SECONDS` must be at least 1 second");
-    }
-
-    if cfg.admin_ratelimit_max_burst < 1 {
-        err!("`ADMIN_RATELIMIT_MAX_BURST` must be at least 1");
-    }
-
-    if cfg.unauthenticated_ratelimit_seconds < 1 {
-        err!("`UNAUTHENTICATED_RATELIMIT_SECONDS` must be at least 1 second");
-    }
-
-    if cfg.unauthenticated_ratelimit_max_burst < 1 {
-        err!("`UNAUTHENTICATED_RATELIMIT_MAX_BURST` must be at least 1");
-    }
-
     if !cfg.disable_admin_token {
         match cfg.admin_token.as_ref() {
             Some(t) if t.starts_with("$argon2") => {
@@ -1503,23 +1418,33 @@ pub enum PathType {
 // Android (v2026.2.1): https://github.com/bitwarden/android/blob/6902c19c0093fa476bbf74ccaa70c9f14afbb82f/core/src/main/kotlin/com/bitwarden/core/data/manager/model/FlagKey.kt#L31
 // iOS (v2026.2.1): https://github.com/bitwarden/ios/blob/cdd9ba1770ca2ffc098d02d12cc3208e3a830454/BitwardenShared/Core/Platform/Models/Enum/FeatureFlag.swift#L7
 pub const SUPPORTED_FEATURE_FLAGS: &[&str] = &[
+    // Architecture
+    "desktop-ui-migration-milestone-1",
+    "desktop-ui-migration-milestone-2",
+    "desktop-ui-migration-milestone-3",
+    "desktop-ui-migration-milestone-4",
     // Auth Team
     "pm-5594-safari-account-switching",
     "pm-32413-multi-client-password-management",
     // Autofill Team
-    "undetermined-cipher-scenario-logic",
     "enable-basic-auth-response",
-    "fill-assist-targeting-rules",
+    "ssh-agent",
     "ssh-agent-v2",
-    "windows-desktop-autotype",
-    "windows-desktop-autotype-ga",
     // Key Management Team
-    "biometrics-sdk-ipc",
-    "windows-native-credential-sync",
-    "macos-native-credential-sync",
-    "enable-account-encryption-v2-jit-password-registration",
+    "ssh-key-vault-item",
+    "pm-25373-windows-biometrics-v2",
+    "pm-26340-linux-biometrics-v2",
+    "pm-31050-no-logout-key-upgrade-rotation",
     "pm-27278-v2-password-registration",
+    "enable-account-encryption-v2-jit-password-registration",
+    "pm-30144-sdk-key-rotation",
+    "force-upgrade-v2-encryption",
     // Mobile Team
+    "anon-addy-self-host-alias",
+    "simple-login-self-host-alias",
+    "mutual-tls",
+    "cxp-import-mobile",
+    "cxp-export-mobile",
     "pm-34171-card-scanner",
     // Platform Team
     "pm-30529-webauthn-related-origins",
@@ -1527,34 +1452,11 @@ pub const SUPPORTED_FEATURE_FLAGS: &[&str] = &[
     "pm-32009-new-item-types",
 ];
 
-#[derive(Clone, Copy, Serialize)]
-pub enum ConfigFileStatus {
-    NotFound,
-    Loaded,
-    Error,
-}
-
 impl Config {
     pub async fn load() -> Result<Self, Error> {
         // Loading from env and file
         let env = ConfigBuilder::from_env();
-        let (usr, config_file_status) = match ConfigBuilder::from_file().await {
-            Ok(Some(usr)) => (usr, ConfigFileStatus::Loaded),
-            Ok(None) => (ConfigBuilder::default(), ConfigFileStatus::NotFound),
-            Err(e) => {
-                println!(
-                    "[ERROR] Failed to load configuration from `{}`\n\
-                    #####################################################################################\n\
-                    # The file seems to exist but might contain invalid JSON or invalid values.         #\n\
-                    # Check the syntax and make sure every value is valid and within its allowed range. #\n\
-                    # This file is not used until those errors are resolved.                            #\n\
-                    #####################################################################################\n\
-                {e:?}\n",
-                    *CONFIG_FILE
-                );
-                (ConfigBuilder::default(), ConfigFileStatus::Error)
-            }
-        };
+        let usr = ConfigBuilder::from_file().await.unwrap_or_default();
 
         // Create merged config, config file overwrites env
         let mut overrides = Vec::new();
@@ -1574,7 +1476,6 @@ impl Config {
                 _env: env,
                 _usr: usr,
                 _overrides: overrides,
-                _config_file_status: config_file_status,
             }),
         })
     }
@@ -1608,7 +1509,6 @@ impl Config {
             writer.config = config;
             writer._usr = builder;
             writer._overrides = overrides;
-            writer._config_file_status = ConfigFileStatus::Loaded;
         }
 
         //Save to file
@@ -1621,13 +1521,22 @@ impl Config {
         Ok(())
     }
 
+    async fn update_config_partial(&self, other: ConfigBuilder) -> Result<(), Error> {
+        let builder = {
+            let usr = &self.inner.read().unwrap()._usr;
+            let mut overrides = Vec::new();
+            usr.merge(&other, false, &mut overrides)
+        };
+        self.update_config(builder, false).await
+    }
+
     /// Tests whether an email's domain is allowed. A domain is allowed if it
     /// is in signups_domains_whitelist, or if no whitelist is set (so there
     /// are no domain restrictions in effect).
     pub fn is_email_domain_allowed(&self, email: &str) -> bool {
         let e: Vec<&str> = email.rsplitn(2, '@').collect();
         if e.len() != 2 || e[0].is_empty() || e[1].is_empty() {
-            warn!("Failed to parse email address '{}'", email.escape_debug());
+            warn!("Failed to parse email address '{email}'");
             return false;
         }
         let email_domain = e[0].to_lowercase();
@@ -1700,7 +1609,6 @@ impl Config {
             writer.config = config;
             writer._usr = usr;
             writer._overrides = Vec::new();
-            writer._config_file_status = ConfigFileStatus::NotFound;
         }
 
         // Invalidate CSS Cache because several config items might have impact on the rendered CSS
@@ -1717,6 +1625,23 @@ impl Config {
         inner._enable_smtp && (inner.smtp_host.is_some() || inner.use_sendmail)
     }
 
+    pub async fn get_duo_akey(&self) -> String {
+        if let Some(akey) = self._duo_akey() {
+            akey
+        } else {
+            let akey_s = crate::crypto::encode_random_bytes::<64>(&data_encoding::BASE64);
+
+            // Save the new value
+            let builder = ConfigBuilder {
+                _duo_akey: Some(akey_s.clone()),
+                ..Default::default()
+            };
+            self.update_config_partial(builder).await.ok();
+
+            akey_s
+        }
+    }
+
     pub fn is_webauthn_2fa_supported(&self) -> bool {
         Url::parse(&self.domain()).expect("DOMAIN not a valid URL").domain().is_some()
     }
@@ -1848,7 +1773,6 @@ where
     reg!("email/protected_action", ".html");
     reg!("email/pw_hint_none", ".html");
     reg!("email/pw_hint_some", ".html");
-    reg!("email/recover_twofactor", ".html");
     reg!("email/register_verify_email", ".html");
     reg!("email/send_2fa_removed_from_org", ".html");
     reg!("email/send_emergency_access_invite", ".html");
diff --git a/src/db/mod.rs b/src/db/mod.rs
index 39aea1d3..2eae3f3c 100644
--- a/src/db/mod.rs
+++ b/src/db/mod.rs
@@ -1,11 +1,7 @@
 mod query_logger;
 
 use std::{
-    future::Future,
-    sync::{
-        Arc, OnceLock,
-        atomic::{AtomicBool, Ordering},
-    },
+    sync::{Arc, OnceLock},
     time::Duration,
 };
 
@@ -127,7 +123,6 @@ pub static ACTIVE_DB_TYPE: OnceLock<DbConnType> = OnceLock::new();
 pub struct DbConn {
     conn: Arc<Mutex<Option<PooledConnection<DbConnManager>>>>,
     permit: Option<OwnedSemaphorePermit>,
-    transaction_open: AtomicBool,
 }
 
 #[derive(Debug)]
@@ -155,7 +150,6 @@ impl Drop for DbConn {
     fn drop(&mut self) {
         let conn = Arc::clone(&self.conn);
         let permit = self.permit.take();
-        let transaction_open = self.transaction_open.load(Ordering::Acquire);
 
         // Since connection can't be on the stack in an async fn during an
         // await, we have to spawn a new blocking-safe thread...
@@ -163,13 +157,7 @@ impl Drop for DbConn {
             // And then re-enter the runtime to wait on the async mutex, but in a blocking fashion.
             let mut conn = tokio::runtime::Handle::current().block_on(conn.lock_owned());
 
-            if let Some(mut conn) = conn.take() {
-                if transaction_open {
-                    // A cancelled request must not return an open transaction to the pool.
-                    if let Err(error) = conn.batch_execute("ROLLBACK") {
-                        error!("Failed to roll back a cancelled database transaction: {error}");
-                    }
-                }
+            if let Some(conn) = conn.take() {
                 drop(conn);
             }
 
@@ -224,8 +212,8 @@ impl DbPool {
         let pool = Pool::builder()
             .max_size(max_conns)
             .min_idle(Some(CONFIG.database_min_conns()))
-            .idle_timeout(Some(Duration::from_secs(u64::from(CONFIG.database_idle_timeout()))))
-            .connection_timeout(Duration::from_secs(u64::from(CONFIG.database_timeout())))
+            .idle_timeout(Some(Duration::from_secs(CONFIG.database_idle_timeout())))
+            .connection_timeout(Duration::from_secs(CONFIG.database_timeout()))
             .connection_customizer(Box::new(DbConnOptions {
                 init_stmts: conn_type.get_init_stmts(),
             }))
@@ -245,7 +233,7 @@ impl DbPool {
 
     // Get a connection from the pool
     pub async fn get(&self) -> Result<DbConn, Error> {
-        let duration = Duration::from_secs(u64::from(CONFIG.database_timeout()));
+        let duration = Duration::from_secs(CONFIG.database_timeout());
         let permit = match timeout(duration, Arc::clone(&self.semaphore).acquire_owned()).await {
             Ok(p) => p.expect("Semaphore should be open"),
             Err(_) => {
@@ -260,7 +248,6 @@ impl DbPool {
         Ok(DbConn {
             conn: Arc::new(Mutex::new(Some(c))),
             permit: Some(permit),
-            transaction_open: AtomicBool::new(false),
         })
     }
 }
@@ -333,29 +320,6 @@ impl DbConnType {
 }
 
 impl DbConn {
-    /// Run asynchronous model calls on this request's pooled connection in one transaction.
-    /// Send external notifications only after this returns successfully.
-    pub async fn transaction<F, Fut, T>(&self, operation: F) -> Result<T, Error>
-    where
-        F: FnOnce() -> Fut,
-        Fut: Future<Output = Result<T, Error>>,
-    {
-        self.run(|conn| conn.batch_execute("BEGIN")).await.map_res("Error starting database transaction")?;
-        self.transaction_open.store(true, Ordering::Release);
-        let result = operation().await;
-        if result.is_ok() {
-            let committed = self.run(|conn| conn.batch_execute("COMMIT")).await;
-            let closed = committed.is_ok() || self.run(|conn| conn.batch_execute("ROLLBACK")).await.is_ok();
-            if closed {
-                self.transaction_open.store(false, Ordering::Release);
-            }
-            committed.map_res("Error committing database transaction")?;
-        } else if self.run(|conn| conn.batch_execute("ROLLBACK")).await.is_ok() {
-            self.transaction_open.store(false, Ordering::Release);
-        }
-        result
-    }
-
     pub async fn run<F, R>(&self, f: F) -> R
     where
         F: FnOnce(&mut DbConnInner) -> R + Send,
@@ -570,257 +534,3 @@ mod postgresql_migrations {
         Ok(())
     }
 }
-
-/// A throwaway SQLite database with the real schema, for tests that need to run queries.
-#[cfg(all(test, sqlite))]
-pub mod test_db {
-    use super::{DbConn, DbConnManager, sqlite_migrations::MIGRATIONS};
-    use diesel::{Connection, connection::SimpleConnection, r2d2::Pool, sqlite::SqliteConnection};
-    use diesel_migrations::MigrationHarness;
-    use std::sync::{Arc, atomic::AtomicBool};
-    use tokio::sync::Mutex;
-
-    pub struct TestDb {
-        pool: Pool<DbConnManager>,
-        // Keep the named in-memory database alive across pooled connections.
-        _keeper: SqliteConnection,
-    }
-
-    impl TestDb {
-        fn new() -> Self {
-            let url = format!("sqlite://{}?mode=memory&cache=shared", crate::util::get_uuid());
-            let mut keeper = SqliteConnection::establish(&url).unwrap();
-            keeper.run_pending_migrations(MIGRATIONS).unwrap();
-            let pool = Pool::builder().max_size(2).build(DbConnManager::new(&url)).unwrap();
-            Self {
-                pool,
-                _keeper: keeper,
-            }
-        }
-
-        pub fn conn(&self) -> DbConn {
-            DbConn {
-                conn: Arc::new(Mutex::new(Some(self.pool.get().unwrap()))),
-                permit: None,
-                transaction_open: AtomicBool::new(false),
-            }
-        }
-    }
-
-    // CONFIG must initialize in a child process: the DNS bootstrap test needs it uninitialized.
-    pub fn run(test: impl AsyncFnOnce(&TestDb)) {
-        if std::env::var_os("VAULTWARDEN_ISOLATED_CONFIG_TEST").is_none() {
-            let output = std::process::Command::new(std::env::current_exe().unwrap())
-                .args(["--exact", std::thread::current().name().unwrap(), "--nocapture"])
-                .env("VAULTWARDEN_ISOLATED_CONFIG_TEST", "1")
-                .env("DATABASE_URL", "sqlite://:memory:")
-                .output()
-                .unwrap();
-            assert!(
-                output.status.success() && String::from_utf8_lossy(&output.stdout).contains("1 passed; 0 failed"),
-                "{}\n{}",
-                String::from_utf8_lossy(&output.stdout),
-                String::from_utf8_lossy(&output.stderr)
-            );
-            return;
-        }
-        // DbConn::run uses block_in_place, requiring a multi-threaded runtime.
-        tokio::runtime::Builder::new_multi_thread().enable_all().build().unwrap().block_on(async {
-            super::models::test_flag::CUSTOM_ROLES_ENABLED.set(Some(true));
-            test(&TestDb::new()).await;
-        });
-    }
-
-    #[test]
-    fn custom_role_migration_preserves_memberships_and_guards_downgrade() {
-        use super::schema::users_organizations::dsl::*;
-        use diesel::{migration::MigrationSource, prelude::*};
-        let mut conn = SqliteConnection::establish(":memory:").unwrap();
-        for migration in conn.pending_migrations(MIGRATIONS).unwrap() {
-            if migration.name().version().to_string() == "20261010120000" {
-                break;
-            }
-            conn.run_migration(&migration).unwrap();
-        }
-        conn.batch_execute(
-            "PRAGMA foreign_keys=OFF;
-            INSERT INTO organizations (uuid,name,billing_email) VALUES ('org','Org','a@b');
-            INSERT INTO users_organizations (uuid,user_uuid,org_uuid,access_all,akey,status,atype) VALUES
-            ('0','0','org',TRUE,'key',2,0), ('1','1','org',TRUE,'key',2,1),
-            ('2','2','org',FALSE,'key',1,2), ('3','3','org',FALSE,'key',2,3), ('4','4','org',TRUE,'key',2,3);",
-        )
-        .unwrap();
-        let rows = |conn: &mut SqliteConnection| {
-            users_organizations
-                .select((uuid, user_uuid, org_uuid, access_all, akey, status, atype))
-                .order(uuid)
-                .load::<(String, String, String, bool, String, i32, i32)>(conn)
-                .unwrap()
-        };
-        let before = rows(&mut conn);
-        conn.run_pending_migrations(MIGRATIONS).unwrap();
-        assert_eq!(rows(&mut conn), before);
-        let grants = |conn: &mut SqliteConnection| {
-            diesel::select(diesel::dsl::sql::<diesel::sql_types::BigInt>(
-                "(SELECT COUNT(*) FROM users_organizations WHERE manage_users OR manage_groups OR manage_policies
-                OR create_new_collections OR edit_any_collection OR delete_any_collection
-                OR access_event_logs OR access_import_export OR access_reports)",
-            ))
-            .get_result::<i64>(conn)
-            .unwrap()
-        };
-        assert_eq!(grants(&mut conn), 0);
-        let migration = MigrationSource::<diesel::sqlite::Sqlite>::migrations(&MIGRATIONS)
-            .unwrap()
-            .into_iter()
-            .find(|m| m.name().version().to_string() == "20261010120000")
-            .unwrap();
-        for member_status in [1, 2] {
-            conn.batch_execute(&format!(
-                "UPDATE users_organizations SET atype=4,manage_users=TRUE,status={member_status} WHERE uuid='2'"
-            ))
-            .unwrap();
-            let custom = rows(&mut conn);
-            assert!(conn.revert_migration(&*migration).is_err());
-            assert_eq!(rows(&mut conn), custom);
-            assert!(users_organizations.filter(uuid.eq("2")).select(manage_users).first::<bool>(&mut conn).unwrap());
-        }
-        conn.batch_execute("UPDATE users_organizations SET atype=2,manage_users=FALSE,status=1 WHERE uuid='2'")
-            .unwrap();
-        conn.revert_migration(&*migration).unwrap();
-        assert!(diesel::sql_query("SELECT manage_users FROM users_organizations").execute(&mut conn).is_err());
-        conn.run_pending_migrations(MIGRATIONS).unwrap();
-        assert_eq!(grants(&mut conn), 0);
-        assert_eq!(rows(&mut conn), before);
-    }
-
-    use super::models::{Collection, CustomPermission, Membership, MembershipType, Organization, OrganizationId, User};
-
-    pub async fn organization(conn: &DbConn) -> Organization {
-        let org = Organization::new("Org".into(), "billing@example.com", None, None);
-        org.save(conn).await.unwrap();
-        org
-    }
-
-    pub async fn member(
-        conn: &DbConn,
-        org: &OrganizationId,
-        role: MembershipType,
-        permissions: &[CustomPermission],
-    ) -> (User, Membership) {
-        let mut user = User::new(&format!("{}@example.com", crate::util::get_uuid()), None);
-        user.password_hash = b"existing-account".to_vec();
-        user.save(conn).await.unwrap();
-        let mut member = Membership::new(user.uuid.clone(), org.clone(), None);
-        member.set_type(role);
-        member.status = 2;
-        member.set_custom_permissions(&permissions.iter().copied().collect());
-        member.save(conn).await.unwrap();
-        (user, member)
-    }
-
-    pub async fn custom_member(conn: &DbConn, permission: CustomPermission) -> (Organization, User, Membership) {
-        let org = organization(conn).await;
-        let (user, member) = member(conn, &org.uuid, MembershipType::Custom, &[permission]).await;
-        (org, user, member)
-    }
-
-    pub async fn collection(conn: &DbConn, org: &OrganizationId) -> Collection {
-        let collection = Collection::new(org.clone(), "Collection".into(), None);
-        collection.save(conn).await.unwrap();
-        collection
-    }
-
-    #[test]
-    fn transactions_rollback_before_connection_reuse_and_commit_success() {
-        use crate::error::MapResult;
-        use diesel::RunQueryDsl;
-        run(async |db| {
-            let conn = db.conn();
-            conn.run(|c| c.batch_execute("CREATE TABLE probe (id INTEGER PRIMARY KEY)")).await.unwrap();
-            for (sql, expected) in [
-                ("INSERT INTO probe VALUES (1); INSERT INTO probe VALUES (1)", 0_i64),
-                ("INSERT INTO probe VALUES (1)", 1),
-            ] {
-                let result: Result<(), super::Error> = conn
-                    .transaction(async || conn.run(move |c| c.batch_execute(sql)).await.map_res("Insert failed"))
-                    .await;
-                assert_eq!(result.is_ok(), expected == 1);
-                let count: i64 = conn
-                    .run(|c| {
-                        diesel::select(diesel::dsl::sql::<diesel::sql_types::BigInt>("(SELECT COUNT(*) FROM probe)"))
-                            .get_result(c)
-                    })
-                    .await
-                    .unwrap();
-                assert_eq!(count, expected);
-                // The same live connection must accept another transaction, before DbConn::drop can help.
-                conn.run(|c| c.batch_execute("BEGIN; ROLLBACK")).await.unwrap();
-            }
-        });
-    }
-
-    #[test]
-    fn collection_and_cipher_access_requires_active_membership_and_enabled_groups() {
-        use super::models::{Cipher, CipherAccessScope, CollectionCipher, CollectionUser, test_flag};
-        use crate::{
-            api::core::{CipherSyncData, CipherSyncType},
-            auth::{CollectionAction, custom_member_may},
-        };
-        run(async |db| {
-            let conn = db.conn();
-            let (org, user, mut member) = custom_member(&conn, CustomPermission::EditAnyCollection).await;
-            let collection = collection(&conn, &org.uuid).await;
-            let mut cipher = Cipher::new(2);
-            cipher.name = "Cipher".into();
-            cipher.organization_uuid = Some(org.uuid.clone());
-            cipher.save(&conn).await.unwrap();
-            CollectionCipher::save(&cipher.uuid, &collection.uuid, &conn).await.unwrap();
-            for (enabled, status, allowed) in [(true, 2, true), (false, 2, false), (true, 1, false)] {
-                test_flag::CUSTOM_ROLES_ENABLED.set(Some(enabled));
-                member.status = status;
-                member.save(&conn).await.unwrap();
-                assert!(!cipher.is_accessible_to_user(&user.uuid, CipherAccessScope::User, &conn).await);
-                assert_eq!(
-                    cipher.is_write_accessible_to_user(&user.uuid, CipherAccessScope::OrganizationAdmin, &conn).await,
-                    allowed
-                );
-            }
-            test_flag::CUSTOM_ROLES_ENABLED.set(Some(true));
-            member.status = 2;
-            member.save(&conn).await.unwrap();
-            let foreign = organization(&conn).await;
-            cipher.organization_uuid = Some(foreign.uuid);
-            assert!(!cipher.is_accessible_to_user(&user.uuid, CipherAccessScope::OrganizationAdmin, &conn).await);
-            cipher.organization_uuid = Some(org.uuid.clone());
-            member.set_custom_permissions(&std::collections::HashSet::new());
-            member.save(&conn).await.unwrap();
-            let sql=format!("INSERT INTO groups (uuid,organizations_uuid,name,access_all,creation_date,revision_date)
-                VALUES ('g','{}','Group',FALSE,CURRENT_TIMESTAMP,CURRENT_TIMESTAMP);
-                INSERT INTO groups_users (groups_uuid,users_organizations_uuid) VALUES ('g','{}');
-                INSERT INTO collections_groups (collections_uuid,groups_uuid,read_only,hide_passwords,manage) VALUES ('{}','g',FALSE,FALSE,TRUE);",
-                org.uuid,member.uuid,collection.uuid);
-            conn.run(move |c| c.batch_execute(&sql)).await.unwrap();
-            for status in [2, 1, -3, -126] {
-                member.status = status;
-                member.save(&conn).await.unwrap();
-                let allowed = status == 2 && crate::CONFIG.org_groups_enabled();
-                assert_eq!(custom_member_may(CollectionAction::Edit, &member, &collection.uuid, &conn).await, allowed);
-                let sync = CipherSyncData::new(&user.uuid, CipherSyncType::User, &conn).await;
-                for cached in [None, Some(&sync)] {
-                    assert_eq!(
-                        cipher
-                            .get_access_restrictions(&user.uuid, CipherAccessScope::User, cached, &conn)
-                            .await
-                            .is_some(),
-                        allowed
-                    );
-                }
-            }
-            member.status = 2;
-            member.save(&conn).await.unwrap();
-            CollectionUser::save(&user.uuid, &collection.uuid, false, false, true, &conn).await.unwrap();
-            assert!(custom_member_may(CollectionAction::Edit, &member, &collection.uuid, &conn).await);
-        });
-    }
-}
diff --git a/src/db/models/attachment.rs b/src/db/models/attachment.rs
index 659648d0..0536dde5 100644
--- a/src/db/models/attachment.rs
+++ b/src/db/models/attachment.rs
@@ -61,7 +61,7 @@ impl Attachment {
             let token = encode_jwt(&generate_file_download_claims(self.cipher_uuid.clone(), self.id.clone()));
             Ok(format!("{host}/attachments/{}/{}?token={token}", self.cipher_uuid, self.id))
         } else {
-            Ok(operator.presign_read(&self.get_file_path(), Duration::from_mins(1)).await?.uri().to_string())
+            Ok(operator.presign_read(&self.get_file_path(), Duration::from_mins(5)).await?.uri().to_string())
         }
     }
 
diff --git a/src/db/models/auth_request.rs b/src/db/models/auth_request.rs
index f2b0ecdc..cc4b60fd 100644
--- a/src/db/models/auth_request.rs
+++ b/src/db/models/auth_request.rs
@@ -4,7 +4,7 @@ use diesel::prelude::*;
 use serde_json::Value;
 
 use crate::{
-    api::{ApiResult, EmptyResult},
+    api::EmptyResult,
     crypto::ct_eq,
     db::{DbConn, schema::auth_requests},
     error::MapResult,
@@ -166,30 +166,6 @@ impl AuthRequest {
         .await
     }
 
-    pub async fn delete_all_by_user(user_uuid: &UserId, conn: &DbConn) -> EmptyResult {
-        conn.run(move |conn| {
-            diesel::delete(auth_requests::table.filter(auth_requests::user_uuid.eq(user_uuid)))
-                .execute(conn)
-                .map_res("Error deleting auth requests for user")
-        })
-        .await
-    }
-
-    /// Marks the request as used to log in. Returns false when it already was, so it only works once.
-    pub async fn set_authentication_date(uuid: &AuthRequestId, conn: &DbConn) -> ApiResult<bool> {
-        let now = Utc::now().naive_utc();
-        conn.run(move |conn| {
-            diesel::update(auth_requests::table)
-                .filter(auth_requests::uuid.eq(uuid))
-                .filter(auth_requests::authentication_date.is_null())
-                .set(auth_requests::authentication_date.eq(now))
-                .execute(conn)
-                .map(|updated| updated == 1)
-                .map_res("Error updating auth request")
-        })
-        .await
-    }
-
     pub fn check_access_code(&self, access_code: &str) -> bool {
         ct_eq(&self.access_code, access_code)
     }
@@ -197,7 +173,7 @@ impl AuthRequest {
     pub async fn purge_expired_auth_requests(conn: &DbConn) {
         // delete auth requests older than 15 minutes which is functionally equivalent to upstream:
         // https://github.com/bitwarden/server/blob/f8ee2270409f7a13125cd414c450740af605a175/src/Sql/dbo/Auth/Stored%20Procedures/AuthRequest_DeleteIfExpired.sql
-        let expiry_time = Utc::now().naive_utc() - chrono::TimeDelta::minutes(15);
+        let expiry_time = Utc::now().naive_utc() - chrono::TimeDelta::try_minutes(15).unwrap();
         for auth_request in Self::find_created_before(&expiry_time, conn).await {
             auth_request.delete(conn).await.ok();
         }
diff --git a/src/db/models/cipher.rs b/src/db/models/cipher.rs
index 68f97c13..164f5f23 100644
--- a/src/db/models/cipher.rs
+++ b/src/db/models/cipher.rs
@@ -1,4 +1,4 @@
-use std::{borrow::Cow, collections::HashSet};
+use std::borrow::Cow;
 
 use chrono::{NaiveDateTime, TimeDelta, Utc};
 use derive_more::{AsRef, Deref, Display, From};
@@ -19,14 +19,13 @@ use crate::{
         },
     },
     error::MapResult,
-    util::{LowerCase, convert_json_key_lcase_first},
+    util::LowerCase,
 };
 use macros::UuidFromParam;
 
 use super::{
     Archive, Attachment, CollectionCipher, CollectionId, Favorite, FolderCipher, FolderId, Group, Membership,
-    MembershipStatus, OrganizationId, User, UserId,
-    organization::{ORG_ADMIN_ATYPES, custom_edit_any_collection},
+    MembershipStatus, MembershipType, OrganizationId, User, UserId,
 };
 
 #[derive(Identifiable, Queryable, Insertable, AsChangeset)]
@@ -64,9 +63,13 @@ pub struct Cipher {
     pub reprompt: Option<i32>,
 }
 
-/// Whether `data` is a v2 cipher blob, recognized like upstream by a top-level `format_version` key.
+/// Whether `data` is a sealed cipher blob rather than the legacy per-type JSON.
 ///
-/// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Core/Vault/Entities/Cipher.cs#L36-L41>
+/// Ciphers of v2 accounts are encrypted as a single blob that carries everything, name included,
+/// and is opaque to us. It is recognized the same way upstream does, by a top-level
+/// `format_version` key that the legacy JSON never has.
+///
+/// Ref: <https://github.com/bitwarden/server/blob/main/src/Core/Vault/Entities/Cipher.cs>
 pub fn is_data_blob_encrypted(data: &str) -> bool {
     serde_json::from_str::<Value>(data).is_ok_and(|d| is_blob_value(&d))
 }
@@ -81,51 +84,9 @@ pub enum RepromptType {
     Password = 1,
 }
 
-/// Which access a cipher operation is authorized with.
-///
-/// The administrative cipher routes (`/ciphers/<id>/admin` and friends) are served by the same handlers as the
-/// regular vault routes, so the handlers state which one applies. They only differ for a Custom member with Edit
-/// any collection, who reaches every cipher of the organization on the administrative routes, but keeps their
-/// own vault limited to the collections they are assigned to.
-#[derive(Clone, Copy, Debug, Eq, PartialEq)]
-pub enum CipherAccessScope {
-    User,
-    OrganizationAdmin,
-}
-
-impl CipherAccessScope {
-    /// Whether `member` reaches every cipher of their organization with this access.
-    fn reaches_all_ciphers(self, member: &Membership) -> bool {
-        match self {
-            CipherAccessScope::User => member.has_full_access(),
-            CipherAccessScope::OrganizationAdmin => member.can_edit_any_collection(),
-        }
-    }
-
-    /// The access the v2 attachment upload asks for with `adminRequest`. It only picks which check runs, the
-    /// administrative one still needs a member who may edit any collection.
-    pub fn requested(admin_request: Option<bool>) -> Self {
-        if admin_request == Some(true) {
-            CipherAccessScope::OrganizationAdmin
-        } else {
-            CipherAccessScope::User
-        }
-    }
-
-    /// The access for a route that does not tell which one it is, from the member's own membership.
-    pub fn for_member(member: Option<&Membership>) -> Self {
-        if member.is_some_and(Membership::can_edit_any_collection) {
-            CipherAccessScope::OrganizationAdmin
-        } else {
-            CipherAccessScope::User
-        }
-    }
-}
-
 /// Local methods
 impl Cipher {
-    /// The name is set when the data is saved, since a blob-encrypted cipher has it inside `data`
-    pub fn new(atype: i32) -> Self {
+    pub fn new(atype: i32, name: String) -> Self {
         let now = Utc::now().naive_utc();
 
         Self {
@@ -139,7 +100,7 @@ impl Cipher {
             key: None,
 
             atype,
-            name: String::new(),
+            name,
 
             notes: None,
             fields: None,
@@ -165,15 +126,10 @@ impl Cipher {
                     .insert(format!("Ciphers[{index}].Notes"), serde_json::to_value([&max_note_size_msg]).unwrap());
             }
 
-            let is_blob = cipher.is_blob();
-            if let Err(e) = cipher.validate_content(is_blob) {
+            if let Err(e) = cipher.validate_content(cipher.is_blob()) {
                 validation_errors
                     .insert(format!("Ciphers[{index}].{}", e.field), serde_json::to_value([e.message]).unwrap());
             }
-            if let Err(e) = cipher.validate_type_data(is_blob) {
-                validation_errors
-                    .insert(format!("Ciphers[{index}].Type"), serde_json::to_value([e.message()]).unwrap());
-            }
 
             // Validate the password history if it contains `null` values and if so, return a warning
             if let Some(Value::Array(password_history)) = &cipher.password_history {
@@ -216,51 +172,12 @@ impl Cipher {
         cipher_sync_data: Option<&CipherSyncData>,
         sync_type: CipherSyncType,
         conn: &DbConn,
-    ) -> Result<Value, crate::Error> {
-        self.to_json_scoped(host, user_uuid, cipher_sync_data, sync_type, CipherAccessScope::User, conn).await
-    }
-
-    /// [`Cipher::to_json`] for an administrative route, telling what the member may do with the cipher there.
-    pub async fn to_json_org_admin(
-        &self,
-        host: &str,
-        user_uuid: &UserId,
-        conn: &DbConn,
-    ) -> Result<Value, crate::Error> {
-        self.to_json_scoped(host, user_uuid, None, CipherSyncType::User, CipherAccessScope::OrganizationAdmin, conn)
-            .await
-    }
-
-    pub async fn to_json_org_admin_collections(
-        &self,
-        host: &str,
-        user_uuid: &UserId,
-        conn: &DbConn,
-    ) -> Result<Value, crate::Error> {
-        self.to_json_scoped(
-            host,
-            user_uuid,
-            None,
-            CipherSyncType::Organization,
-            CipherAccessScope::OrganizationAdmin,
-            conn,
-        )
-        .await
-    }
-
-    async fn to_json_scoped(
-        &self,
-        host: &str,
-        user_uuid: &UserId,
-        cipher_sync_data: Option<&CipherSyncData>,
-        sync_type: CipherSyncType,
-        scope: CipherAccessScope,
-        conn: &DbConn,
     ) -> Result<Value, crate::Error> {
         use crate::util::{format_date, validate_and_format_date};
 
-        // Parsed once, since `data` can be large and this runs for every cipher in a sync
-        let type_data = serde_json::from_str::<Value>(&self.data);
+        // Parsed once here, since `data` can be large and this runs for every cipher in a sync.
+        // `LowerCase` only lowercases the first letter of each key, so it keeps `format_version`.
+        let type_data = serde_json::from_str::<LowerCase<Value>>(&self.data).map(|d| d.data);
         let is_blob_encrypted = type_data.as_ref().is_ok_and(is_blob_value);
 
         let mut attachments_json: Value = Value::Null;
@@ -288,7 +205,7 @@ impl Cipher {
         // We don't need these values at all for Organizational syncs
         // Skip any other database calls if this is the case and just return false.
         let (read_only, hide_passwords, _) = if sync_type == CipherSyncType::User {
-            if let Some((ro, hp, mn)) = self.get_access_restrictions(user_uuid, scope, cipher_sync_data, conn).await {
+            if let Some((ro, hp, mn)) = self.get_access_restrictions(user_uuid, cipher_sync_data, conn).await {
                 (ro, hp, mn)
             } else {
                 error!("Cipher ownership assertion failure");
@@ -298,70 +215,62 @@ impl Cipher {
             (false, false, false)
         };
 
-        let fields_json: Vec<_> = self
-            .fields
-            .as_ref()
-            .and_then(|s| {
-                serde_json::from_str::<Vec<LowerCase<Value>>>(s)
-                    .inspect_err(|e| warn!("Error parsing fields {e:?} for {}", self.uuid))
-                    .ok()
-            })
-            .map(|d| {
-                d.into_iter()
-                    .map(|mut f| {
-                        // Check if the `type` key is a number, strings break some clients
-                        // The fallback type is the hidden type `1`. this should prevent accidental data disclosure
-                        // If not try to convert the string value to a number and fallback to `1`
-                        // If it is both not a number and not a string, fallback to `1`
-                        match f.data.get("type") {
-                            Some(t) if t.is_number() => {}
-                            Some(t) if t.is_string() => {
-                                let type_num = &t.as_str().unwrap_or("1").parse::<u8>().unwrap_or(1);
-                                f.data["type"] = json!(type_num);
+        // Like upstream, a cipher that was stored without fields or password history reports them as
+        // null rather than as an empty list; clients keep the two apart.
+        let fields_json: Option<Vec<_>> = self.fields.as_ref().map(|s| {
+            serde_json::from_str::<Vec<LowerCase<Value>>>(s)
+                .inspect_err(|e| warn!("Error parsing fields {e:?} for {}", self.uuid))
+                .ok()
+                .map(|d| {
+                    d.into_iter()
+                        .map(|mut f| {
+                            // Check if the `type` key is a number, strings break some clients
+                            // The fallback type is the hidden type `1`. this should prevent accidental data disclosure
+                            // If not try to convert the string value to a number and fallback to `1`
+                            // If it is both not a number and not a string, fallback to `1`
+                            match f.data.get("type") {
+                                Some(t) if t.is_number() => {}
+                                Some(t) if t.is_string() => {
+                                    let type_num = &t.as_str().unwrap_or("1").parse::<u8>().unwrap_or(1);
+                                    f.data["type"] = json!(type_num);
+                                }
+                                _ => {
+                                    f.data["type"] = json!(1);
+                                }
                             }
-                            _ => {
-                                f.data["type"] = json!(1);
-                            }
-                        }
-                        f.data
-                    })
-                    .collect()
-            })
-            .unwrap_or_default();
+                            f.data
+                        })
+                        .collect()
+                })
+                .unwrap_or_default()
+        });
 
-        let password_history_json: Vec<_> = self
-            .password_history
-            .as_ref()
-            .and_then(|s| {
-                serde_json::from_str::<Vec<LowerCase<Value>>>(s)
-                    .inspect_err(|e| warn!("Error parsing password history {e:?} for {}", self.uuid))
-                    .ok()
-            })
-            .map(|d| {
-                // Check every password history item if they are valid and return it.
-                // If a password field has the type `null` skip it, it breaks newer Bitwarden clients
-                // A second check is done to verify the lastUsedDate exists and is a valid DateTime string, if not the epoch start time will be used
-                d.into_iter()
-                    .filter_map(|d| match d.data.get("password") {
-                        Some(p) if p.is_string() => Some(d.data),
-                        _ => None,
-                    })
-                    .map(|mut d| {
-                        let lud = if let Some(l) = d.get("lastUsedDate").and_then(|l| l.as_str()) {
-                            validate_and_format_date(l)
-                        } else {
-                            "1970-01-01T00:00:00.000000Z".to_owned()
-                        };
-                        d["lastUsedDate"] = json!(lud);
-                        d
-                    })
-                    .collect()
-            })
-            .unwrap_or_default();
-
-        // Like upstream, fields and password history stored as NULL are sent as null, not `[]`
-        let fields_json = self.fields.is_some().then_some(fields_json);
-        let password_history_json = self.password_history.is_some().then_some(password_history_json);
+        let password_history_json: Option<Vec<_>> = self.password_history.as_ref().map(|s| {
+            serde_json::from_str::<Vec<LowerCase<Value>>>(s)
+                .inspect_err(|e| warn!("Error parsing password history {e:?} for {}", self.uuid))
+                .ok()
+                .map(|d| {
+                    // Check every password history item if they are valid and return it.
+                    // If a password field has the type `null` skip it, it breaks newer Bitwarden clients
+                    // A second check is done to verify the lastUsedDate exists and is a valid DateTime string, if not the epoch start time will be used
+                    d.into_iter()
+                        .filter_map(|d| match d.data.get("password") {
+                            Some(p) if p.is_string() => Some(d.data),
+                            _ => None,
+                        })
+                        .map(|mut d| {
+                            let lud = if let Some(l) = d.get("lastUsedDate").and_then(|l| l.as_str()) {
+                                validate_and_format_date(l)
+                            } else {
+                                "1970-01-01T00:00:00.000000Z".to_owned()
+                            };
+                            d["lastUsedDate"] = json!(lud);
+                            d
+                        })
+                        .collect()
+                })
+                .unwrap_or_default()
+        });
 
         let collection_ids = if let Some(cipher_sync_data) = cipher_sync_data {
             if let Some(cipher_collections) = cipher_sync_data.cipher_collections.get(&self.uuid) {
@@ -370,7 +279,7 @@ impl Cipher {
                 Cow::from(Vec::new())
             }
         } else {
-            Cow::from(self.get_admin_collections(user_uuid.clone(), scope, conn).await)
+            Cow::from(self.get_admin_collections(user_uuid.clone(), conn).await)
         };
 
         // There are three types of cipher response models in upstream
@@ -459,7 +368,8 @@ impl Cipher {
         };
 
         if is_blob_encrypted {
-            // Like upstream, sent as-is with the structured fields null
+            // The blob holds all of the content, so it is sent back as-is and the structured fields
+            // stay null, as upstream does. Only the name needs clearing, the others are never stored.
             json_object["data"] = json!(self.data);
             json_object["name"] = Value::Null;
         } else {
@@ -468,18 +378,16 @@ impl Cipher {
         Ok(json_object)
     }
 
-    /// The per-type data of a legacy cipher, with fixups for values known to break clients.
+    /// The per-type data (`login`, `card`, …) of a legacy cipher, from `type_data` as parsed from
+    /// `self.data`, with fixups for values that are known to break clients.
     fn legacy_type_data_json(&self, type_data: Result<Value, serde_json::Error>) -> Value {
         use crate::util::validate_and_format_date;
 
         // Get the type_data or a default to an empty json object '{}'.
         // If not passing an empty object, mobile clients will crash.
-        let mut type_data_json = if let Ok(data @ Value::Object(_)) = type_data {
-            convert_json_key_lcase_first(data)
-        } else {
-            warn!("Error parsing data field for {}", self.uuid);
-            Value::Object(serde_json::Map::new())
-        };
+        let mut type_data_json = type_data
+            .inspect_err(|_| warn!("Error parsing data field for {}", self.uuid))
+            .unwrap_or_else(|_| Value::Object(serde_json::Map::new()));
 
         // NOTE: This was marked as *Backwards Compatibility Code*, but as of January 2021 this is still being used by upstream
         // Set the first element of the Uris array as Uri, this is needed several (mobile) clients.
@@ -623,22 +531,12 @@ impl Cipher {
 
     /// Purge all ciphers that are old enough to be auto-deleted.
     pub async fn purge_trash(conn: &DbConn) {
-        let Some(auto_delete_days) = CONFIG.trash_auto_delete_days().filter(|&d| d != 0) else {
-            debug!("trash_auto_delete_days is not configured or set to 0, skipping");
-            return;
-        };
-
-        let Some(days) = TimeDelta::try_days(i64::from(auto_delete_days)) else {
-            error!("Unable to calculate auto delete days!");
-            return;
-        };
-        let now = Utc::now().naive_utc();
-        let Some(dt) = now.checked_sub_signed(days) else {
-            error!("Unable to calculate trash purge date!");
-            return;
-        };
-        for cipher in Self::find_deleted_before(&dt, conn).await {
-            cipher.delete(conn).await.ok();
+        if let Some(auto_delete_days) = CONFIG.trash_auto_delete_days() {
+            let now = Utc::now().naive_utc();
+            let dt = now - TimeDelta::try_days(auto_delete_days).unwrap();
+            for cipher in Self::find_deleted_before(&dt, conn).await {
+                cipher.delete(conn).await.ok();
+            }
         }
     }
 
@@ -649,16 +547,7 @@ impl Cipher {
         conn: &DbConn,
     ) -> EmptyResult {
         User::update_uuid_revision(user_uuid, conn).await;
-        self.move_to_folder_without_revision_update(folder_uuid, user_uuid, conn).await
-    }
 
-    /// Same as `move_to_folder`, but the caller is responsible for updating the user's revision.
-    pub async fn move_to_folder_without_revision_update(
-        &self,
-        folder_uuid: Option<FolderId>,
-        user_uuid: &UserId,
-        conn: &DbConn,
-    ) -> EmptyResult {
         match (self.get_folder_uuid(user_uuid, conn).await, folder_uuid) {
             // No changes
             (None, None) => Ok(()),
@@ -691,21 +580,20 @@ impl Cipher {
         self.user_uuid.is_some() && self.user_uuid.as_ref().unwrap() == user_uuid
     }
 
-    /// Returns whether this cipher is owned by an org in which the user reaches every cipher with `scope`.
+    /// Returns whether this cipher is owned by an org in which the user has full access.
     async fn is_in_full_access_org(
         &self,
         user_uuid: &UserId,
-        scope: CipherAccessScope,
         cipher_sync_data: Option<&CipherSyncData>,
         conn: &DbConn,
     ) -> bool {
         if let Some(ref org_uuid) = self.organization_uuid {
             if let Some(cipher_sync_data) = cipher_sync_data {
                 if let Some(cached_member) = cipher_sync_data.members.get(org_uuid) {
-                    return scope.reaches_all_ciphers(cached_member);
+                    return cached_member.has_full_access();
                 }
             } else if let Some(member) = Membership::find_confirmed_by_user_and_org(user_uuid, org_uuid, conn).await {
-                return scope.reaches_all_ciphers(&member);
+                return member.has_full_access();
             }
         }
         false
@@ -738,7 +626,6 @@ impl Cipher {
     pub async fn get_access_restrictions(
         &self,
         user_uuid: &UserId,
-        scope: CipherAccessScope,
         cipher_sync_data: Option<&CipherSyncData>,
         conn: &DbConn,
     ) -> Option<(bool, bool, bool)> {
@@ -746,7 +633,7 @@ impl Cipher {
         // a collection that the user has full access to. If so, there are no
         // access restrictions.
         if self.is_owned_by_user(user_uuid)
-            || self.is_in_full_access_org(user_uuid, scope, cipher_sync_data, conn).await
+            || self.is_in_full_access_org(user_uuid, cipher_sync_data, conn).await
             || self.is_in_full_access_group(user_uuid, cipher_sync_data, conn).await
         {
             return Some((false, false, true));
@@ -861,7 +748,6 @@ impl Cipher {
                 // Only allow group access via a confirmed membership, since
                 // groups_users rows are kept when a membership is revoked.
                 .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32))
-                .filter(ciphers::organization_uuid.eq(users_organizations::org_uuid.nullable()))
                 .select((collections_groups::read_only, collections_groups::hide_passwords, collections_groups::manage))
                 .load::<(bool, bool, bool)>(conn)
                 .expect("Error getting group access restrictions")
@@ -869,13 +755,8 @@ impl Cipher {
         .await
     }
 
-    pub async fn is_write_accessible_to_user(
-        &self,
-        user_uuid: &UserId,
-        scope: CipherAccessScope,
-        conn: &DbConn,
-    ) -> bool {
-        match self.get_access_restrictions(user_uuid, scope, None, conn).await {
+    pub async fn is_write_accessible_to_user(&self, user_uuid: &UserId, conn: &DbConn) -> bool {
+        match self.get_access_restrictions(user_uuid, None, conn).await {
             Some((read_only, _hide_passwords, manage)) => !read_only || manage,
             None => false,
         }
@@ -883,20 +764,15 @@ impl Cipher {
 
     // used for checking if collection can be edited (only if user has access to a collection they
     // can write to and also passwords are not hidden to prevent privilege escalation)
-    pub async fn is_in_editable_collection_by_user(
-        &self,
-        user_uuid: &UserId,
-        scope: CipherAccessScope,
-        conn: &DbConn,
-    ) -> bool {
-        match self.get_access_restrictions(user_uuid, scope, None, conn).await {
+    pub async fn is_in_editable_collection_by_user(&self, user_uuid: &UserId, conn: &DbConn) -> bool {
+        match self.get_access_restrictions(user_uuid, None, conn).await {
             Some((read_only, hide_passwords, manage)) => (!read_only && !hide_passwords) || manage,
             None => false,
         }
     }
 
-    pub async fn is_accessible_to_user(&self, user_uuid: &UserId, scope: CipherAccessScope, conn: &DbConn) -> bool {
-        self.get_access_restrictions(user_uuid, scope, None, conn).await.is_some()
+    pub async fn is_accessible_to_user(&self, user_uuid: &UserId, conn: &DbConn) -> bool {
+        self.get_access_restrictions(user_uuid, None, conn).await.is_some()
     }
 
     // Returns whether this cipher is a favorite of the specified user.
@@ -1013,7 +889,7 @@ impl Cipher {
 
                 if !visible_only {
                     query = query.or_filter(
-                        users_organizations::atype.eq_any(ORG_ADMIN_ATYPES), // Org admin/owner
+                        users_organizations::atype.le(MembershipType::Admin as i32), // Org admin/owner
                     );
                 }
 
@@ -1048,7 +924,7 @@ impl Cipher {
 
                 if !visible_only {
                     query = query.or_filter(
-                        users_organizations::atype.eq_any(ORG_ADMIN_ATYPES), // Org admin/owner
+                        users_organizations::atype.le(MembershipType::Admin as i32), // Org admin/owner
                     );
                 }
 
@@ -1164,7 +1040,6 @@ impl Cipher {
                             .eq(ciphers_collections::collection_uuid)
                             .and(collections_groups::groups_uuid.eq(groups::uuid))),
                     )
-                    .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32))
                     .filter(
                         users_organizations::access_all
                             .eq(true) // User has access all
@@ -1196,7 +1071,6 @@ impl Cipher {
                             .eq(ciphers_collections::collection_uuid)
                             .and(users_collections::user_uuid.eq(user_uuid.clone()))),
                     )
-                    .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32))
                     .filter(
                         users_organizations::access_all
                             .eq(true) // User has access all
@@ -1212,12 +1086,7 @@ impl Cipher {
         }
     }
 
-    pub async fn get_admin_collections(
-        &self,
-        user_uuid: UserId,
-        scope: CipherAccessScope,
-        conn: &DbConn,
-    ) -> Vec<CollectionId> {
+    pub async fn get_admin_collections(&self, user_uuid: UserId, conn: &DbConn) -> Vec<CollectionId> {
         if CONFIG.org_groups_enabled() {
             conn.run(move |conn| {
                 ciphers_collections::table
@@ -1246,7 +1115,6 @@ impl Cipher {
                             .eq(ciphers_collections::collection_uuid)
                             .and(collections_groups::groups_uuid.eq(groups::uuid))),
                     )
-                    .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32))
                     .filter(
                         users_organizations::access_all
                             .eq(true) // User has access all
@@ -1257,9 +1125,7 @@ impl Cipher {
                             .or(collections_groups::collections_uuid
                                 .is_not_null() // Access via groups
                                 .and(collections_groups::read_only.eq(false)))
-                            .or(users_organizations::atype.eq_any(ORG_ADMIN_ATYPES)) // User is admin or owner
-                            .or(custom_edit_any_collection()
-                                .and::<_, diesel::sql_types::Bool>(scope == CipherAccessScope::OrganizationAdmin)),
+                            .or(users_organizations::atype.le(MembershipType::Admin as i32)), // User is admin or owner
                     )
                     .select(ciphers_collections::collection_uuid)
                     .load::<CollectionId>(conn)
@@ -1281,16 +1147,13 @@ impl Cipher {
                             .eq(ciphers_collections::collection_uuid)
                             .and(users_collections::user_uuid.eq(user_uuid.clone()))),
                     )
-                    .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32))
                     .filter(
                         users_organizations::access_all
                             .eq(true) // User has access all
                             .or(users_collections::user_uuid
                                 .eq(user_uuid) // User has access to collection
                                 .and(users_collections::read_only.eq(false)))
-                            .or(users_organizations::atype.eq_any(ORG_ADMIN_ATYPES)) // User is admin or owner
-                            .or(custom_edit_any_collection()
-                                .and::<_, diesel::sql_types::Bool>(scope == CipherAccessScope::OrganizationAdmin)),
+                            .or(users_organizations::atype.le(MembershipType::Admin as i32)), // User is admin or owner
                     )
                     .select(ciphers_collections::collection_uuid)
                     .load::<CollectionId>(conn)
@@ -1332,10 +1195,9 @@ impl Cipher {
                 )
                 .or_filter(users_collections::user_uuid.eq(user_uuid)) // User has access to collection
                 .or_filter(users_organizations::access_all.eq(true)) // User has access all
-                .or_filter(users_organizations::atype.eq_any(ORG_ADMIN_ATYPES)) // User is admin or owner
+                .or_filter(users_organizations::atype.le(MembershipType::Admin as i32)) // User is admin or owner
                 .or_filter(groups::access_all.eq(true)) //Access via group
                 .or_filter(collections_groups::collections_uuid.is_not_null()) //Access via group
-                .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32))
                 .select(ciphers_collections::all_columns)
                 .distinct()
                 .load::<(CipherId, CollectionId)>(conn)
@@ -1343,50 +1205,6 @@ impl Cipher {
         })
         .await
     }
-
-    /// Every collection of every cipher of the organization, for the members who may see all of them.
-    pub async fn get_collections_with_cipher_by_organization(
-        org_uuid: &OrganizationId,
-        conn: &DbConn,
-    ) -> Vec<(CipherId, CollectionId)> {
-        conn.run(move |conn| {
-            ciphers_collections::table
-                .inner_join(collections::table.on(collections::uuid.eq(ciphers_collections::collection_uuid)))
-                .filter(collections::org_uuid.eq(org_uuid))
-                .select(ciphers_collections::all_columns)
-                .load::<(CipherId, CollectionId)>(conn)
-                .unwrap_or_default()
-        })
-        .await
-    }
-
-    /// The ciphers of the organization of `member` the Admin Console lists when they may not edit every cipher, like
-    /// Bitwarden does: the ones in the member's own vault, then, for a member who may edit any collection, the ones in
-    /// no collection at all.
-    pub async fn find_assigned_to_member(member: &Membership, conn: &DbConn) -> (Vec<Self>, Vec<Self>) {
-        let assigned: Vec<Self> = Self::find_by_user_visible(&member.user_uuid, conn)
-            .await
-            .into_iter()
-            .filter(|cipher| cipher.organization_uuid.as_ref() == Some(&member.org_uuid))
-            .collect();
-        if !member.can_edit_any_collection() {
-            return (assigned, Vec::new());
-        }
-
-        let listed: HashSet<CipherId> = assigned.iter().map(|cipher| cipher.uuid.clone()).collect();
-        let in_collections: HashSet<CipherId> =
-            Self::get_collections_with_cipher_by_organization(&member.org_uuid, conn)
-                .await
-                .into_iter()
-                .map(|(cipher, _)| cipher)
-                .collect();
-        let unassigned = Self::find_by_org(&member.org_uuid, conn)
-            .await
-            .into_iter()
-            .filter(|cipher| !in_collections.contains(&cipher.uuid) && !listed.contains(&cipher.uuid))
-            .collect();
-        (assigned, unassigned)
-    }
 }
 
 #[derive(
diff --git a/src/db/models/collection.rs b/src/db/models/collection.rs
index 4f1533e3..be108f13 100644
--- a/src/db/models/collection.rs
+++ b/src/db/models/collection.rs
@@ -18,7 +18,7 @@ use macros::UuidFromParam;
 
 use super::{
     CipherId, CollectionGroup, GroupUser, Membership, MembershipId, MembershipStatus, MembershipType, OrganizationId,
-    User, UserId, custom_roles_enabled, organization::ORG_ADMIN_ATYPES,
+    User, UserId,
 };
 
 // See (v2026.7.0): https://github.com/bitwarden/server/blob/5d4461aa42cadbacfef8fe2166c5453a5c52773a/src/Core/AdminConsole/Entities/Collection.cs
@@ -109,22 +109,18 @@ impl Collection {
                 Some(m) if m.has_full_access() => (false, false, m.atype >= MembershipType::Manager),
                 Some(m) => {
                     // Only let a manager manage collections when the have full read/write access
-                    // A Custom member only manages a collection with the manage option
                     let is_manager = m.atype == MembershipType::Manager;
-                    let is_custom = m.has_type(MembershipType::Custom) && custom_roles_enabled();
                     if let Some(cu) = cipher_sync_data.user_collections.get(&self.uuid) {
                         (
                             cu.read_only,
                             cu.hide_passwords,
-                            (is_manager && (cu.manage || (!cu.read_only && !cu.hide_passwords)))
-                                || (is_custom && cu.manage),
+                            is_manager && (cu.manage || (!cu.read_only && !cu.hide_passwords)),
                         )
                     } else if let Some(cg) = cipher_sync_data.user_collections_groups.get(&self.uuid) {
                         (
                             cg.read_only,
                             cg.hide_passwords,
-                            (is_manager && (cg.manage || (!cg.read_only && !cg.hide_passwords)))
-                                || (is_custom && cg.manage),
+                            is_manager && (cg.manage || (!cg.read_only && !cg.hide_passwords)),
                         )
                     } else {
                         (false, false, false)
@@ -138,17 +134,6 @@ impl Collection {
                 Some(m) if m.atype == MembershipType::Manager && self.is_manageable_by_user(user_uuid, conn).await => {
                     (false, false, true)
                 }
-                // A Custom member reads and writes every collection with Edit any collection in the Admin Console, but
-                // only manages a collection with the manage option on it
-                Some(m) if m.has_type(MembershipType::Custom) && custom_roles_enabled() => {
-                    let manage = self.is_explicitly_manageable_by_user(user_uuid, conn).await;
-                    if manage || m.can_edit_any_collection() {
-                        (false, false, manage)
-                    } else {
-                        let read_only = !self.is_writable_by_user(user_uuid, conn).await;
-                        (read_only, self.hide_passwords_for_user(user_uuid, conn).await, false)
-                    }
-                }
                 Some(m) => {
                     let is_manager = m.atype == MembershipType::Manager;
                     let read_only = !self.is_writable_by_user(user_uuid, conn).await;
@@ -382,7 +367,6 @@ impl Collection {
                             .and(collections_groups::collections_uuid.eq(collections::uuid))),
                     )
                     .filter(collections::uuid.eq(uuid))
-                    .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32))
                     .filter(
                         users_collections::collection_uuid
                             .eq(uuid)
@@ -390,7 +374,7 @@ impl Collection {
                                 // Directly accessed collection
                                 users_organizations::access_all.eq(true).or(
                                     // access_all in Organization
-                                    users_organizations::atype.eq_any(ORG_ADMIN_ATYPES), // Org admin or owner
+                                    users_organizations::atype.le(MembershipType::Admin as i32), // Org admin or owner
                                 ),
                             )
                             .or(
@@ -422,12 +406,11 @@ impl Collection {
                             .and(users_organizations::user_uuid.eq(user_uuid))),
                     )
                     .filter(collections::uuid.eq(uuid))
-                    .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32))
                     .filter(users_collections::collection_uuid.eq(uuid).or(
                         // Directly accessed collection
                         users_organizations::access_all.eq(true).or(
                             // access_all in Organization
-                            users_organizations::atype.eq_any(ORG_ADMIN_ATYPES), // Org admin or owner
+                            users_organizations::atype.le(MembershipType::Admin as i32), // Org admin or owner
                         ),
                     ))
                     .select(collections::all_columns)
@@ -447,8 +430,7 @@ impl Collection {
                     .inner_join(
                         users_organizations::table.on(collections::org_uuid
                             .eq(users_organizations::org_uuid)
-                            .and(users_organizations::user_uuid.eq(user_uuid.clone()))
-                            .and(users_organizations::status.eq(MembershipStatus::Confirmed as i32))),
+                            .and(users_organizations::user_uuid.eq(user_uuid.clone()))),
                     )
                     .left_join(
                         users_collections::table.on(users_collections::collection_uuid
@@ -470,7 +452,7 @@ impl Collection {
                     )
                     .filter(
                         users_organizations::atype
-                            .eq_any(ORG_ADMIN_ATYPES) // Org admin or owner
+                            .le(MembershipType::Admin as i32) // Org admin or owner
                             .or(users_organizations::access_all.eq(true)) // access_all via membership
                             .or(users_collections::collection_uuid
                                 .eq(&self.uuid) // write access given to collection
@@ -494,8 +476,7 @@ impl Collection {
                     .inner_join(
                         users_organizations::table.on(collections::org_uuid
                             .eq(users_organizations::org_uuid)
-                            .and(users_organizations::user_uuid.eq(user_uuid.clone()))
-                            .and(users_organizations::status.eq(MembershipStatus::Confirmed as i32))),
+                            .and(users_organizations::user_uuid.eq(user_uuid.clone()))),
                     )
                     .left_join(
                         users_collections::table.on(users_collections::collection_uuid
@@ -504,7 +485,7 @@ impl Collection {
                     )
                     .filter(
                         users_organizations::atype
-                            .eq_any(ORG_ADMIN_ATYPES) // Org admin or owner
+                            .le(MembershipType::Admin as i32) // Org admin or owner
                             .or(users_organizations::access_all.eq(true)) // access_all via membership
                             .or(users_collections::collection_uuid
                                 .eq(&self.uuid) // write access given to collection
@@ -546,7 +527,6 @@ impl Collection {
                         .and(collections_groups::collections_uuid.eq(collections::uuid))),
                 )
                 .filter(collections::uuid.eq(&self.uuid))
-                .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32))
                 .filter(
                     users_collections::collection_uuid
                         .eq(&self.uuid)
@@ -555,7 +535,7 @@ impl Collection {
                             // Directly accessed collection
                             users_organizations::access_all.eq(true).or(
                                 // access_all in Organization
-                                users_organizations::atype.eq_any(ORG_ADMIN_ATYPES), // Org admin or owner
+                                users_organizations::atype.le(MembershipType::Admin as i32), // Org admin or owner
                             ),
                         )
                         .or(
@@ -606,7 +586,6 @@ impl Collection {
                         .and(collections_groups::collections_uuid.eq(collections::uuid))),
                 )
                 .filter(collections::uuid.eq(&uuid))
-                .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32))
                 .filter(
                     users_collections::collection_uuid
                         .eq(&uuid)
@@ -615,7 +594,7 @@ impl Collection {
                             // Directly accessed collection
                             users_organizations::access_all.eq(true).or(
                                 // access_all in Organization
-                                users_organizations::atype.eq_any(ORG_ADMIN_ATYPES), // Org admin or owner
+                                users_organizations::atype.le(MembershipType::Admin as i32), // Org admin or owner
                             ),
                         )
                         .or(
@@ -650,23 +629,8 @@ impl Collection {
         user_uuid: &UserId,
         conn: &DbConn,
     ) -> bool {
-        !Self::find_explicitly_manageable_by_user(org_uuid, user_uuid, conn).await.is_empty()
-    }
-
-    pub async fn is_explicitly_manageable_by_user(&self, user_uuid: &UserId, conn: &DbConn) -> bool {
-        Self::find_explicitly_manageable_by_user(&self.org_uuid, user_uuid, conn).await.contains(&self.uuid)
-    }
-
-    // The collections of the org the user has manage access to by the manage option, directly or via a group.
-    // Unlike is_coll_manageable_by_user, neither the role nor any access_all counts.
-    pub async fn find_explicitly_manageable_by_user(
-        org_uuid: &OrganizationId,
-        user_uuid: &UserId,
-        conn: &DbConn,
-    ) -> Vec<CollectionId> {
         let org_uuid = org_uuid.to_string();
         let user_uuid = user_uuid.to_string();
-        let groups_enabled = CONFIG.org_groups_enabled();
         conn.run(move |conn| {
             collections::table
                 .left_join(
@@ -686,18 +650,15 @@ impl Collection {
                         .and(collections_groups::collections_uuid.eq(collections::uuid))),
                 )
                 .filter(collections::org_uuid.eq(&org_uuid))
-                .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32))
                 .filter(
-                    users_collections::manage.eq(true).or(users_collections::user_uuid
-                        .is_null()
-                        .or(users_organizations::atype.eq(MembershipType::Manager as i32))
-                        .and(collections_groups::manage.eq(true))
-                        .and::<_, diesel::sql_types::Bool>(groups_enabled)),
+                    // Manage permission on a collection assigned directly or via a group.
+                    users_collections::manage.eq(true).or(collections_groups::manage.eq(true)),
                 )
-                .select(collections::uuid)
-                .distinct()
-                .load::<CollectionId>(conn)
-                .unwrap_or_default()
+                .count()
+                .first::<i64>(conn)
+                .ok()
+                .unwrap_or(0)
+                != 0
         })
         .await
     }
@@ -858,18 +819,10 @@ impl CollectionUser {
         .await
     }
 
-    // Only returns the collections of organizations the user is a confirmed member of
     pub async fn find_by_user(user_uuid: &UserId, conn: &DbConn) -> Vec<Self> {
         conn.run(move |conn| {
             users_collections::table
-                .inner_join(collections::table.on(collections::uuid.eq(users_collections::collection_uuid)))
-                .inner_join(
-                    users_organizations::table.on(users_organizations::org_uuid
-                        .eq(collections::org_uuid)
-                        .and(users_organizations::user_uuid.eq(users_collections::user_uuid))),
-                )
                 .filter(users_collections::user_uuid.eq(user_uuid))
-                .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32))
                 .select(users_collections::all_columns)
                 .load::<Self>(conn)
                 .expect("Error loading users_collections")
diff --git a/src/db/models/emergency_access.rs b/src/db/models/emergency_access.rs
index 02c05d5e..09783061 100644
--- a/src/db/models/emergency_access.rs
+++ b/src/db/models/emergency_access.rs
@@ -1,4 +1,4 @@
-use chrono::{NaiveDateTime, TimeDelta, Utc};
+use chrono::{NaiveDateTime, Utc};
 use derive_more::{AsRef, Deref, Display, From};
 use diesel::prelude::*;
 use serde_json::Value;
@@ -112,26 +112,8 @@ impl EmergencyAccess {
             "object": "emergencyAccessGranteeDetails",
         }))
     }
-
-    pub fn deadline_at(&self) -> Result<NaiveDateTime, crate::Error> {
-        if !(EMERGENCY_ACCESS_TIMEOUT_RANGE).contains(&self.wait_time_days) {
-            err!("Emergency access wait time is out-of-bounds!")
-        }
-
-        let initiated_at = self.recovery_initiated_at.map_res("Emergency access initiation date missing!")?;
-
-        TimeDelta::try_days(i64::from(self.wait_time_days))
-            .and_then(|w| initiated_at.checked_add_signed(w))
-            .map_res("Emergency access deadline is invalid")
-    }
-
-    pub fn is_recovery_allowed(&self, now: &NaiveDateTime) -> Result<bool, crate::Error> {
-        Ok(self.deadline_at()?.le(now))
-    }
 }
 
-pub const EMERGENCY_ACCESS_TIMEOUT_RANGE: std::ops::RangeInclusive<i32> = 1..=90;
-
 #[derive(Copy, Clone)]
 pub enum EmergencyAccessType {
     View = 0,
@@ -187,42 +169,27 @@ impl EmergencyAccess {
 
     pub async fn update_access_status_and_save(
         &mut self,
-        from_status: i32,
-        to_status: i32,
+        status: i32,
         date: &NaiveDateTime,
         conn: &DbConn,
     ) -> EmptyResult {
-        let uuid = self.uuid.clone();
-        let updated_at = *date;
-        let res = conn
-            .run(move |conn| {
-                crate::util::retry(
-                    || {
-                        diesel::update(
-                            emergency_access::table
-                                .filter(emergency_access::uuid.eq(&uuid))
-                                .filter(emergency_access::status.eq(from_status)),
-                        )
-                        .set((emergency_access::status.eq(to_status), emergency_access::updated_at.eq(updated_at)))
-                        .execute(conn)
-                    },
-                    10,
-                )
-            })
-            .await;
-
-        match res {
-            Ok(1) => {} // One record updated, which is valid
-            Ok(_) => err!("Emergency access status was changed already"),
-            Err(e) => err!("Error updating emergency access status", format!("{e}")),
-        }
-
-        self.status = to_status;
-        self.updated_at = updated_at;
-
         // Update the grantee so that it will refresh it's status.
         User::update_uuid_revision(self.grantee_uuid.as_ref().expect("Error getting grantee"), conn).await;
-        Ok(())
+        self.status = status;
+        date.clone_into(&mut self.updated_at);
+
+        conn.run(move |conn| {
+            crate::util::retry(
+                || {
+                    diesel::update(emergency_access::table.filter(emergency_access::uuid.eq(&self.uuid)))
+                        .set((emergency_access::status.eq(status), emergency_access::updated_at.eq(date)))
+                        .execute(conn)
+                },
+                10,
+            )
+            .map_res("Error updating emergency access status")
+        })
+        .await
     }
 
     pub async fn update_last_notification_date_and_save(&mut self, date: &NaiveDateTime, conn: &DbConn) -> EmptyResult {
diff --git a/src/db/models/event.rs b/src/db/models/event.rs
index e020bb3d..cc0eb504 100644
--- a/src/db/models/event.rs
+++ b/src/db/models/event.rs
@@ -79,7 +79,6 @@ pub enum EventType {
     CipherSoftDeleted = 1115,
     CipherRestored = 1116,
     CipherClientToggledCardNumberVisible = 1117,
-    CipherClientHttpAuthReleased = 1133,
 
     // Collection
     CollectionCreated = 1300,
@@ -112,8 +111,8 @@ pub enum EventType {
     // OrganizationUserAutomaticallyConfirmed = 1517,
     // OrganizationUserSelfRevoked = 1518, // User self-revoked due to declining organization data ownership policy
     OrganizationUserAdminResetTwoFactor = 1519,
-    OrganizationUserRevokedTwoFactorNonCompliance = 1520,
-    OrganizationUserRevokedSingleOrganizationNonCompliance = 1521,
+    // OrganizationUserRevoked_TwoFactorNonCompliance = 1520,
+    // OrganizationUserRevoked_SingleOrganizationNonCompliance = 1521,
     OrganizationUserNotificationBannerActionClicked = 1522,
 
     // Organization
@@ -348,23 +347,17 @@ impl Event {
     }
 
     pub async fn clean_events(conn: &DbConn) -> EmptyResult {
-        let Some(days_to_retain) = CONFIG.events_days_retain().filter(|&d| d != 0) else {
-            return Ok(());
-        };
-
-        let Some(days_to_retain) = TimeDelta::try_days(i64::from(days_to_retain)) else {
-            err!("Unable to calculate the event retention date, check 'EVENTS_DAYS_RETAIN'")
-        };
-
-        let Some(dt) = Utc::now().naive_utc().checked_sub_signed(days_to_retain) else {
-            err!("Unable to calculate the event retention date, check 'EVENTS_DAYS_RETAIN'")
-        };
-        conn.run(move |conn| {
-            diesel::delete(event::table.filter(event::event_date.lt(dt)))
-                .execute(conn)
-                .map_res("Error cleaning old events")
-        })
-        .await
+        if let Some(days_to_retain) = CONFIG.events_days_retain() {
+            let dt = Utc::now().naive_utc() - TimeDelta::try_days(days_to_retain).unwrap();
+            conn.run(move |conn| {
+                diesel::delete(event::table.filter(event::event_date.lt(dt)))
+                    .execute(conn)
+                    .map_res("Error cleaning old events")
+            })
+            .await
+        } else {
+            Ok(())
+        }
     }
 }
 
diff --git a/src/db/models/group.rs b/src/db/models/group.rs
index c8df7ef2..d39a15e7 100644
--- a/src/db/models/group.rs
+++ b/src/db/models/group.rs
@@ -104,6 +104,7 @@ impl Group {
             "id": self.uuid,
             "organizationId": self.organizations_uuid,
             "name": self.name,
+            "accessAll": self.access_all,
             "externalId": self.external_id,
             "collections": collections_groups,
             "object": "groupDetails"
@@ -137,15 +138,15 @@ impl CollectionGroup {
     }
 
     pub fn to_json_details_for_group(&self) -> Value {
-        // Return the stored manage flag. Deriving it from !read_only && !hide_passwords turned the group
-        // permission "Can edit items" (readOnly=false, hidePasswords=false, manage=false) into "Can manage"
-        // in GET /organizations/<org>/collections/details, while GET /groups/<id>/details reported the stored
-        // value. Saving the collection access dialog then persisted manage=true.
+        // If both read_only and hide_passwords are false, then manage should be true
+        // You can't have an entry with read_only and manage, or hide_passwords and manage
+        // Or an entry with everything to false
+        // For backwards compatibility and migration proposes we keep checking read_only and hide_password
         json!({
             "id": self.groups_uuid,
             "readOnly": self.read_only,
             "hidePasswords": self.hide_passwords,
-            "manage": self.manage,
+            "manage": self.manage || (!self.read_only && !self.hide_passwords),
         })
     }
 }
@@ -248,7 +249,6 @@ impl Group {
                         .and(groups::organizations_uuid.eq(users_organizations::org_uuid))),
                 )
                 .filter(users_organizations::user_uuid.eq(user_uuid))
-                .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32))
                 .filter(groups::access_all.eq(true))
                 .select(groups::organizations_uuid)
                 .distinct()
@@ -387,7 +387,6 @@ impl CollectionGroup {
                         .and(collections::org_uuid.eq(groups::organizations_uuid))),
                 )
                 .filter(users_organizations::user_uuid.eq(user_uuid))
-                .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32))
                 .select(collections_groups::all_columns)
                 .load::<Self>(conn)
                 .expect("Error loading user collection groups")
@@ -573,6 +572,26 @@ impl GroupUser {
         }
     }
 
+    pub async fn delete_by_group_and_member(
+        group_uuid: &GroupId,
+        member_uuid: &MembershipId,
+        conn: &DbConn,
+    ) -> EmptyResult {
+        match Membership::find_by_uuid(member_uuid, conn).await {
+            Some(member) => User::update_uuid_revision(&member.user_uuid, conn).await,
+            None => warn!("Member could not be found!"),
+        }
+
+        conn.run(move |conn| {
+            diesel::delete(groups_users::table)
+                .filter(groups_users::groups_uuid.eq(group_uuid))
+                .filter(groups_users::users_organizations_uuid.eq(member_uuid))
+                .execute(conn)
+                .map_res("Error deleting group users")
+        })
+        .await
+    }
+
     pub async fn delete_all_by_group(group_uuid: &GroupId, org_uuid: &OrganizationId, conn: &DbConn) -> EmptyResult {
         let group_users = GroupUser::find_by_group(group_uuid, org_uuid, conn).await;
         for group_user in group_users {
diff --git a/src/db/models/mod.rs b/src/db/models/mod.rs
index e4e77c4d..5131a0fd 100644
--- a/src/db/models/mod.rs
+++ b/src/db/models/mod.rs
@@ -22,22 +22,18 @@ mod user_signature_key_pair;
 pub use self::archive::Archive;
 pub use self::attachment::{Attachment, AttachmentId};
 pub use self::auth_request::{AuthRequest, AuthRequestId};
-pub use self::cipher::{Cipher, CipherAccessScope, CipherId, RepromptType, is_data_blob_encrypted};
+pub use self::cipher::{Cipher, CipherId, RepromptType, is_data_blob_encrypted};
 pub use self::collection::{Collection, CollectionCipher, CollectionId, CollectionUser};
 pub use self::device::{Device, DeviceId, DeviceType, DeviceWithAuthRequest, PushId};
-pub use self::emergency_access::{
-    EMERGENCY_ACCESS_TIMEOUT_RANGE, EmergencyAccess, EmergencyAccessId, EmergencyAccessStatus, EmergencyAccessType,
-};
+pub use self::emergency_access::{EmergencyAccess, EmergencyAccessId, EmergencyAccessStatus, EmergencyAccessType};
 pub use self::event::{Event, EventType};
 pub use self::favorite::Favorite;
 pub use self::folder::{Folder, FolderCipher, FolderId};
 pub use self::group::{CollectionGroup, Group, GroupId, GroupUser};
-pub use self::org_policy::{FillAssistPolicyData, OrgPolicy, OrgPolicyId, OrgPolicyType};
-#[cfg(all(test, sqlite))]
-pub(crate) use self::organization::test_flag;
+pub use self::org_policy::{OrgPolicy, OrgPolicyId, OrgPolicyType};
 pub use self::organization::{
-    CustomPermission, Membership, MembershipId, MembershipStatus, MembershipType, OrgApiKeyId, Organization,
-    OrganizationApiKey, OrganizationId, custom_roles_enabled,
+    Membership, MembershipId, MembershipStatus, MembershipType, OrgApiKeyId, Organization, OrganizationApiKey,
+    OrganizationId,
 };
 pub use self::send::{Send, SendFileId, SendId, SendType};
 pub use self::sso_auth::{OIDCAuthenticatedUser, OIDCCodeResponseError, SsoAuth};
diff --git a/src/db/models/org_policy.rs b/src/db/models/org_policy.rs
index 554f51fc..94e53cbd 100644
--- a/src/db/models/org_policy.rs
+++ b/src/db/models/org_policy.rs
@@ -1,4 +1,3 @@
-use chrono::{NaiveDateTime, Utc};
 use derive_more::{AsRef, From};
 use diesel::prelude::*;
 use serde::Deserialize;
@@ -12,7 +11,6 @@ use crate::{
         schema::{org_policies, users_organizations},
     },
     error::MapResult,
-    util::format_date,
 };
 
 use super::{Membership, MembershipId, MembershipStatus, MembershipType, OrganizationId, TwoFactor, UserId};
@@ -26,7 +24,6 @@ pub struct OrgPolicy {
     pub atype: i32,
     pub enabled: bool,
     pub data: String,
-    pub revision_date: NaiveDateTime,
 }
 
 // https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Core/AdminConsole/Enums/PolicyType.cs
@@ -49,12 +46,10 @@ pub enum OrgPolicyType {
     RemoveUnlockWithPin = 14,
     RestrictedItemTypes = 15,
     UriMatchDefaults = 16,
-    AutotypeDefaultSetting = 17,
+    // AutotypeDefaultSetting = 17, // Not supported yet
     // AutoConfirm = 18, // Not supported (not implemented yet)
     // BlockClaimedDomainAccountCreation = 19, // Not supported (Not AGPLv3 Licensed)
     OrganizationUserNotification = 20,
-    // SendControls = 21, // Not supported yet
-    FillAssist = 22,
 }
 
 // https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Core/AdminConsole/Models/Data/Organizations/Policies/SendOptionsPolicyData.cs#L5
@@ -73,14 +68,6 @@ pub struct ResetPasswordDataModel {
     pub auto_enroll_enabled: bool,
 }
 
-// https://github.com/bitwarden/server/blob/13bc813de8e715a71d3410f1e584e87ccdf76025/src/Core/AdminConsole/Models/Data/Organizations/Policies/FillAssistPolicyData.cs
-#[derive(Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct FillAssistPolicyData {
-    #[serde(alias = "RulesUrl")]
-    pub rules_url: Option<String>,
-}
-
 /// Local methods
 impl OrgPolicy {
     pub fn new(org_uuid: OrganizationId, atype: OrgPolicyType, enabled: bool, data: String) -> Self {
@@ -90,7 +77,6 @@ impl OrgPolicy {
             atype: atype as i32,
             enabled,
             data,
-            revision_date: Utc::now().naive_utc(),
         }
     }
 
@@ -106,7 +92,7 @@ impl OrgPolicy {
             "type": self.atype,
             "data": data_json,
             "enabled": self.enabled,
-            "revisionDate": format_date(&self.revision_date),
+            "revisionDate": null,
             "object": "policy",
         });
 
@@ -124,13 +110,11 @@ impl OrgPolicy {
 
 /// Database methods
 impl OrgPolicy {
-    pub async fn save(&mut self, conn: &DbConn) -> EmptyResult {
-        self.revision_date = Utc::now().naive_utc();
-
+    pub async fn save(&self, conn: &DbConn) -> EmptyResult {
         db_run! { conn:
             sqlite, mysql {
                 match diesel::replace_into(org_policies::table)
-                    .values(&*self)
+                    .values(self)
                     .execute(conn)
                 {
                     Ok(_) => Ok(()),
@@ -138,7 +122,7 @@ impl OrgPolicy {
                     Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
                         diesel::update(org_policies::table)
                             .filter(org_policies::uuid.eq(&self.uuid))
-                            .set(&*self)
+                            .set(self)
                             .execute(conn)
                             .map_res("Error saving org_policy")
                     }
@@ -158,10 +142,10 @@ impl OrgPolicy {
                 .map_res("Error deleting org_policy for insert")?;
 
                 diesel::insert_into(org_policies::table)
-                    .values(&*self)
+                    .values(self)
                     .on_conflict(org_policies::uuid)
                     .do_update()
-                    .set(&*self)
+                    .set(self)
                     .execute(conn)
                     .map_res("Error saving org_policy")
             }
diff --git a/src/db/models/organization.rs b/src/db/models/organization.rs
index 7eb2260b..2de993b1 100644
--- a/src/db/models/organization.rs
+++ b/src/db/models/organization.rs
@@ -24,8 +24,8 @@ use crate::{
 use macros::UuidFromParam;
 
 use super::{
-    Cipher, CipherId, Collection, CollectionId, CollectionUser, Group, GroupId, GroupUser, OrgPolicy, OrgPolicyType,
-    TwoFactor, User, UserId,
+    Cipher, CipherId, Collection, CollectionGroup, CollectionId, CollectionUser, Group, GroupId, GroupUser, OrgPolicy,
+    OrgPolicyType, TwoFactor, User, UserId,
 };
 
 #[derive(Identifiable, Queryable, Insertable, AsChangeset)]
@@ -44,7 +44,6 @@ pub struct Organization {
 #[diesel(table_name = users_organizations)]
 #[diesel(treat_none_as_null = true)]
 #[diesel(primary_key(uuid))]
-#[expect(clippy::struct_excessive_bools, reason = "Each Custom role permission is a column of its own")]
 pub struct Membership {
     pub uuid: MembershipId,
     pub user_uuid: UserId,
@@ -58,19 +57,9 @@ pub struct Membership {
     pub atype: i32,
     pub reset_password_key: Option<String>,
     pub external_id: Option<String>,
-
-    // The permissions of a Custom role, only accessed through `CustomPermission`.
-    manage_users: bool,
-    manage_groups: bool,
-    manage_policies: bool,
-    create_new_collections: bool,
-    edit_any_collection: bool,
-    delete_any_collection: bool,
-    access_event_logs: bool,
-    access_import_export: bool,
-    access_reports: bool,
-
-    /// The user's v2 upgrade token, for the org to unwrap the v2 user key after an upgrade. Opaque to us.
+    /// A copy of the user's v2 upgrade token, kept when a v1 -> v2 upgrade leaves the account
+    /// recovery key (`reset_password_key`) wrapped by the v1 user key. It lets the organization
+    /// unwrap the v2 user key from it. Opaque to us, like `User::v2_upgrade_token`.
     pub v2_upgrade_token: Option<String>,
 }
 
@@ -107,74 +96,42 @@ impl MembershipStatus {
     }
 }
 
-#[derive(Copy, Clone, Debug, PartialEq, Eq, num_derive::FromPrimitive)]
+#[derive(Copy, Clone, PartialEq, Eq, num_derive::FromPrimitive)]
 pub enum MembershipType {
     Owner = 0,
     Admin = 1,
     User = 2,
-    // The legacy Manager role. The Bitwarden clients no longer know it and are shown a Custom role instead.
     Manager = 3,
-    // Only granted while EXPERIMENTAL_CUSTOM_ROLES is enabled.
-    Custom = 4,
 }
 
 impl MembershipType {
     pub fn from_str(s: &str) -> Option<Self> {
+        #[expect(
+            clippy::match_same_arms,
+            reason = "Specifically define `4|Custom` since this is a hack, not a default"
+        )]
         match s {
             "0" | "Owner" => Some(MembershipType::Owner),
             "1" | "Admin" => Some(MembershipType::Admin),
             "2" | "User" => Some(MembershipType::User),
             "3" | "Manager" => Some(MembershipType::Manager),
-            "4" | "Custom" => Some(MembershipType::Custom),
+            // HACK: We convert the custom role to a manager role
+            "4" | "Custom" => Some(MembershipType::Manager),
             _ => None,
         }
     }
-
-    /// The role a member invite or edit from the Bitwarden clients asks for, given the member's current
-    /// role (`None` for an invite).
-    ///
-    /// The clients no longer know the legacy Manager role and are shown a Custom role in its place, so a
-    /// requested Custom role is the legacy Manager unless EXPERIMENTAL_CUSTOM_ROLES is enabled, in which case
-    /// `custom_permissions` are the permissions requested along with it. An existing Manager or Custom member
-    /// keeps their role when the request repeats it, so an unrelated edit never turns one into the other. A
-    /// Manager only becomes a Custom member when the permissions they are shown with are changed.
-    pub fn requested(
-        requested: MembershipType,
-        current: Option<&Membership>,
-        custom_permissions: Option<&HashSet<CustomPermission>>,
-    ) -> MembershipType {
-        if requested != MembershipType::Custom {
-            return requested;
-        }
-        match (current, custom_permissions) {
-            (Some(member), _) if member.has_type(MembershipType::Custom) => MembershipType::Custom,
-            (Some(member), Some(permissions))
-                if member.has_type(MembershipType::Manager) && *permissions != member.legacy_manager_permissions() =>
-            {
-                MembershipType::Custom
-            }
-            (Some(member), _) if member.has_type(MembershipType::Manager) => MembershipType::Manager,
-            (_, Some(_)) => MembershipType::Custom,
-            (_, None) => MembershipType::Manager,
-        }
-    }
-
-    /// The authority of a role, which is what roles are compared by. A Custom member gets its authority from
-    /// its permissions, never from its role, so the role itself ranks right above User and below Manager.
-    const fn rank(self) -> u8 {
-        match self {
-            MembershipType::User => 0,
-            MembershipType::Custom => 1,
-            MembershipType::Manager => 2,
-            MembershipType::Admin => 3,
-            MembershipType::Owner => 4,
-        }
-    }
 }
 
 impl Ord for MembershipType {
     fn cmp(&self, other: &MembershipType) -> Ordering {
-        self.rank().cmp(&other.rank())
+        // For easy comparison, map each variant to an access level (where 0 is lowest).
+        const ACCESS_LEVEL: [i32; 4] = [
+            3, // Owner
+            2, // Admin
+            0, // User
+            1, // Manager && Custom
+        ];
+        ACCESS_LEVEL[*self as usize].cmp(&ACCESS_LEVEL[*other as usize])
     }
 }
 
@@ -230,125 +187,6 @@ impl PartialOrd<MembershipType> for i32 {
     }
 }
 
-/// The granular permissions of the Custom role.
-#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
-pub enum CustomPermission {
-    ManageUsers,
-    ManageGroups,
-    ManagePolicies,
-    CreateNewCollections,
-    EditAnyCollection,
-    DeleteAnyCollection,
-    AccessEventLogs,
-    AccessImportExport,
-    AccessReports,
-}
-
-/// The permissions this version enforces on every endpoint they open. Only these can be granted, a stored
-/// grant of any other one grants nothing. They are implemented one at a time, so this grows with them.
-const SUPPORTED_CUSTOM_PERMISSIONS: &[CustomPermission] = &[
-    CustomPermission::ManageUsers,
-    CustomPermission::CreateNewCollections,
-    CustomPermission::EditAnyCollection,
-    CustomPermission::DeleteAnyCollection,
-];
-
-impl CustomPermission {
-    pub const ALL: [CustomPermission; 9] = [
-        CustomPermission::ManageUsers,
-        CustomPermission::ManageGroups,
-        CustomPermission::ManagePolicies,
-        CustomPermission::CreateNewCollections,
-        CustomPermission::EditAnyCollection,
-        CustomPermission::DeleteAnyCollection,
-        CustomPermission::AccessEventLogs,
-        CustomPermission::AccessImportExport,
-        CustomPermission::AccessReports,
-    ];
-
-    /// The key of the permission in the `permissions` object of the Bitwarden clients.
-    pub const fn json_key(self) -> &'static str {
-        match self {
-            CustomPermission::ManageUsers => "manageUsers",
-            CustomPermission::ManageGroups => "manageGroups",
-            CustomPermission::ManagePolicies => "managePolicies",
-            CustomPermission::CreateNewCollections => "createNewCollections",
-            CustomPermission::EditAnyCollection => "editAnyCollection",
-            CustomPermission::DeleteAnyCollection => "deleteAnyCollection",
-            CustomPermission::AccessEventLogs => "accessEventLogs",
-            CustomPermission::AccessImportExport => "accessImportExport",
-            CustomPermission::AccessReports => "accessReports",
-        }
-    }
-
-    pub fn is_supported(self) -> bool {
-        SUPPORTED_CUSTOM_PERMISSIONS.contains(&self)
-    }
-
-    /// The permissions a member invite or edit grants a Custom role.
-    ///
-    /// A permission is only granted when it is set to `true`, and anything but a boolean is rejected: this
-    /// replaces the member's permissions, so a malformed value must not silently remove one. Granting a
-    /// permission this version does not enforce is rejected as well. The clients also send permissions
-    /// Vaultwarden does not know at all, like `manageSso`, those are ignored.
-    pub fn requested(permissions: &HashMap<String, Value>) -> Result<HashSet<CustomPermission>, crate::Error> {
-        let mut granted = HashSet::new();
-        for permission in CustomPermission::ALL {
-            match permissions.get(permission.json_key()) {
-                None | Some(Value::Bool(false)) => {}
-                Some(Value::Bool(true)) if permission.is_supported() => {
-                    granted.insert(permission);
-                }
-                Some(Value::Bool(true)) => {
-                    err!(format!("The Custom role permission '{}' is not supported yet", permission.json_key()))
-                }
-                Some(_) => {
-                    err!(format!("The Custom role permission '{}' must be true or false", permission.json_key()))
-                }
-            }
-        }
-        Ok(granted)
-    }
-}
-
-/// The stored roles with authority over the whole organization. Queries match them by value, comparing
-/// `atype <= Admin` would also match any unknown value below it.
-pub(super) const ORG_ADMIN_ATYPES: [i32; 2] = [MembershipType::Owner as i32, MembershipType::Admin as i32];
-
-/// Whether the experimental Custom role is enabled. Nothing is ever granted through a Custom role otherwise.
-pub fn custom_roles_enabled() -> bool {
-    #[cfg(test)]
-    if let Some(enabled) = test_flag::CUSTOM_ROLES_ENABLED.get() {
-        return enabled;
-    }
-    CONFIG.experimental_custom_roles()
-}
-
-type CustomEditAnyCollection = diesel::dsl::And<
-    diesel::dsl::And<
-        diesel::dsl::Eq<users_organizations::atype, i32>,
-        diesel::dsl::Eq<users_organizations::edit_any_collection, bool>,
-    >,
-    bool,
-    diesel::sql_types::Bool,
->;
-
-/// SQL: a Custom member with Edit any collection, while Custom roles are enabled.
-pub(super) fn custom_edit_any_collection() -> CustomEditAnyCollection {
-    users_organizations::atype
-        .eq(MembershipType::Custom as i32)
-        .and(users_organizations::edit_any_collection.eq(true))
-        .and::<_, diesel::sql_types::Bool>(custom_roles_enabled())
-}
-
-#[cfg(test)]
-pub mod test_flag {
-    thread_local! {
-        /// Overrides EXPERIMENTAL_CUSTOM_ROLES for the tests running on this thread.
-        pub static CUSTOM_ROLES_ENABLED: std::cell::Cell<Option<bool>> = const { std::cell::Cell::new(None) };
-    }
-}
-
 /// Local methods
 impl Organization {
     pub fn new(name: String, billing_email: &str, private_key: Option<String>, public_key: Option<String>) -> Self {
@@ -440,154 +278,10 @@ impl Membership {
             atype: MembershipType::User as i32,
             reset_password_key: None,
             external_id: None,
-
-            manage_users: false,
-            manage_groups: false,
-            manage_policies: false,
-            create_new_collections: false,
-            edit_any_collection: false,
-            delete_any_collection: false,
-            access_event_logs: false,
-            access_import_export: false,
-            access_reports: false,
-
             v2_upgrade_token: None,
         }
     }
 
-    fn custom_permission_mut(&mut self, permission: CustomPermission) -> &mut bool {
-        match permission {
-            CustomPermission::ManageUsers => &mut self.manage_users,
-            CustomPermission::ManageGroups => &mut self.manage_groups,
-            CustomPermission::ManagePolicies => &mut self.manage_policies,
-            CustomPermission::CreateNewCollections => &mut self.create_new_collections,
-            CustomPermission::EditAnyCollection => &mut self.edit_any_collection,
-            CustomPermission::DeleteAnyCollection => &mut self.delete_any_collection,
-            CustomPermission::AccessEventLogs => &mut self.access_event_logs,
-            CustomPermission::AccessImportExport => &mut self.access_import_export,
-            CustomPermission::AccessReports => &mut self.access_reports,
-        }
-    }
-
-    /// Change the role. Nothing the old role carried survives a role change: the Custom role permissions are
-    /// dropped, so changing the role back later starts from none. A Custom role never keeps the legacy
-    /// `access_all` flag, its reach only comes from its permissions.
-    pub fn set_type(&mut self, new_type: MembershipType) {
-        if self.atype != new_type as i32 {
-            for permission in CustomPermission::ALL {
-                *self.custom_permission_mut(permission) = false;
-            }
-        }
-        if new_type == MembershipType::Custom {
-            self.access_all = false;
-        }
-        self.atype = new_type as i32;
-    }
-
-    /// Grant this Custom member exactly `permissions` out of those this version enforces. A stored grant of a
-    /// permission this version does not enforce is kept as it is: it grants nothing here.
-    pub fn set_custom_permissions(&mut self, permissions: &HashSet<CustomPermission>) {
-        for permission in CustomPermission::ALL.into_iter().filter(|p| p.is_supported()) {
-            *self.custom_permission_mut(permission) = permissions.contains(&permission);
-        }
-    }
-
-    /// Why this legacy Manager can't become a Custom member with `permissions` without losing what they may do now, if
-    /// they can't. A conversion must not silently change their access. A Custom role can't keep access to all
-    /// collections, which also puts every collection in the Manager's own vault, unless the permissions it is shown as
-    /// are given up too. And it only manages every collection with Edit any collection, not through a group with access
-    /// to all collections, which stays dynamic. The collections they manage with the manage permission stay managed.
-    pub async fn custom_role_conversion_loss(
-        &self,
-        permissions: &HashSet<CustomPermission>,
-        conn: &DbConn,
-    ) -> Option<&'static str> {
-        if !self.has_type(MembershipType::Manager) {
-            return None;
-        }
-        if self.access_all && permissions.is_superset(&self.legacy_manager_permissions()) {
-            return Some(
-                "This Manager has access to all collections, which a Custom member can't have: the collections they \
-                 aren't assigned to would disappear from their vault. Uncheck Manage all collections for them to give \
-                 that access up, or keep the Manager role.",
-            );
-        }
-        if !permissions.contains(&CustomPermission::EditAnyCollection)
-            && GroupUser::has_full_access_by_member(&self.org_uuid, &self.uuid, conn).await
-        {
-            return Some(
-                "This Manager manages every collection through a group with access to all collections, which a Custom \
-                 member only does with Edit any collection. Grant that permission, or remove them from the group \
-                 first.",
-            );
-        }
-        None
-    }
-
-    fn custom_permission(&self, permission: CustomPermission) -> bool {
-        match permission {
-            CustomPermission::ManageUsers => self.manage_users,
-            CustomPermission::ManageGroups => self.manage_groups,
-            CustomPermission::ManagePolicies => self.manage_policies,
-            CustomPermission::CreateNewCollections => self.create_new_collections,
-            CustomPermission::EditAnyCollection => self.edit_any_collection,
-            CustomPermission::DeleteAnyCollection => self.delete_any_collection,
-            CustomPermission::AccessEventLogs => self.access_event_logs,
-            CustomPermission::AccessImportExport => self.access_import_export,
-            CustomPermission::AccessReports => self.access_reports,
-        }
-    }
-
-    /// Whether the role of this member grants `permission`. Only a Custom role grants any, only while Custom roles
-    /// are enabled, and only the permissions this version enforces.
-    fn grants_custom_permission(&self, permission: CustomPermission) -> bool {
-        custom_roles_enabled()
-            && permission.is_supported()
-            && self.has_type(MembershipType::Custom)
-            && self.custom_permission(permission)
-    }
-
-    /// Whether this member may act with `permission`, granted by their Custom role. Like the authority of any
-    /// other role, it needs a confirmed membership.
-    pub fn has_custom_permission(&self, permission: CustomPermission) -> bool {
-        self.has_status(MembershipStatus::Confirmed) && self.grants_custom_permission(permission)
-    }
-
-    /// The permissions the "Manage all collections" a legacy Manager is shown with stands for: their `access_all`.
-    pub fn legacy_manager_permissions(&self) -> HashSet<CustomPermission> {
-        if self.has_type(MembershipType::Manager) && self.access_all {
-            HashSet::from([
-                CustomPermission::CreateNewCollections,
-                CustomPermission::EditAnyCollection,
-                CustomPermission::DeleteAnyCollection,
-            ])
-        } else {
-            HashSet::new()
-        }
-    }
-
-    /// The permissions the clients are shown, which a legacy Manager is shown as a Custom member with.
-    pub fn shown_custom_permissions(&self) -> HashSet<CustomPermission> {
-        if self.has_type(MembershipType::Manager) {
-            self.legacy_manager_permissions()
-        } else {
-            CustomPermission::ALL.into_iter().filter(|p| self.grants_custom_permission(*p)).collect()
-        }
-    }
-
-    fn custom_permissions_json(&self) -> Value {
-        let shown = self.shown_custom_permissions();
-        let mut permissions = json!({
-            "manageSso": false, // Not supported
-            "manageResetPassword": false,
-            "manageScim": false, // Not supported (Not AGPLv3 Licensed)
-        });
-        for permission in CustomPermission::ALL {
-            permissions[permission.json_key()] = json!(shown.contains(&permission));
-        }
-        permissions
-    }
-
     pub fn restore(&mut self) -> bool {
         if self.status < MembershipStatus::Invited as i32 {
             self.status += ACTIVATE_REVOKE_DIFF;
@@ -656,7 +350,7 @@ impl OrganizationApiKey {
 impl Organization {
     pub async fn save(&self, conn: &DbConn) -> EmptyResult {
         if !crate::util::is_valid_email(&self.billing_email) {
-            err!(format!("BillingEmail {} is not a valid email address", self.billing_email.escape_debug()))
+            err!(format!("BillingEmail {} is not a valid email address", self.billing_email))
         }
 
         for member in &Membership::find_by_org(&self.uuid, conn).await {
@@ -756,8 +450,24 @@ impl Membership {
         // It will be converted back on other locations
         let membership_type = self.type_manager_as_custom();
 
-        // A Manager is shown with the 3 Collection permissions set, when they have the access_all permission
-        let permissions = self.custom_permissions_json();
+        let permissions = json!({
+                // TODO: Add full support for Custom User Roles
+                // See: https://bitwarden.com/help/article/user-types-access-control/#custom-role
+                // Currently we use the custom role as a manager role and link the 3 Collection roles to mimic the access_all permission
+                "accessEventLogs": false,
+                "accessImportExport": false,
+                "accessReports": false,
+                // If the following 3 Collection roles are set to true a custom user has access all permission
+                "createNewCollections": membership_type == 4 && self.access_all,
+                "editAnyCollection": membership_type == 4 && self.access_all,
+                "deleteAnyCollection": membership_type == 4 && self.access_all,
+                "manageGroups": false,
+                "managePolicies": false,
+                "manageSso": false, // Not supported
+                "manageUsers": false,
+                "manageResetPassword": false,
+                "manageScim": false // Not supported (Not AGPLv3 Licensed)
+        });
 
         // https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Api/AdminConsole/Models/Response/ProfileOrganizationResponseModel.cs
         json!({
@@ -813,7 +523,8 @@ impl Membership {
             "limitCollectionDeletion": true,
             "limitItemDeletion": false,
             "allowAdminAccessToAllCollectionItems": true,
-            "userIsClaimedByOrganization": false, // Means not managed via the Members UI, like SSO
+            "userIsManagedByOrganization": false, // Means not managed via the Members UI, like SSO
+            "userIsClaimedByOrganization": false, // The new key instead of the obsolete userIsManagedByOrganization
 
             "permissions": permissions,
 
@@ -821,8 +532,7 @@ impl Membership {
 
             // These are per user
             "userId": self.user_uuid,
-            // Accepted (not yet confirmed) members have no key yet; send null like upstream, not ""
-            "key": (!self.akey.is_empty()).then_some(&self.akey),
+            "key": self.akey,
             "status": self.status,
             "type": membership_type,
             "enabled": true,
@@ -831,13 +541,7 @@ impl Membership {
         })
     }
 
-    // Used by admins to view other members, so nothing here may depend on this member's status
-    pub async fn to_json_details_for_admin(
-        &self,
-        include_collections: bool,
-        include_groups: bool,
-        conn: &DbConn,
-    ) -> Value {
+    pub async fn to_json_user_details(&self, include_collections: bool, include_groups: bool, conn: &DbConn) -> Value {
         let user = User::find_by_uuid(&self.user_uuid, conn).await.unwrap();
 
         // Because BitWarden want the status to be -1 for revoked users we need to catch that here.
@@ -860,23 +564,52 @@ impl Membership {
 
         // Check if a user is in a group which has access to all collections
         // If that is the case, we should not return individual collections!
-        // This is used by admins to view other members, so it must not depend on the membership status
         let full_access_group =
-            CONFIG.org_groups_enabled() && GroupUser::has_full_access_by_member(&self.org_uuid, &self.uuid, conn).await;
+            CONFIG.org_groups_enabled() && Group::is_in_full_access_group(&self.user_uuid, &self.org_uuid, conn).await;
 
         // If collections are to be included, only include them if the user does not have full access via a group or defined to the user it self
-        // Only the collections assigned directly are returned, the ones assigned via a group are returned via a special group endpoint
         let collections: Vec<Value> = if include_collections && !(full_access_group || self.access_all) {
-            CollectionUser::find_by_organization_and_user_uuid(&self.org_uuid, &self.user_uuid, conn)
+            // Get all collections for the user here already to prevent more queries
+            let cu: HashMap<CollectionId, CollectionUser> =
+                CollectionUser::find_by_organization_and_user_uuid(&self.org_uuid, &self.user_uuid, conn)
+                    .await
+                    .into_iter()
+                    .map(|cu| (cu.collection_uuid.clone(), cu))
+                    .collect();
+
+            // Get all collection groups for this user to prevent there inclusion
+            let cg: HashSet<CollectionId> = CollectionGroup::find_by_user(&self.user_uuid, conn)
                 .await
                 .into_iter()
-                .map(|cu| {
-                    json!({
-                        "id": cu.collection_uuid,
-                        "readOnly": cu.read_only,
-                        "hidePasswords": cu.hide_passwords,
-                        "manage": cu.manage || (self.atype == MembershipType::Manager && !cu.read_only && !cu.hide_passwords),
-                    })
+                .map(|cg| cg.collections_uuid)
+                .collect();
+
+            Collection::find_by_organization_and_user_uuid(&self.org_uuid, &self.user_uuid, conn)
+                .await
+                .into_iter()
+                .filter_map(|c| {
+                    let (read_only, hide_passwords, manage) = if self.has_full_access() {
+                        (false, false, self.atype >= MembershipType::Manager)
+                    } else if let Some(cu) = cu.get(&c.uuid) {
+                        (
+                            cu.read_only,
+                            cu.hide_passwords,
+                            cu.manage || (self.atype == MembershipType::Manager && !cu.read_only && !cu.hide_passwords),
+                        )
+                    // If previous checks failed it might be that this user has access via a group, but we should not return those elements here
+                    // Those are returned via a special group endpoint
+                    } else if cg.contains(&c.uuid) {
+                        return None;
+                    } else {
+                        (true, true, false)
+                    };
+
+                    Some(json!({
+                        "id": c.uuid,
+                        "readOnly": read_only,
+                        "hidePasswords": hide_passwords,
+                        "manage": manage,
+                    }))
                 })
                 .collect()
         } else {
@@ -887,11 +620,29 @@ impl Membership {
         // It will be converted back on other locations
         let membership_type = self.type_manager_as_custom();
 
-        // Only return permissions if there are any, else Bitwarden will assume the defaults of all false
-        let permissions = if self.shown_custom_permissions().is_empty() {
-            json!(null)
+        // HACK: Only return permissions if the user is of type custom and has access_all
+        // Else Bitwarden will assume the defaults of all false
+        let permissions = if membership_type == 4 && self.access_all {
+            json!({
+                // TODO: Add full support for Custom User Roles
+                // See: https://bitwarden.com/help/article/user-types-access-control/#custom-role
+                // Currently we use the custom role as a manager role and link the 3 Collection roles to mimic the access_all permission
+                "accessEventLogs": false,
+                "accessImportExport": false,
+                "accessReports": false,
+                // If the following 3 Collection roles are set to true a custom user has access all permission
+                "createNewCollections": true,
+                "editAnyCollection": true,
+                "deleteAnyCollection": true,
+                "manageGroups": false,
+                "managePolicies": false,
+                "manageSso": false, // Not supported
+                "manageUsers": false,
+                "manageResetPassword": false,
+                "manageScim": false // Not supported (Not AGPLv3 Licensed)
+            })
         } else {
-            self.custom_permissions_json()
+            json!(null)
         };
 
         json!({
@@ -906,6 +657,7 @@ impl Membership {
 
             "status": status,
             "type": membership_type,
+            "accessAll": self.access_all,
             "twoFactorEnabled": twofactor_enabled,
             "resetPasswordEnrolled": self.reset_password_key.is_some(),
             "hasMasterPassword": !user.password_hash.is_empty(),
@@ -913,6 +665,7 @@ impl Membership {
             "permissions": permissions,
 
             "ssoBound": false, // Not supported
+            "managedByOrganization": false, // This key is obsolete replaced by claimedByOrganization
             "claimedByOrganization": false, // Means not managed via the Members UI, like SSO
             "usesKeyConnector": false, // Not supported
             "accessSecretsManager": false, // Not supported (Not AGPLv3 Licensed)
@@ -963,6 +716,7 @@ impl Membership {
 
             "status": status,
             "type": self.atype,
+            "accessAll": self.access_all,
             "collections": coll_uuids,
 
             "object": "organizationUserDetails",
@@ -992,12 +746,6 @@ impl Membership {
     }
 
     pub async fn save(&self, conn: &DbConn) -> EmptyResult {
-        // The legacy `access_all` flag reaches every collection, which a Custom role may only do through its
-        // permissions, so it must never be stored on one. `set_type` takes care of this.
-        if self.has_type(MembershipType::Custom) && self.access_all {
-            err!("A Custom role membership can't have access to all collections")
-        }
-
         User::update_uuid_revision(&self.user_uuid, conn).await;
 
         db_run! { conn:
@@ -1072,25 +820,6 @@ impl Membership {
         (self.access_all || self.atype >= MembershipType::Admin) && self.has_status(MembershipStatus::Confirmed)
     }
 
-    /// Whether this member may edit every collection and the items in them in the Admin Console: every member with
-    /// full access, and a Custom member with Edit any collection. Unlike full access, the permission does not add
-    /// anything to the member's own vault.
-    pub fn can_edit_any_collection(&self) -> bool {
-        self.has_full_access() || self.has_custom_permission(CustomPermission::EditAnyCollection)
-    }
-
-    /// Whether this member may see every collection and who has access to them in the Admin Console. Deleting any
-    /// collection needs that, but not the items in them.
-    pub fn can_view_all_collections(&self) -> bool {
-        self.can_edit_any_collection() || self.has_custom_permission(CustomPermission::DeleteAnyCollection)
-    }
-
-    /// Whether this member may read every collection's member and group assignments in the Admin Console.
-    /// Manage users grants this access without granting the plain all-collections listing or metadata editing.
-    pub fn can_view_all_collection_access_details(&self) -> bool {
-        self.can_view_all_collections() || self.has_custom_permission(CustomPermission::ManageUsers)
-    }
-
     pub async fn find_by_uuid(uuid: &MembershipId, conn: &DbConn) -> Option<Self> {
         conn.run(move |conn| {
             users_organizations::table.filter(users_organizations::uuid.eq(uuid)).first::<Self>(conn).ok()
@@ -1213,8 +942,6 @@ impl Membership {
     }
 
     // Get all users which are either owner or admin, or a manager which can manage/access all
-    // A Custom member with Edit any collection is not listed: the Admin Console sends this list back when a collection
-    // is saved, which would assign them to it for good, while the others are skipped there for their access_all.
     pub async fn find_confirmed_and_manage_all_by_org(org_uuid: &OrganizationId, conn: &DbConn) -> Vec<Self> {
         conn.run(move |conn| {
             users_organizations::table
@@ -1310,6 +1037,17 @@ impl Membership {
         .await
     }
 
+    pub async fn get_orgs_by_user(user_uuid: &UserId, conn: &DbConn) -> Vec<OrganizationId> {
+        conn.run(move |conn| {
+            users_organizations::table
+                .filter(users_organizations::user_uuid.eq(user_uuid))
+                .select(users_organizations::org_uuid)
+                .load::<OrganizationId>(conn)
+                .unwrap_or_default()
+        })
+        .await
+    }
+
     pub async fn find_by_user_and_policy(user_uuid: &UserId, policy_type: OrgPolicyType, conn: &DbConn) -> Vec<Self> {
         conn.run(move |conn| {
             users_organizations::table
@@ -1332,7 +1070,6 @@ impl Membership {
         conn.run(move |conn| {
             users_organizations::table
                 .filter(users_organizations::org_uuid.eq(org_uuid))
-                .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32))
                 .left_join(users_collections::table.on(users_collections::user_uuid.eq(users_organizations::user_uuid)))
                 .left_join(
                     ciphers_collections::table.on(ciphers_collections::collection_uuid
@@ -1359,7 +1096,6 @@ impl Membership {
         conn.run(move |conn| {
             users_organizations::table
                 .filter(users_organizations::org_uuid.eq(org_uuid))
-                .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32))
                 .inner_join(
                     groups_users::table.on(groups_users::users_organizations_uuid.eq(users_organizations::uuid)),
                 )
@@ -1395,7 +1131,6 @@ impl Membership {
                         .and(ciphers::organization_uuid.eq(users_organizations::org_uuid.nullable()))),
                 )
                 .filter(users_organizations::user_uuid.eq(user_uuid))
-                .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32))
                 .filter(
                     users_organizations::atype.eq_any(vec![MembershipType::Owner as i32, MembershipType::Admin as i32]),
                 )
@@ -1535,166 +1270,13 @@ pub struct OrgApiKeyId(String);
 #[cfg(test)]
 mod tests {
     use super::*;
-    use CustomPermission::*;
-    use MembershipType::{Admin, Custom, Manager, Owner, User};
-
-    fn member(role: MembershipType) -> Membership {
-        let mut member = Membership::new("user".into(), "org".into(), None);
-        member.atype = role as i32;
-        member.status = MembershipStatus::Confirmed as i32;
-        member
-    }
 
     #[test]
-    fn membership_type_authority() {
-        assert!(Owner > Admin && Admin > Manager && Manager > Custom && Custom > User);
-        assert!((Custom as i32) >= User && (Custom as i32) < Manager && (Custom as i32) < Admin);
-        for raw in [99, -1] {
-            assert_eq!((raw >= User, raw >= Manager, raw >= Admin, raw < Admin), (false, false, false, true));
-        }
-        for (value, expected) in [
-            ("3", Some(Manager)),
-            ("Manager", Some(Manager)),
-            ("4", Some(Custom)),
-            ("Custom", Some(Custom)),
-            ("5", None),
-        ] {
-            assert_eq!(MembershipType::from_str(value), expected);
-        }
-    }
-
-    #[test]
-    fn requested_membership_type() {
-        let none = HashSet::new();
-        let edit = HashSet::from([EditAnyCollection]);
-        let legacy = HashSet::from([CreateNewCollections, EditAnyCollection, DeleteAnyCollection]);
-        for (current, all, permissions, disabled, enabled) in [
-            (None, false, &none, Manager, Custom),
-            (Some(User), false, &edit, Manager, Custom),
-            (Some(Owner), false, &none, Manager, Custom),
-            (Some(Manager), false, &none, Manager, Manager),
-            (Some(Manager), true, &legacy, Manager, Manager),
-            (Some(Manager), false, &edit, Manager, Custom),
-            (Some(Manager), true, &none, Manager, Custom),
-            (Some(Manager), true, &edit, Manager, Custom),
-            (Some(Custom), false, &none, Custom, Custom),
-        ] {
-            let current = current.map(|role| {
-                let mut m = member(role);
-                m.access_all = all;
-                m
-            });
-            for (permissions, expected) in [(None, disabled), (Some(permissions), enabled)] {
-                assert_eq!(MembershipType::requested(Custom, current.as_ref(), permissions), expected);
-            }
-        }
-        assert_eq!(MembershipType::requested(User, Some(&member(Custom)), None), User);
-        assert_eq!(MembershipType::requested(User, Some(&member(Manager)), None), User);
-        for requested in [Owner, Admin, Manager] {
-            assert_eq!(MembershipType::requested(requested, Some(&member(Custom)), None), requested);
-        }
-    }
-
-    #[test]
-    fn custom_permission_requests() {
-        let ignored = serde_json::from_value(json!({"manageUsers":false,"manageSso":true})).unwrap();
-        assert!(CustomPermission::requested(&ignored).unwrap().is_empty());
-        for permission in CustomPermission::ALL {
-            for value in [json!(true), json!(null), json!("true"), json!(1), json!([true])] {
-                let request = HashMap::from([(permission.json_key().to_owned(), value.clone())]);
-                let result = CustomPermission::requested(&request);
-                if value == json!(true) && SUPPORTED_CUSTOM_PERMISSIONS.contains(&permission) {
-                    assert_eq!(result.unwrap(), HashSet::from([permission]));
-                } else {
-                    assert!(result.is_err(), "{permission:?}: {value}");
-                }
-            }
-        }
-        assert_eq!(
-            SUPPORTED_CUSTOM_PERMISSIONS,
-            [ManageUsers, CreateNewCollections, EditAnyCollection, DeleteAnyCollection]
-        );
-    }
-
-    #[test]
-    fn role_changes_drop_custom_permissions() {
-        for (from, to) in [
-            (Custom, Owner),
-            (Custom, Admin),
-            (Custom, Manager),
-            (Custom, User),
-            (User, Custom),
-            (Manager, Custom),
-            (Custom, Custom),
-            (Admin, User),
-        ] {
-            let mut member = member(from);
-            member.access_all = true;
-            for permission in CustomPermission::ALL {
-                *member.custom_permission_mut(permission) = true;
-            }
-            member.set_type(to);
-            for permission in CustomPermission::ALL {
-                assert_eq!(*member.custom_permission_mut(permission), from == to, "{from:?} -> {to:?}");
-            }
-            assert_eq!(member.access_all, to != Custom);
-        }
-    }
-    #[test]
-    fn permission_matrix_preserves_role_status_flag_and_collection_boundaries() {
-        let legacy = HashSet::from([CreateNewCollections, EditAnyCollection, DeleteAnyCollection]);
-        for (role, all) in
-            [(Owner, false), (Admin, false), (Manager, false), (Manager, true), (Custom, false), (User, false)]
-        {
-            for permission in CustomPermission::ALL {
-                let mut member = member(role);
-                member.access_all = all;
-                *member.custom_permission_mut(permission) = true;
-                for enabled in [false, true] {
-                    test_flag::CUSTOM_ROLES_ENABLED.set(Some(enabled));
-                    let shown = if role == Manager && all {
-                        legacy.clone()
-                    } else if role == Custom && enabled && permission.is_supported() {
-                        HashSet::from([permission])
-                    } else {
-                        HashSet::new()
-                    };
-                    assert_eq!(member.shown_custom_permissions(), shown);
-                    for status in [-128, -127, -126, -3, -2, -1, 0, 1, 2] {
-                        member.status = status;
-                        let allowed = enabled && role == Custom && status == 2 && permission.is_supported();
-                        let full = status == 2 && (role == Owner || role == Admin || all);
-                        let edit = full || (allowed && permission == EditAnyCollection);
-                        let view = full || (allowed && matches!(permission, EditAnyCollection | DeleteAnyCollection));
-                        assert_eq!(
-                            (
-                                member.has_custom_permission(permission),
-                                member.can_edit_any_collection(),
-                                member.can_view_all_collections()
-                            ),
-                            (allowed, edit, view),
-                            "{role:?} {all} {enabled} {status} {permission:?}"
-                        );
-                    }
-                }
-            }
-        }
-        for raw in [99, -1] {
-            let mut member = member(Custom);
-            member.atype = raw;
-            for p in CustomPermission::ALL {
-                *member.custom_permission_mut(p) = true;
-            }
-            for enabled in [false, true] {
-                test_flag::CUSTOM_ROLES_ENABLED.set(Some(enabled));
-                assert!(CustomPermission::ALL.into_iter().all(|p| !member.has_custom_permission(p)));
-                assert!(!member.can_edit_any_collection() && !member.can_view_all_collections());
-            }
-        }
-        let empty = member(Custom);
-        assert!(!empty.can_edit_any_collection() && !empty.can_view_all_collections());
-        assert!(empty.shown_custom_permissions().is_empty());
-
-        test_flag::CUSTOM_ROLES_ENABLED.set(None);
+    #[allow(non_snake_case)]
+    fn partial_cmp_MembershipType() {
+        assert!(MembershipType::Owner > MembershipType::Admin);
+        assert!(MembershipType::Admin > MembershipType::Manager);
+        assert!(MembershipType::Manager > MembershipType::User);
+        assert!(MembershipType::Manager == MembershipType::from_str("4").unwrap());
     }
 }
diff --git a/src/db/models/send.rs b/src/db/models/send.rs
index 118f947f..d7de7749 100644
--- a/src/db/models/send.rs
+++ b/src/db/models/send.rs
@@ -140,10 +140,6 @@ impl Send {
         None
     }
 
-    fn access_id(&self) -> String {
-        BASE64URL_NOPAD.encode(Uuid::parse_str(&self.uuid).unwrap_or_default().as_bytes())
-    }
-
     pub fn to_json(&self) -> Value {
         let mut data = serde_json::from_str::<LowerCase<Value>>(&self.data).map(|d| d.data).unwrap_or_default();
 
@@ -154,7 +150,7 @@ impl Send {
 
         json!({
             "id": self.uuid,
-            "accessId": self.access_id(),
+            "accessId": BASE64URL_NOPAD.encode(Uuid::parse_str(&self.uuid).unwrap_or_default().as_bytes()),
             "type": self.atype,
 
             "name": self.name,
@@ -186,7 +182,7 @@ impl Send {
         }
 
         json!({
-            "id": self.access_id(),
+            "id": self.uuid,
             "type": self.atype,
 
             "name": self.name,
@@ -260,7 +256,7 @@ impl Send {
 
     /// Whether the Send is currently within its validity window: not disabled, not past its
     /// expiration date, and not past its deletion date. Does not consider `max_access_count`
-    /// (counted on each access) or the password.
+    /// (consumed at token issuance) or the password.
     pub fn is_accessible(&self) -> bool {
         let now = Utc::now().naive_utc();
         if self.disabled {
@@ -313,6 +309,19 @@ impl Send {
         Ok(())
     }
 
+    pub async fn find_by_access_id(access_id: &str, conn: &DbConn) -> Option<Self> {
+        let Ok(uuid_vec) = BASE64URL_NOPAD.decode(access_id.as_bytes()) else {
+            return None;
+        };
+
+        let uuid = match Uuid::from_slice(&uuid_vec) {
+            Ok(u) => SendId::from(u.to_string()),
+            Err(_) => return None,
+        };
+
+        Self::find_by_uuid(&uuid, conn).await
+    }
+
     pub async fn find_by_uuid(uuid: &SendId, conn: &DbConn) -> Option<Self> {
         conn.run(move |conn| sends::table.filter(sends::uuid.eq(uuid)).first::<Self>(conn).ok()).await
     }
@@ -334,6 +343,7 @@ impl Send {
     pub async fn size_by_user(user_uuid: &UserId, conn: &DbConn) -> Option<i64> {
         #[derive(serde::Deserialize)]
         struct FileData {
+            #[serde(rename = "size", alias = "Size")]
             size: NumberOrString,
         }
 
@@ -351,6 +361,13 @@ impl Send {
         Some(total)
     }
 
+    pub async fn find_by_org(org_uuid: &OrganizationId, conn: &DbConn) -> Vec<Self> {
+        conn.run(move |conn| {
+            sends::table.filter(sends::organization_uuid.eq(org_uuid)).load::<Self>(conn).expect("Error loading sends")
+        })
+        .await
+    }
+
     pub async fn find_by_past_deletion_date(conn: &DbConn) -> Vec<Self> {
         let now = Utc::now().naive_utc();
         conn.run(move |conn| {
diff --git a/src/db/models/two_factor.rs b/src/db/models/two_factor.rs
index 051ea4df..5f57635e 100644
--- a/src/db/models/two_factor.rs
+++ b/src/db/models/two_factor.rs
@@ -137,11 +137,11 @@ impl TwoFactor {
         .await
     }
 
-    pub async fn find_by_user_and_type(user_uuid: &UserId, atype: TwoFactorType, conn: &DbConn) -> Option<Self> {
+    pub async fn find_by_user_and_type(user_uuid: &UserId, atype: i32, conn: &DbConn) -> Option<Self> {
         conn.run(move |conn| {
             twofactor::table
                 .filter(twofactor::user_uuid.eq(user_uuid))
-                .filter(twofactor::atype.eq(atype as i32))
+                .filter(twofactor::atype.eq(atype))
                 .first::<Self>(conn)
                 .ok()
         })
diff --git a/src/db/models/two_factor_incomplete.rs b/src/db/models/two_factor_incomplete.rs
index e4c7e308..4b8cadcb 100644
--- a/src/db/models/two_factor_incomplete.rs
+++ b/src/db/models/two_factor_incomplete.rs
@@ -37,7 +37,7 @@ impl TwoFactorIncomplete {
         ip: &ClientIp,
         conn: &DbConn,
     ) -> EmptyResult {
-        if CONFIG.incomplete_2fa_time_limit() == 0 || !CONFIG.mail_enabled() {
+        if CONFIG.incomplete_2fa_time_limit() <= 0 || !CONFIG.mail_enabled() {
             return Ok(());
         }
 
@@ -66,7 +66,7 @@ impl TwoFactorIncomplete {
     }
 
     pub async fn mark_complete(user_uuid: &UserId, device_uuid: &DeviceId, conn: &DbConn) -> EmptyResult {
-        if CONFIG.incomplete_2fa_time_limit() == 0 || !CONFIG.mail_enabled() {
+        if CONFIG.incomplete_2fa_time_limit() <= 0 || !CONFIG.mail_enabled() {
             return Ok(());
         }
 
diff --git a/src/db/models/user.rs b/src/db/models/user.rs
index 49ea67b7..6b4658ed 100644
--- a/src/db/models/user.rs
+++ b/src/db/models/user.rs
@@ -20,8 +20,8 @@ use crate::{
 use macros::UuidFromParam;
 
 use super::{
-    AuthRequest, Cipher, Device, EmergencyAccess, Favorite, Folder, Membership, MembershipType, TwoFactor,
-    TwoFactorIncomplete, UserSignatureKeyPair,
+    Cipher, Device, EmergencyAccess, Favorite, Folder, Membership, MembershipType, TwoFactor, TwoFactorIncomplete,
+    UserSignatureKeyPair,
 };
 
 #[derive(Identifiable, Queryable, Insertable, AsChangeset, Selectable)]
@@ -74,11 +74,13 @@ pub struct User {
 
     pub key_id: Option<KeyId>,
 
-    // The v2 state: all set, with a `user_signature_key_pairs` row, or none, see `User::is_v2`
+    // "v2" account cryptographic state. Either all of these are set (together with a row in
+    // `user_signature_key_pairs`) or none of them are; see `User::is_v2`.
     pub signed_public_key: Option<String>,
     pub security_state: Option<String>,
     pub security_version: Option<i32>,
-    /// JSON `{"wrappedUserKey1", "wrappedUserKey2"}` for sessions that still hold the v1 user key. Opaque to us.
+    /// JSON `{"wrappedUserKey1": ..., "wrappedUserKey2": ...}`, letting clients that still hold the
+    /// v1 user key obtain the v2 one after another client performed the upgrade. Opaque to us.
     pub v2_upgrade_token: Option<String>,
 }
 
@@ -194,19 +196,6 @@ impl User {
         self.signed_public_key.is_some() && self.security_state.is_some() && self.security_version.is_some()
     }
 
-    /// Upstream's `HasV2Encryption`: a private key wrapped as `CoseEncrypt0B64` (type 7) and security version 2.
-    /// Upstream only uses it to decide which accounts need a v2-capable client.
-    ///
-    /// Ref: <https://github.com/bitwarden/server/blob/8da186ad73f80d37157fe6fd42323e4284e83ec1/src/Core/Entities/User.cs#L245-L278>
-    pub fn has_v2_encryption(&self) -> bool {
-        self.security_version == Some(2)
-            && self
-                .private_key
-                .as_deref()
-                .and_then(|private_key| private_key.split_once('.'))
-                .is_some_and(|(enc_type, _)| enc_type.parse::<u8>() == Ok(7))
-    }
-
     pub fn check_valid_password(&self, password: &str) -> bool {
         crypto::verify_password_hash(
             password.as_bytes(),
@@ -216,11 +205,6 @@ impl User {
         )
     }
 
-    /// Upstream's `GetMasterPasswordSalt`: there is no separate salt, so the normalized email
-    pub fn master_password_salt(&self) -> String {
-        self.email.trim().to_lowercase()
-    }
-
     pub fn check_valid_recovery_code(&self, recovery_code: &str) -> bool {
         if let Some(ref totp_recover) = self.totp_recover {
             crypto::ct_eq(recovery_code, totp_recover.to_lowercase())
@@ -271,7 +255,9 @@ impl User {
 
     pub async fn reset_security_stamp(&mut self, conn: &DbConn) -> EmptyResult {
         self.security_stamp = get_uuid();
-        // Keeps the unexpired route exceptions, set for the stamp being replaced, and drops a rotation's grace
+        // A reset is meant to end the other sessions, which a key rotation's grace would undo. The
+        // route exceptions stay, since they are set right before a reset, for the stamp it replaces.
+        // This is also where expired exceptions get dropped.
         let mut exceptions = self.stamp_exceptions();
         exceptions.retain(|e| e.routes.is_some() && !e.is_expired());
         self.set_stamp_exceptions(&exceptions);
@@ -279,7 +265,13 @@ impl User {
         Ok(())
     }
 
-    /// Resets the stamp but lets issued access tokens run out, as upstream only checks it on refresh.
+    /// Resets the security stamp after a key rotation, while letting the access tokens already
+    /// issued keep working until they expire.
+    ///
+    /// This is what upstream does: there the stamp is only checked when a token is refreshed, so a
+    /// rotation invalidates refresh tokens but not the access tokens in use. Clients rely on it to
+    /// keep a session going across a rotation. Chained rotations keep every earlier stamp that is
+    /// still within its window.
     pub async fn reset_security_stamp_after_key_rotation(&mut self, conn: &DbConn) -> EmptyResult {
         let previous_stamp = self.security_stamp.clone();
         let mut grace: Vec<UserStampException> =
@@ -344,10 +336,6 @@ impl User {
 
 /// Database methods
 impl User {
-    pub fn verified(&self) -> bool {
-        !CONFIG.mail_enabled() || self.verified_at.is_some()
-    }
-
     async fn v2_signature_key_pair(&self, conn: &DbConn) -> Option<UserSignatureKeyPair> {
         if !self.is_v2() {
             return None;
@@ -355,35 +343,34 @@ impl User {
         UserSignatureKeyPair::find_by_user(&self.uuid, conn).await
     }
 
-    /// The `accountKeys` object (upstream's `PrivateKeysResponseModel`), null without a key pair
     pub async fn account_keys_json(&self, conn: &DbConn) -> Value {
-        if self.private_key.is_some() {
-            let (signed_public_key, signature_key_pair, security_state) = match self.v2_signature_key_pair(conn).await {
-                Some(key_pair) => (
-                    json!(self.signed_public_key),
-                    key_pair.to_json(),
-                    json!({
-                        "securityState": self.security_state,
-                        "securityVersion": self.security_version,
-                    }),
-                ),
-                None => (Value::Null, Value::Null, Value::Null),
-            };
-
-            json!({
-                "publicKeyEncryptionKeyPair": {
-                    "wrappedPrivateKey": self.private_key,
-                    "publicKey": self.public_key,
-                    "signedPublicKey": signed_public_key,
-                    "object": "publicKeyEncryptionKeyPair",
-                },
-                "securityState": security_state,
-                "signatureKeyPair": signature_key_pair,
-                "object": "privateKeys"
-            })
-        } else {
-            Value::Null
+        if self.private_key.is_none() {
+            return Value::Null;
         }
+
+        let (signed_public_key, signature_key_pair, security_state) = match self.v2_signature_key_pair(conn).await {
+            Some(key_pair) => (
+                json!(self.signed_public_key),
+                key_pair.to_json(),
+                json!({
+                    "securityState": self.security_state,
+                    "securityVersion": self.security_version,
+                }),
+            ),
+            None => (Value::Null, Value::Null, Value::Null),
+        };
+
+        json!({
+            "publicKeyEncryptionKeyPair": {
+                "wrappedPrivateKey": self.private_key,
+                "publicKey": self.public_key,
+                "signedPublicKey": signed_public_key,
+                "object": "publicKeyEncryptionKeyPair",
+            },
+            "signatureKeyPair": signature_key_pair,
+            "securityState": security_state,
+            "object": "privateKeys"
+        })
     }
 
     pub async fn public_keys_json(&self, conn: &DbConn) -> Value {
@@ -432,7 +419,7 @@ impl User {
             "id": self.uuid,
             "name": self.name,
             "email": self.email,
-            "emailVerified": self.verified(),
+            "emailVerified": !CONFIG.mail_enabled() || self.verified_at.is_some(),
             "premium": true,
             "premiumFromOrganization": false,
             "culture": "en-US",
@@ -454,7 +441,7 @@ impl User {
 
     pub async fn save(&mut self, conn: &DbConn) -> EmptyResult {
         if !crate::util::is_valid_email(&self.email) {
-            err!(format!("User email {} is not a valid email address", self.email.escape_debug()))
+            err!(format!("User email {} is not a valid email address", self.email))
         }
 
         self.updated_at = Utc::now().naive_utc();
@@ -481,7 +468,7 @@ impl User {
         }
     }
 
-    pub async fn delete(&self, conn: &DbConn) -> EmptyResult {
+    pub async fn delete(self, conn: &DbConn) -> EmptyResult {
         for member in Membership::find_confirmed_by_user(&self.uuid, conn).await {
             if member.atype == MembershipType::Owner
                 && Membership::count_confirmed_by_org_and_type(&member.org_uuid, MembershipType::Owner, conn).await <= 1
@@ -497,7 +484,6 @@ impl User {
         Cipher::delete_all_by_user(&self.uuid, conn).await?;
         Favorite::delete_all_by_user(&self.uuid, conn).await?;
         Folder::delete_all_by_user(&self.uuid, conn).await?;
-        AuthRequest::delete_all_by_user(&self.uuid, conn).await?;
         Device::delete_all_by_user(&self.uuid, conn).await?;
         TwoFactor::delete_all_by_user(&self.uuid, conn).await?;
         TwoFactorIncomplete::delete_all_by_user(&self.uuid, conn).await?;
@@ -505,7 +491,7 @@ impl User {
         Invitation::take(&self.email, conn).await; // Delete invitation if any
 
         conn.run(move |conn| {
-            diesel::delete(users::table.filter(users::uuid.eq(&self.uuid))).execute(conn).map_res("Error deleting user")
+            diesel::delete(users::table.filter(users::uuid.eq(self.uuid))).execute(conn).map_res("Error deleting user")
         })
         .await
     }
@@ -604,7 +590,7 @@ impl Invitation {
 
     pub async fn save(&self, conn: &DbConn) -> EmptyResult {
         if !crate::util::is_valid_email(&self.email) {
-            err!(format!("Invitation email {} is not a valid email address", self.email.escape_debug()))
+            err!(format!("Invitation email {} is not a valid email address", self.email))
         }
 
         db_run! { conn:
@@ -673,24 +659,34 @@ impl Invitation {
 pub struct UserId(String);
 
 #[derive(
-    Clone, Debug, DieselNewType, FromForm, PartialEq, Eq, Hash, Serialize, AsRef, Deref, Display, From, UuidFromParam,
+    Clone,
+    Debug,
+    DieselNewType,
+    FromForm,
+    PartialEq,
+    Eq,
+    Hash,
+    Serialize,
+    Deserialize,
+    AsRef,
+    Deref,
+    Display,
+    From,
+    UuidFromParam,
 )]
 #[deref(forward)]
 #[from(forward)]
-pub struct KeyId(String);
+pub struct KeyId(#[serde(deserialize_with = "deserialize_key_id")] String);
 
-/// Like upstream, a key id is 32 lowercase hex characters. Key ids are compared as strings, so one in any other
-/// format would never match the id the clients send.
+/// Rejects a key id from a request that isn't 16 bytes as lowercase hex, as upstream's `[KeyId]` does.
 ///
-/// Ref: <https://github.com/bitwarden/server/blob/8da186ad73f80d37157fe6fd42323e4284e83ec1/src/Core/KeyManagement/Models/Data/KeyId.cs#L20-L42>
-impl<'de> serde::Deserialize<'de> for KeyId {
-    fn deserialize<D: serde::Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
-        let key_id = String::deserialize(deserializer)?;
-        if key_id.len() != 32 || !key_id.bytes().all(|b| matches!(b, b'0'..=b'9' | b'a'..=b'f')) {
-            return Err(serde::de::Error::custom("Key id must be 32 lowercase hex characters"));
-        }
-        Ok(Self(key_id))
+/// Ref: <https://github.com/bitwarden/server/blob/main/src/Core/KeyManagement/Models/Data/KeyId.cs>
+fn deserialize_key_id<'de, D: serde::Deserializer<'de>>(deserializer: D) -> Result<String, D::Error> {
+    let key_id = <String as serde::Deserialize>::deserialize(deserializer)?;
+    if key_id.len() != 32 || !key_id.bytes().all(|b| matches!(b, b'0'..=b'9' | b'a'..=b'f')) {
+        return Err(serde::de::Error::custom("Key id must be a 32 character lowercase hex-encoded string."));
     }
+    Ok(key_id)
 }
 
 impl SsoUser {
@@ -746,56 +742,3 @@ impl SsoUser {
         .await
     }
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn test_key_id_format() {
-        let key_id: KeyId = serde_json::from_str(r#""0123456789abcdef0123456789abcdef""#).unwrap();
-        assert_eq!(key_id.as_ref(), "0123456789abcdef0123456789abcdef");
-
-        for invalid in ["", "0123456789ABCDEF0123456789ABCDEF", "0123456789abcdef", "0123456789abcdef0123456789abcdeg"]
-        {
-            assert!(serde_json::from_str::<KeyId>(&format!("\"{invalid}\"")).is_err(), "{invalid:?}");
-        }
-
-        // An absent key id stays optional
-        assert_eq!(serde_json::from_str::<Option<KeyId>>("null").unwrap(), None);
-    }
-
-    #[test]
-    fn test_has_v2_encryption() {
-        // User::new loads CONFIG; isolate it from the DNS bootstrap test and filesystem configuration.
-        if std::env::var_os("VAULTWARDEN_ISOLATED_CONFIG_TEST").is_none() {
-            let output = std::process::Command::new(std::env::current_exe().unwrap())
-                .args(["--exact", std::thread::current().name().unwrap(), "--nocapture"])
-                .env("VAULTWARDEN_ISOLATED_CONFIG_TEST", "1")
-                .env("DATABASE_URL", "sqlite://:memory:")
-                .output()
-                .unwrap();
-            assert!(
-                output.status.success() && String::from_utf8_lossy(&output.stdout).contains("1 passed; 0 failed"),
-                "{}\n{}",
-                String::from_utf8_lossy(&output.stdout),
-                String::from_utf8_lossy(&output.stderr)
-            );
-            return;
-        }
-
-        let user = |private_key: Option<&str>, security_version: Option<i32>| {
-            let mut user = User::new("user@example.com", None);
-            user.private_key = private_key.map(String::from);
-            user.security_version = security_version;
-            user
-        };
-
-        assert!(user(Some("7.cose"), Some(2)).has_v2_encryption());
-        assert!(!user(Some("7.cose"), Some(1)).has_v2_encryption());
-        assert!(!user(Some("7.cose"), None).has_v2_encryption());
-        assert!(!user(Some("2.iv|data|mac"), Some(2)).has_v2_encryption());
-        assert!(!user(Some("7"), Some(2)).has_v2_encryption());
-        assert!(!user(None, Some(2)).has_v2_encryption());
-    }
-}
diff --git a/src/db/models/user_signature_key_pair.rs b/src/db/models/user_signature_key_pair.rs
index 72509761..5af984bd 100644
--- a/src/db/models/user_signature_key_pair.rs
+++ b/src/db/models/user_signature_key_pair.rs
@@ -12,9 +12,14 @@ use crate::{
 
 use super::UserId;
 
-/// A user's signature key pair, part of the v2 state, in its own table like upstream.
+/// A user's signature key pair, part of the "v2" account cryptographic state.
 ///
-/// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Sql/dbo/KeyManagement/Tables/UserSignatureKeyPair.sql#L1-L15>
+/// Upstream keeps this in its own table rather than as columns on the user, with a unique index on
+/// the user id. The stated intent is to eventually keep superseded key pairs around (an `active`
+/// flag was sketched but not shipped), which is why this is modelled as a row with its own identity
+/// instead of a set of user attributes.
+///
+/// Ref: <https://github.com/bitwarden/server/blob/main/src/Sql/dbo/KeyManagement/Tables/UserSignatureKeyPair.sql>
 #[derive(Identifiable, Queryable, Insertable, AsChangeset, Selectable)]
 #[diesel(table_name = user_signature_key_pairs)]
 #[diesel(treat_none_as_null = true)]
@@ -33,7 +38,7 @@ pub struct UserSignatureKeyPair {
     pub updated_at: NaiveDateTime,
 }
 
-/// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Core/KeyManagement/Enums/SignatureAlgorithm.cs#L6-L10>
+/// https://github.com/bitwarden/server/blob/main/src/Core/KeyManagement/Enums/SignatureAlgorithm.cs
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub enum SignatureAlgorithm {
     Ed25519 = 0,
diff --git a/src/db/schema.rs b/src/db/schema.rs
index 98792674..00a58a75 100644
--- a/src/db/schema.rs
+++ b/src/db/schema.rs
@@ -116,7 +116,6 @@ table! {
         atype -> Integer,
         enabled -> Bool,
         data -> Text,
-        revision_date -> Timestamp,
     }
 }
 
@@ -260,15 +259,6 @@ table! {
         atype -> Integer,
         reset_password_key -> Nullable<Text>,
         external_id -> Nullable<Text>,
-        manage_users -> Bool,
-        manage_groups -> Bool,
-        manage_policies -> Bool,
-        create_new_collections -> Bool,
-        edit_any_collection -> Bool,
-        delete_any_collection -> Bool,
-        access_event_logs -> Bool,
-        access_import_export -> Bool,
-        access_reports -> Bool,
         v2_upgrade_token -> Nullable<Text>,
     }
 }
diff --git a/src/error.rs b/src/error.rs
index 3fee3dc4..d90c38e3 100644
--- a/src/error.rs
+++ b/src/error.rs
@@ -425,12 +425,12 @@ macro_rules! err_json {
 macro_rules! err_handler {
     ($expr:expr) => {{
         error!(target: "auth", "Unauthorized Error: {}", $expr);
-        return ::rocket::request::Outcome::Error((::rocket::http::Status::Unauthorized, $expr));
+        return ::rocket::request::Outcome::Error((rocket::http::Status::Unauthorized, $expr));
     }};
     ($usr_msg:expr, $log_value:expr) => {{
         let usr_msg = $usr_msg;
         let log_value = $log_value;
         error!(target: "auth", "Unauthorized Error: {usr_msg}. {log_value}");
-        return ::rocket::request::Outcome::Error((::rocket::http::Status::Unauthorized, usr_msg));
+        return ::rocket::request::Outcome::Error((rocket::http::Status::Unauthorized, usr_msg));
     }};
 }
diff --git a/src/http_client.rs b/src/http_client.rs
index 6225e233..5ef293fc 100644
--- a/src/http_client.rs
+++ b/src/http_client.rs
@@ -466,7 +466,7 @@ mod tests {
     #[test]
     fn dotted_decimal_loopback_normalizes() {
         let ip = parse_to_ip("127.0.0.1").unwrap();
-        assert_eq!(ip, IpAddr::V4(Ipv4Addr::LOCALHOST));
+        assert_eq!(ip, IpAddr::V4(Ipv4Addr::new(127, 0, 0, 1)));
         assert!(!is_global_hardcoded(ip));
     }
 
@@ -474,21 +474,21 @@ mod tests {
     fn single_decimal_loopback_normalizes() {
         // 127.0.0.1 == 2130706433
         let ip = parse_to_ip("2130706433").unwrap();
-        assert_eq!(ip, IpAddr::V4(Ipv4Addr::LOCALHOST));
+        assert_eq!(ip, IpAddr::V4(Ipv4Addr::new(127, 0, 0, 1)));
         assert!(!is_global_hardcoded(ip));
     }
 
     #[test]
     fn hex_loopback_normalizes() {
         let ip = parse_to_ip("0x7f000001").unwrap();
-        assert_eq!(ip, IpAddr::V4(Ipv4Addr::LOCALHOST));
+        assert_eq!(ip, IpAddr::V4(Ipv4Addr::new(127, 0, 0, 1)));
         assert!(!is_global_hardcoded(ip));
     }
 
     #[test]
     fn dotted_hex_loopback_normalizes() {
         let ip = parse_to_ip("0x7f.0.0.1").unwrap();
-        assert_eq!(ip, IpAddr::V4(Ipv4Addr::LOCALHOST));
+        assert_eq!(ip, IpAddr::V4(Ipv4Addr::new(127, 0, 0, 1)));
         assert!(!is_global_hardcoded(ip));
     }
 
@@ -496,14 +496,14 @@ mod tests {
     fn octal_loopback_normalizes() {
         // 017700000001 == 127.0.0.1
         let ip = parse_to_ip("017700000001").unwrap();
-        assert_eq!(ip, IpAddr::V4(Ipv4Addr::LOCALHOST));
+        assert_eq!(ip, IpAddr::V4(Ipv4Addr::new(127, 0, 0, 1)));
         assert!(!is_global_hardcoded(ip));
     }
 
     #[test]
     fn dotted_octal_loopback_normalizes() {
         let ip = parse_to_ip("0177.0.0.01").unwrap();
-        assert_eq!(ip, IpAddr::V4(Ipv4Addr::LOCALHOST));
+        assert_eq!(ip, IpAddr::V4(Ipv4Addr::new(127, 0, 0, 1)));
         assert!(!is_global_hardcoded(ip));
     }
 
@@ -535,19 +535,19 @@ mod tests {
     #[test]
     fn get_valid_host_normalizes_decimal_int() {
         let h = get_valid_host("2130706433").expect("valid");
-        assert!(matches!(h, Host::Ipv4(ip) if ip == Ipv4Addr::LOCALHOST));
+        assert!(matches!(h, Host::Ipv4(ip) if ip == Ipv4Addr::new(127, 0, 0, 1)));
     }
 
     #[test]
     fn get_valid_host_normalizes_hex() {
         let h = get_valid_host("0x7f000001").expect("valid");
-        assert!(matches!(h, Host::Ipv4(ip) if ip == Ipv4Addr::LOCALHOST));
+        assert!(matches!(h, Host::Ipv4(ip) if ip == Ipv4Addr::new(127, 0, 0, 1)));
     }
 
     #[test]
     fn get_valid_host_normalizes_octal() {
         let h = get_valid_host("017700000001").expect("valid");
-        assert!(matches!(h, Host::Ipv4(ip) if ip == Ipv4Addr::LOCALHOST));
+        assert!(matches!(h, Host::Ipv4(ip) if ip == Ipv4Addr::new(127, 0, 0, 1)));
     }
 
     // ===
diff --git a/src/mail.rs b/src/mail.rs
index 14294213..b20f2853 100644
--- a/src/mail.rs
+++ b/src/mail.rs
@@ -36,7 +36,7 @@ fn smtp_transport() -> AsyncSmtpTransport<Tokio1Executor> {
 
     let smtp_client = AsyncSmtpTransport::<Tokio1Executor>::builder_dangerous(host.as_str())
         .port(CONFIG.smtp_port())
-        .timeout(Some(Duration::from_secs(u64::from(CONFIG.smtp_timeout()))));
+        .timeout(Some(Duration::from_secs(CONFIG.smtp_timeout())));
 
     // Determine security
     let smtp_client = if CONFIG.smtp_security() == *"off" {
@@ -169,7 +169,7 @@ pub async fn send_password_hint(address: &str, hint: Option<String>) -> EmptyRes
 }
 
 pub async fn send_delete_account(address: &str, user_id: &UserId) -> EmptyResult {
-    let claims = generate_delete_claims(user_id.to_string())?;
+    let claims = generate_delete_claims(user_id.to_string());
     let delete_token = encode_jwt(&claims);
 
     let (subject, body_html, body_text) = get_text(
@@ -187,7 +187,7 @@ pub async fn send_delete_account(address: &str, user_id: &UserId) -> EmptyResult
 }
 
 pub async fn send_verify_email(address: &str, user_id: &UserId) -> EmptyResult {
-    let claims = generate_verify_email_claims(user_id)?;
+    let claims = generate_verify_email_claims(user_id);
     let verify_email_token = encode_jwt(&claims);
 
     let (subject, body_html, body_text) = get_text(
@@ -206,7 +206,7 @@ pub async fn send_verify_email(address: &str, user_id: &UserId) -> EmptyResult {
 
 pub async fn send_register_verify_email(email: &str, token: &str) -> EmptyResult {
     let mut query = url::Url::parse("https://query.builder").unwrap();
-    query.query_pairs_mut().append_pair("email", email).append_pair("token", token).append_pair("fromEmail", "true");
+    query.query_pairs_mut().append_pair("email", email).append_pair("token", token);
     let Some(query_string) = query.query() else {
         err!("Failed to build verify URL query parameters")
     };
@@ -237,7 +237,7 @@ pub async fn send_welcome(address: &str) -> EmptyResult {
 }
 
 pub async fn send_welcome_must_verify(address: &str, user_id: &UserId) -> EmptyResult {
-    let claims = generate_verify_email_claims(user_id)?;
+    let claims = generate_verify_email_claims(user_id);
     let verify_email_token = encode_jwt(&claims);
 
     let (subject, body_html, body_text) = get_text(
@@ -292,7 +292,7 @@ pub async fn send_invite(
         org_id.clone(),
         member_id.clone(),
         invited_by_email,
-    )?;
+    );
     let invite_token = encode_jwt(&claims);
     let mut query = url::Url::parse("https://query.builder").unwrap();
     {
@@ -351,7 +351,7 @@ pub async fn send_emergency_access_invite(
         emer_id.clone(),
         String::from(grantor_name),
         String::from(grantor_email),
-    )?;
+    );
 
     // Build the query here to ensure proper escaping
     let mut query = url::Url::parse("https://query.builder").unwrap();
@@ -531,21 +531,6 @@ pub async fn send_new_device_logged_in(address: &str, ip: &str, dt: &NaiveDateTi
     send_email(address, &subject, body_html, body_text).await
 }
 
-pub async fn send_recover_twofactor(address: &str, ip: &str, dt: &NaiveDateTime) -> EmptyResult {
-    let fmt = "%A, %B %_d, %Y at %r %Z";
-    let (subject, body_html, body_text) = get_text(
-        "email/recover_twofactor",
-        json!({
-            "url": CONFIG.domain(),
-            "img_src": CONFIG._smtp_img_src(),
-            "ip": ip,
-            "datetime": crate::util::format_naive_datetime_local(dt, fmt),
-        }),
-    )?;
-
-    send_email(address, &subject, body_html, body_text).await
-}
-
 pub async fn send_incomplete_2fa_login(
     address: &str,
     ip: &str,
@@ -738,8 +723,8 @@ async fn send_email(address: &str, subject: &str, body_html: String, body_text:
     let smtp_from = Address::from_str(&CONFIG.smtp_from())?;
 
     let body = if CONFIG.smtp_embed_images() {
-        let logo_gray_body = Body::new(crate::api::STATIC_FILES["logo-gray.png"].bytes.to_vec());
-        let mail_github_body = Body::new(crate::api::STATIC_FILES["mail-github.png"].bytes.to_vec());
+        let logo_gray_body = Body::new(crate::api::static_files("logo-gray.png").unwrap().1.to_vec());
+        let mail_github_body = Body::new(crate::api::static_files("mail-github.png").unwrap().1.to_vec());
         MultiPart::alternative().singlepart(SinglePart::plain(body_text)).multipart(
             MultiPart::related()
                 .singlepart(SinglePart::html(body_html))
diff --git a/src/main.rs b/src/main.rs
index 6d34c850..437354af 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -577,19 +577,9 @@ async fn launch_rocket(pool: db::DbPool, extra_debug: bool) -> Result<(), Error>
         .limit("data-form", 525.megabytes()) // This needs to match the maximum allowed file size for Send
         .limit("file", 525.megabytes()); // This needs to match the maximum allowed file size for attachments
 
-    let rocket = rocket::custom(config);
-    #[cfg(feature = "unsafe_test_mode")]
-    let rocket = {
-        warn!(
-            "This build has `unsafe_test_mode`: its test seeder at /test/seeder creates accounts without any checks. \
-            Never use it outside of tests!"
-        );
-        rocket.mount([basepath, "/test/seeder"].concat(), api::test_seeder_routes())
-    };
-
     // If adding more paths here, consider also adding them to
     // crate::utils::LOGGED_ROUTES to make sure they appear in the log
-    let instance = rocket
+    let instance = rocket::custom(config)
         .mount([basepath, "/"].concat(), api::web_routes())
         .mount([basepath, "/api"].concat(), api::core_routes())
         .mount([basepath, "/admin"].concat(), api::admin_routes())
@@ -605,7 +595,7 @@ async fn launch_rocket(pool: db::DbPool, extra_debug: bool) -> Result<(), Error>
         .manage(Arc::clone(&WS_ANONYMOUS_SUBSCRIPTIONS))
         .attach(util::AppHeaders())
         .attach(util::Cors())
-        .attach(util::BetterLogging::new(extra_debug, basepath))
+        .attach(util::BetterLogging(extra_debug))
         .ignite()
         .await?;
 
@@ -730,7 +720,7 @@ fn schedule_jobs(pool: db::DbPool) {
             }
 
             // Clean unused, expired Duo authentication contexts.
-            if !CONFIG.duo_context_purge_schedule().is_empty() && CONFIG._enable_duo() {
+            if !CONFIG.duo_context_purge_schedule().is_empty() && CONFIG._enable_duo() && !CONFIG.duo_use_iframe() {
                 sched.add(Job::new(CONFIG.duo_context_purge_schedule().parse().unwrap(), || {
                     runtime.spawn(purge_duo_contexts(pool.clone()));
                 }));
@@ -739,7 +729,7 @@ fn schedule_jobs(pool: db::DbPool) {
             // Cleanup the event table of records x days old.
             if CONFIG.org_events_enabled()
                 && !CONFIG.event_cleanup_schedule().is_empty()
-                && CONFIG.events_days_retain().is_some_and(|d| d != 0)
+                && CONFIG.events_days_retain().is_some()
             {
                 sched.add(Job::new(CONFIG.event_cleanup_schedule().parse().unwrap(), || {
                     runtime.spawn(api::event_cleanup_job(pool.clone()));
@@ -764,9 +754,7 @@ fn schedule_jobs(pool: db::DbPool) {
             // tick, the one that was added earlier will run first.
             loop {
                 sched.tick();
-                runtime.block_on(tokio::time::sleep(tokio::time::Duration::from_millis(u64::from(
-                    CONFIG.job_poll_interval_ms(),
-                ))));
+                runtime.block_on(tokio::time::sleep(tokio::time::Duration::from_millis(CONFIG.job_poll_interval_ms())));
             }
         })
         .expect("Error spawning job scheduler thread");
diff --git a/src/ratelimit.rs b/src/ratelimit.rs
index 50d1f99b..70217957 100644
--- a/src/ratelimit.rs
+++ b/src/ratelimit.rs
@@ -7,20 +7,20 @@ use crate::{CONFIG, Error};
 type Limiter<T = IpAddr> = RateLimiter<T, DashMapStateStore<T>, DefaultClock>;
 
 static LIMITER_LOGIN: LazyLock<Limiter> = LazyLock::new(|| {
-    let seconds = Duration::from_secs(u64::from(CONFIG.login_ratelimit_seconds()));
-    let burst = NonZeroU32::new(u32::from(CONFIG.login_ratelimit_max_burst())).expect("Non-zero login ratelimit burst");
+    let seconds = Duration::from_secs(CONFIG.login_ratelimit_seconds());
+    let burst = NonZeroU32::new(CONFIG.login_ratelimit_max_burst()).expect("Non-zero login ratelimit burst");
     RateLimiter::keyed(Quota::with_period(seconds).expect("Non-zero login ratelimit seconds").allow_burst(burst))
 });
 
 static LIMITER_ADMIN: LazyLock<Limiter> = LazyLock::new(|| {
-    let seconds = Duration::from_secs(u64::from(CONFIG.admin_ratelimit_seconds()));
-    let burst = NonZeroU32::new(u32::from(CONFIG.admin_ratelimit_max_burst())).expect("Non-zero admin ratelimit burst");
+    let seconds = Duration::from_secs(CONFIG.admin_ratelimit_seconds());
+    let burst = NonZeroU32::new(CONFIG.admin_ratelimit_max_burst()).expect("Non-zero admin ratelimit burst");
     RateLimiter::keyed(Quota::with_period(seconds).expect("Non-zero admin ratelimit seconds").allow_burst(burst))
 });
 
 static LIMITER_UNAUTHENTICATED: LazyLock<Limiter> = LazyLock::new(|| {
-    let seconds = Duration::from_secs(u64::from(CONFIG.unauthenticated_ratelimit_seconds()));
-    let burst = NonZeroU32::new(u32::from(CONFIG.unauthenticated_ratelimit_max_burst()))
+    let seconds = Duration::from_secs(CONFIG.unauthenticated_ratelimit_seconds());
+    let burst = NonZeroU32::new(CONFIG.unauthenticated_ratelimit_max_burst())
         .expect("Non-zero unauthenticated ratelimit burst");
     RateLimiter::keyed(
         Quota::with_period(seconds).expect("Non-zero unauthenticated ratelimit seconds").allow_burst(burst),
diff --git a/src/sso.rs b/src/sso.rs
index baa17492..01fbd906 100644
--- a/src/sso.rs
+++ b/src/sso.rs
@@ -2,6 +2,7 @@ use std::{sync::LazyLock, time::Duration};
 
 use chrono::Utc;
 use derive_more::{AsRef, Deref, Display, From, Into};
+use regex::Regex;
 use url::Url;
 
 use crate::{
@@ -174,16 +175,16 @@ pub fn decode_state(base64_state: &str) -> ApiResult<OIDCState> {
         if let Ok(valid) = String::from_utf8(vec) {
             OIDCState(valid)
         } else {
-            err!(format!("Invalid utf8 chars in {} after base64 decoding", base64_state.escape_debug()))
+            err!(format!("Invalid utf8 chars in {base64_state} after base64 decoding"))
         }
     } else {
-        err!(format!("Failed to decode {} using base64", base64_state.escape_debug()))
+        err!(format!("Failed to decode {base64_state} using base64"))
     };
 
     Ok(state)
 }
 
-// redirect_uri from: https://github.com/bitwarden/server/blob/main/src/Identity/IdentityServer/StaticClientStore.cs
+// redirect_uri from: https://github.com/bitwarden/server/blob/main/src/Identity/IdentityServer/ApiClient.cs
 pub async fn authorize_url(
     state: OIDCState,
     client_challenge: OIDCCodeChallenge,
@@ -192,21 +193,20 @@ pub async fn authorize_url(
     binding_hash: Option<String>,
     conn: DbConn,
 ) -> ApiResult<Url> {
-    // The desktop app uses the localhost callback when it can't register the custom scheme (AppImage, dev builds)
-    let localhost_redirect_uri =
-        (8065..=8070).map(|port| format!("http://localhost:{port}")).find(|uri| uri == raw_redirect_uri);
-
     let redirect_uri = match client_id {
         "web" | "browser" => format!("{}/sso-connector.html", CONFIG.domain()),
-        "desktop" => localhost_redirect_uri.unwrap_or_else(|| "bitwarden://sso-callback".to_owned()),
-        "mobile" => "bitwarden://sso-callback".to_owned(),
+        "desktop" | "mobile" => "bitwarden://sso-callback".to_owned(),
         "cli" => {
-            let Some(uri) = localhost_redirect_uri else {
-                err!(format!("Unsupported redirect uri {}", raw_redirect_uri.escape_debug()))
-            };
-            uri
+            let port_regex = Regex::new(r"^http://localhost:([0-9]{4})$").unwrap();
+            if let Some(port) =
+                port_regex.captures(raw_redirect_uri).and_then(|captures| captures.get(1).map(|c| c.as_str()))
+            {
+                format!("http://localhost:{port}")
+            } else {
+                err!("Failed to extract port number")
+            }
         }
-        _ => err!(format!("Unsupported client {}", client_id.escape_debug())),
+        _ => err!(format!("Unsupported client {client_id}")),
     };
 
     let (auth_url, sso_auth) = Client::authorize_url(state, client_challenge, redirect_uri, binding_hash).await?;
@@ -242,8 +242,7 @@ impl OIDCIdentifier {
 
 // During the 2FA flow we will
 //  - retrieve the user information and then only discover he needs 2FA.
-//  - second time we will rely on `SsoAuth.auth_response` since the `code` has already been exchanged,
-//    after checking the PKCE verifier again like upstream does on every redemption.
+//  - second time we will rely on `SsoAuth.auth_response` since the `code` has already been exchanged.
 // The `SsoAuth` will ensure that the user is authorized only once.
 pub async fn exchange_code(
     code: &OIDCCode,
@@ -257,7 +256,6 @@ pub async fn exchange_code(
     };
 
     if let Some(authenticated_user) = sso_auth.auth_response.clone() {
-        Client::check_client_verifier(&client_verifier, &sso_auth)?;
         return Ok((sso_auth, authenticated_user));
     }
 
@@ -266,8 +264,8 @@ pub async fn exchange_code(
         (_, Some(re)) => {
             let error_msg = format!(
                 "SSO authorization failed: {}, {}",
-                re.error.escape_debug(),
-                re.error_description.as_deref().unwrap_or_default().escape_debug()
+                re.error,
+                re.error_description.as_ref().unwrap_or(&String::new())
             );
             sso_auth.delete(conn).await?;
             err!(error_msg);
@@ -309,11 +307,7 @@ pub async fn exchange_code(
         user_name: user_name.clone(),
     };
 
-    if CONFIG.sso_debug_tokens() {
-        debug!("Authenticated user {authenticated_user:?}");
-    } else {
-        debug!("Authenticated user {identifier}");
-    }
+    debug!("Authenticated user {authenticated_user:?}");
     sso_auth.auth_response = Some(authenticated_user.clone());
     sso_auth.updated_at = Utc::now().naive_utc();
     sso_auth.save(conn).await?;
diff --git a/src/sso_client.rs b/src/sso_client.rs
index 246e5678..bc766586 100644
--- a/src/sso_client.rs
+++ b/src/sso_client.rs
@@ -29,7 +29,7 @@ static CLIENT_CACHE_KEY: LazyLock<String> = LazyLock::new(|| "sso-client".to_own
 static CLIENT_CACHE: LazyLock<moka::sync::Cache<String, Client>> = LazyLock::new(|| {
     moka::sync::Cache::builder()
         .max_capacity(1)
-        .time_to_live(Duration::from_secs(u64::from(CONFIG.sso_client_cache_expiration())))
+        .time_to_live(Duration::from_secs(CONFIG.sso_client_cache_expiration()))
         .build()
 });
 static REFRESH_CACHE: LazyLock<moka::future::Cache<String, Result<RefreshTokenResponse, String>>> =
@@ -212,16 +212,6 @@ impl Client {
         Ok((auth_url, SsoAuth::new(state, client_challenge, nonce.secret().clone(), redirect_uri, binding_hash)))
     }
 
-    // Check the client's PKCE verifier against the challenge it sent when starting the flow
-    pub fn check_client_verifier(client_verifier: &OIDCCodeVerifier, sso_auth: &SsoAuth) -> EmptyResult {
-        let verifier = PkceCodeVerifier::new(client_verifier.to_string());
-        let challenge = PkceCodeChallenge::from_code_verifier_sha256(&verifier);
-        if challenge.as_str() != &*sso_auth.client_challenge {
-            err!("PKCE client challenge failed")
-        }
-        Ok(())
-    }
-
     pub async fn exchange_code(
         &self,
         code: OIDCCode,
@@ -244,10 +234,15 @@ impl Client {
 
         let mut exchange = self.core_client.exchange_code(oidc_code);
 
+        let verifier = PkceCodeVerifier::new(client_verifier.into());
         if CONFIG.sso_pkce() {
-            exchange = exchange.set_pkce_verifier(PkceCodeVerifier::new(client_verifier.into()));
+            exchange = exchange.set_pkce_verifier(verifier);
         } else {
-            Self::check_client_verifier(&client_verifier, sso_auth)?;
+            let challenge = PkceCodeChallenge::from_code_verifier_sha256(&verifier);
+            if challenge.as_str() != String::from(sso_auth.client_challenge.clone()) {
+                err!("PKCE client challenge failed")
+                // Might need to notify admin ? how ?
+            }
         }
 
         match exchange.request_async(&self.http_client).await {
@@ -260,7 +255,7 @@ impl Client {
                 };
 
                 if CONFIG.sso_debug_tokens() {
-                    debug!("Id token: {id_token}");
+                    debug!("Id token: {}", id_token.to_string());
                     debug!("Access token: {}", token_response.access_token().secret());
                     debug!("Refresh token: {:?}", token_response.refresh_token().map(RefreshToken::secret));
                     debug!("Expiration time: {:?}", token_response.expires_in());
diff --git a/src/static/scripts/admin_diagnostics.js b/src/static/scripts/admin_diagnostics.js
index 1d2f6605..ae4d4235 100644
--- a/src/static/scripts/admin_diagnostics.js
+++ b/src/static/scripts/admin_diagnostics.js
@@ -93,9 +93,7 @@ async function generateSupportString(event, dj) {
     supportString += `* Running within a container: ${yn(dj.running_within_container)} (Base: ${dj.container_base_image})\n`;
     supportString += `* Database type: ${dj.db_type}\n`;
     supportString += `* Database version: ${dj.db_version}\n`;
-    supportString += `* Uses config.json: ${yn(dj.config_file_status !== "NotFound")}`;
-    supportString += dj.config_file_status !== "NotFound" ? ` (Valid: ${chk(dj.config_file_status === "Loaded")})\n` : "\n";
-    supportString += `* Environment variables are valid: ${chk(dj.invalid_env_vars == "")}\n`;
+    supportString += `* Uses config.json: ${yn(dj.overrides !== "")}\n`;
     supportString += `* Uses custom templates: ${yn(dj.template_overrides !== "")}${template_overrides}\n`;
     supportString += `* Uses a reverse proxy: ${yn(dj.ip_header_exists)}\n`;
     if (dj.ip_header_exists) {
@@ -118,7 +116,7 @@ async function generateSupportString(event, dj) {
     }
     supportString += `* HTTP Response Checks: ${chk(httpResponseCheck)}\n`;
     if (dj.invalid_feature_flags != "") {
-        supportString += "* Invalid feature flags: true :x:\n";
+        supportString += "* Invalid feature flags: true\n";
     }
 
     const jsonResponse = await fetch(`${BASE_URL}/admin/diagnostics/config`, {
@@ -134,11 +132,6 @@ async function generateSupportString(event, dj) {
     supportString += "\n### Config & Details (Generated via diagnostics page)\n\n";
     supportString += "<details><summary>Show Config & Details</summary>\n";
 
-    // Show invalid environment variables if they exists
-    if (dj.invalid_env_vars != "") {
-        supportString += `\n**Invalid environment variables:** ${dj.invalid_env_vars}\n`;
-    }
-
     // Add overrides if they exists
     if (dj.overrides != "") {
         supportString += `\n**Environment settings which are overridden:** ${dj.overrides}\n`;
diff --git a/src/static/scripts/admin_users.js b/src/static/scripts/admin_users.js
index 63128627..63ee2d7b 100644
--- a/src/static/scripts/admin_users.js
+++ b/src/static/scripts/admin_users.js
@@ -173,14 +173,10 @@ const ORG_TYPES = {
         "name": "User",
         "bg": "blue"
     },
-    "3": {
+    "4": {
         "name": "Manager",
         "bg": "green"
     },
-    "4": {
-        "name": "Custom",
-        "bg": "teal"
-    },
 };
 
 const userOrgTypeDialog = document.getElementById("userOrgTypeDialog");
@@ -191,19 +187,15 @@ userOrgTypeDialog.addEventListener("show.bs.modal", function (event) {
     const userUuid = event.relatedTarget.parentNode.dataset.vwUserUuid;
     // Get org specific values
     const userOrgType = event.relatedTarget.dataset.vwOrgType;
+    const userOrgTypeName = ORG_TYPES[userOrgType]["name"];
     const orgName = event.relatedTarget.dataset.vwOrgName;
     const orgUuid = event.relatedTarget.dataset.vwOrgUuid;
 
-    document.getElementById("userOrgTypeForm").reset();
     document.getElementById("userOrgTypeDialogOrgName").textContent = orgName;
     document.getElementById("userOrgTypeDialogUserEmail").textContent = userEmail;
     document.getElementById("userOrgTypeUserUuid").value = userUuid;
     document.getElementById("userOrgTypeOrgUuid").value = orgUuid;
-    // The Custom role can only be selected while it is enabled
-    const userOrgTypeRadio = document.getElementById(`userOrgType${ORG_TYPES[userOrgType]?.name}`);
-    if (userOrgTypeRadio) {
-        userOrgTypeRadio.checked = true;
-    }
+    document.getElementById(`userOrgType${userOrgTypeName}`).checked = true;
 }, false);
 
 // Prevent accidental submission of the form with valid elements after the modal has been hidden.
@@ -230,7 +222,7 @@ function updateUserOrgType(event) {
 function initUserTable() {
     // Color all the org buttons per type
     document.querySelectorAll("button[data-vw-org-type]").forEach(function (e) {
-        const orgType = ORG_TYPES[e.dataset.vwOrgType] ?? { "name": "Unknown", "bg": "gray" };
+        const orgType = ORG_TYPES[e.dataset.vwOrgType];
         e.style.backgroundColor = orgType.bg;
         if (orgType.font !== undefined) {
             e.style.color = orgType.font;
diff --git a/src/static/scripts/datatables.css b/src/static/scripts/datatables.css
index 81827eed..3a32d7ed 100644
--- a/src/static/scripts/datatables.css
+++ b/src/static/scripts/datatables.css
@@ -4,10 +4,10 @@
  *
  * To rebuild or modify this file with the latest versions of the included
  * software please visit:
- *   https://datatables.net/download/#bs5/dt-3.1.4
+ *   https://datatables.net/download/#bs5/dt-3.0.4
  *
  * Included libraries:
- *   DataTables 3.1.4
+ *   DataTables 3.0.4
  */
 
 /*! DataTables Bootstrap 5 integration
diff --git a/src/static/scripts/datatables.js b/src/static/scripts/datatables.js
index 8dc93bd6..3d4c727d 100644
--- a/src/static/scripts/datatables.js
+++ b/src/static/scripts/datatables.js
@@ -4,13 +4,13 @@
  *
  * To rebuild or modify this file with the latest versions of the included
  * software please visit:
- *   https://datatables.net/download/#bs5/dt-3.1.4
+ *   https://datatables.net/download/#bs5/dt-3.0.4
  *
  * Included libraries:
- *   DataTables 3.1.4
+ *   DataTables 3.0.4
  */
 
-/*! DataTables 3.1.4
+/*! DataTables 3.0.4
  * Copyright (c) SpryMedia Ltd - datatables.net/license
  */
 
@@ -318,7 +318,7 @@ function htmlNum(d, decimalPoint, formatted, allowEmpty) {
     }
     return !html(d)
         ? null
-        : num(stripHtml(d), decimalPoint, formatted, allowEmpty)
+        : num$1(stripHtml(d), decimalPoint, formatted, allowEmpty)
             ? true
             : null;
 }
@@ -341,7 +341,7 @@ function jquery(input) {
  * @param allowEmpty Allow an empty value to be considered a number
  * @returns `true` if numeric
  */
-function num(d, decimalPoint, formatted, allowEmpty) {
+function num$1(d, decimalPoint, formatted, allowEmpty) {
     let type = typeof d;
     if (type === 'number' || type === 'bigint') {
         return true;
@@ -383,7 +383,7 @@ var is = /*#__PURE__*/Object.freeze({
     html: html,
     htmlNum: htmlNum,
     jquery: jquery,
-    num: num,
+    num: num$1,
     plainObject: plainObject
 });
 
@@ -453,9 +453,6 @@ function assignDeep(out, ...inputs) {
             continue;
         }
         for (const [key, value] of Object.entries(input)) {
-            if (key === '__proto__') {
-                continue;
-            }
             if (Array.isArray(value)) {
                 if (!Array.isArray(out[key])) {
                     out[key] = [];
@@ -492,9 +489,6 @@ function assignDeep(out, ...inputs) {
 function assignDeepObjects(out, extender, breakRefs = false) {
     let val;
     for (let prop in extender) {
-        if (prop === '__proto__') {
-            continue;
-        }
         if (Object.prototype.hasOwnProperty.call(extender, prop)) {
             val = extender[prop];
             if (plainObject(val)) {
@@ -540,134 +534,12 @@ var object = /*#__PURE__*/Object.freeze({
     map: map$1
 });
 
-// Can be assigned in DateTable.use()
-var __win;
-var __bootstrap;
-var __foundation;
-var __luxon$1;
-var __moment$1;
-var __dateTime;
-var __dataTable;
-var __jquery;
-function getWin() {
-    if (__win) {
-        return __win;
-    }
-    if (typeof globalThis !== 'undefined' && globalThis.window) {
-        return globalThis.window;
-    }
-    if (typeof window !== 'undefined') {
-        return window;
-    }
-    return {};
-}
-/**
- * Set the libraries that DataTables uses, or the global objects.
- * Note that the arguments can be either way around (legacy support)
- * and the second is optional. See docs.
- */
-function external (arg1, arg2) {
-    // Reverse arguments for legacy support
-    var module = typeof arg1 === 'string' ? arg2 : arg1;
-    var type = typeof arg2 === 'string' ? arg2 : arg1;
-    // Getter
-    if (module === undefined && typeof type === 'string') {
-        switch (type) {
-            case 'lib':
-            case 'jq':
-                if (__jquery) {
-                    return __jquery;
-                }
-                let local = getWin().jQuery;
-                if (local && local.fn) {
-                    return local;
-                }
-                return null;
-            case 'win':
-                return getWin();
-            case 'doc':
-                return getWin().document;
-            case 'datatable':
-                return __dataTable;
-            case 'datetime':
-                return __dateTime;
-            case 'luxon':
-                return __luxon$1 || getWin().luxon || null;
-            case 'moment':
-                return __moment$1 || getWin().moment || null;
-            case 'bootstrap':
-                // Use local if set, otherwise try window, which could be undefined
-                return __bootstrap || getWin().bootstrap || null;
-            case 'foundation':
-                // Ditto
-                return __foundation || getWin().Foundation || null;
-            default:
-                return null;
-        }
-    }
-    // Setter
-    if (type === 'lib' ||
-        type === 'jq' ||
-        (module && module.fn && module.fn.jquery)) {
-        __jquery = module;
-        jQuerySetup();
-    }
-    else if (type === 'datatable' || (module && module.isDataTable)) {
-        __dataTable = module;
-    }
-    else if (type === 'win' || (module && module.document)) {
-        __win = module;
-    }
-    else if (type === 'datetime' || (module && module.type === 'DateTime')) {
-        __dateTime = module;
-    }
-    else if (type === 'luxon' || (module && module.FixedOffsetZone)) {
-        __luxon$1 = module;
-    }
-    else if (type === 'moment' || (module && module.isMoment)) {
-        __moment$1 = module;
-    }
-    else if (type === 'bootstrap' ||
-        (module && module.Modal && module.Modal.NAME === 'modal')) {
-        // This is currently for BS5 only. BS3/4 attach to jQuery, so no need to use `.use()`
-        __bootstrap = module;
-    }
-    else if (type === 'foundation' || (module && module.Reveal)) {
-        __foundation = module;
-    }
-}
-/**
- * Attach jQuery to DataTables
- */
-function jQuerySetup() {
-    if (!__dataTable || !__jquery) {
-        return;
-    }
-    // Provide access to the host jQuery object (circular reference)
-    __dataTable.$ = __jquery;
-    // jQuery integration - expose the core function.
-    __jquery.fn.dataTable = __dataTable;
-    // jQuery wrapper - returning a DataTable instance
-    __jquery.fn.DataTable = function (options) {
-        let table = new __dataTable(this.toArray(), options);
-        return table;
-    };
-    // Legacy aliases
-    __jquery.fn.dataTableSettings = __dataTable.ext.settings;
-    __jquery.fn.dataTableExt = __dataTable.ext;
-    // All properties that are available to $.fn.dataTable should also be available
-    // on $.fn.DataTable
-    each(__dataTable, function (prop, val) {
-        __jquery.fn.DataTable[prop] = val;
-    });
-}
-
 const defaults$5 = {
     cache: true,
     contentType: 'application/x-www-form-urlencoded; charset=UTF-8',
     headers: {},
     traditional: false,
-    url: ''
+    url: location.href
 };
 /**
  * Trigger an Ajax call to the server based on the configuration parameters
@@ -826,9 +698,8 @@ function convertSpaces(sendData, options) {
  */
 function isCrossDomain(url) {
     // Use the current page as the base to handle relative URLs correctly
-    const win = external('win');
-    const target = new URL(url, win.location.origin);
-    return target.origin !== win.location.origin;
+    const target = new URL(url, window.location.origin);
+    return target.origin !== window.location.origin;
 }
 /**
  * Get the HTTP method from the Ajax request options
@@ -1367,6 +1238,107 @@ var data = /*#__PURE__*/Object.freeze({
     set: set$1
 });
 
+// Can be assigned in DateTable.use()
+var __bootstrap;
+var __foundation;
+var __luxon$1;
+var __moment$1;
+var __dateTime;
+var __dataTable;
+var __jquery;
+/**
+ * Set the libraries that DataTables uses, or the global objects.
+ * Note that the arguments can be either way around (legacy support)
+ * and the second is optional. See docs.
+ */
+function external (arg1, arg2) {
+    // Reverse arguments for legacy support
+    var module = typeof arg1 === 'string' ? arg2 : arg1;
+    var type = typeof arg2 === 'string' ? arg2 : arg1;
+    // Getter
+    if (module === undefined && typeof type === 'string') {
+        switch (type) {
+            case 'lib':
+            case 'jq':
+                return __jquery !== undefined ? __jquery : window.jQuery || null;
+            case 'win':
+                return window;
+            case 'datatable':
+                return __dataTable;
+            case 'datetime':
+                return __dateTime;
+            case 'luxon':
+                return __luxon$1 || window.luxon || null;
+            case 'moment':
+                return __moment$1 || window.moment || null;
+            case 'bootstrap':
+                // Use local if set, otherwise try window, which could be undefined
+                return __bootstrap || window.bootstrap || null;
+            case 'foundation':
+                // Ditto
+                return __foundation || window.Foundation || null;
+            default:
+                return null;
+        }
+    }
+    // Setter
+    if (type === 'lib' ||
+        type === 'jq' ||
+        (module && module.fn && module.fn.jquery)) {
+        __jquery = module;
+        jQuerySetup();
+    }
+    else if (type === 'datatable' || (module && module.isDataTable)) {
+        __dataTable = module;
+    }
+    else if (type === 'win' || (module && module.document)) {
+        window = module;
+        document = module.document;
+    }
+    else if (type === 'datetime' || (module && module.type === 'DateTime')) {
+        __dateTime = module;
+    }
+    else if (type === 'luxon' || (module && module.FixedOffsetZone)) {
+        __luxon$1 = module;
+    }
+    else if (type === 'moment' || (module && module.isMoment)) {
+        __moment$1 = module;
+    }
+    else if (type === 'bootstrap' ||
+        (module && module.Modal && module.Modal.NAME === 'modal')) {
+        // This is currently for BS5 only. BS3/4 attach to jQuery, so no need to use `.use()`
+        __bootstrap = module;
+    }
+    else if (type === 'foundation' || (module && module.Reveal)) {
+        __foundation = module;
+    }
+}
+/**
+ * Attach jQuery to DataTables
+ */
+function jQuerySetup() {
+    if (!__dataTable || !__jquery) {
+        return;
+    }
+    // Provide access to the host jQuery object (circular reference)
+    __dataTable.$ = __jquery;
+    // jQuery integration - expose the core function.
+    __jquery.fn.dataTable = __dataTable;
+    // jQuery wrapper - returning a DataTable instance
+    __jquery.fn.DataTable = function (options) {
+        let table = new __dataTable(this.toArray(), options);
+        return table;
+    };
+    // Legacy aliases
+    __jquery.fn.dataTableSettings = __dataTable.ext.settings;
+    __jquery.fn.dataTableExt = __dataTable.ext;
+    // All properties that are available to $.fn.dataTable should also be available
+    // on $.fn.DataTable
+    each(__dataTable, function (prop, val) {
+        __jquery.fn.DataTable[prop] = val;
+    });
+}
+
 function debounce(fn, timeout = 250) {
     let timer;
     return function (...args) {
@@ -1676,8 +1648,7 @@ function parseEventName(original) {
  */
 function add(el, nameFull, handler, selector, one) {
     let jq = external('jq');
-    let doc = external('doc');
-    if (jq && el.constructor !== EventTarget) {
+    if (jq) {
         let method = one ? 'one' : 'on';
         if (selector) {
             jq(el)[method](nameFull, selector, handler);
@@ -1694,8 +1665,8 @@ function add(el, nameFull, handler, selector, one) {
     }
     // Special handling for the "ready" event - it will trigger when the content
     // is ready, but also if it is already ready, when added.
-    if (el === doc && eventName === 'DOMContentLoaded' && nameFull.includes('ready')) {
-        if (doc.readyState === 'complete') {
+    if (el === document && eventName === 'DOMContentLoaded' && nameFull.includes('ready')) {
+        if (document.readyState === 'complete') {
             handler(new Event('DOMContentLoaded'));
             return;
         }
@@ -1766,7 +1737,7 @@ function add(el, nameFull, handler, selector, one) {
  */
 function remove(el, nameFull, handler, selector) {
     let jq = external('jq');
-    if (jq && el.constructor !== EventTarget) {
+    if (jq) {
         if (selector) {
             jq(el).off(nameFull, selector, handler);
         }
@@ -1834,8 +1805,7 @@ function remove(el, nameFull, handler, selector) {
  */
 function trigger(el, nameFull, bubbles = false, args = [], eventProps = null, returnEvent = false) {
     let jq = external('jq');
-    let win = external('win');
-    if (jq && el.constructor !== EventTarget) {
+    if (jq) {
         let method = bubbles ? 'trigger' : 'triggerHandler';
         let ev = jq.Event(nameFull);
         each(eventProps, (key, val) => {
@@ -1854,19 +1824,10 @@ function trigger(el, nameFull, bubbles = false, args = [], eventProps = null, re
     if (!eventName) {
         return false;
     }
-    let event;
-    // If running in Node, we might be using JSDom which has its own event
-    // classes. The EventTarget is always the global, separate from the window
-    // events. 99% of the time, they will be the same.
-    if (el.constructor === EventTarget) {
-        event = new Event(eventName, { bubbles, cancelable: true });
-    }
-    else {
-        let isMouseEvent = _mouseEvents.includes(eventName.toLowerCase());
-        event = isMouseEvent
-            ? new win.MouseEvent(eventName, { bubbles, cancelable: true })
-            : new win.Event(eventName, { bubbles, cancelable: true });
-    }
+    let isMouseEvent = _mouseEvents.includes(eventName.toLowerCase());
+    let event = isMouseEvent
+        ? new MouseEvent(eventName, { bubbles, cancelable: true })
+        : new Event(eventName, { bubbles, cancelable: true });
     // Set the extra properties for the event
     setEventProp(event, 'namespace', namespaces.join('.'));
     setEventProp(event, '_args', args || []);
@@ -1888,7 +1849,7 @@ var win = {
      */
     height() {
         var _a;
-        return ((_a = external('doc').querySelector('html')) === null || _a === void 0 ? void 0 : _a.clientHeight) || 0;
+        return ((_a = document.querySelector('html')) === null || _a === void 0 ? void 0 : _a.clientHeight) || 0;
     },
     /**
      * Remove an event handler from the window
@@ -1949,21 +1910,17 @@ var win = {
      */
     width() {
         var _a;
-        return ((_a = external('doc').querySelector('html')) === null || _a === void 0 ? void 0 : _a.clientWidth) || 0;
+        return ((_a = document.querySelector('html')) === null || _a === void 0 ? void 0 : _a.clientWidth) || 0;
     }
 };
 
 function create$3(name) {
-    let el = external('doc').createElement(name);
+    let el = document.createElement(name);
     return new Dom(el);
 }
 function select(selector) {
     return new Dom(selector);
 }
-/**
- * Event target for events which don't use the document
- */
-const _staticEventTarget = new EventTarget();
 /**
  * `Dom` is a class that provides a chaining UI for simple DOM manipulation and
  * selection.
@@ -1994,7 +1951,7 @@ class Dom {
     add(selector, sort = true) {
         if (selector) {
             if (typeof selector === 'string') {
-                let elements = Array.from(external('doc').querySelectorAll(selector));
+                let elements = Array.from(document.querySelectorAll(selector));
                 addArray(this, elements);
             }
             else if (selector instanceof Dom) {
@@ -2430,7 +2387,7 @@ class Dom {
             include === 'inner' ||
             include === 'outer') {
             let el = this[0];
-            let computed = external('win').getComputedStyle(this[0]);
+            let computed = window.getComputedStyle(this[0]);
             let rectHeight = el.getBoundingClientRect().height;
             if (!include || include === 'content') {
                 // Content. Minus scrollbar if there is one. This is basically
@@ -2508,7 +2465,7 @@ class Dom {
         if (this.count() === 0) {
             return false;
         }
-        return external('doc').body.contains(this[0]);
+        return document.body.contains(this[0]);
     }
     /**
      * Determine if the first element in the result set is visible or not.
@@ -2618,10 +2575,10 @@ class Dom {
             };
         }
         let box = this[0].getBoundingClientRect();
-        let docElem = external('doc').documentElement;
+        let docElem = document.documentElement;
         return {
-            top: box.top + external('win').pageYOffset - docElem.clientTop,
-            left: box.left + external('win').pageXOffset - docElem.clientLeft
+            top: box.top + window.pageYOffset - docElem.clientTop,
+            left: box.left + window.pageXOffset - docElem.clientLeft
         };
     }
     /**
@@ -2632,7 +2589,7 @@ class Dom {
      * @returns Instance with the result set as the offset parents
      */
     offsetParent() {
-        return this.map(el => el.offsetParent || external('doc').body);
+        return this.map(el => el.offsetParent || document.body);
     }
     on(arg1, arg2, arg3) {
         let { handler, names, selector } = normaliseEventParams(arg1, arg2, arg3);
@@ -2700,7 +2657,7 @@ class Dom {
      */
     prepend(content) {
         return this.each(el => {
-            if (arrayLike(content) || dom(content)) {
+            if (content instanceof Dom) {
                 // Reverse the array, so if there are multiple elements, they
                 // end up being added sequentially, just like jQuery
                 let itemsReversed = Array.from(content).reverse();
@@ -2928,7 +2885,7 @@ class Dom {
             include === 'inner' ||
             include === 'outer') {
             let el = this[0];
-            let computed = external('win').getComputedStyle(el);
+            let computed = window.getComputedStyle(el);
             let rectWidth = el.getBoundingClientRect().width;
             if (!include || include === 'content') {
                 // Content. Minus scrollbar if there is one. This is basically
@@ -2981,15 +2938,6 @@ Dom.c = create$3;
  * @returns Dom instance for manipulating the new element
  */
 Dom.create = create$3;
-/**
- * Non-DOM event listener. Add an event listener with no document.
- *
- * @param name Event name
- * @param fn Event callback
- */
-Dom.on = function (name, fn) {
-    add(_staticEventTarget, name, fn, null, false);
-};
 /**
  * Select items from the document and wrap in a `Dom` instance (alias of
  * `select`)
@@ -3011,20 +2959,6 @@ Dom.select = select;
  * false to disable and have it jump to the end.
  */
 Dom.transitions = true;
-/**
- * Trigger an event non-DOM events.
- *
- * @param name Event name. This can optionally include period separated
- *   namespaces. Multiple events can be added by space separation of the
- *   names.
- * @param args Arguments to pass to the event handlers (after the event
- *   object, which is always the first parameter).
- * @param props An object of key/value pairs which should be added to the
- *   event object that is created and fired for the events.
- */
-Dom.trigger = function (name, args, props) {
-    trigger(_staticEventTarget, name, true, args, props);
-};
 /**
  * Window object methods
  */
@@ -3076,10 +3010,10 @@ function documentOrder(a, b) {
     let position = a.compareDocumentPosition(b);
     if (position & Node.DOCUMENT_POSITION_DISCONNECTED) {
         // One is disconnected - find which
-        if (external('doc').body.contains(a)) {
+        if (document.body.contains(a)) {
             return -1;
         }
-        else if (external('doc').body.contains(b)) {
+        else if (document.body.contains(b)) {
             return 1;
         }
         return 0;
@@ -3541,7 +3475,7 @@ function invalidateRow(settings, rowIdx, src, colIdx) {
     else {
         // Reading from data object, update the DOM
         var cells = row.cells;
-        var display = getDisplay(settings, rowIdx);
+        var display = getRowDisplay(settings, rowIdx);
         if (cells.length) {
             if (colIdx !== undefined) {
                 writeCell(cells[colIdx], display[colIdx]);
@@ -3800,7 +3734,8 @@ function calculateColumnWidths(settings) {
     // Construct a worst case table with the widest, assign any user defined
     // widths, then insert it into  the DOM and allow the browser to do all
     // the hard work of calculating table widths
-    var tmpTable = Dom.s(table.cloneNode())
+    var tmpTable = Dom
+        .s(table.cloneNode())
         .css('visibility', 'hidden')
         .css('margin', '0')
         .attrRemove('id');
@@ -3846,7 +3781,7 @@ function calculateColumnWidths(settings) {
     }
     if (longestData.length) {
         for (i = 0; i < longestData[0].length; i++) {
-            var tr = Dom.c('tr').appendTo(tmpTable.children('tbody'));
+            var tr = Dom.c('tr').appendTo(tmpTable.find('tbody'));
             for (j = 0; j < visibleColumns.length; j++) {
                 columnIdx = visibleColumns[j];
                 column = columns[columnIdx];
@@ -3854,7 +3789,8 @@ function calculateColumnWidths(settings) {
                 var autoClass = ext.type.className[column.type];
                 var padding = column.contentPadding || (scrollX ? '-' : '');
                 var text = longest + padding;
-                var cell = Dom.c('td')
+                var cell = Dom
+                    .c('td')
                     .classAdd(autoClass)
                     .classAdd(column.className)
                     .appendTo(tr);
@@ -3876,7 +3812,8 @@ function calculateColumnWidths(settings) {
     // with minimal height, so it has no effect on if the container scrolls
     // or not. Otherwise it might trigger scrolling when it actually isn't
     // needed
-    var holder = Dom.c('div')
+    var holder = Dom
+        .c('div')
         .css(scrollX || scrollY
         ? {
             position: 'absolute',
@@ -3946,7 +3883,8 @@ function calculateColumnWidths(settings) {
             // This flag allows the above to be satisfied.
             var first = Dom.s(settings.tableWrapper).isVisible();
             // Use an empty div to attach the observer so it isn't impacted by height changes
-            var resizer = Dom.c('div')
+            var resizer = Dom
+                .c('div')
                 .css({
                 width: '100%',
                 height: '0'
@@ -3999,19 +3937,14 @@ function wrapperWidth(settings) {
  */
 function getWideStrings(settings, colIdx) {
     var column = settings.columns[colIdx];
-    // Do we need to recalculate (i.e. was invalidated), or just use the cached
-    // data? Recalculate if display based for the column.
-    if (!column.wideStrings || column.widthCalc === 'display') {
+    // Do we need to recalculate (i.e. was invalidated), or just use the cached data?
+    if (!column.wideStrings) {
         var allStrings = [];
         var collection = [];
-        let rows = settings.displayMaster;
-        if (column.widthCalc === 'display') {
-            rows = settings.display.slice(settings.displayStart, settings.displayStart + settings.pageLength);
-        }
         // Create an array with the string information for the column
-        for (var i = 0, len = rows.length; i < len; i++) {
-            var rowIdx = rows[i];
-            var data = getDisplay(settings, rowIdx, colIdx);
+        for (var i = 0, iLen = settings.displayMaster.length; i < iLen; i++) {
+            var rowIdx = settings.displayMaster[i];
+            var data = getRowDisplay(settings, rowIdx)[colIdx];
             var cellString = data && typeof data === 'object' && data.nodeType
                 ? data.innerHTML
                 : data + '';
@@ -4190,20 +4123,20 @@ function featureTable(settings) {
     let scrollBody = children.eq(1);
     let scrollFoot = children.eq(2);
     // When the body is scrolled, then we also want to scroll the header and
-    // footer. Equally we want changes in the header / footer to transition the
-    // body. The header and footer are `overflow: hidden`, so the user can't
-    // scroll those elements other than triggering a focus action in them.
+    // footer. Note that each element has its own scroll listener, and that in
+    // turn sets the scroll for the other elements. However this doesn't lead to
+    // an infinite loop as `scroll` is only triggered if the value changes.
     scrollBody.on('scroll.DT', () => {
         let scrollLeft = scrollBody.scrollLeft();
         scrollHead.scrollLeft(scrollLeft);
         scrollFoot.scrollLeft(scrollLeft);
     });
-    scrollHead.on('focusin.DT', () => {
+    scrollHead.on('scroll.DT', () => {
         let scrollLeft = scrollHead.scrollLeft();
         scrollBody.scrollLeft(scrollLeft);
         scrollFoot.scrollLeft(scrollLeft);
     });
-    scrollFoot.on('focusin.DT', () => {
+    scrollFoot.on('scroll.DT', () => {
         let scrollLeft = scrollFoot.scrollLeft();
         scrollHead.scrollLeft(scrollLeft);
         scrollBody.scrollLeft(scrollLeft);
@@ -4377,9 +4310,7 @@ function scrollDraw(settings) {
         .find('[role]')
         .attrRemove('role');
     table.find('tbody tr:not([role])').attr('role', 'row');
-    table
-        .find('tbody td:not([role]), tbody th:not([role])')
-        .attr('role', 'cell');
+    table.find('tbody td:not([role]), tbody th:not([role])').attr('role', 'cell');
     scrollAria(headerCopy);
     scrollAria(footerCopy);
     // Adjust the position of the header in case we loose the y-scrollbar
@@ -5825,12 +5756,8 @@ function ajaxDataSrcParam(settings, param, json) {
     return json[old] !== undefined ? json[old] : json[param];
 }
 
-let __filter_div;
-let __filter_div_textContent;
-function createFilterDiv() {
-    __filter_div = Dom.c('div').get(0);
-    __filter_div_textContent = __filter_div.textContent !== undefined;
-}
+const __filter_div = Dom.c('div').get(0);
+const __filter_div_textContent = __filter_div.textContent !== undefined;
 /**
  * Filter the table using both the global filter and column based filtering
  *
@@ -6018,9 +5945,6 @@ function filterData(settings) {
     let column;
     let j, jen, cellData, row;
     let wasInvalidated = false;
-    if (!__filter_div) {
-        createFilterDiv();
-    }
     for (let rowIdx = 0; rowIdx < data.length; rowIdx++) {
         if (!data[rowIdx]) {
             continue;
@@ -6067,7 +5991,14 @@ function filterData(settings) {
     return wasInvalidated;
 }
 
-function getDisplay(settings, rowIdx, colIdx = null) {
+/**
+ * Render and cache a row's display data for the columns, if required
+ *
+ * @param settings DataTables settings object
+ * @param rowIdx Row index
+ * @returns Array with display information
+ */
+function getRowDisplay(settings, rowIdx) {
     var rowModal = settings.data[rowIdx];
     var columns = settings.columns;
     if (!rowModal) {
@@ -6076,29 +6007,11 @@ function getDisplay(settings, rowIdx, colIdx = null) {
     if (!rowModal.displayData) {
         // Need to render and cache
         rowModal.displayData = [];
-    }
-    const displayData = rowModal.displayData;
-    // Check if we need to actually perform the render to get the display data
-    if (!displayData._complete) {
-        if (colIdx !== null) {
-            // Single cell
-            if (!displayData[colIdx]) {
-                displayData[colIdx] = getCellData(settings, rowIdx, colIdx, 'display');
-            }
-        }
-        else {
-            // Whole row
-            for (var i = 0, len = columns.length; i < len; i++) {
-                if (!displayData[i]) {
-                    displayData[i] = getCellData(settings, rowIdx, i, 'display');
-                    displayData._complete = true;
-                }
-            }
+        for (var colIdx = 0, len = columns.length; colIdx < len; colIdx++) {
+            rowModal.displayData.push(getCellData(settings, rowIdx, colIdx, 'display'));
         }
     }
-    // At this point the item(s) we want will have been created - possibly all,
-    // but that doesn't matter, as long as we've got the one we want.
-    return colIdx !== null ? displayData[colIdx] : displayData;
+    return rowModal.displayData;
 }
 /**
  * Create a new TR element (and it's TD children) for a row
@@ -6110,10 +6023,10 @@ function getDisplay(settings, rowIdx, colIdx = null) {
  * @param tds Array of TD|TH elements for the row - must be given if trIn is.
  */
 function createTr(settings, rowIdx, trIn, tds) {
-    var row = settings.data[rowIdx], cells = [], tr, td, column, i, iLen, create, trClass = settings.classes.tbody.row, doc = external('doc');
+    var row = settings.data[rowIdx], cells = [], tr, td, column, i, iLen, create, trClass = settings.classes.tbody.row;
     if (row && row.tr === null) {
         let rowData = row.data;
-        tr = trIn || doc.createElement('tr');
+        tr = trIn || document.createElement('tr');
         row.tr = tr;
         row.cells = cells;
         Dom.s(tr).classAdd(trClass);
@@ -6128,7 +6041,7 @@ function createTr(settings, rowIdx, trIn, tds) {
             column = settings.columns[i];
             create = trIn && tds && tds[i] ? false : true;
             td = create
-                ? doc.createElement(column.cellType)
+                ? document.createElement(column.cellType)
                 : tds[i];
             if (!td) {
                 log(settings, 0, 'Incorrect column count', 18);
@@ -6138,7 +6051,7 @@ function createTr(settings, rowIdx, trIn, tds) {
                 column: i
             };
             cells.push(td);
-            var display = getDisplay(settings, rowIdx);
+            var display = getRowDisplay(settings, rowIdx);
             // Need to create the HTML if new, or if a rendering function is
             // defined
             if (create ||
@@ -6531,8 +6444,10 @@ function _emptyRow(settings) {
     else if (lang.emptyTable && recordsTotal(settings) === 0) {
         zero = lang.emptyTable;
     }
-    return Dom.c('tr')
-        .append(Dom.c('td')
+    return Dom
+        .c('tr')
+        .append(Dom
+        .c('td')
         .attr('colSpan', visibleColumns(settings))
         .classAdd(settings.classes.empty.row)
         .html(zero))
@@ -6659,12 +6574,15 @@ function detectHeader(settings, thead, write) {
                         cell.parent(':not([data-dt-order=disable])').count() !==
                             0 &&
                         cell.find('div.dt-column-order').count() === 0) {
-                        Dom.c('div').classAdd('dt-column-order').appendTo(cell);
+                        Dom.c('div')
+                            .classAdd('dt-column-order')
+                            .appendTo(cell);
                     }
                     // We need to wrap the elements in the header in another
                     // element to use flexbox layout for those elements
                     var headerFooter = isHeader ? 'header' : 'footer';
-                    if (cell.find('div.dt-column-' + headerFooter).count() === 0) {
+                    if (cell.find('div.dt-column-' + headerFooter).count() ===
+                        0) {
                         Dom.c('div')
                             .classAdd('dt-column-' + headerFooter)
                             .append(Array.from(cell.get(0).childNodes))
@@ -6874,12 +6792,6 @@ function callbackFire(ctx, callbackArr, eventName, args, bubbles = false) {
         });
     }
     if (eventName !== null) {
-        // Non-DOM events
-        if (bubbles) {
-            Dom.trigger(eventName + '.dt', args, {
-                dt: ctx.api
-            });
-        }
         let table = Dom.s(ctx.table);
         let result = table.trigger(eventName + '.dt', bubbles, args, {
             dt: ctx.api
@@ -7505,29 +7417,24 @@ function __mlHelper(localeString) {
         };
     };
 }
-var __thousands;
-var __decimal;
-function detectIntl() {
-    let win = DataTable.use('win');
-    // Based on locale, determine standard number formatting
-    // Fallback for legacy browsers is US English
-    __thousands = ',';
-    __decimal = '.';
-    if (win.Intl !== undefined) {
-        try {
-            var num = new Intl.NumberFormat().formatToParts(100000.1);
-            for (var i = 0; i < num.length; i++) {
-                if (num[i].type === 'group') {
-                    __thousands = num[i].value;
-                }
-                else if (num[i].type === 'decimal') {
-                    __decimal = num[i].value;
-                }
+// Based on locale, determine standard number formatting
+// Fallback for legacy browsers is US English
+var __thousands = ',';
+var __decimal = '.';
+if (window.Intl !== undefined) {
+    try {
+        var num = new Intl.NumberFormat().formatToParts(100000.1);
+        for (var i = 0; i < num.length; i++) {
+            if (num[i].type === 'group') {
+                __thousands = num[i].value;
+            }
+            else if (num[i].type === 'decimal') {
+                __decimal = num[i].value;
             }
         }
-        catch (e) {
-            // noop
-        }
+    }
+    catch (e) {
+        // noop
     }
 }
 /**
@@ -7568,9 +7475,6 @@ var helpers = {
     datetime: __mlHelper('toLocaleString'),
     time: __mlHelper('toLocaleTimeString'),
     number: function (thousands, decimal, precision, prefix, postfix) {
-        if (!__thousands && !__decimal) {
-            detectIntl();
-        }
         // Auto locale detection
         if (thousands === null || thousands === undefined) {
             thousands = __thousands;
@@ -7652,8 +7556,7 @@ const defaults$2 = {
     title: null,
     type: null,
     visible: true,
-    width: null,
-    widthCalc: 'all'
+    width: null
 };
 
 /**
@@ -7754,10 +7657,6 @@ class Settings {
          * Width of the column
          */
         this.width = null;
-        /**
-         * Which cells to use when calculating the column width
-         */
-        this.widthCalc = 'all';
         /**
          * Width of the column when it was first "encountered"
          */
@@ -7925,7 +7824,7 @@ function browserDetect(ctx) {
             .css({
             position: 'fixed',
             top: '0',
-            left: -1 * external('win').pageXOffset + 'px', // allow for scrolling
+            left: -1 * window.pageXOffset + 'px', // allow for scrolling
             height: '1px',
             width: '1px',
             overflow: 'hidden'
@@ -7969,7 +7868,9 @@ function addColumn(settings) {
         data: defaults$2.data ? defaults$2.data : columnIdx,
         idx: columnIdx,
         searchFixed: {},
-        colEl: Dom.c('col').attr('data-dt-column', columnIdx)
+        colEl: Dom
+            .c('col')
+            .attr('data-dt-column', columnIdx)
     });
     settings.columns.push(column);
     // Legacy support for `searchCols` property. If set, and there is a value
@@ -7977,7 +7878,9 @@ function addColumn(settings) {
     // specific `search` option is applied in `columnOptions`, but we always
     // want the search object for the column to exist.
     let searchCols = settings.searchCols;
-    settings.searches[columnIdx] = create$1(searchCols[columnIdx] ? hungarianToCamel(searchCols[columnIdx]) : {});
+    settings.searches[columnIdx] = create$1(searchCols[columnIdx]
+        ? hungarianToCamel(searchCols[columnIdx])
+        : {});
     settings.searches[columnIdx].columns = [columnIdx];
 }
 /**
@@ -8467,18 +8370,12 @@ function columnsFromHeader(cell) {
  */
 function columnCells(header, row = null, column = null) {
     var out = [];
-    var included = [];
     for (var i = 0; i < header.length; i++) {
         if (row === null || row === i) {
             for (var j = 0; j < header[i].length; j++) {
                 var cell = header[i][j].cell;
-                if ((column === null || column === j) &&
-                    !included.includes(cell)) {
-                    included.push(cell);
-                    out.push({
-                        cell,
-                        row: header[i].row
-                    });
+                if ((column === null || column === j) && !out.includes(cell)) {
+                    out.push(cell);
                 }
             }
         }
@@ -8493,35 +8390,31 @@ function columnCells(header, row = null, column = null) {
  * @returns Array of selected elements
  */
 function columnOrderingCells(settings, notSelector) {
-    let combined = [];
-    let titleRow = settings.titleRow;
+    var cells = [];
+    var titleRow = settings.titleRow;
     if (titleRow === true) {
         // Top row (legacy `orderCellsTop`)
-        combined = columnCells(settings.header, 0);
+        cells = columnCells(settings.header, 0);
     }
     else if (titleRow === false) {
         // Bottom row (legacy `orderCellsTop`)
-        combined = columnCells(settings.header, settings.header.length - 1);
+        cells = columnCells(settings.header, settings.header.length - 1);
     }
     else if (titleRow !== null) {
         // Specific row
-        combined = columnCells(settings.header, titleRow);
+        cells = columnCells(settings.header, titleRow);
     }
     else {
         // All
-        combined = columnCells(settings.header);
+        cells = columnCells(settings.header);
     }
-    let cells = combined.map(c => c.cell);
-    let rows = combined.map(c => c.row);
     return Dom.s(cells)
         .filter('th' + notSelector + ', td' + notSelector)
         .filter(el => {
-        let idx = cells.indexOf(el);
-        if (idx >= 0) {
-            return Dom.s(rows[idx]).filter(notSelector).length !== 0;
-        }
-        // Shouldn't be able to get here!
-        return true;
+        return (Dom.s(el)
+            .parent()
+            .filter(notSelector)
+            .length !== 0);
     });
 }
 
@@ -8720,7 +8613,7 @@ const ext = {
     /**
      * DataTables build type (expanded by the download builder)
      */
-    builder: 'bs5/dt-3.1.4',
+    builder: 'bs5/dt-3.0.4',
     /**
      * Buttons. For use with the Buttons extension for DataTables. This is
      * defined here so other extensions can define buttons regardless of load
@@ -8866,7 +8759,7 @@ const ext = {
      * Software version
      *  @type string
      */
-    version: '3.1.4'
+    version: '3.0.4'
 };
 //
 // Backwards compatibility. Alias to pre 1.10 Hungarian notation counter parts
@@ -9278,6 +9171,9 @@ const properties = {};
 const classes = {
     Api
 };
+// TODO debug
+window.classes = classes;
+window.properties = properties;
 /**
  * Create a new API "class" (function), used for nested levels of the API - e.g.
  * `ApiRows` and `ApiColumn`.
@@ -9565,7 +9461,7 @@ register('destroy()', function (remove) {
         callbackFire(settings, 'destroy', 'destroy', [settings], true);
         // If not being removed from the document, make all columns visible
         if (!remove) {
-            new Api(settings).columns().visible(true);
+            new Api(settings).columns().visible();
         }
         // Container width change listener
         if (settings.resizeObserver) {
@@ -10062,7 +9958,7 @@ function selectColumns(settings, selector, opts) {
                         }
                         // Selector
                         if (match && match[1]) {
-                            let columnElements = columnCells(settings.header, null, col.idx).map(c => c.cell);
+                            let columnElements = columnCells(settings.header, null, col.idx);
                             return Dom.s(columnElements)
                                 .filter(match[1])
                                 .count() > 0
@@ -10099,7 +9995,7 @@ function selectColumns(settings, selector, opts) {
             return [s._DT_CellIndex.column];
         }
         // Selector on the TH elements for the columns
-        var result = Dom.s(columnCells(settings.header).map(c => c.cell))
+        var result = Dom.s(columnCells(settings.header))
             .filter(s)
             .mapTo(el => {
             return columnsFromHeader(el);
@@ -10309,14 +10205,11 @@ registerPlural('columns().widths()', 'column().width()', function () {
     // Injects a fake row into the table for just a moment so the widths can
     // be read, regardless of colspan in the header and rows being present
     // in the body
-    let columns = this.columns(':visible');
-    let row = Dom.c('tr');
-    for (let i = 0; i < columns.count(); i++) {
-        Dom.c('td').appendTo(row);
-    }
+    var columns = this.columns(':visible');
+    var row = Dom.c('tr').html('<td>' + Array(columns.count()).join('</td><td>') + '</td>');
     Dom.s(this.table().body()).append(row);
-    let widths = [];
-    let indexes = columns.indexes();
+    var widths = [];
+    var indexes = columns.indexes();
     row.children().each((el, idx) => {
         widths[indexes[idx]] = Dom.s(el).width('outer');
     });
@@ -10496,7 +10389,7 @@ register('processing()', function (show) {
 });
 
 // Add the state event handler in time for the initial draw to save state
-Dom.on('preInit.dt', function (e, context) {
+Dom.s(document).on('preInit.dt', function (e, context) {
     var api = new Api(context);
     api.on('stateSaveParams.DT', function (ev, settings, d) {
         // This could be more compact with the API, but it is a lot faster as a
@@ -10519,7 +10412,7 @@ Dom.on('preInit.dt', function (e, context) {
     });
 });
 // But initial details can wait until the end
-Dom.on('plugin-init.dt', function (e, context) {
+Dom.s(document).on('plugin-init.dt', function (e, context) {
     var api = context.api;
     // And the initial load state
     detailsStateLoad(api, api.state.loaded());
@@ -11332,7 +11225,7 @@ const _licenseInfo = {
     expires: null,
     valid: null
 };
-let _wm;
+const _wm = Dom.c('div');
 const _publicKey = 'BE1A9w9D9U/4s4/TogY+1sW/dLJ8IquzK1PmV70J93ZTIvXMZ0eV2NAb52ntpgwVFySSB2fOI7geLNO737rQAyo=';
 /**
  * Convert a base64 string to a binary array
@@ -11361,7 +11254,7 @@ function check(releaseDate, software) {
         noticeDisplay();
     }
     else if (_licenseInfo.valid === false) {
-        noticePrep('Invalid license key');
+        noticePrep('License key invalid');
         noticeDisplay();
     }
     else if (_licenseInfo.type === 'trial') {
@@ -11371,7 +11264,7 @@ function check(releaseDate, software) {
             : -1;
         if (remaining < 0) {
             // Trial expires
-            consoleMsg('Your trial has now expired. Please visit https://datatables.net/plus to purchase a license', 'warn');
+            consoleMsg('Your trial has now expired - https://datatables.net/plus', 'warn');
             noticePrep('Trial expired');
             noticeDisplay();
             return false;
@@ -11446,15 +11339,7 @@ const key = function (key) {
  * @returns
  */
 function noticePrep(text) {
-    // Already prep-ed. Rather than possibly showing multiple messages, just
-    // let the first one show.
-    if (_ready) {
-        return;
-    }
     if (!_ready) {
-        if (!_wm) {
-            _wm = Dom.c('div');
-        }
         let shadow = _wm[0].attachShadow({ mode: 'closed' });
         let notice = Dom.c('div').css({
             position: 'fixed',
@@ -11466,59 +11351,37 @@ function noticePrep(text) {
             padding: '0.5em 1em',
             'font-family': 'sans-serif',
             'font-size': '12px',
-            'line-height': '1.4em',
-            'text-align': 'center',
             'border-radius': '4px',
             'z-index': '10000',
-            'box-shadow': '1px 3px 5px rgba(0, 0, 0, 0.333)'
+            'box-shadow': '0 2px 5px rgba(0,0,0,0.2)'
         });
+        Dom.c('a')
+            .attr('href', 'https://datatables.net/tn/25')
+            .attr('target', '_blank')
+            .css({
+            color: 'inherit',
+            'text-decoration': 'none'
+        })
+            .appendTo(notice);
+        if (!text) {
+            text = 'License key required';
+        }
         shadow.appendChild(notice[0]);
         _notice = notice;
         _ready = true;
     }
-    _notice.empty();
     if (text) {
-        // Specific notice
         _notice
-            .append(Dom.c('span').text('DataTables Plus'))
-            .append(Dom.c('br'))
-            .append(Dom.c('span').text(text + ' - '))
-            .append(Dom.c('a')
-            .attr('href', 'https://datatables.net/tn/25')
-            .attr('target', '_blank')
-            .css({
-            color: 'inherit'
-        })
-            .html('learn more &#187;'));
-    }
-    else {
-        _notice
-            .append(Dom.c('span').text('DataTables Plus - Evaluation Mode'))
-            .append(Dom.c('br'))
-            .append(Dom.c('a')
-            .attr('href', 'https://datatables.net/plus/trial')
-            .attr('target', '_blank')
-            .css({
-            color: 'inherit'
-        })
-            .text('Start a Free Trial'))
-            .append(Dom.c('span').text(' - '))
-            .append(Dom.c('a')
-            .attr('href', 'https://datatables.net/plus')
-            .attr('target', '_blank')
-            .css({
-            color: 'inherit'
-        })
-            .text('Purchase a License'));
+            .find('a')
+            .html('DataTables Plus: ' + text + ' - learn more &#187;');
     }
 }
 /**
  * Display the license notice
  */
 function noticeDisplay() {
-    let doc = external('doc');
-    if (!_processingKey && doc.body && !doc.body.contains(_wm[0])) {
-        doc.body.appendChild(_wm[0]);
+    if (!_processingKey && document.body && !document.body.contains(_wm[0])) {
+        document.body.appendChild(_wm[0]);
     }
 }
 /**
@@ -11592,7 +11455,7 @@ function plus (DataTable) {
         value: function (releaseDate, software = '') {
             // Unsecure sites are only useful for development, so allow there
             // and on the site.
-            let host = external('win').location.hostname;
+            let host = window.location.hostname;
             let isDev = host === '192.168.234.234' ||
                 host.endsWith('.datatables.net') ||
                 host === 'datatables.net';
@@ -11616,8 +11479,7 @@ function plus (DataTable) {
 }
 function getSubtle() {
     // Backwards compat for old browsers
-    let win = external('win');
-    let cryptoObj = win.crypto || win.msCrypto;
+    let cryptoObj = window.crypto || window.msCrypto;
     let subtle = cryptoObj.subtle || cryptoObj.webkitSubtle;
     return subtle;
 }
@@ -11703,7 +11565,7 @@ function _divProp(el, prop, val) {
     }
 }
 register$2('div', function (settings, opts) {
-    var n = Dom.c('div').get(0);
+    var n = document.createElement('div');
     if (opts) {
         _divProp(n, 'className', opts.className);
         _divProp(n, 'id', opts.id);
@@ -11861,7 +11723,7 @@ function _pagingDraw(settings, host, opts) {
         buttonEls.push(btn.display);
     }
     let wrapped = renderer(settings, 'pagingContainer')(settings, buttonEls);
-    let activeEl = host.find(external('doc').activeElement).attr('data-dt-idx');
+    let activeEl = host.find(document.activeElement).attr('data-dt-idx');
     host.empty().append(wrapped);
     if (activeEl) {
         host.find('[data-dt-idx="' + activeEl + '"]').trigger('focus');
@@ -12468,10 +12330,7 @@ const defaults = {
     stateDuration: 7200,
     stateLoadCallback: function (settings) {
         try {
-            const state = (settings.stateDuration === -1 ? sessionStorage : localStorage).getItem('DataTables_' +
-                settings.unique +
-                '_' +
-                external('win').location.pathname);
+            const state = (settings.stateDuration === -1 ? sessionStorage : localStorage).getItem('DataTables_' + settings.unique + '_' + location.pathname);
             return state ? JSON.parse(state) : {};
         }
         catch (e) {
@@ -12485,10 +12344,7 @@ const defaults = {
         try {
             (settings.stateDuration === -1
                 ? sessionStorage
-                : localStorage).setItem('DataTables_' +
-                settings.unique +
-                '_' +
-                external('win').location.pathname, JSON.stringify(data));
+                : localStorage).setItem('DataTables_' + settings.unique + '_' + location.pathname, JSON.stringify(data));
         }
         catch (e) {
             // noop
@@ -12544,8 +12400,6 @@ const DataTable = function (selector, options) {
         if (init.on && init.on.options) {
             listener(table, 'options', init.on.options);
         }
-        // Don't have the settings object here, so can't use `callbackFire`
-        Dom.trigger('options.dt', [init]);
         table.trigger('options.dt', true, [init]);
         // Backwards compatibility parameter mapping
         compatOpts(defaults, true);
@@ -12940,9 +12794,7 @@ DataTable.feature = {
 };
 // Register the libraries
 util.external(DataTable);
-// If jQuery is present on the global, let DataTables know about it. This is
-// required as it registers the plugin functions on the .fn object.
-if (typeof window !== 'undefined' && window.jQuery) {
+if (window.jQuery) {
     util.external(window.jQuery);
 }
 
diff --git a/src/static/templates/admin/diagnostics.hbs b/src/static/templates/admin/diagnostics.hbs
index 5991bc69..0c889353 100644
--- a/src/static/templates/admin/diagnostics.hbs
+++ b/src/static/templates/admin/diagnostics.hbs
@@ -69,26 +69,12 @@
                     </dd>
                     <dt class="col-sm-5">Uses config.json</dt>
                     <dd class="col-sm-7">
-                    {{#if (eq page_data.config_file_status "Loaded")}}
+                    {{#if page_data.overrides}}
                         <span class="d-inline"><b>Yes</b></span>
-                        {{#if page_data.overrides}}
                         <span class="badge bg-info text-dark abbr-badge" title="Environment variables are overwritten by a config.json.&#013;&#010;{{page_data.overrides}}">Details</span>
-                        {{/if}}
-                    {{~else if (eq page_data.config_file_status "Error")}}
-                        <span class="d-inline"><b>Errors</b></span>
-                        <span class="badge bg-danger abbr-badge" title="Config file could not be loaded and was ignored. Check server logs for details.">Details</span>
-                    {{~else}}
-                        <span class="d-inline"><b>No</b></span>
                     {{/if}}
-                    </dd>
-                    <dt class="col-sm-5">Environment variables are valid</dt>
-                    <dd class="col-sm-7">
-                    {{#if page_data.invalid_env_vars}}
-                        <span class="d-inline"><b>No</b></span>
-                        <span class="badge bg-danger abbr-badge" title="Invalid environment variables are found and defaults are used instead.&#013;&#010;{{page_data.invalid_env_vars}}">Details</span>
-                    {{/if}}
-                    {{#unless page_data.invalid_env_vars}}
-                        <span class="d-block"><b>Yes</b></span>
+                    {{#unless page_data.overrides}}
+                        <span class="d-block"><b>No</b></span>
                     {{/unless}}
                     </dd>
                     <dt class="col-sm-5">Uses custom templates</dt>
diff --git a/src/static/templates/admin/users.hbs b/src/static/templates/admin/users.hbs
index 22d8205c..b1dfb17d 100644
--- a/src/static/templates/admin/users.hbs
+++ b/src/static/templates/admin/users.hbs
@@ -135,11 +135,6 @@
                         <div class="radio">
                             <label><input type="radio" value="3" class="form-radio-input" name="user_type" id="userOrgTypeManager">&nbsp;Manager</label>
                         </div>
-                        {{#if custom_roles_enabled}}
-                        <div class="radio">
-                            <label><input type="radio" value="4" class="form-radio-input" name="user_type" id="userOrgTypeCustom">&nbsp;Custom</label>
-                        </div>
-                        {{/if}}
                         <div class="radio">
                             <label><input type="radio" value="1" class="form-radio-input" name="user_type" id="userOrgTypeAdmin">&nbsp;Admin</label>
                         </div>
diff --git a/src/static/templates/email/recover_twofactor.hbs b/src/static/templates/email/recover_twofactor.hbs
deleted file mode 100644
index 92e4330a..00000000
--- a/src/static/templates/email/recover_twofactor.hbs
+++ /dev/null
@@ -1,9 +0,0 @@
-Two-Step Login Recovered From {{ip}}
-<!---------------->
-Two-step login on your account has been disabled by using the account's recovery code.
-
-* Date: {{datetime}}
-* IP Address: {{ip}}
-
-If you did not perform this action, you should immediately take steps to secure your account.
-{{> email/email_footer_text }}
diff --git a/src/static/templates/email/recover_twofactor.html.hbs b/src/static/templates/email/recover_twofactor.html.hbs
deleted file mode 100644
index 847cbae0..00000000
--- a/src/static/templates/email/recover_twofactor.html.hbs
+++ /dev/null
@@ -1,26 +0,0 @@
-Two-Step Login Recovered From {{ip}}
-<!---------------->
-{{> email/email_header }}
-<table width="100%" cellpadding="0" cellspacing="0" style="margin: 0; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; color: #333; line-height: 25px; -webkit-font-smoothing: antialiased; -webkit-text-size-adjust: none;">
-   <tr style="margin: 0; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; color: #333; line-height: 25px; -webkit-font-smoothing: antialiased; -webkit-text-size-adjust: none;">
-      <td class="content-block" style="font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; color: #333; line-height: 25px; margin: 0; -webkit-font-smoothing: antialiased; padding: 0 0 10px; -webkit-text-size-adjust: none;" valign="top">
-         Two-step login on your account has been disabled by using the account's recovery code.
-      </td>
-   </tr>
-   <tr style="margin: 0; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; color: #333; line-height: 25px; -webkit-font-smoothing: antialiased; -webkit-text-size-adjust: none;">
-      <td class="content-block" style="font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; color: #333; line-height: 25px; margin: 0; -webkit-font-smoothing: antialiased; padding: 0 0 10px; -webkit-text-size-adjust: none;" valign="top">
-         <b>Date:</b> {{datetime}}
-      </td>
-   </tr>
-   <tr style="margin: 0; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; color: #333; line-height: 25px; -webkit-font-smoothing: antialiased; -webkit-text-size-adjust: none;">
-      <td class="content-block" style="font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; color: #333; line-height: 25px; margin: 0; -webkit-font-smoothing: antialiased; padding: 0 0 10px; -webkit-text-size-adjust: none;" valign="top">
-         <b>IP Address:</b> {{ip}}
-      </td>
-   </tr>
-   <tr style="margin: 0; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; color: #333; line-height: 25px; -webkit-font-smoothing: antialiased; -webkit-text-size-adjust: none;">
-      <td class="content-block last" style="font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; color: #333; line-height: 25px; margin: 0; -webkit-font-smoothing: antialiased; padding: 0; -webkit-text-size-adjust: none;" valign="top">
-         If you did not perform this action, you should immediately take steps to secure your account.
-      </td>
-   </tr>
-</table>
-{{> email/email_footer }}
diff --git a/src/static/templates/email/send_emergency_access_invite.html.hbs b/src/static/templates/email/send_emergency_access_invite.html.hbs
index b5ab3a07..5318378c 100644
--- a/src/static/templates/email/send_emergency_access_invite.html.hbs
+++ b/src/static/templates/email/send_emergency_access_invite.html.hbs
@@ -9,7 +9,7 @@ Emergency access for {{{grantor_name}}}
     </tr>
     <tr style="margin: 0; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; color: #333; line-height: 25px; -webkit-font-smoothing: antialiased; -webkit-text-size-adjust: none;">
        <td class="content-block" style="font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; color: #333; line-height: 25px; margin: 0; -webkit-font-smoothing: antialiased; padding: 0 0 10px; -webkit-text-size-adjust: none; text-align: center;" valign="top" align="center">
-          <a data-testid="emergency" href="{{{url}}}"
+          <a href="{{{url}}}"
              clicktracking=off target="_blank" style="color: #ffffff; text-decoration: none; text-align: center; cursor: pointer; display: inline-block; border-radius: 5px; background-color: #3c8dbc; border-color: #3c8dbc; border-style: solid; border-width: 10px 20px; margin: 0; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; line-height: 25px; -webkit-font-smoothing: antialiased; -webkit-text-size-adjust: none;">
           Become emergency contact
           </a>
diff --git a/src/static/templates/scss/vaultwarden.scss.hbs b/src/static/templates/scss/vaultwarden.scss.hbs
index 5328e82e..5bbe5db2 100644
--- a/src/static/templates/scss/vaultwarden.scss.hbs
+++ b/src/static/templates/scss/vaultwarden.scss.hbs
@@ -42,27 +42,45 @@ a[href$="/settings/sponsored-families"] {
 {{/if}}
 
 /* Hide the `Enterprise Single Sign-On` button on the login page */
+{{#if (webver ">=2025.5.1")}}
 {{#if (not sso_enabled)}}
 .vw-sso-login {
   @extend %vw-hide;
 }
 {{/if}}
+{{else}}
+app-root ng-component > form > div:nth-child(1) > div > button[buttontype="secondary"].\!tw-text-primary-600:nth-child(4) {
+  @extend %vw-hide;
+}
+{{/if}}
 
 /* Hide the `Log in with passkey` settings */
 app-user-layout app-password-settings app-webauthn-login-settings {
   @extend %vw-hide;
 }
 /* Hide Log in with passkey on the login page */
+{{#if (webver ">=2025.5.1")}}
 .vw-passkey-login {
   @extend %vw-hide;
 }
+{{else}}
+app-root ng-component > form > div:nth-child(1) > div > button[buttontype="secondary"].\!tw-text-primary-600:nth-child(3) {
+  @extend %vw-hide;
+}
+{{/if}}
 
 /* Hide the or text followed by the two buttons hidden above */
+{{#if (webver ">=2025.5.1")}}
 {{#if (or (not sso_enabled) sso_only)}}
 .vw-or-text {
   @extend %vw-hide;
 }
 {{/if}}
+{{else}}
+app-root ng-component > form > div:nth-child(1) > div:nth-child(3) > div:nth-child(2) {
+  @extend %vw-hide;
+}
+{{/if}}
 
 /* Hide the `Other` button on the login page */
 {{#if (or (not sso_enabled) sso_only)}}
@@ -98,21 +116,10 @@ app-security > app-two-factor-setup > form {
 }
 
 /* Hide unsupported Custom Role options */
-{{#if custom_roles_enabled}}
-/* Only the collection permissions and Manage users can be granted yet */
-:is(bit-dialog, [bit-dialog]) div.tw-col-span-4:has(input[formcontrolname*="access"]),
-:is(bit-dialog, [bit-dialog]) bit-form-control:has(input[formcontrolname="manageGroups"]),
-:is(bit-dialog, [bit-dialog]) bit-form-control:has(input[formcontrolname="managePolicies"]),
-:is(bit-dialog, [bit-dialog]) bit-form-control:has(input[formcontrolname="manageSso"]),
-:is(bit-dialog, [bit-dialog]) bit-form-control:has(input[formcontrolname="manageResetPassword"]) {
-  @extend %vw-hide;
-}
-{{else}}
 :is(bit-dialog, [bit-dialog]) div.tw-ml-4:has(bit-form-control input),
 :is(bit-dialog, [bit-dialog]) div.tw-col-span-4:has(input[formcontrolname*="access"], input[formcontrolname*="manage"]) {
   @extend %vw-hide;
 }
-{{/if}}
 
 /* Change collapsed menu icon to Vaultwarden */
 bit-nav-logo bit-nav-item a:before {
@@ -147,10 +154,17 @@ ng-dropdown-panel div.ng-dropdown-panel-items div:has(> [title="DuckDuckGo"]) {
   take a while for the change to take effect. To avoid the button appearing
   when it shouldn't, we'll keep this style in place for a couple of versions */
 /* Hide the register link on the login screen */
+{{#if (webver "<2025.3.0")}}
+app-login form div + div + div + div + hr,
+app-login form div + div + div + div + hr + p {
+  @extend %vw-hide;
+}
+{{else}}
 app-root a[routerlink="/signup"] {
   @extend %vw-hide;
 }
 {{/if}}
+{{/if}}
 
 {{#if remember_2fa_disabled}}
 /* Hide checkbox to remember 2FA token for 30 days */
@@ -206,13 +220,6 @@ auth-input-password > form > bit-form-field:nth-child(4) {
   @extend %vw-hide;
 }
 {{/unless}}
-
-{{#unless email_change_allowed}}
-/* Hide the whole `Change email` section, including its heading, if not allowed */
-div:has(> app-change-email) {
-  @extend %vw-hide;
-}
-{{/unless}}
 /**** End Dynamic Vaultwarden Changes ****/
 /**** Include a special user stylesheet for custom changes ****/
 {{#if load_user_scss}}
diff --git a/src/util.rs b/src/util.rs
index 696c3360..6de2d803 100644
--- a/src/util.rs
+++ b/src/util.rs
@@ -210,7 +210,7 @@ impl Fairing for Cors {
 pub struct Cached<R> {
     response: R,
     is_immutable: bool,
-    ttl: u32,
+    ttl: u64,
 }
 
 impl<R> Cached<R> {
@@ -230,7 +230,7 @@ impl<R> Cached<R> {
         }
     }
 
-    pub fn ttl(response: R, ttl: u32, is_immutable: bool) -> Cached<R> {
+    pub fn ttl(response: R, ttl: u64, is_immutable: bool) -> Cached<R> {
         Self {
             response,
             is_immutable,
@@ -251,7 +251,7 @@ impl<'r, R: 'r + Responder<'r, 'static> + Send> Responder<'r, 'static> for Cache
         res.set_raw_header("Cache-Control", cache_control_header);
 
         let time_now = Local::now();
-        let expiry_time = time_now + chrono::TimeDelta::try_seconds(self.ttl.into()).unwrap();
+        let expiry_time = time_now + chrono::TimeDelta::try_seconds(self.ttl.try_into().unwrap()).unwrap();
         res.set_raw_header("Expires", format_datetime_http(&expiry_time));
         Ok(res)
     }
@@ -259,16 +259,14 @@ impl<'r, R: 'r + Responder<'r, 'static> + Send> Responder<'r, 'static> for Cache
 
 pub struct EtagCached<R> {
     response: R,
-    content_type: ContentType,
     etag: String,
 }
 
 impl<R> EtagCached<R> {
     /// An `etag` response should always be quoted
-    pub fn new(response: R, content_type: ContentType, etag: &str) -> Self {
+    pub fn new(response: R, etag: &str) -> Self {
         Self {
             response,
-            content_type,
             etag: format!("\"{etag}\""),
         }
     }
@@ -290,8 +288,7 @@ impl<'r, R: 'r + Responder<'r, 'static> + Send> Responder<'r, 'static> for EtagC
             self.response.respond_to(request)?
         };
 
-        // Both 200 (OK) and 304 (Not Modified) need to return the Content-Type Etag and Cache-Control
-        res.set_header(self.content_type);
+        // Both 200 (OK) and 304 (Not Modified) need to return the etag and cache-control
         res.set_raw_header("Etag", self.etag);
         res.set_raw_header("Cache-Control", "public, no-cache");
         Ok(res)
@@ -302,69 +299,19 @@ impl<'r, R: 'r + Responder<'r, 'static> + Send> Responder<'r, 'static> for EtagC
 // Effectively ignores, any static file route, and the alive endpoint
 const LOGGED_ROUTES: [&str; 7] = ["/api", "/admin", "/identity", "/icons", "/attachments", "/events", "/notifications"];
 
-const MAX_LOGGED_QUERY_BYTES: usize = 100;
-
-// Query values can hold secrets, like the access code of a login request, so we don't log them
-fn redact_query_values(query: &str) -> String {
-    query
-        .split('&')
-        .map(|param| match param.split_once('=') {
-            Some((name, _)) => format!("{name}=…"),
-            None => param.to_owned(),
-        })
-        .collect::<Vec<_>>()
-        .join("&")
-}
-
-// When extra is true, we ignore the whitelist above and also print the mounts
-pub struct BetterLogging {
-    extra: bool,
-    log_requests: bool,
-    log_response: bool,
-    domain_path: String,
-}
-
-impl BetterLogging {
-    pub fn new(extra: bool, domain_path: &str) -> Self {
-        Self {
-            extra,
-            log_requests: log_enabled!(target: "request", log::Level::Info),
-            log_response: log_enabled!(target: "response", log::Level::Info),
-            domain_path: rocket::http::RawStr::new(&domain_path).percent_decode_lossy().into_owned(),
-        }
-    }
-
-    fn log_path<'p>(&self, method: Method, path: &'p rocket::http::RawStr) -> Option<std::borrow::Cow<'p, str>> {
-        if !self.extra && method == Method::Options {
-            return None;
-        }
-        let path = path.percent_decode_lossy();
-        if self.extra {
-            return Some(path);
-        }
-        let subpath = path.strip_prefix(&self.domain_path).unwrap_or(&path);
-        LOGGED_ROUTES.iter().any(|r| subpath.starts_with(r)).then_some(path)
-    }
-}
-
+// Boolean is extra debug, when true, we ignore the whitelist above and also print the mounts
+pub struct BetterLogging(pub bool);
 #[rocket::async_trait]
 impl Fairing for BetterLogging {
     fn info(&self) -> Info {
-        let mut kind = Kind::Liftoff;
-        if self.log_requests {
-            kind = kind | Kind::Request;
-        }
-        if self.log_response {
-            kind = kind | Kind::Response;
-        }
         Info {
             name: "Better Logging",
-            kind,
+            kind: Kind::Liftoff | Kind::Request | Kind::Response,
         }
     }
 
     async fn on_liftoff(&self, rocket: &Rocket<Orbit>) {
-        if self.extra {
+        if self.0 {
             info!(target: "routes", "Routes loaded:");
             let mut routes: Vec<_> = rocket.routes().collect();
             routes.sort_by_key(|r| r.uri.path());
@@ -388,29 +335,36 @@ impl Fairing for BetterLogging {
     }
 
     async fn on_request(&self, request: &mut Request<'_>, _data: &mut Data<'_>) {
-        let uri = request.uri();
         let method = request.method();
-        let Some(path) = self.log_path(method, uri.path().raw()) else {
+        if !self.0 && method == Method::Options {
             return;
-        };
-        match uri.query() {
-            Some(q) => {
-                let query = redact_query_values(q.as_str());
-                let query = &query[..query.floor_char_boundary(MAX_LOGGED_QUERY_BYTES)];
-                info!(target: "request", "{method} {}?{}", path.escape_debug(), query.escape_debug());
+        }
+        let uri = request.uri();
+        let uri_path = uri.path();
+        let uri_path_str = uri_path.url_decode_lossy();
+        let uri_subpath = uri_path_str.strip_prefix(&CONFIG.domain_path()).unwrap_or(&uri_path_str);
+        if self.0 || LOGGED_ROUTES.iter().any(|r| uri_subpath.starts_with(r)) {
+            match uri.query() {
+                Some(q) => info!(target: "request", "{method} {uri_path_str}?{}", &q[..q.len().min(30)]),
+                None => info!(target: "request", "{method} {uri_path_str}"),
             }
-            None => info!(target: "request", "{method} {}", path.escape_debug()),
         }
     }
 
     async fn on_response<'r>(&self, request: &'r Request<'_>, response: &mut Response<'r>) {
-        if self.log_path(request.method(), request.uri().path().raw()).is_none() {
+        if !self.0 && request.method() == Method::Options {
             return;
         }
-        let status = response.status();
-        match request.route() {
-            Some(r) => info!(target: "response", "{r} => {status}"),
-            None => info!(target: "response", "{status}"),
+        let uri_path = request.uri().path();
+        let uri_path_str = uri_path.url_decode_lossy();
+        let uri_subpath = uri_path_str.strip_prefix(&CONFIG.domain_path()).unwrap_or(&uri_path_str);
+        if self.0 || LOGGED_ROUTES.iter().any(|r| uri_subpath.starts_with(r)) {
+            let status = response.status();
+            if let Some(route) = request.route() {
+                info!(target: "response", "{route} => {status}");
+            } else {
+                info!(target: "response", "{status}");
+            }
         }
     }
 }
@@ -426,7 +380,7 @@ pub fn get_display_size(size: i64) -> String {
     let mut unit_counter = 0;
 
     loop {
-        if size > 1024. && unit_counter < UNITS.len() - 1 {
+        if size > 1024. {
             size /= 1024.;
             unit_counter += 1;
         } else {
@@ -493,34 +447,20 @@ pub fn get_env_str_value(key: &str) -> Option<String> {
     }
 }
 
-pub static INVALID_ENV_VARS: std::sync::Mutex<Vec<&'static str>> = std::sync::Mutex::new(Vec::new());
-
-pub fn get_env<V>(key: &'static str) -> Option<V>
+pub fn get_env<V>(key: &str) -> Option<V>
 where
     V: FromStr,
 {
-    let value = get_env_str_value(key);
-    let value_is_some = value.is_some();
-    let parsed: Option<V> = try_parse_string(value);
-    if parsed.is_none() && value_is_some {
-        println!("[ERROR] `{key}` contains an invalid value for its type and is ignored, the default is used instead.");
-        INVALID_ENV_VARS.lock().unwrap().push(key);
-    }
-    parsed
+    try_parse_string(get_env_str_value(key))
 }
 
-pub fn get_env_bool(key: &'static str) -> Option<bool> {
+pub fn get_env_bool(key: &str) -> Option<bool> {
     const TRUE_VALUES: &[&str] = &["true", "t", "yes", "y", "1"];
     const FALSE_VALUES: &[&str] = &["false", "f", "no", "n", "0"];
 
     match get_env_str_value(key) {
         Some(val) if TRUE_VALUES.contains(&val.to_lowercase().as_ref()) => Some(true),
         Some(val) if FALSE_VALUES.contains(&val.to_lowercase().as_ref()) => Some(false),
-        Some(_) => {
-            println!("[ERROR] `{key}` contains an invalid boolean value and is ignored, the default is used instead.");
-            INVALID_ENV_VARS.lock().unwrap().push(key);
-            None
-        }
         _ => None,
     }
 }
@@ -582,8 +522,8 @@ pub fn format_datetime_http(dt: &DateTime<Local>) -> String {
     expiry_time.to_rfc2822().replace("+0000", "GMT")
 }
 
-pub fn parse_date(date: &str) -> Option<NaiveDateTime> {
-    DateTime::parse_from_rfc3339(date).ok().map(|dt| dt.naive_utc())
+pub fn parse_date(date: &str) -> NaiveDateTime {
+    DateTime::parse_from_rfc3339(date).unwrap().naive_utc()
 }
 
 /// Returns true or false if an email address is valid or not
@@ -899,12 +839,6 @@ pub fn parse_experimental_client_feature_flags(
         .collect()
 }
 
-/// Whether the admin enabled this supported client feature flag
-pub fn is_client_feature_flag_enabled(flag: &str) -> bool {
-    parse_experimental_client_feature_flags(&CONFIG.experimental_client_feature_flags(), &FeatureFlagFilter::ValidOnly)
-        .contains_key(flag)
-}
-
 /// TODO: This is extracted from IpAddr::is_global, which is unstable:
 /// https://doc.rust-lang.org/nightly/std/net/enum.IpAddr.html#method.is_global
 /// Remove once https://github.com/rust-lang/rust/issues/27709 is merged
@@ -1009,15 +943,15 @@ mod tests {
     use std::net::IpAddr;
 
     #[test]
-    #[ignore = "exhaustive IPv4 check is too slow for the regular test suite"]
+    #[ignore]
     fn test_ipv4_global() {
         for a in 0..u8::MAX {
-            println!("Iter: {a}/255");
+            println!("Iter: {}/255", a);
             for b in 0..u8::MAX {
                 for c in 0..u8::MAX {
                     for d in 0..u8::MAX {
                         let ip = IpAddr::V4(std::net::Ipv4Addr::new(a, b, c, d));
-                        assert_eq!(ip.is_global(), is_global_hardcoded(ip), "IP mismatch: {ip}");
+                        assert_eq!(ip.is_global(), is_global_hardcoded(ip), "IP mismatch: {}", ip)
                     }
                 }
             }
@@ -1025,15 +959,15 @@ mod tests {
     }
 
     #[test]
-    #[ignore = "random IPv6 check is too slow for the regular test suite"]
+    #[ignore]
     fn test_ipv6_global() {
-        use rand::RngExt;
+        use rand::Rng;
 
         std::thread::scope(|s| {
             for t in 0..16 {
-                let _handle = s.spawn(move || {
+                let handle = s.spawn(move || {
                     let mut v = [0u8; 16];
-                    let mut rng = rand::rng();
+                    let mut rng = rand::thread_rng();
 
                     for i in 0..20 {
                         println!("Thread {t} Iter: {i}/50");
@@ -1048,28 +982,3 @@ mod tests {
         });
     }
 }
-
-#[cfg(test)]
-mod query_log_tests {
-    use super::{MAX_LOGGED_QUERY_BYTES, redact_query_values};
-
-    #[test]
-    fn test_redact_query_values() {
-        assert_eq!(redact_query_values("code=SECRET"), "code=…");
-        assert_eq!(redact_query_values("code=SECRET&other=SECRET"), "code=…&other=…");
-        assert_eq!(redact_query_values("a=1&b=2&flag"), "a=…&b=…&flag");
-        assert_eq!(redact_query_values("a=b=SECRET"), "a=…");
-        assert_eq!(redact_query_values("a=1&&=SECRET"), "a=…&&=…");
-        assert_eq!(redact_query_values("a=x%26b%3DSECRET"), "a=…");
-        assert_eq!(redact_query_values("a=1;b=SECRET"), "a=…");
-        assert_eq!(redact_query_values("a=1&a=SECRET"), "a=…&a=…");
-        assert_eq!(redact_query_values(""), "");
-    }
-
-    #[test]
-    fn test_redacted_query_truncates_on_a_char_boundary() {
-        let name = "a".repeat(MAX_LOGGED_QUERY_BYTES - 1);
-        let query = redact_query_values(&format!("{name}=SECRET"));
-        assert_eq!(&query[..query.floor_char_boundary(MAX_LOGGED_QUERY_BYTES)], format!("{name}="));
-    }
-}
diff --git a/tools/sdk-live-tests/run.sh b/tools/sdk-live-tests/run.sh
deleted file mode 100755
index d57183e0..00000000
--- a/tools/sdk-live-tests/run.sh
+++ /dev/null
@@ -1,145 +0,0 @@
-#!/usr/bin/env bash
-# Runs the live-server end-to-end tests of bitwarden/sdk-internal (e2e/wasm) against vaultwarden.
-#
-# Usage: tools/sdk-live-tests/run.sh --sdk-dir <path> [--skip-sdk-build] [--mode vectors|seeder] [-- <vitest args>]
-#
-# --skip-sdk-build uses the package already in the SDK's crates/bitwarden-wasm-internal/npm: an earlier build, or a
-# published @bitwarden/sdk-internal unpacked there.
-#
-# The server is built with `unsafe_test_mode`, whose test seeder (src/api/test_seeder.rs) creates the test accounts.
-# - vectors: for SDK versions whose live tests log in to one given account. Every user test vector with a master
-#   password gets a fresh server, is seeded there with its vault, and the tests run on it (they rotate its keys).
-# - seeder: for SDK versions whose tests seed their own accounts through BW_LIVE_SEEDER_URL. One server, one run.
-# The mode follows what the SDK's e2e/wasm/live/config.ts reads, unless --mode says otherwise. Arguments after `--` go
-# to vitest, e.g. `-- tests/user-crypto-management/rotate-user-keys.live.test.ts` to run one file.
-#
-# Every vector runs even after a failure; a summary follows, and the exit code is 1 if any failed. The server logs are
-# in <target dir>/sdk-live-tests/. BW_LIVE_CLIENT_VERSION defaults to 2026.10.1, the minimum for V2 accounts.
-#
-# Needs: Node.js >= 22.12, curl, python3, and to build the SDK its Rust toolchain with the wasm32-unknown-unknown target
-# and rust-src.
-set -euo pipefail
-
-VW_DIR="$(cd "$(dirname "$0")/../.." && pwd)"
-TARGET_DIR="${CARGO_TARGET_DIR:-${VW_DIR}/target}"
-OUT_DIR="${TARGET_DIR}/sdk-live-tests"
-PORT=8099
-URL="http://127.0.0.1:${PORT}"
-SEEDER_URL="${URL}/test/seeder"
-SEEDER_USERNAME="sdk-live-tests"
-SEEDER_PASSWORD="$(python3 -c 'import secrets; print(secrets.token_urlsafe(24))')"
-SKIP=3 # seed_vector.py's exit code for a vector the tests can't use
-export BW_LIVE_CLIENT_VERSION="${BW_LIVE_CLIENT_VERSION:-2026.10.1}"
-
-SDK_DIR=""
-BUILD_SDK=1
-MODE=""
-VITEST_ARGS=()
-while [[ $# -gt 0 ]]; do
-  case "$1" in
-    --sdk-dir) SDK_DIR="$(cd "$2" && pwd)"; shift 2 ;;
-    --skip-sdk-build) BUILD_SDK=0; shift ;;
-    --mode) MODE="$2"; shift 2 ;;
-    --) shift; VITEST_ARGS=("$@"); break ;;
-    *) echo "Unknown argument: $1" >&2; exit 2 ;;
-  esac
-done
-[[ -n "${SDK_DIR}" ]] || { echo "--sdk-dir is required" >&2; exit 2; }
-TESTS_DIR="${SDK_DIR}/e2e/wasm"
-[[ -f "${TESTS_DIR}/live/config.ts" ]] || { echo "${TESTS_DIR}/live/config.ts not found: no live tests in this SDK" >&2; exit 2; }
-if [[ -z "${MODE}" ]]; then
-  if grep -q BW_LIVE_SEEDER_URL "${TESTS_DIR}/live/config.ts"; then MODE=seeder; else MODE=vectors; fi
-fi
-[[ "${MODE}" == vectors || "${MODE}" == seeder ]] || { echo "--mode must be vectors or seeder" >&2; exit 2; }
-echo "Mode: ${MODE}, client version ${BW_LIVE_CLIENT_VERSION}"
-
-(cd "${VW_DIR}" && cargo build --features sqlite,unsafe_test_mode)
-if [[ ${BUILD_SDK} -eq 1 ]]; then
-  bash "${SDK_DIR}/crates/bitwarden-wasm-internal/build.sh"
-fi
-(cd "${TESTS_DIR}" && npm ci)
-
-server=""
-trap 'if [[ -n "${server}" ]]; then kill "${server}" 2>/dev/null || true; fi' EXIT
-
-# Starts a server on an empty database in $OUT_DIR/$1
-start_server() {
-  local data_dir="${OUT_DIR}/$1"
-  rm -rf "${data_dir}" && mkdir -p "${data_dir}"
-  if curl -s -o /dev/null "${URL}/alive"; then
-    echo "Something already answers on port ${PORT}" >&2
-    return 1
-  fi
-  ENV_FILE=/dev/null DATA_FOLDER="${data_dir}" DATABASE_URL="sqlite://${data_dir}/db.sqlite3" \
-    ROCKET_ADDRESS=127.0.0.1 ROCKET_PORT="${PORT}" DOMAIN="${URL}" WEB_VAULT_ENABLED=false \
-    SIGNUPS_ALLOWED=true SIGNUPS_VERIFY=false LOGIN_RATELIMIT_MAX_BURST=1000 \
-    TEST_SEEDER_USERNAME="${SEEDER_USERNAME}" TEST_SEEDER_PASSWORD="${SEEDER_PASSWORD}" \
-    "${TARGET_DIR}/debug/vaultwarden" > "${data_dir}/vaultwarden.log" 2>&1 &
-  server=$!
-  local i
-  for i in $(seq 1 60); do
-    if ! kill -0 "${server}" 2>/dev/null; then break; fi
-    if curl -sf -o /dev/null "${URL}/alive"; then return 0; fi
-    sleep 1
-  done
-  echo "The server didn't start; the end of ${data_dir}/vaultwarden.log:" >&2
-  tail -50 "${data_dir}/vaultwarden.log" >&2
-  stop_server
-  return 1
-}
-
-stop_server() {
-  if [[ -n "${server}" ]]; then
-    kill "${server}" 2>/dev/null || true
-    wait "${server}" 2>/dev/null || true
-    server=""
-  fi
-}
-
-run_tests() {
-  (cd "${TESTS_DIR}" && BW_LIVE_SERVER_URL="${URL}" "$@" npm run test:live -- "${VITEST_ARGS[@]}")
-}
-
-results=()
-failed=0
-if [[ "${MODE}" == seeder ]]; then
-  if start_server seeder && run_tests env BW_LIVE_SEEDER_URL="${SEEDER_URL}" \
-    BW_LIVE_SEEDER_USERNAME="${SEEDER_USERNAME}" BW_LIVE_SEEDER_PASSWORD="${SEEDER_PASSWORD}"; then
-    results+=("seeder: pass")
-  else
-    results+=("seeder: FAIL")
-    failed=1
-  fi
-  stop_server
-else
-  for vector_file in "${SDK_DIR}"/test-vectors/users/*.json; do
-    vector="$(basename "${vector_file}" .json)"
-    echo "=== ${vector}"
-    if ! start_server "${vector}"; then
-      results+=("${vector}: FAIL (server didn't start)")
-      failed=1
-      continue
-    fi
-    status=0
-    credentials="$(python3 -I "${VW_DIR}/tools/sdk-live-tests/seed_vector.py" "${vector_file}" "${SEEDER_URL}" \
-      "${SEEDER_USERNAME}" "${SEEDER_PASSWORD}")" || status=$?
-    if [[ ${status} -eq ${SKIP} ]]; then
-      results+=("${vector}: skip (${credentials})")
-    elif [[ ${status} -ne 0 ]]; then
-      results+=("${vector}: FAIL (seeding)")
-      failed=1
-    elif run_tests env BW_LIVE_EMAIL="$(sed -n 1p <<< "${credentials}")" \
-      BW_LIVE_PASSWORD="$(sed -n 2p <<< "${credentials}")"; then
-      results+=("${vector}: pass")
-    else
-      results+=("${vector}: FAIL")
-      failed=1
-    fi
-    stop_server
-  done
-fi
-
-echo
-echo "=== Summary (logs in ${OUT_DIR})"
-printf '%s\n' "${results[@]}"
-exit "${failed}"
diff --git a/tools/sdk-live-tests/seed_vector.py b/tools/sdk-live-tests/seed_vector.py
deleted file mode 100644
index 85db6f07..00000000
--- a/tools/sdk-live-tests/seed_vector.py
+++ /dev/null
@@ -1,59 +0,0 @@
-"""Seeds one of the SDK's user test vectors, vault included, through vaultwarden's test seeder.
-
-Usage: seed_vector.py <vector.json> <seeder url> <seeder username> <seeder password>
-
-Prints the account's email and password, one per line. Exits 3, printing why, for a vector the tests can't log in
-with (no master password), and 1 if the seeder refuses it.
-"""
-
-import base64
-import json
-import sys
-import urllib.error
-import urllib.request
-import uuid
-
-SKIP = 3
-
-
-def main() -> int:
-    vector_file, seeder_url, username, password = sys.argv[1:5]
-    with open(vector_file, encoding="utf-8") as f:
-        vector = json.load(f)
-
-    has_master_password = any("masterPasswordUnlock" in method for method in vector.get("unlockMethods", []))
-    if not has_master_password or "password" not in vector.get("account", {}):
-        print("no master password")
-        return SKIP
-
-    # Without attachments: the rotation test compares the vault before and after, and our sync gives each attachment
-    # a link with a fresh download token every time (upstream's is the same on every sync). A vector's legacy
-    # attachments, without a key of their own, would also make the SDK refuse to rotate at all.
-    for cipher in vector.get("vault", {}).get("ciphers", []):
-        cipher.get("encrypted", {}).pop("attachments", None)
-
-    credentials = base64.b64encode(f"{username}:{password}".encode()).decode()
-    request = urllib.request.Request(
-        f"{seeder_url}/seed",
-        data=json.dumps({"template": "TestVectorUserScene", "arguments": vector}).encode(),
-        method="POST",
-        headers={
-            "Authorization": f"Basic {credentials}",
-            "Content-Type": "application/json",
-            "X-Play-Id": f"sdk-live-tests-{uuid.uuid4()}",
-        },
-    )
-    try:
-        with urllib.request.urlopen(request) as response:
-            result = json.load(response)["result"]
-    except urllib.error.HTTPError as e:
-        print(f"The seeder refused {vector_file}: {e.code} {e.read().decode(errors='replace')}", file=sys.stderr)
-        return 1
-
-    print(result["email"])
-    print(vector["account"]["password"])
-    return 0
-
-
-if __name__ == "__main__":
-    sys.exit(main())