Move the v2 upgrade token migration to its own version

Diesel identifies a migration by the date in its folder name alone, and silently drops one of two folders that share it. The Custom Roles migration uses the same date.

.env.template

@@ -411,6 +411,9 @@
 ## - "biometrics-sdk-ipc": Enable biometric unlock over the SDK IPC framework (Desktop >= 2026.9.0, Browser >= 2026.9.0)
 ## - "windows-native-credential-sync": Register the desktop app as a passkey provider in Windows, so passkeys in the vault can be used by other apps and browsers.
 ##   Requires the Microsoft Store (appx) build of the desktop app. Stable releases up to and including 2026.9.1 lack the required plugin registration, so it has no effect there yet.
+## - "pm-27278-v2-password-registration": Register new accounts with v2 encryption. (Web >= 2026.6.4, Desktop/Browser/CLI >= 2026.7.0, Android >= 2026.4.1, iOS >= 2026.5.1)
+## - "enable-account-encryption-v2-jit-password-registration": Give SSO users who set their master password on their first login v2 encryption. (Web >= 2026.1.1, Desktop/Browser/CLI >= 2026.1.0, Android >= 2026.4.1, iOS >= 2026.6.0)
+##   These two flags can't be undone: a v2 account stays v2, and it can only log in from clients that are 2025.11.0 or newer and send their version, which rules out some older and third-party clients.
 # EXPERIMENTAL_CLIENT_FEATURE_FLAGS=
 
 ## Require new device emails. When a user logs in an email is required to be sent.

.typos.toml

@@ -14,9 +14,8 @@ extend-ignore-re = [
     # In SMTP it's called HELO, so ignore it
     "(?i)helo_name",
     "Server name sent during.+HELO",
-    # COSE Is short for CBOR Object Signing and Encryption, ignore these specific items
+    # COSE Is short for CBOR Object Signing and Encryption
-    "COSEKey",
+    "(?i)cose",
-    "COSEAlgorithm",
     # Ignore this specific string as it's valid
     "Ensure they are valid OTPs",
     # This word is misspelled upstream

Cargo.toml

@@ -107,7 +107,7 @@ serde = { version = "1.0.229", features = ["derive"] }
 serde_json = "1.0.154"
 
 # A safe, extensible ORM and Query builder
-diesel = { version = "2.3.14", features = ["chrono", "r2d2", "numeric"] }
+diesel = { version = "2.3.14", features = ["chrono", "r2d2", "numeric", "64-column-tables"] }
 diesel_migrations = "2.3.2"
 
 derive_more = { version = "2.1.1", features = [

migrations/mysql/2026-10-08-120000_cipher_data_longtext/up.sql

@@ -0,0 +1,3 @@
+-- A blob-encrypted cipher keeps all of its content in `data`, up to 500,000 characters, so the
+-- 64 KiB of TEXT is too small. Like upstream, which uses LONGTEXT.
+ALTER TABLE ciphers MODIFY data LONGTEXT NOT NULL;

migrations/mysql/2026-10-09-120000_user_crypto_v2/down.sql

@@ -0,0 +1,5 @@
+DROP TABLE IF EXISTS user_signature_key_pairs;
+
+ALTER TABLE users DROP COLUMN signed_public_key;
+ALTER TABLE users DROP COLUMN security_state;
+ALTER TABLE users DROP COLUMN security_version;

migrations/mysql/2026-10-09-120000_user_crypto_v2/up.sql

@@ -0,0 +1,14 @@
+ALTER TABLE users ADD COLUMN signed_public_key TEXT;
+ALTER TABLE users ADD COLUMN security_state TEXT;
+ALTER TABLE users ADD COLUMN security_version INTEGER;
+
+CREATE TABLE user_signature_key_pairs (
+    uuid                CHAR(36) NOT NULL PRIMARY KEY,
+    user_uuid           CHAR(36) NOT NULL UNIQUE,
+    signature_algorithm INTEGER  NOT NULL, -- 0 = ed25519, 1 = mldsa44
+    signing_key         TEXT     NOT NULL,
+    verifying_key       TEXT     NOT NULL,
+    created_at          DATETIME NOT NULL,
+    updated_at          DATETIME NOT NULL,
+    FOREIGN KEY (user_uuid) REFERENCES users (uuid) ON DELETE CASCADE
+);

migrations/mysql/2026-11-02-120000_reset_user_key_id/up.sql

@@ -0,0 +1,4 @@
+-- Key rotations before this kept the id of the old user key, so every new
+-- cipher was refused from then on. Stale ids can't be told apart, so clear
+-- all of them; clients record their current key's id again when it's empty.
+UPDATE users SET key_id = NULL;

migrations/mysql/2026-11-04-120000_add_v2_upgrade_token/down.sql

@@ -0,0 +1,2 @@
+ALTER TABLE users DROP COLUMN v2_upgrade_token;
+ALTER TABLE users_organizations DROP COLUMN v2_upgrade_token;

migrations/mysql/2026-11-04-120000_add_v2_upgrade_token/up.sql

@@ -0,0 +1,2 @@
+ALTER TABLE users ADD COLUMN v2_upgrade_token TEXT;
+ALTER TABLE users_organizations ADD COLUMN v2_upgrade_token TEXT;

migrations/postgresql/2026-10-08-120000_cipher_data_longtext/up.sql

@@ -0,0 +1,3 @@
+-- TEXT has no size limit here, only MySQL needed the change.
+-- PostgreSQL rejects a migration that is only comments ("Received an empty query"), hence the no-op.
+SELECT 1;

migrations/postgresql/2026-10-09-120000_user_crypto_v2/down.sql

@@ -0,0 +1,5 @@
+DROP TABLE IF EXISTS user_signature_key_pairs;
+
+ALTER TABLE users DROP COLUMN signed_public_key;
+ALTER TABLE users DROP COLUMN security_state;
+ALTER TABLE users DROP COLUMN security_version;

migrations/postgresql/2026-10-09-120000_user_crypto_v2/up.sql

@@ -0,0 +1,13 @@
+ALTER TABLE users ADD COLUMN signed_public_key TEXT;
+ALTER TABLE users ADD COLUMN security_state TEXT;
+ALTER TABLE users ADD COLUMN security_version INTEGER;
+
+CREATE TABLE user_signature_key_pairs (
+    uuid                CHAR(36) NOT NULL PRIMARY KEY,
+    user_uuid           CHAR(36) NOT NULL UNIQUE REFERENCES users (uuid) ON DELETE CASCADE,
+    signature_algorithm INTEGER  NOT NULL, -- 0 = ed25519, 1 = mldsa44
+    signing_key         TEXT     NOT NULL,
+    verifying_key       TEXT     NOT NULL,
+    created_at          TIMESTAMP NOT NULL,
+    updated_at          TIMESTAMP NOT NULL
+);

migrations/postgresql/2026-11-02-120000_reset_user_key_id/up.sql

@@ -0,0 +1,4 @@
+-- Key rotations before this kept the id of the old user key, so every new
+-- cipher was refused from then on. Stale ids can't be told apart, so clear
+-- all of them; clients record their current key's id again when it's empty.
+UPDATE users SET key_id = NULL;

migrations/postgresql/2026-11-04-120000_add_v2_upgrade_token/down.sql

@@ -0,0 +1,2 @@
+ALTER TABLE users DROP COLUMN v2_upgrade_token;
+ALTER TABLE users_organizations DROP COLUMN v2_upgrade_token;

migrations/postgresql/2026-11-04-120000_add_v2_upgrade_token/up.sql

@@ -0,0 +1,2 @@
+ALTER TABLE users ADD COLUMN v2_upgrade_token TEXT;
+ALTER TABLE users_organizations ADD COLUMN v2_upgrade_token TEXT;