.dockerignore

@@ -1,7 +1,7 @@
-# Ignore everything
+// Ignore everything
 *
 
-# Allow what is needed
+// Allow what is needed
 !.git
 !docker/healthcheck.sh
 !docker/start.sh

.env.template

@@ -390,7 +390,6 @@
 ##
 ## The following flags are available:
 ## - "pm-5594-safari-account-switching": Enable account switching in Safari. (Safari >= 2026.2.0)
-## - "pm-32413-multi-client-password-management": Enable changing the master password directly in the client. (Desktop/Extension >= 2026.4.0)
 ## - "ssh-agent": Enable SSH agent support on Desktop. (Desktop >= 2024.12.0)
 ## - "ssh-agent-v2": Enable newer SSH agent support. (Desktop >= 2026.2.1)
 ## - "ssh-key-vault-item": Enable the creation and use of SSH key vault items. (Clients >= 2024.12.0)
@@ -519,9 +518,6 @@
 ## Prevent users from logging in directly without going through SSO
 # SSO_ONLY=false
 
-## Allow SSO flow to create account. You probably want to disable it when using a public provider.
-# SSO_SIGNUPS_ALLOWED=true
-
 ## On SSO Signup if a user with a matching email already exists make the association
 # SSO_SIGNUPS_MATCH_EMAIL=true
 

.github/workflows/build.yml

@@ -113,7 +113,7 @@ jobs:
 
       # Enable Rust Caching
       - name: Rust Caching
-        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
           # Use a custom prefix-key to force a fresh start. This is sometimes needed with bigger changes.
           # Like changing the build host from Ubuntu 20.04 to 22.04 for example.

.github/workflows/hadolint.yml

@@ -20,7 +20,7 @@ jobs:
     steps:
       # Start Docker Buildx
       - name: Setup Docker Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
         # https://github.com/moby/buildkit/issues/3969
         # Also set max parallelism to 2, the default of 4 breaks GitHub Actions and causes OOMKills
         with:
@@ -41,12 +41,12 @@ jobs:
       # Uses the Docker-based action (hadolint pre-bundled in ghcr.io/hadolint/hadolint:v2.14.0-debian)
       # so no binary is downloaded at runtime. Pinned by commit SHA for supply-chain safety.
       - name: Run hadolint on Dockerfile.debian
-        uses: hadolint/hadolint-action@06be81baf89a55ffd0e24b8f04a4185738dd3387 # v3.5.0
+        uses: hadolint/hadolint-action@2a66e89f53d0771bb131a7fa31f3136336094aa6 # v3.4.0
         with:
           dockerfile: docker/Dockerfile.debian
 
       - name: Run hadolint on Dockerfile.alpine
-        uses: hadolint/hadolint-action@06be81baf89a55ffd0e24b8f04a4185738dd3387 # v3.5.0
+        uses: hadolint/hadolint-action@2a66e89f53d0771bb131a7fa31f3136336094aa6 # v3.4.0
         with:
           dockerfile: docker/Dockerfile.alpine
       # End Test Dockerfiles with hadolint

.github/workflows/release.yml

@@ -58,13 +58,13 @@ jobs:
 
     steps:
       - name: Initialize QEMU binfmt support
-        uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0
+        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
         with:
           platforms: "arm64,arm"
 
       # Start Docker Buildx
       - name: Setup Docker Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
         # https://github.com/moby/buildkit/issues/3969
         # Also set max parallelism to 2, the default of 4 breaks GitHub Actions and causes OOMKills
         with:

.github/workflows/trivy.yml

@@ -50,6 +50,6 @@ jobs:
           severity: CRITICAL,HIGH
 
       - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+        uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
         with:
           sarif_file: 'trivy-results.sarif'

.github/workflows/typos.yml

@@ -23,4 +23,4 @@ jobs:
 
       # When this version is updated, do not forget to update this in `.pre-commit-config.yaml` too
       - name: Spell Check Repo
-        uses: crate-ci/typos@d43b6c087ac471e2ea7b8af622ff15f05c0c365b # v1.50.1
+        uses: crate-ci/typos@8a48f81b6c64dcfea44b3633223084c4be58ac5f # v1.49.0

.github/workflows/zizmor.yml

@@ -24,7 +24,7 @@ jobs:
           persist-credentials: false
 
       - name: Run zizmor
-        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
+        uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
         with:
           # intentionally not scanning the entire repository,
           # since it contains integration tests.

.pre-commit-config.yaml

@@ -18,7 +18,7 @@ repos:
 
   # When this version is updated, do not forget to update this in `.github/workflows/typos.yaml` too
   - repo: https://github.com/crate-ci/typos
-    rev: d43b6c087ac471e2ea7b8af622ff15f05c0c365b # v1.50.1
+    rev: 8a48f81b6c64dcfea44b3633223084c4be58ac5f # v1.49.0
     hooks:
       - id: typos
         always_run: true

Cargo.toml

@@ -1,6 +1,6 @@
 [workspace.package]
 edition = "2024"
-rust-version = "1.96.1"
+rust-version = "1.95.0"
 license = "AGPL-3.0-only"
 repository = "https://github.com/dani-garcia/vaultwarden"
 publish = false
@@ -12,6 +12,7 @@ members = ["macros"]
 name = "vaultwarden"
 version = "1.0.0"
 authors = ["Daniel García <dani-garcia@users.noreply.github.com>"]
+readme = "README.md"
 build = "build.rs"
 repository.workspace = true
 edition.workspace = true
@@ -40,7 +41,6 @@ vendored_openssl = ["openssl/vendored"]
 enable_mimalloc = ["dep:mimalloc"]
 s3 = [
     "opendal/services-s3",
-    "dep:opendal-http-transport-reqwest",
     "dep:aws-config",
     "dep:aws-credential-types",
     "dep:aws-smithy-runtime-api",
@@ -66,7 +66,7 @@ syslog = "7.0.0"
 macros = { path = "./macros" }
 
 # Logging
-log = "0.4.34"
+log = "0.4.33"
 fern = { version = "0.7.1", features = ["syslog-7", "reopen-1"] }
 # We need the `log` feature for `tracing` to enable logging for several crates to work, like lettre or webauthn-rs
 tracing = { version = "0.1.44", features = ["log"] }
@@ -90,7 +90,7 @@ rmpv = "1.3.1" # MessagePack library
 dashmap = "6.2.1"
 
 # Async futures
-futures = "0.3.34"
+futures = "0.3.33"
 tokio = { version = "1.53.1", features = [
     "fs",
     "io-util",
@@ -107,7 +107,7 @@ serde = { version = "1.0.229", features = ["derive"] }
 serde_json = "1.0.151"
 
 # A safe, extensible ORM and Query builder
-diesel = { version = "2.3.13", features = ["chrono", "r2d2", "numeric"] }
+diesel = { version = "2.3.11", features = ["chrono", "r2d2", "numeric"] }
 diesel_migrations = "2.3.2"
 
 derive_more = { version = "2.1.1", features = [
@@ -120,16 +120,16 @@ derive_more = { version = "2.1.1", features = [
 diesel-derive-newtype = "2.1.3"
 
 # SQLite, statically bundled unless the `sqlite_system` feature is enabled
-libsqlite3-sys = { version = "0.38.2", optional = true }
+libsqlite3-sys = { version = "0.37.0", optional = true }
 
 # Crypto-related libraries
 rand = "0.10.2"
 ring = "0.17.14"
-rustls = { version = "0.23.44", features = ["ring", "std"], default-features = false }
+rustls = { version = "0.23.43", features = ["ring", "std"], default-features = false }
 subtle = "2.6.1"
 
 # UUID generation
-uuid = { version = "1.26.0", features = ["v4"] }
+uuid = { version = "1.24.0", features = ["v4"] }
 
 # Date and time libraries
 chrono = { version = "0.4.45", default-features = false, features = ["clock", "serde"] }
@@ -180,10 +180,10 @@ percent-encoding = "2.3.2" # URL encoding library used for URL's in the emails
 email_address = "0.2.9"
 
 # HTML Template library
-handlebars = { version = "6.4.4", features = ["dir_source"] }
+handlebars = { version = "6.4.3", features = ["dir_source"] }
 
 # HTTP client (Used for favicons, version check, DUO and HIBP API)
-reqwest = { version = "0.13.5", default-features = false, features = [
+reqwest = { version = "0.13.4", default-features = false, features = [
     # Misc
     "charset",
     "cookies",
@@ -201,7 +201,7 @@ reqwest = { version = "0.13.5", default-features = false, features = [
     "socks",
     "system-proxy",
 ] }
-hickory-resolver = "0.26.2"
+hickory-resolver = "0.26.1"
 
 # Favicon extraction libraries
 html5gum = "0.8.4"
@@ -212,13 +212,13 @@ regex = { version = "1.13.1", default-features = false, features = [
 ] }
 data-url = "0.3.2"
 bytes = "1.12.1"
-svg-hush = "0.9.7"
+svg-hush = "0.9.6"
 
 # Cache function results (Used for version check and favicon fetching)
-cached = { version = "4.0.0", features = ["async"] }
+cached = { version = "2.0.2", features = ["async"] }
 
 # Used for custom short lived cookie jar during favicon extraction
-cookie = "0.18.2"
+cookie = "0.18.1"
 cookie_store = "0.22.1"
 
 # Used by U2F, JWT and PostgreSQL
@@ -232,11 +232,11 @@ pastey = "0.2.3"
 governor = "0.10.4"
 
 # CIDR parsing for the trusted proxies of the client IP header
-ipnet = "2.12.2"
+ipnet = "2.12.1"
 
 # OIDC for SSO
 openidconnect = { version = "4.0.1", default-features = false }
-moka = { version = "0.12.16", features = ["future"] }
+moka = { version = "0.12.15", features = ["future"] }
 
 # Check client versions for specific features.
 semver = "1.0.28"
@@ -245,10 +245,10 @@ semver = "1.0.28"
 # Mainly used for the musl builds, since the default musl malloc is very slow
 mimalloc = { version = "0.1.52", optional = true, default-features = false, features = ["secure"] }
 
-which = "8.0.6"
+which = "8.0.5"
 
 # Argon2 library with support for the PHC format
-argon2 = "0.6.0"
+argon2 = "0.5.3"
 
 # Reading a password from the cli for generating the Argon2id ADMIN_TOKEN
 rpassword = "7.5.4"
@@ -257,21 +257,20 @@ rpassword = "7.5.4"
 grass_compiler = { version = "0.13.4", default-features = false }
 
 # File are accessed through Apache OpenDAL
-opendal = { version = "0.59.1", default-features = false, features = ["services-fs"] }
+opendal = { version = "0.58.1", default-features = false, features = ["services-fs"] }
-opendal-http-transport-reqwest = { version = "0.59.1", default-features = false, features = ["rustls-no-provider"], optional = true }
 
 # For retrieving AWS credentials, including temporary SSO credentials
-aws-config = { version = "1.12.0", optional = true, default-features = false, features = [
+aws-config = { version = "1.10.1", optional = true, default-features = false, features = [
     "behavior-version-latest",
     "credentials-process",
     "rt-tokio",
     "sso",
 ] }
 aws-credential-types = { version = "1.3.0", optional = true }
-aws-smithy-runtime-api = { version = "1.16.0", optional = true }
+aws-smithy-runtime-api = { version = "1.14.0", optional = true }
 http = { version = "1.5.0", optional = true }
-reqsign-aws-v4 = { version = "3.3.0", optional = true }
+reqsign-aws-v4 = { version = "3.1.0", optional = true }
-reqsign-core = { version = "3.3.1", optional = true }
+reqsign-core = { version = "3.2.1", optional = true }
 
 # Strip debuginfo from the release builds
 # The debug symbols are to provide better panic traces

docker/DockerSettings.yaml

@@ -5,8 +5,7 @@ vault_image_digest: "sha256:ba8bab66d4330ab9dbafa8f245bcbe99cf6ee3f2c8ce9b5fbb10
 # We use the linux/amd64 platform shell scripts since there is no difference between the different platform scripts
 # https://github.com/tonistiigi/xx | https://hub.docker.com/r/tonistiigi/xx/tags
 xx_image_digest: "sha256:c64defb9ed5a91eacb37f96ccc3d4cd72521c4bd18d5442905b95e2226b0e707"
-# The `rust_version` variable is extracted from `rust-toolchain.toml`
+rust_version: 1.97.1 # Rust version to be used
-# rust_version: x.yy.z # Rust version to be used
 debian_version: trixie # Debian release name to be used
 alpine_version: "3.24" # Alpine version to be used
 # For which platforms/architectures will we try to build images

docker/Dockerfile.alpine

@@ -32,10 +32,10 @@ FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@sha256:ba8bab66d4330
 ########################## ALPINE BUILD IMAGES ##########################
 ## NOTE: The Alpine Base Images do not support other platforms then linux/amd64 and linux/arm64
 ## And for Alpine we define all build images here, they will only be loaded when actually used
-FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:x86_64-musl-stable-1.98.1 AS build_amd64
+FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:x86_64-musl-stable-1.97.1 AS build_amd64
-FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:aarch64-musl-stable-1.98.1 AS build_arm64
+FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:aarch64-musl-stable-1.97.1 AS build_arm64
-FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:armv7-musleabihf-stable-1.98.1 AS build_armv7
+FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:armv7-musleabihf-stable-1.97.1 AS build_armv7
-FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:arm-musleabi-stable-1.98.1 AS build_armv6
+FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:arm-musleabi-stable-1.97.1 AS build_armv6
 
 ########################## BUILD IMAGE ##########################
 # hadolint ignore=DL3006

docker/Dockerfile.debian

@@ -36,7 +36,7 @@ FROM --platform=linux/amd64 docker.io/tonistiigi/xx@sha256:c64defb9ed5a91eacb37f
 
 ########################## BUILD IMAGE ##########################
 # hadolint ignore=DL3006
-FROM --platform=$BUILDPLATFORM docker.io/library/rust:1.98.1-slim-trixie AS build
+FROM --platform=$BUILDPLATFORM docker.io/library/rust:1.97.1-slim-trixie AS build
 # hadolint ignore=DL3067
 COPY --from=xx / /
 ARG TARGETARCH

docker/render_template

@@ -3,23 +3,17 @@
 import os
 import argparse
 import json
-import tomllib
 import yaml
 import jinja2
 
 # Load settings file
-with open('DockerSettings.yaml', 'r', encoding='utf-8') as yaml_file:
+with open("DockerSettings.yaml", 'r') as yaml_file:
 	yaml_data = yaml.safe_load(yaml_file)
 
-# Extract the rust_version from the rust-toolchain.toml file
-script_dir = os.path.dirname(os.path.abspath(__file__))
-with open(os.path.join(script_dir, '..', 'rust-toolchain.toml'), 'rb') as toolchain_file:
-    yaml_data["rust_version"] = tomllib.load(toolchain_file)["toolchain"]["channel"]
-
 settings_env = jinja2.Environment(
 	loader=jinja2.FileSystemLoader(os.getcwd()),
 )
-settings_yaml = yaml.safe_load(settings_env.get_template('DockerSettings.yaml').render(yaml_data))
+settings_yaml = yaml.safe_load(settings_env.get_template("DockerSettings.yaml").render(yaml_data))
 
 args_parser = argparse.ArgumentParser()
 args_parser.add_argument('template_file', help='Jinja2 template file to render.')

macros/Cargo.toml

@@ -14,7 +14,7 @@ proc-macro = true
 
 [dependencies]
 quote = "1.0.47"
-syn = "3.0.5"
+syn = "3.0.3"
 
 [lints]
 workspace = true

migrations/mysql/2024-03-13-170000_sso_users_cascade/up.sql

@@ -1,31 +1,15 @@
-SELECT if (
+-- Dynamically create DROP FOREIGN KEY
-    EXISTS(
+-- Some versions of MySQL or MariaDB might fail if the key doesn't exists
-        SELECT CONSTRAINT_NAME FROM information_schema.table_constraints
+-- This checks if the key exists, and if so, will drop it.
-            WHERE TABLE_SCHEMA = DATABASE()
+SET @drop_sso_fk = IF((SELECT true FROM information_schema.TABLE_CONSTRAINTS WHERE
-                AND TABLE_NAME = 'sso_users'
+    CONSTRAINT_SCHEMA = DATABASE() AND
-                AND CONSTRAINT_TYPE = 'FOREIGN KEY'
+    TABLE_NAME = 'sso_users' AND
-                AND CONSTRAINT_NAME = 'sso_users_ibfk_1'
+    CONSTRAINT_NAME = 'sso_users_ibfk_1' AND
-    )
+    CONSTRAINT_TYPE = 'FOREIGN KEY') = true,
-    ,'ALTER TABLE sso_users DROP FOREIGN KEY `sso_users_ibfk_1`'
+    'ALTER TABLE sso_users DROP FOREIGN KEY sso_users_ibfk_1',
-    ,'SELECT "info: FK sso_users_ibfk_1 does not exist."'
+    'SELECT 1');
-) INTO @drop_stmt;
+PREPARE stmt FROM @drop_sso_fk;
-PREPARE drop_stmt FROM @drop_stmt;
+EXECUTE stmt;
-EXECUTE drop_stmt;
+DEALLOCATE PREPARE stmt;
-
-SELECT if (
-    EXISTS(
-        SELECT CONSTRAINT_NAME FROM information_schema.table_constraints
-            WHERE TABLE_SCHEMA = DATABASE()
-                AND TABLE_NAME = 'sso_users'
-                AND CONSTRAINT_TYPE = 'FOREIGN KEY'
-                AND CONSTRAINT_NAME = '1'
-    )
-    ,'ALTER TABLE sso_users DROP FOREIGN KEY `1`'
-    ,'SELECT "info: FK sso_users 1 does not exist."'
-) INTO @drop_stmt;
-PREPARE drop_stmt FROM @drop_stmt;
-EXECUTE drop_stmt;
-
-DEALLOCATE PREPARE drop_stmt;
 
 ALTER TABLE sso_users ADD FOREIGN KEY(user_uuid) REFERENCES users(uuid) ON UPDATE CASCADE ON DELETE CASCADE;

playwright/docker-compose.yml

@@ -61,7 +61,7 @@ services:
   Mariadb:
     profiles: ["playwright"]
     container_name: playwright_mariadb
-    image: mariadb:12.2.2
+    image: mariadb:11.2.4
     env_file: test.env
     healthcheck:
       test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]

playwright/tests/organization.smtp.spec.ts

@@ -127,9 +127,6 @@ test('Organization is visible', async ({ page }) => {
 });
 
 test('Recover user password', async ({ page }) => {
-    await logUser(test, page, users.user2, { mailBuffer: mail2Buffer });
-    await activateTOTP(test, page, users.user2);
-
     await logUser(test, page, users.user1, { mailBuffer: mail1Buffer });
 
     let newPassword = "TotoNewPassword";
@@ -141,10 +138,9 @@ test('Recover user password', async ({ page }) => {
         await page.getByRole('menuitem', { name: 'Recover account' }).click();
         await page.getByRole('textbox', { name: 'New master password * (required)', exact: true }).fill(newPassword);
         await page.getByRole('textbox', { name: 'Confirm new master password * (' }).fill(newPassword);
-        await page.getByRole('checkbox', { name: 'Reset two-step login' }).check();
         await page.getByRole('button', { name: 'Save' }).click();
         await utils.checkNotification(page, 'Account recovery success');
-        await mail2Buffer.expect((m) => m.subject.includes('Admin account recovery from Test organization'));
+        await mail2Buffer.expect((m) => m.subject.includes('Master Password Has Been Changed'));
     });
 
     let user2 = {
@@ -154,7 +150,6 @@ test('Recover user password', async ({ page }) => {
     };
     await logUser(test, page, user2, {
         mailBuffer: mail2Buffer,
-        mail2fa: true,
         notNewDevice: true,
     });
 });

rust-toolchain.toml

@@ -1,4 +1,4 @@
 [toolchain]
-channel = "1.98.1"
+channel = "1.97.1"
 components = [ "rustfmt", "clippy" ]
 profile = "minimal"

src/api/admin.rs

@@ -231,7 +231,7 @@ fn validate_token(token: &str) -> bool {
         None => false,
         Some(t) if t.starts_with("$argon2") => {
             use argon2::password_hash::PasswordVerifier;
-            match argon2::password_hash::phc::PasswordHash::new(t) {
+            match argon2::password_hash::PasswordHash::new(t) {
                 Ok(h) => {
                     // NOTE: hash params from `ADMIN_TOKEN` are used instead of what is configured in the `Argon2` instance.
                     argon2::Argon2::default().verify_password(token.trim().as_ref(), &h).is_ok()
@@ -425,7 +425,7 @@ async fn delete_user(user_id: UserId, token: AdminToken, conn: DbConn) -> EmptyR
 
     for membership in memberships {
         log_event(
-            EventType::OrganizationUserDeleted,
+            EventType::OrganizationUserDeleted as i32,
             &membership.uuid,
             &membership.org_uuid,
             &ACTING_ADMIN_USER.into(),
@@ -446,7 +446,7 @@ async fn delete_sso_user(user_id: UserId, token: AdminToken, conn: DbConn) -> Em
 
     for membership in memberships {
         log_event(
-            EventType::OrganizationUserUnlinkedSso,
+            EventType::OrganizationUserUnlinkedSso as i32,
             &membership.uuid,
             &membership.org_uuid,
             &ACTING_ADMIN_USER.into(),
@@ -571,7 +571,7 @@ async fn update_membership_type(data: Json<MembershipTypeData>, token: AdminToke
     OrgPolicy::check_user_allowed(&member_to_edit, "modify", &conn).await?;
 
     log_event(
-        EventType::OrganizationUserUpdated,
+        EventType::OrganizationUserUpdated as i32,
         &member_to_edit.uuid,
         &data.org_uuid,
         &ACTING_ADMIN_USER.into(),
@@ -647,7 +647,7 @@ use cached::macros::cached;
 /// Cache this function to prevent API call rate limit. Github only allows 60 requests per hour, and we use 3 here already
 /// It will cache this function for 600 seconds (10 minutes) which should prevent the exhaustion of the rate limit
 /// Any cache will be lost if Vaultwarden is restarted
-#[cached(ttl_secs = 600, sync_writes = "default")]
+#[cached(ttl = 600, sync_writes = "default")]
 async fn get_release_info(has_http_access: bool) -> (String, String, String) {
     // If the HTTP Check failed, do not even attempt to check for new versions since we were not able to connect with github.com anyway.
     if has_http_access {

src/api/core/accounts.rs

@@ -595,52 +595,29 @@ async fn post_keys(data: Json<KeysData>, headers: Headers, conn: DbConn) -> Json
 #[serde(rename_all = "camelCase")]
 struct ChangePassData {
     master_password_hash: String,
+    new_master_password_hash: String,
     master_password_hint: Option<String>,
-    authentication_data: Option<AuthenticationData>,
+    key: String,
-    unlock_data: Option<UnlockData>,
-
-    // Outdated values, might still be used by older clients
-    new_master_password_hash: Option<String>,
-    key: Option<String>,
 }
 
 #[post("/accounts/password", data = "<data>")]
 async fn post_password(data: Json<ChangePassData>, headers: Headers, conn: DbConn, nt: Notify<'_>) -> EmptyResult {
     let data: ChangePassData = data.into_inner();
-    let user = headers.user;
+    let mut user = headers.user;
 
     if !user.check_valid_password(&data.master_password_hash) {
         err!("Invalid password")
     }
 
-    log_user_event(EventType::UserChangedPassword as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn)
-        .await;
-
-    let (new_master_password_hash, new_key) =
-        if let (Some(unlock_data), Some(authentication_data)) = (data.unlock_data, data.authentication_data) {
-            if authentication_data.kdf != unlock_data.kdf {
-                err!("KDF settings must be equal for authentication and unlock")
-            }
-
-            if user.email != authentication_data.salt || user.email != unlock_data.salt {
-                err!("Invalid master password salt")
-            }
-
-            (authentication_data.master_password_authentication_hash, unlock_data.master_key_wrapped_user_key)
-        } else if let (Some(new_master_password_hash), Some(new_key)) = (data.new_master_password_hash, data.key) {
-            (new_master_password_hash, new_key)
-        } else {
-            err!("Invalid request!")
-        };
-
-    let mut user = user;
-
     user.password_hint = clean_password_hint(data.master_password_hint.as_ref());
     enforce_password_hint_setting(user.password_hint.as_ref())?;
 
+    log_user_event(EventType::UserChangedPassword as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn)
+        .await;
+
     user.set_password(
-        &new_master_password_hash,
+        &data.new_master_password_hash,
-        Some(new_key),
+        Some(data.key),
         true,
         Some(vec![
             String::from("post_rotatekey"),
@@ -1340,13 +1317,11 @@ pub struct PreloginData {
 }
 
 #[post("/accounts/prelogin", data = "<data>")]
-async fn post_prelogin(data: Json<PreloginData>, ip: ClientIp, conn: DbConn) -> JsonResult {
+async fn post_prelogin(data: Json<PreloginData>, conn: DbConn) -> Json<Value> {
-    prelogin(data, ip, conn).await
+    prelogin(data, conn).await
 }
 
-pub async fn prelogin(data: Json<PreloginData>, ip: ClientIp, conn: DbConn) -> JsonResult {
+pub async fn prelogin(data: Json<PreloginData>, conn: DbConn) -> Json<Value> {
-    crate::ratelimit::check_limit_unauthenticated(&ip.ip)?;
-
     let data: PreloginData = data.into_inner();
 
     let (kdf_type, kdf_iter, kdf_mem, kdf_para) = match User::find_by_mail(&data.email, &conn).await {
@@ -1354,7 +1329,7 @@ pub async fn prelogin(data: Json<PreloginData>, ip: ClientIp, conn: DbConn) -> J
         None => (User::CLIENT_KDF_TYPE_DEFAULT, User::CLIENT_KDF_ITER_DEFAULT, None, None),
     };
 
-    Ok(Json(json!({
+    Json(json!({
         "kdf": kdf_type,
         "kdfIterations": kdf_iter,
         "kdfMemory": kdf_mem,
@@ -1366,7 +1341,7 @@ pub async fn prelogin(data: Json<PreloginData>, ip: ClientIp, conn: DbConn) -> J
             "parallelism": kdf_para
         },
         "salt": null,
-    })))
+    }))
 }
 
 // https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Api/Auth/Models/Request/Accounts/SecretVerificationRequestModel.cs
@@ -1597,8 +1572,6 @@ async fn post_auth_request(
     conn: DbConn,
     nt: Notify<'_>,
 ) -> JsonResult {
-    crate::ratelimit::check_limit_unauthenticated(&client_headers.ip.ip)?;
-
     let data = data.into_inner();
 
     let Some(user) = User::find_by_mail(&data.email, &conn).await else {
@@ -1611,7 +1584,7 @@ async fn post_auth_request(
         _ => err!("AuthRequest doesn't exist", "Device verification failed"),
     };
 
-    let auth_request = AuthRequest::new(
+    let mut auth_request = AuthRequest::new(
         user.uuid.clone(),
         data.device_identifier.clone(),
         client_headers.device_type,
@@ -1760,8 +1733,6 @@ async fn get_auth_request_response(
     client_headers: ClientHeaders,
     conn: DbConn,
 ) -> JsonResult {
-    crate::ratelimit::check_limit_unauthenticated(&client_headers.ip.ip)?;
-
     let Some(auth_request) = AuthRequest::find_by_uuid(&auth_request_id, &conn).await else {
         err!("AuthRequest doesn't exist", "User not found")
     };

src/api/core/ciphers.rs

@@ -167,7 +167,7 @@ async fn sync(data: SyncData, headers: Headers, client_version: Option<ClientVer
         api::core::get_eq_domains(&headers, true).into_inner()
     };
 
-    // This is very similar to the userDecryptionOptions sent in connect/token,
+    // This is very similar to the the userDecryptionOptions sent in connect/token,
     // but as of 2025-12-19 they're both using different casing conventions.
     let has_master_password = !headers.user.password_hash.is_empty();
     let master_password_unlock = if has_master_password {
@@ -537,12 +537,11 @@ pub async fn update_cipher_from_data(
     cipher.move_to_folder(data.folder_id, &headers.user.uuid, conn).await?;
     cipher.set_favorite(data.favorite, &headers.user.uuid, conn).await?;
 
-    match data.archived_date {
+    if let Some(dt_str) = data.archived_date {
-        Some(dt_str) => match NaiveDateTime::parse_from_str(&dt_str, "%+") {
+        match NaiveDateTime::parse_from_str(&dt_str, "%+") {
             Ok(dt) => cipher.set_archived_at(dt, &headers.user.uuid, conn).await?,
             Err(err) => warn!("Error parsing ArchivedDate '{dt_str}': {err}"),
-        },
+        }
-        None => cipher.unarchive(&headers.user.uuid, conn).await?,
     }
 
     if ut != UpdateType::None {
@@ -554,8 +553,16 @@ pub async fn update_cipher_from_data(
                 (_, _) => EventType::CipherUpdated,
             };
 
-            log_event(event_type, &cipher.uuid, org_id, &headers.user.uuid, headers.device.atype, &headers.ip.ip, conn)
+            log_event(
-                .await;
+                event_type as i32,
+                &cipher.uuid,
+                org_id,
+                &headers.user.uuid,
+                headers.device.atype,
+                &headers.ip.ip,
+                conn,
+            )
+            .await;
         }
         nt.send_cipher_update(
             ut,
@@ -843,7 +850,7 @@ async fn post_collections_update(
     .await;
 
     log_event(
-        EventType::CipherUpdatedCollections,
+        EventType::CipherUpdatedCollections as i32,
         &cipher.uuid,
         org_uuid,
         &headers.user.uuid,
@@ -923,7 +930,7 @@ async fn post_collections_admin(
     .await;
 
     log_event(
-        EventType::CipherUpdatedCollections,
+        EventType::CipherUpdatedCollections as i32,
         &cipher.uuid,
         org_uuid,
         &headers.user.uuid,
@@ -1328,7 +1335,7 @@ async fn save_attachment(
 
     if let Some(org_id) = &cipher.organization_uuid {
         log_event(
-            EventType::CipherAttachmentCreated,
+            EventType::CipherAttachmentCreated as i32,
             &cipher.uuid,
             org_id,
             &headers.user.uuid,
@@ -1689,7 +1696,7 @@ async fn purge_org_vault(
             nt.send_user_update(UpdateType::SyncVault, &user, headers.device.push_uuid.as_ref(), &conn).await;
 
             log_event(
-                EventType::OrganizationPurgedVault,
+                EventType::OrganizationPurgedVault as i32,
                 &organization.org_id,
                 &organization.org_id,
                 &user.uuid,
@@ -1817,9 +1824,9 @@ async fn delete_cipher_by_uuid(
         let event_type = if *delete_options == CipherDeleteOptions::SoftSingle
             || *delete_options == CipherDeleteOptions::SoftMulti
         {
-            EventType::CipherSoftDeleted
+            EventType::CipherSoftDeleted as i32
         } else {
-            EventType::CipherDeleted
+            EventType::CipherDeleted as i32
         };
 
         log_event(event_type, &cipher.uuid, &org_id, &headers.user.uuid, headers.device.atype, &headers.ip.ip, conn)
@@ -1888,7 +1895,7 @@ async fn restore_cipher_by_uuid(
 
     if let Some(org_id) = &cipher.organization_uuid {
         log_event(
-            EventType::CipherRestored,
+            EventType::CipherRestored as i32,
             &cipher.uuid.clone(),
             org_id,
             &headers.user.uuid,
@@ -1965,7 +1972,7 @@ async fn delete_cipher_attachment_by_id(
 
     if let Some(ref org_id) = cipher.organization_uuid {
         log_event(
-            EventType::CipherAttachmentDeleted,
+            EventType::CipherAttachmentDeleted as i32,
             &cipher.uuid,
             org_id,
             &headers.user.uuid,

src/api/core/events.rs

@@ -10,7 +10,7 @@ use crate::{
     auth::{AdminHeaders, Headers},
     db::{
         DbConn, DbPool,
-        models::{Cipher, CipherId, Event, EventType, Membership, MembershipId, OrganizationId, UserId},
+        models::{Cipher, CipherId, Event, Membership, MembershipId, OrganizationId, UserId},
     },
     util::parse_date,
 };
@@ -267,7 +267,7 @@ async fn log_user_event_impl(
 }
 
 pub async fn log_event(
-    event_type: EventType,
+    event_type: i32,
     source_uuid: &str,
     org_id: &OrganizationId,
     act_user_id: &UserId,
@@ -278,7 +278,7 @@ pub async fn log_event(
     if !CONFIG.org_events_enabled() {
         return;
     }
-    log_event_impl(event_type as i32, source_uuid, org_id, act_user_id, device_type, None, ip, conn).await;
+    log_event_impl(event_type, source_uuid, org_id, act_user_id, device_type, None, ip, conn).await;
 }
 
 #[expect(clippy::too_many_arguments)]

src/api/core/organizations.rs

@@ -1,7 +1,7 @@
 use std::collections::{HashMap, HashSet};
 
 use num_traits::FromPrimitive;
-use rocket::{Route, http::Status, serde::json::Json};
+use rocket::{Route, serde::json::Json};
 use serde_json::Value;
 
 use crate::{
@@ -17,8 +17,7 @@ use crate::{
         models::{
             Cipher, CipherId, Collection, CollectionCipher, CollectionGroup, CollectionId, CollectionUser, EventType,
             Group, GroupId, GroupUser, Invitation, Membership, MembershipId, MembershipStatus, MembershipType,
-            OrgPolicy, OrgPolicyType, Organization, OrganizationApiKey, OrganizationId, TwoFactor, TwoFactorType, User,
+            OrgPolicy, OrgPolicyType, Organization, OrganizationApiKey, OrganizationId, User, UserId,
-            UserId,
         },
     },
     mail,
@@ -133,6 +132,7 @@ struct FullCollectionData {
     name: String,
     groups: Vec<CollectionGroupData>,
     users: Vec<CollectionMembershipData>,
+    id: Option<CollectionId>,
     external_id: Option<String>,
 }
 
@@ -269,7 +269,7 @@ async fn leave_organization(org_id: OrganizationId, headers: OrgMemberHeaders, c
     }
 
     log_event(
-        EventType::OrganizationUserLeft,
+        EventType::OrganizationUserLeft as i32,
         &membership.uuid,
         &org_id,
         &headers.user.uuid,
@@ -327,7 +327,7 @@ async fn post_organization(
     org.save(&conn).await?;
 
     log_event(
-        EventType::OrganizationUpdated,
+        EventType::OrganizationUpdated as i32,
         org_id.as_ref(),
         &org_id,
         &headers.user.uuid,
@@ -391,7 +391,7 @@ async fn get_org_collections(org_id: OrganizationId, headers: ManagerHeadersLoos
     }
 
     if !headers.membership.has_full_access() {
-        err_code!("Resource not found.", "User does not have full access", Status::NotFound.code);
+        err_code!("Resource not found.", "User does not have full access", rocket::http::Status::NotFound.code);
     }
 
     Ok(Json(json!({
@@ -514,7 +514,7 @@ async fn post_organization_collections(
     collection.save(&conn).await?;
 
     log_event(
-        EventType::CollectionCreated,
+        EventType::CollectionCreated as i32,
         &collection.uuid,
         &org_id,
         &headers.user.uuid,
@@ -597,7 +597,7 @@ async fn post_bulk_access_collections(
         collection.save(&conn).await?;
 
         log_event(
-            EventType::CollectionUpdated,
+            EventType::CollectionUpdated as i32,
             &collection.uuid,
             &org_id,
             &headers.user.uuid,
@@ -674,7 +674,7 @@ async fn post_organization_collection_update(
     collection.save(&conn).await?;
 
     log_event(
-        EventType::CollectionUpdated,
+        EventType::CollectionUpdated as i32,
         &collection.uuid,
         &org_id,
         &headers.user.uuid,
@@ -723,7 +723,7 @@ async fn delete_organization_collection_impl(
         err!("Collection not found", "Collection does not exist or does not belong to this organization")
     };
     log_event(
-        EventType::CollectionDeleted,
+        EventType::CollectionDeleted as i32,
         &collection.uuid,
         org_id,
         &headers.user.uuid,
@@ -887,11 +887,11 @@ struct OrgIdData {
 #[get("/ciphers/organization-details?<data..>")]
 async fn get_org_details(data: OrgIdData, headers: ManagerHeadersLoose, conn: DbConn) -> JsonResult {
     if data.organization_id != headers.membership.org_uuid {
-        err_code!("Resource not found.", "Organization id's do not match", Status::NotFound.code);
+        err_code!("Resource not found.", "Organization id's do not match", rocket::http::Status::NotFound.code);
     }
 
     if !headers.membership.has_full_access() {
-        err_code!("Resource not found.", "User does not have full access", Status::NotFound.code);
+        err_code!("Resource not found.", "User does not have full access", rocket::http::Status::NotFound.code);
     }
 
     Ok(Json(json!({
@@ -955,7 +955,7 @@ async fn get_members(
     }
 
     if !headers.membership.has_full_access() {
-        err_code!("Resource not found.", "User does not have full access", Status::NotFound.code);
+        err_code!("Resource not found.", "User does not have full access", rocket::http::Status::NotFound.code);
     }
 
     let mut users_json = Vec::new();
@@ -1148,7 +1148,7 @@ async fn send_invite(
         }
 
         log_event(
-            EventType::OrganizationUserInvited,
+            EventType::OrganizationUserInvited as i32,
             &new_member.uuid,
             &org_id,
             &headers.user.uuid,
@@ -1447,7 +1447,7 @@ async fn confirm_invite_impl(
     OrgPolicy::check_user_allowed(&member_to_confirm, "confirm", conn).await?;
 
     log_event(
-        EventType::OrganizationUserConfirmed,
+        EventType::OrganizationUserConfirmed as i32,
         &member_to_confirm.uuid,
         org_id,
         &headers.user.uuid,
@@ -1637,7 +1637,7 @@ async fn edit_member(
     }
 
     log_event(
-        EventType::OrganizationUserUpdated,
+        EventType::OrganizationUserUpdated as i32,
         &member_to_edit.uuid,
         &org_id,
         &headers.user.uuid,
@@ -1724,7 +1724,7 @@ async fn delete_member_impl(
     }
 
     log_event(
-        EventType::OrganizationUserRemoved,
+        EventType::OrganizationUserRemoved as i32,
         &member_to_delete.uuid,
         org_id,
         &headers.user.uuid,
@@ -1793,22 +1793,11 @@ async fn bulk_public_keys(
 use super::ciphers::CipherData;
 use super::ciphers::update_cipher_from_data;
 
-// The import endpoint only ever uses the name/id/external_id of a collection.
-// Bitwarden's own server ignores `groups`/`users` here too, so do not make them
-// mandatory: clients are free to leave them out.
-#[derive(Deserialize)]
-#[serde(rename_all = "camelCase")]
-struct ImportCollectionData {
-    name: String,
-    id: Option<CollectionId>,
-    external_id: Option<String>,
-}
-
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct ImportData {
     ciphers: Vec<CipherData>,
-    collections: Vec<ImportCollectionData>,
+    collections: Vec<FullCollectionData>,
     collection_relationships: Vec<RelationsData>,
 }
 
@@ -2155,7 +2144,7 @@ async fn put_policy(
                 }
 
                 log_event(
-                    EventType::OrganizationUserRemoved,
+                    EventType::OrganizationUserRemoved as i32,
                     &member.uuid,
                     &org_id,
                     &headers.user.uuid,
@@ -2181,7 +2170,7 @@ async fn put_policy(
     policy.save(&conn).await?;
 
     log_event(
-        EventType::PolicyUpdated,
+        EventType::PolicyUpdated as i32,
         policy.uuid.as_ref(),
         &org_id,
         &headers.user.uuid,
@@ -2350,7 +2339,7 @@ async fn revoke_member_impl(
             member.save(conn).await?;
 
             log_event(
-                EventType::OrganizationUserRevoked,
+                EventType::OrganizationUserRevoked as i32,
                 &member.uuid,
                 org_id,
                 &headers.user.uuid,
@@ -2448,7 +2437,7 @@ async fn restore_member_impl(
             member.save(conn).await?;
 
             log_event(
-                EventType::OrganizationUserRestored,
+                EventType::OrganizationUserRestored as i32,
                 &member.uuid,
                 org_id,
                 &headers.user.uuid,
@@ -2487,7 +2476,7 @@ async fn get_groups_data(
             || Collection::has_manageable_collection_by_user(&org_id, &headers.membership.user_uuid, &conn).await
     };
     if !allowed {
-        err_code!("Resource not found.", "User does not have access", Status::NotFound.code);
+        err_code!("Resource not found.", "User does not have access", rocket::http::Status::NotFound.code);
     }
 
     let groups: Vec<Value> = if CONFIG.org_groups_enabled() {
@@ -2616,7 +2605,7 @@ async fn post_groups(
     let group = group_request.to_group(&org_id);
 
     log_event(
-        EventType::GroupCreated,
+        EventType::GroupCreated as i32,
         &group.uuid,
         &org_id,
         &headers.user.uuid,
@@ -2657,7 +2646,7 @@ async fn put_group(
     GroupUser::delete_all_by_group(&group_id, &org_id, &conn).await?;
 
     log_event(
-        EventType::GroupUpdated,
+        EventType::GroupUpdated as i32,
         &updated_group.uuid,
         &org_id,
         &headers.user.uuid,
@@ -2690,7 +2679,7 @@ async fn add_update_group(
         user_entry.save(conn).await?;
 
         log_event(
-            EventType::OrganizationUserUpdatedGroups,
+            EventType::OrganizationUserUpdatedGroups as i32,
             &assigned_member,
             &org_id,
             &headers.user.uuid,
@@ -2765,7 +2754,7 @@ async fn delete_group_impl(
     };
 
     log_event(
-        EventType::GroupDeleted,
+        EventType::GroupDeleted as i32,
         &group.uuid,
         org_id,
         &headers.user.uuid,
@@ -2876,7 +2865,7 @@ async fn put_group_members(
         user_entry.save(&conn).await?;
 
         log_event(
-            EventType::OrganizationUserUpdatedGroups,
+            EventType::OrganizationUserUpdatedGroups as i32,
             &assigned_member,
             &org_id,
             &headers.user.uuid,
@@ -2914,7 +2903,7 @@ async fn post_delete_group_member(
     }
 
     log_event(
-        EventType::OrganizationUserUpdatedGroups,
+        EventType::OrganizationUserUpdatedGroups as i32,
         &member_id,
         &org_id,
         &headers.user.uuid,
@@ -2938,8 +2927,8 @@ struct OrganizationUserResetPasswordEnrollmentRequest {
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct OrganizationUserRecoverAccountRequest {
-    new_master_password_hash: Option<String>,
+    new_master_password_hash: String,
-    key: Option<String>,
+    key: String,
 
     #[serde(default)]
     reset_master_password: bool,
@@ -2983,7 +2972,12 @@ async fn put_recover_account(
     conn: DbConn,
     nt: Notify<'_>,
 ) -> EmptyResult {
-    recover_account(org_id, member_id, headers, data.into_inner(), conn, nt).await
+    let req = data.into_inner();
+    if req.reset_master_password && !req.reset_two_factor {
+        recover_account(org_id, member_id, headers, req, conn, nt).await
+    } else {
+        err!("Unsupported operation")
+    }
 }
 
 // Deprecated since `v2026.4.2`
@@ -3003,7 +2997,7 @@ async fn recover_account(
     org_id: OrganizationId,
     member_id: MembershipId,
     headers: AdminHeaders,
-    req: OrganizationUserRecoverAccountRequest,
+    reset_request: OrganizationUserRecoverAccountRequest,
     conn: DbConn,
     nt: Notify<'_>,
 ) -> EmptyResult {
@@ -3018,7 +3012,7 @@ async fn recover_account(
         err!("User to reset isn't member of required organization")
     };
 
-    let Some(mut user) = User::find_by_uuid(&member.user_uuid, &conn).await else {
+    let Some(user) = User::find_by_uuid(&member.user_uuid, &conn).await else {
         err!("User not found")
     };
 
@@ -3031,56 +3025,29 @@ async fn recover_account(
         err!("Organization user must be confirmed for password reset functionality");
     }
 
-    let fallback_2fa_email = if req.reset_two_factor && CONFIG.email_2fa_auto_fallback() {
+    // Sending email before resetting password to ensure working email configuration and the resulting
-        TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Email as i32, &conn).await.is_none()
+    // user notification. Also this might add some protection against security flaws and misuse
-    } else {
+    if let Err(e) = mail::send_admin_reset_password(&user.email, user.display_name(), &org.name).await {
-        false
-    };
-
-    // Sending email first ensure working email configuration and the resulting user notification.
-    // Also this might add some protection against security flaws and misuse
-    if let Err(e) = mail::send_admin_account_recovery(
-        &user.email,
-        user.display_name(),
-        &org.name,
-        req.reset_master_password,
-        req.reset_two_factor,
-        fallback_2fa_email,
-    )
-    .await
-    {
         err!(format!("Error sending user reset password email: {e:#?}"));
     }
 
-    if req.reset_master_password {
+    let mut user = user;
-        if let Some(key) = req.key
+    user.set_password(reset_request.new_master_password_hash.as_str(), Some(reset_request.key), true, None, &conn)
-            && let Some(hash) = req.new_master_password_hash
+        .await?;
-        {
-            user.set_password(hash.as_str(), Some(key), true, None, &conn).await?;
-        } else {
-            err_code!("Unprocessable request", "Missing fields to reset password", Status::UnprocessableEntity.code);
-        }
-    }
-
-    if req.reset_two_factor {
-        TwoFactor::delete_all_by_user(&user.uuid, &conn).await?;
-        if !fallback_2fa_email || two_factor::email::find_and_activate_email_2fa(&user.uuid, &conn).await.is_err() {
-            two_factor::enforce_2fa_policy(&user, &headers.user.uuid, headers.device.atype, &headers.ip.ip, &conn)
-                .await?;
-        }
-    }
-
     user.save(&conn).await?;
 
     nt.send_logout(&user, None, &conn).await;
 
-    if req.reset_master_password {
+    log_event(
-        headers.log_event(EventType::OrganizationUserAdminResetPassword, &member_id, &org_id, &conn).await;
+        EventType::OrganizationUserAdminResetPassword as i32,
-    }
+        &member_id,
-
+        &org_id,
-    if req.reset_two_factor {
+        &headers.user.uuid,
-        headers.log_event(EventType::OrganizationUserAdminResetTwoFactor, &member_id, &org_id, &conn).await;
+        headers.device.atype,
-    }
+        &headers.ip.ip,
+        &conn,
+    )
+    .await;
 
     Ok(())
 }
@@ -3199,9 +3166,9 @@ async fn put_reset_password_enrollment(
     membership.save(&conn).await?;
 
     let event_type = if membership.reset_password_key.is_some() {
-        EventType::OrganizationUserResetPasswordEnroll
+        EventType::OrganizationUserResetPasswordEnroll as i32
     } else {
-        EventType::OrganizationUserResetPasswordWithdraw
+        EventType::OrganizationUserResetPasswordWithdraw as i32
     };
 
     log_event(event_type, &membership.uuid, &org_id, &headers.user.uuid, headers.device.atype, &headers.ip.ip, &conn)

src/api/core/two_factor/email.rs

@@ -63,19 +63,13 @@ async fn send_email_login(data: Json<SendEmailLoginData>, client_headers: Client
 
     let user = if let Some(email) = email {
         let Some(user) = User::find_by_mail(email, &conn).await else {
-            err!(
+            err!("Username or password is incorrect. Try again.")
-                "Username or password is incorrect. Try again",
-                format!("IP: {}. Username: {email}.", client_headers.ip.ip)
-            )
         };
 
         if let Some(master_password_hash) = master_password_hash {
             // Check password
             if !user.check_valid_password(master_password_hash) {
-                err!(
+                err!("Username or password is incorrect. Try again.")
-                    "Username or password is incorrect. Try again",
-                    format!("IP: {}. Username: {email}.", client_headers.ip.ip)
-                )
             }
         } else if let Some(auth_request_id) = auth_request_id {
             let Some(auth_request) = AuthRequest::find_by_uuid(auth_request_id, &conn).await else {
@@ -102,10 +96,7 @@ async fn send_email_login(data: Json<SendEmailLoginData>, client_headers: Client
         };
         // SSO login only sends device id, so we get the user by the most recently used device
         let Some(user) = User::find_by_device_for_email2fa(device_identifier, &conn).await else {
-            err!(
+            err!("Username or password is incorrect. Try again.")
-                "Username or password is incorrect. Try again",
-                format!("IP: {}. Device: {device_identifier}.", client_headers.ip.ip)
-            )
         };
 
         user

src/api/core/two_factor/mod.rs

@@ -16,8 +16,8 @@ use crate::{
     db::{
         DbConn, DbPool,
         models::{
-            Device, DeviceType, EventType, Membership, MembershipType, OrgPolicyType, Organization, OrganizationId,
+            DeviceType, EventType, Membership, MembershipType, OrgPolicyType, Organization, OrganizationId, TwoFactor,
-            TwoFactor, TwoFactorIncomplete, TwoFactorType, User, UserId,
+            TwoFactorIncomplete, TwoFactorType, User, UserId,
         },
     },
     mail,
@@ -151,7 +151,6 @@ async fn disable_twofactor(data: Json<DisableTwoFactorData>, headers: Headers, c
 
     if let Some(twofactor) = TwoFactor::find_by_user_and_type(&user.uuid, type_, &conn).await {
         twofactor.delete(&conn).await?;
-        Device::clear_twofactor_remember_by_user(&user.uuid, &conn).await?;
         log_user_event(EventType::UserDisabled2fa as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn)
             .await;
     }
@@ -191,7 +190,7 @@ pub async fn enforce_2fa_policy(
             member.save(conn).await?;
 
             log_event(
-                EventType::OrganizationUserRevoked,
+                EventType::OrganizationUserRevoked as i32,
                 &member.uuid,
                 &member.org_uuid,
                 act_user_id,
@@ -225,8 +224,16 @@ pub async fn enforce_2fa_policy_for_org(
             member.revoke();
             member.save(conn).await?;
 
-            log_event(EventType::OrganizationUserRevoked, &member.uuid, org_id, act_user_id, device_type, ip, conn)
+            log_event(
-                .await;
+                EventType::OrganizationUserRevoked as i32,
+                &member.uuid,
+                org_id,
+                act_user_id,
+                device_type,
+                ip,
+                conn,
+            )
+            .await;
         }
     }
 

src/api/identity.rs

@@ -3,7 +3,7 @@ use num_traits::FromPrimitive;
 use rocket::{
     Route,
     form::{Form, FromForm},
-    http::{Accept, Cookie, CookieJar, MediaType, SameSite},
+    http::{Cookie, CookieJar, SameSite},
     response::Redirect,
     serde::json::Json,
 };
@@ -234,24 +234,6 @@ async fn sso_login(
                     }
                 )
             }
-            Some((user, None))
-                if user.private_key.is_none()
-                    && !CONFIG.sso_signups_allowed()
-                    && !CONFIG.is_email_domain_allowed(&user.email)
-                    && !CONFIG.mail_enabled()
-                    && Invitation::find_by_mail(&user.email, conn).await.is_none() =>
-            {
-                error!(
-                    "Login failure ({}), no invitation with email ({}) was found",
-                    user_infos.identifier, user.email
-                );
-                err_silent!(
-                    "Missing invitation",
-                    ErrorEvent {
-                        event: EventType::UserFailedLogIn
-                    }
-                )
-            }
             Some((user, None)) if user.private_key.is_some() && !CONFIG.sso_signups_match_email() => {
                 error!(
                     "Login failure ({}), existing non SSO user ({}) with same email ({}) and association is disabled",
@@ -299,15 +281,7 @@ async fn sso_login(
     // Will trigger 2FA flow if needed
     let (user, mut device, twofactor_token, sso_user) = match user_with_sso {
         None => {
-            if !CONFIG.is_sso_signup_allowed(&user_infos.email) {
+            if !CONFIG.is_email_domain_allowed(&user_infos.email) {
-                if CONFIG.signups_domains_whitelist().is_empty() {
-                    err!(
-                        "Signups are disabled. You will need an invitation",
-                        ErrorEvent {
-                            event: EventType::UserFailedLogIn
-                        }
-                    );
-                }
                 err!(
                     "Email domain not allowed",
                     ErrorEvent {
@@ -905,12 +879,6 @@ async fn twofactor_auth(
 
             // Remove all twofactors from the user
             TwoFactor::delete_all_by_user(&user.uuid, conn).await?;
-
-            // No device may keep skipping 2FA once every second factor is gone.
-            // `device` is cleared in memory too, since saving it later would restore its token.
-            Device::clear_twofactor_remember_by_user(&user.uuid, conn).await?;
-            device.delete_twofactor_remember();
-
             enforce_2fa_policy(user, &user.uuid, device.atype, &ip.ip, conn).await?;
 
             log_user_event(EventType::UserRecovered2fa as i32, &user.uuid, device.atype, &ip.ip, conn).await;
@@ -1056,13 +1024,13 @@ async fn json_err_twofactor(
 }
 
 #[post("/accounts/prelogin", data = "<data>")]
-async fn post_prelogin(data: Json<PreloginData>, ip: ClientIp, conn: DbConn) -> JsonResult {
+async fn post_prelogin(data: Json<PreloginData>, conn: DbConn) -> Json<Value> {
-    prelogin(data, ip, conn).await
+    prelogin(data, conn).await
 }
 
 #[post("/accounts/prelogin/password", data = "<data>")]
-async fn prelogin_password(data: Json<PreloginData>, ip: ClientIp, conn: DbConn) -> JsonResult {
+async fn prelogin_password(data: Json<PreloginData>, conn: DbConn) -> Json<Value> {
-    prelogin(data, ip, conn).await
+    prelogin(data, conn).await
 }
 
 #[post("/accounts/register", data = "<data>")]
@@ -1083,18 +1051,11 @@ enum RegisterVerificationResponse {
     #[response(status = 204)]
     NoContent(()),
     Token(Json<String>),
-    PlainToken(String),
-}
-
-// Return JSON only when the client explicitly requests it, otherwise return plain text.
-fn accepts_json(accept: Option<&Accept>) -> bool {
-    accept.is_some_and(|accept| accept.preferred().media_type() == &MediaType::JSON)
 }
 
 #[post("/accounts/register/send-verification-email", data = "<data>")]
 async fn register_verification_email(
     data: Json<RegisterVerificationData>,
-    accept: Option<&Accept>,
     ip: ClientIp,
     conn: DbConn,
 ) -> ApiResult<RegisterVerificationResponse> {
@@ -1132,11 +1093,7 @@ async fn register_verification_email(
     } else {
         // If email verification is not required, return the token directly
         // the clients will use this token to finish the registration
-        Ok(if accepts_json(accept) {
+        Ok(RegisterVerificationResponse::Token(Json(token)))
-            RegisterVerificationResponse::Token(Json(token))
-        } else {
-            RegisterVerificationResponse::PlainToken(token)
-        })
     }
 }
 

src/api/web.rs

@@ -301,6 +301,9 @@ pub fn static_files(filename: &str) -> Result<(ContentType, &'static [u8]), Erro
         "jdenticon-3.3.0.js" => Ok((ContentType::JavaScript, include_bytes!("../static/scripts/jdenticon-3.3.0.js"))),
         "datatables.js" => Ok((ContentType::JavaScript, include_bytes!("../static/scripts/datatables.js"))),
         "datatables.css" => Ok((ContentType::CSS, include_bytes!("../static/scripts/datatables.css"))),
+        "jquery-4.0.0.slim.js" => {
+            Ok((ContentType::JavaScript, include_bytes!("../static/scripts/jquery-4.0.0.slim.js")))
+        }
         _ => err!(format!("Static file not found: {filename}")),
     }
 }

src/auth.rs

@@ -23,14 +23,14 @@ use rocket::{
 
 use crate::{
     CONFIG,
-    api::{ApiResult, core::log_event},
+    api::ApiResult,
     config::PathType,
     db::{
         DbConn,
         models::{
             AttachmentId, CipherId, Collection, CollectionId, Device, DeviceId, DeviceType, EmergencyAccessId,
-            EventType, Membership, MembershipId, MembershipStatus, MembershipType, OrgApiKeyId, OrganizationId,
+            Membership, MembershipId, MembershipStatus, MembershipType, OrgApiKeyId, OrganizationId, SendFileId,
-            SendFileId, SendId, User, UserId, UserStampException,
+            SendId, User, UserId, UserStampException,
         },
     },
     error::Error,
@@ -822,12 +822,6 @@ pub struct AdminHeaders {
     pub org_id: OrganizationId,
 }
 
-impl AdminHeaders {
-    pub async fn log_event(&self, event_type: EventType, source_uuid: &str, org_id: &OrganizationId, conn: &DbConn) {
-        log_event(event_type, source_uuid, org_id, &self.user.uuid, self.device.atype, &self.ip.ip, conn).await;
-    }
-}
-
 #[rocket::async_trait]
 impl<'r> FromRequest<'r> for AdminHeaders {
     type Error = &'static str;

src/config.rs

@@ -817,8 +817,6 @@ make_config! {
         sso_enabled:                    bool,   true,   def,    false;
         /// Only SSO login |> Disable Email+Master Password login
         sso_only:                       bool,   true,   def,    false;
-        /// Allow SSO flow to create account |> You probably want to disable it when using a public provider
-        sso_signups_allowed:            bool,   true,   def,    true;
         /// Allow email association |> Associate existing non-SSO user based on email
         sso_signups_match_email:        bool,   true,   def,    true;
         /// Allow unknown email verification status |> Allowing this with `SSO_SIGNUPS_MATCH_EMAIL=true` open potential account takeover.
@@ -1272,7 +1270,7 @@ fn validate_config(cfg: &ConfigItems, on_update: bool) -> Result<(), Error> {
     if !cfg.disable_admin_token {
         match cfg.admin_token.as_ref() {
             Some(t) if t.starts_with("$argon2") => {
-                if let Err(e) = argon2::password_hash::phc::PasswordHash::new(t) {
+                if let Err(e) = argon2::password_hash::PasswordHash::new(t) {
                     err!(format!("The configured Argon2 PHC in `ADMIN_TOKEN` is invalid: '{e}'"))
                 }
             }
@@ -1425,7 +1423,6 @@ pub const SUPPORTED_FEATURE_FLAGS: &[&str] = &[
     "desktop-ui-migration-milestone-4",
     // Auth Team
     "pm-5594-safari-account-switching",
-    "pm-32413-multi-client-password-management",
     // Autofill Team
     "ssh-agent",
     "ssh-agent-v2",
@@ -1547,17 +1544,6 @@ impl Config {
         }
     }
 
-    /// Tests whether SSO signup is allowed for an email address, taking into
-    /// account the sso_signups_allowed and signups_domains_whitelist settings.
-    pub fn is_sso_signup_allowed(&self, email: &str) -> bool {
-        if self.signups_domains_whitelist().is_empty() {
-            self.sso_signups_allowed()
-        } else {
-            // The whitelist setting overrides the signups_allowed setting.
-            self.is_email_domain_allowed(email)
-        }
-    }
-
     // The registration link should be hidden if
     //  - Signup is not allowed and email whitelist is empty unless mail is disabled and invitations are allowed
     //  - The SSO is activated and password login is disabled.
@@ -1745,7 +1731,7 @@ where
     reg!("email/email_footer");
     reg!("email/email_footer_text");
 
-    reg!("email/admin_account_recovery", ".html");
+    reg!("email/admin_reset_password", ".html");
     reg!("email/change_email_existing", ".html");
     reg!("email/change_email_invited", ".html");
     reg!("email/change_email", ".html");

src/db/models/archive.rs

@@ -41,20 +41,17 @@ impl Archive {
     ) -> EmptyResult {
         User::update_uuid_revision(user_uuid, conn).await;
         db_run! { conn:
-            mysql {
+            sqlite, mysql {
-                diesel::insert_into(archives::table)
+                diesel::replace_into(archives::table)
                     .values((
                         archives::user_uuid.eq(user_uuid),
                         archives::cipher_uuid.eq(cipher_uuid),
                         archives::archived_at.eq(archived_at),
                     ))
-                    .on_conflict(diesel::dsl::DuplicatedKeys)
-                    .do_update()
-                    .set(archives::archived_at.eq(archived_at))
                     .execute(conn)
                     .map_res("Error saving archive")
             }
-            postgresql, sqlite {
+            postgresql {
                 diesel::insert_into(archives::table)
                     .values((
                         archives::user_uuid.eq(user_uuid),

src/db/models/attachment.rs

@@ -82,16 +82,24 @@ impl Attachment {
 impl Attachment {
     pub async fn save(&self, conn: &DbConn) -> EmptyResult {
         db_run! { conn:
-            mysql {
+            sqlite, mysql {
-                diesel::insert_into(attachments::table)
+                match diesel::replace_into(attachments::table)
                     .values(self)
-                    .on_conflict(diesel::dsl::DuplicatedKeys)
-                    .do_update()
-                    .set(self)
                     .execute(conn)
-                    .map_res("Error saving attachment")
+                {
+                    Ok(_) => Ok(()),
+                    // Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
+                    Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
+                        diesel::update(attachments::table)
+                            .filter(attachments::id.eq(&self.id))
+                            .set(self)
+                            .execute(conn)
+                            .map_res("Error saving attachment")
+                    }
+                    Err(e) => Err(e.into()),
+                }.map_res("Error saving attachment")
             }
-            postgresql, sqlite {
+            postgresql {
                 diesel::insert_into(attachments::table)
                     .values(self)
                     .on_conflict(attachments::id)

src/db/models/auth_request.rs

@@ -82,23 +82,31 @@ impl AuthRequest {
 }
 
 impl AuthRequest {
-    pub async fn save(&self, conn: &DbConn) -> EmptyResult {
+    pub async fn save(&mut self, conn: &DbConn) -> EmptyResult {
         db_run! { conn:
-            mysql {
+            sqlite, mysql {
-                diesel::insert_into(auth_requests::table)
+                match diesel::replace_into(auth_requests::table)
-                    .values(self)
+                    .values(&*self)
-                    .on_conflict(diesel::dsl::DuplicatedKeys)
-                    .do_update()
-                    .set(self)
                     .execute(conn)
-                    .map_res("Error saving auth_request")
+                {
+                    Ok(_) => Ok(()),
+                    // Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
+                    Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
+                        diesel::update(auth_requests::table)
+                            .filter(auth_requests::uuid.eq(&self.uuid))
+                            .set(&*self)
+                            .execute(conn)
+                            .map_res("Error auth_request")
+                    }
+                    Err(e) => Err(e.into()),
+                }.map_res("Error auth_request")
             }
-            postgresql, sqlite {
+            postgresql {
                 diesel::insert_into(auth_requests::table)
-                    .values(self)
+                    .values(&*self)
                     .on_conflict(auth_requests::uuid)
                     .do_update()
-                    .set(self)
+                    .set(&*self)
                     .execute(conn)
                     .map_res("Error saving auth_request")
             }

src/db/models/cipher.rs

@@ -440,16 +440,24 @@ impl Cipher {
         self.updated_at = Utc::now().naive_utc();
 
         db_run! { conn:
-            mysql {
+            sqlite, mysql {
-                diesel::insert_into(ciphers::table)
+                match diesel::replace_into(ciphers::table)
                     .values(&*self)
-                    .on_conflict(diesel::dsl::DuplicatedKeys)
-                    .do_update()
-                    .set(&*self)
                     .execute(conn)
-                    .map_res("Error saving cipher")
+                {
+                    Ok(_) => Ok(()),
+                    // Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
+                    Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
+                        diesel::update(ciphers::table)
+                            .filter(ciphers::uuid.eq(&self.uuid))
+                            .set(&*self)
+                            .execute(conn)
+                            .map_res("Error saving cipher")
+                    }
+                    Err(e) => Err(e.into()),
+                }.map_res("Error saving cipher")
             }
-            postgresql, sqlite {
+            postgresql {
                 diesel::insert_into(ciphers::table)
                     .values(&*self)
                     .on_conflict(ciphers::uuid)

src/db/models/collection.rs

@@ -168,16 +168,24 @@ impl Collection {
         self.update_users_revision(conn).await;
 
         db_run! { conn:
-            mysql {
+            sqlite, mysql {
-                diesel::insert_into(collections::table)
+                match diesel::replace_into(collections::table)
                     .values(self)
-                    .on_conflict(diesel::dsl::DuplicatedKeys)
-                    .do_update()
-                    .set(self)
                     .execute(conn)
-                    .map_res("Error saving collection")
+                {
+                    Ok(_) => Ok(()),
+                    // Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
+                    Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
+                        diesel::update(collections::table)
+                            .filter(collections::uuid.eq(&self.uuid))
+                            .set(self)
+                            .execute(conn)
+                            .map_res("Error saving collection")
+                    }
+                    Err(e) => Err(e.into()),
+                }.map_res("Error saving collection")
             }
-            postgresql, sqlite {
+            postgresql {
                 diesel::insert_into(collections::table)
                     .values(self)
                     .on_conflict(collections::uuid)
@@ -720,30 +728,53 @@ impl CollectionUser {
     ) -> EmptyResult {
         User::update_uuid_revision(user_uuid, conn).await;
 
-        let values = (
-            users_collections::user_uuid.eq(user_uuid),
-            users_collections::collection_uuid.eq(collection_uuid),
-            users_collections::read_only.eq(read_only),
-            users_collections::hide_passwords.eq(hide_passwords),
-            users_collections::manage.eq(manage),
-        );
-
         db_run! { conn:
-            mysql {
+            sqlite, mysql {
-                diesel::insert_into(users_collections::table)
+                match diesel::replace_into(users_collections::table)
-                    .values(values)
+                    .values((
-                    .on_conflict(diesel::dsl::DuplicatedKeys)
+                        users_collections::user_uuid.eq(user_uuid),
-                    .do_update()
+                        users_collections::collection_uuid.eq(collection_uuid),
-                    .set(values)
+                        users_collections::read_only.eq(read_only),
+                        users_collections::hide_passwords.eq(hide_passwords),
+                        users_collections::manage.eq(manage),
+                    ))
                     .execute(conn)
-                    .map_res("Error adding user to collection")
+                {
+                    Ok(_) => Ok(()),
+                    // Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
+                    Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
+                        diesel::update(users_collections::table)
+                            .filter(users_collections::user_uuid.eq(user_uuid))
+                            .filter(users_collections::collection_uuid.eq(collection_uuid))
+                            .set((
+                                users_collections::user_uuid.eq(user_uuid),
+                                users_collections::collection_uuid.eq(collection_uuid),
+                                users_collections::read_only.eq(read_only),
+                                users_collections::hide_passwords.eq(hide_passwords),
+                                users_collections::manage.eq(manage),
+                            ))
+                            .execute(conn)
+                            .map_res("Error adding user to collection")
+                    }
+                    Err(e) => Err(e.into()),
+                }.map_res("Error adding user to collection")
             }
-            postgresql, sqlite {
+            postgresql {
                 diesel::insert_into(users_collections::table)
-                    .values(values)
+                    .values((
+                        users_collections::user_uuid.eq(user_uuid),
+                        users_collections::collection_uuid.eq(collection_uuid),
+                        users_collections::read_only.eq(read_only),
+                        users_collections::hide_passwords.eq(hide_passwords),
+                        users_collections::manage.eq(manage),
+                    ))
                     .on_conflict((users_collections::user_uuid, users_collections::collection_uuid))
                     .do_update()
-                    .set(values)
+                    .set((
+                        users_collections::read_only.eq(read_only),
+                        users_collections::hide_passwords.eq(hide_passwords),
+                        users_collections::manage.eq(manage),
+                    ))
                     .execute(conn)
                     .map_res("Error adding user to collection")
             }
@@ -878,18 +909,19 @@ impl CollectionCipher {
         Self::update_users_revision(collection_uuid, conn).await;
 
         db_run! { conn:
-            mysql {
+            sqlite, mysql {
-                diesel::insert_into(ciphers_collections::table)
+                // Not checking for ForeignKey Constraints here.
+                // Table ciphers_collections does not have ForeignKey Constraints which would cause conflicts.
+                // This table has no constraints pointing to itself, but only to others.
+                diesel::replace_into(ciphers_collections::table)
                     .values((
                         ciphers_collections::cipher_uuid.eq(cipher_uuid),
                         ciphers_collections::collection_uuid.eq(collection_uuid),
                     ))
-                    .on_conflict(diesel::dsl::DuplicatedKeys)
-                    .do_nothing()
                     .execute(conn)
                     .map_res("Error adding cipher to collection")
             }
-            postgresql, sqlite {
+            postgresql {
                 diesel::insert_into(ciphers_collections::table)
                     .values((
                         ciphers_collections::cipher_uuid.eq(cipher_uuid),

src/db/models/device.rs

@@ -146,18 +146,15 @@ impl Device {
         }
 
         db_run! { conn:
-            mysql {
+            sqlite, mysql {
                 crate::util::retry(||
-                    diesel::insert_into(devices::table)
+                    diesel::replace_into(devices::table)
                         .values(&*self)
-                        .on_conflict(diesel::dsl::DuplicatedKeys)
-                        .do_update()
-                        .set(&*self)
                         .execute(conn),
                     10,
                 ).map_res("Error saving device")
             }
-            postgresql, sqlite {
+            postgresql {
                 crate::util::retry(||
                     diesel::insert_into(devices::table)
                         .values(&*self)
@@ -269,22 +266,10 @@ impl Device {
         let devices = Self::find_by_user(user_uuid, conn).await;
         for mut device in devices {
             device.refresh_token = Device::generate_refresh_token();
-            device.twofactor_remember = None;
             device.save(false, conn).await?;
         }
         Ok(())
     }
-
-    pub async fn clear_twofactor_remember_by_user(user_uuid: &UserId, conn: &DbConn) -> EmptyResult {
-        conn.run(move |conn| {
-            diesel::update(devices::table)
-                .filter(devices::user_uuid.eq(user_uuid))
-                .set(devices::twofactor_remember.eq::<Option<String>>(None))
-                .execute(conn)
-                .map_res("Error removing two factor remember tokens")
-        })
-        .await
-    }
 }
 
 #[derive(Display)]

src/db/models/emergency_access.rs

@@ -146,16 +146,24 @@ impl EmergencyAccess {
         self.updated_at = Utc::now().naive_utc();
 
         db_run! { conn:
-            mysql {
+            sqlite, mysql {
-                diesel::insert_into(emergency_access::table)
+                match diesel::replace_into(emergency_access::table)
                     .values(&*self)
-                    .on_conflict(diesel::dsl::DuplicatedKeys)
-                    .do_update()
-                    .set(&*self)
                     .execute(conn)
-                    .map_res("Error saving emergency access")
+                {
+                    Ok(_) => Ok(()),
+                    // Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
+                    Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
+                        diesel::update(emergency_access::table)
+                            .filter(emergency_access::uuid.eq(&self.uuid))
+                            .set(&*self)
+                            .execute(conn)
+                            .map_res("Error updating emergency access")
+                    }
+                    Err(e) => Err(e.into()),
+                }.map_res("Error saving emergency access")
             }
-            postgresql, sqlite {
+            postgresql {
                 diesel::insert_into(emergency_access::table)
                     .values(&*self)
                     .on_conflict(emergency_access::uuid)

src/db/models/event.rs

@@ -43,7 +43,7 @@ pub struct Event {
     pub provider_org_uuid: Option<String>,
 }
 
-// Upstream enum: https://github.com/bitwarden/server/blob/v2026.6.2/src/Core/Dirt/Enums/EventType.cs
+// Upstream enum: https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Core/AdminConsole/Enums/EventType.cs
 #[derive(Debug, Copy, Clone)]
 pub enum EventType {
     // User
@@ -108,12 +108,6 @@ pub enum EventType {
     OrganizationUserRejectedAuthRequest = 1514,
     OrganizationUserDeleted = 1515, // Both user and organization user data were deleted
     OrganizationUserLeft = 1516,    // User voluntarily left the organization
-    // OrganizationUserAutomaticallyConfirmed = 1517,
-    // OrganizationUserSelfRevoked = 1518, // User self-revoked due to declining organization data ownership policy
-    OrganizationUserAdminResetTwoFactor = 1519,
-    // OrganizationUserRevoked_TwoFactorNonCompliance = 1520,
-    // OrganizationUserRevoked_SingleOrganizationNonCompliance = 1521,
-    // OrganizationUserNotificationBannerActionClicked = 1522,
 
     // Organization
     OrganizationUpdated = 1600,
@@ -208,23 +202,20 @@ impl Event {
     /// Basic Queries
     pub async fn save(&self, conn: &DbConn) -> EmptyResult {
         db_run! { conn:
-            mysql {
+            sqlite, mysql {
-                diesel::insert_into(event::table)
+                diesel::replace_into(event::table)
-                    .values(self)
+                .values(self)
-                    .on_conflict(diesel::dsl::DuplicatedKeys)
+                .execute(conn)
-                    .do_update()
+                .map_res("Error saving event")
-                    .set(self)
-                    .execute(conn)
-                    .map_res("Error saving event")
             }
-            postgresql, sqlite {
+            postgresql {
                 diesel::insert_into(event::table)
-                    .values(self)
+                .values(self)
-                    .on_conflict(event::uuid)
+                .on_conflict(event::uuid)
-                    .do_update()
+                .do_update()
-                    .set(self)
+                .set(self)
-                    .execute(conn)
+                .execute(conn)
-                    .map_res("Error saving event")
+                .map_res("Error saving event")
             }
         }
     }

src/db/models/folder.rs

@@ -77,16 +77,24 @@ impl Folder {
         self.updated_at = Utc::now().naive_utc();
 
         db_run! { conn:
-            mysql {
+            sqlite, mysql {
-                diesel::insert_into(folders::table)
+                match diesel::replace_into(folders::table)
                     .values(&*self)
-                    .on_conflict(diesel::dsl::DuplicatedKeys)
-                    .do_update()
-                    .set(&*self)
                     .execute(conn)
-                    .map_res("Error saving folder")
+                {
+                    Ok(_) => Ok(()),
+                    // Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
+                    Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
+                        diesel::update(folders::table)
+                            .filter(folders::uuid.eq(&self.uuid))
+                            .set(&*self)
+                            .execute(conn)
+                            .map_res("Error saving folder")
+                    }
+                    Err(e) => Err(e.into()),
+                }.map_res("Error saving folder")
             }
-            postgresql, sqlite {
+            postgresql {
                 diesel::insert_into(folders::table)
                     .values(&*self)
                     .on_conflict(folders::uuid)
@@ -139,15 +147,16 @@ impl Folder {
 impl FolderCipher {
     pub async fn save(&self, conn: &DbConn) -> EmptyResult {
         db_run! { conn:
-            mysql {
+            sqlite, mysql {
-                diesel::insert_into(folders_ciphers::table)
+                // Not checking for ForeignKey Constraints here.
+                // Table folders_ciphers does not have ForeignKey Constraints which would cause conflicts.
+                // This table has no constraints pointing to itself, but only to others.
+                diesel::replace_into(folders_ciphers::table)
                     .values(self)
-                    .on_conflict(diesel::dsl::DuplicatedKeys)
-                    .do_nothing()
                     .execute(conn)
                     .map_res("Error adding cipher to folder")
             }
-            postgresql, sqlite {
+            postgresql {
                 diesel::insert_into(folders_ciphers::table)
                     .values(self)
                     .on_conflict((folders_ciphers::cipher_uuid, folders_ciphers::folder_uuid))

src/db/models/group.rs

@@ -166,16 +166,24 @@ impl Group {
         self.revision_date = Utc::now().naive_utc();
 
         db_run! { conn:
-            mysql {
+            sqlite, mysql {
-                diesel::insert_into(groups::table)
+                match diesel::replace_into(groups::table)
                     .values(&*self)
-                    .on_conflict(diesel::dsl::DuplicatedKeys)
-                    .do_update()
-                    .set(&*self)
                     .execute(conn)
-                    .map_res("Error saving group")
+                {
+                    Ok(_) => Ok(()),
+                    // Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
+                    Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
+                        diesel::update(groups::table)
+                            .filter(groups::uuid.eq(&self.uuid))
+                            .set(&*self)
+                            .execute(conn)
+                            .map_res("Error saving group")
+                    }
+                    Err(e) => Err(e.into()),
+                }.map_res("Error saving group")
             }
-            postgresql, sqlite {
+            postgresql {
                 diesel::insert_into(groups::table)
                     .values(&*self)
                     .on_conflict(groups::uuid)
@@ -318,30 +326,53 @@ impl CollectionGroup {
             group_user.update_user_revision(conn).await;
         }
 
-        let values = (
-            collections_groups::collections_uuid.eq(&self.collections_uuid),
-            collections_groups::groups_uuid.eq(&self.groups_uuid),
-            collections_groups::read_only.eq(&self.read_only),
-            collections_groups::hide_passwords.eq(&self.hide_passwords),
-            collections_groups::manage.eq(&self.manage),
-        );
-
         db_run! { conn:
-            mysql {
+            sqlite, mysql {
-                diesel::insert_into(collections_groups::table)
+                match diesel::replace_into(collections_groups::table)
-                    .values(values)
+                    .values((
-                    .on_conflict(diesel::dsl::DuplicatedKeys)
+                        collections_groups::collections_uuid.eq(&self.collections_uuid),
-                    .do_update()
+                        collections_groups::groups_uuid.eq(&self.groups_uuid),
-                    .set(values)
+                        collections_groups::read_only.eq(&self.read_only),
+                        collections_groups::hide_passwords.eq(&self.hide_passwords),
+                        collections_groups::manage.eq(&self.manage),
+                    ))
                     .execute(conn)
-                    .map_res("Error adding group to collection")
+                {
+                    Ok(_) => Ok(()),
+                    // Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
+                    Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
+                        diesel::update(collections_groups::table)
+                            .filter(collections_groups::collections_uuid.eq(&self.collections_uuid))
+                            .filter(collections_groups::groups_uuid.eq(&self.groups_uuid))
+                            .set((
+                                collections_groups::collections_uuid.eq(&self.collections_uuid),
+                                collections_groups::groups_uuid.eq(&self.groups_uuid),
+                                collections_groups::read_only.eq(&self.read_only),
+                                collections_groups::hide_passwords.eq(&self.hide_passwords),
+                                collections_groups::manage.eq(&self.manage),
+                            ))
+                            .execute(conn)
+                            .map_res("Error adding group to collection")
+                    }
+                    Err(e) => Err(e.into()),
+                }.map_res("Error adding group to collection")
             }
-            postgresql, sqlite {
+            postgresql {
                 diesel::insert_into(collections_groups::table)
-                    .values(values)
+                    .values((
+                        collections_groups::collections_uuid.eq(&self.collections_uuid),
+                        collections_groups::groups_uuid.eq(&self.groups_uuid),
+                        collections_groups::read_only.eq(self.read_only),
+                        collections_groups::hide_passwords.eq(self.hide_passwords),
+                        collections_groups::manage.eq(self.manage),
+                    ))
                     .on_conflict((collections_groups::collections_uuid, collections_groups::groups_uuid))
                     .do_update()
-                    .set(values)
+                    .set((
+                        collections_groups::read_only.eq(self.read_only),
+                        collections_groups::hide_passwords.eq(self.hide_passwords),
+                        collections_groups::manage.eq(self.manage),
+                    ))
                     .execute(conn)
                     .map_res("Error adding group to collection")
             }
@@ -466,25 +497,43 @@ impl GroupUser {
     pub async fn save(&mut self, conn: &DbConn) -> EmptyResult {
         self.update_user_revision(conn).await;
 
-        let values = (
-            groups_users::users_organizations_uuid.eq(&self.users_organizations_uuid),
-            groups_users::groups_uuid.eq(&self.groups_uuid),
-        );
-
         db_run! { conn:
-            mysql {
+            sqlite, mysql {
-                diesel::insert_into(groups_users::table)
+                match diesel::replace_into(groups_users::table)
-                    .values(values)
+                    .values((
-                    .on_conflict(diesel::dsl::DuplicatedKeys)
+                        groups_users::users_organizations_uuid.eq(&self.users_organizations_uuid),
-                    .do_nothing()
+                        groups_users::groups_uuid.eq(&self.groups_uuid),
+                    ))
                     .execute(conn)
-                    .map_res("Error adding user to group")
+                {
+                    Ok(_) => Ok(()),
+                    // Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
+                    Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
+                        diesel::update(groups_users::table)
+                            .filter(groups_users::users_organizations_uuid.eq(&self.users_organizations_uuid))
+                            .filter(groups_users::groups_uuid.eq(&self.groups_uuid))
+                            .set((
+                                groups_users::users_organizations_uuid.eq(&self.users_organizations_uuid),
+                                groups_users::groups_uuid.eq(&self.groups_uuid),
+                            ))
+                            .execute(conn)
+                            .map_res("Error adding user to group")
+                    }
+                    Err(e) => Err(e.into()),
+                }.map_res("Error adding user to group")
             }
-            postgresql, sqlite {
+            postgresql {
                 diesel::insert_into(groups_users::table)
-                    .values(values)
+                    .values((
+                        groups_users::users_organizations_uuid.eq(&self.users_organizations_uuid),
+                        groups_users::groups_uuid.eq(&self.groups_uuid),
+                    ))
                     .on_conflict((groups_users::users_organizations_uuid, groups_users::groups_uuid))
-                    .do_nothing()
+                    .do_update()
+                    .set((
+                        groups_users::users_organizations_uuid.eq(&self.users_organizations_uuid),
+                        groups_users::groups_uuid.eq(&self.groups_uuid),
+                    ))
                     .execute(conn)
                     .map_res("Error adding user to group")
             }

src/db/models/org_policy.rs

@@ -318,13 +318,6 @@ impl OrgPolicy {
     }
 
     pub async fn org_is_reset_password_auto_enroll(org_uuid: &OrganizationId, conn: &DbConn) -> bool {
-        // Account recovery depends on outbound mail. When SMTP is disabled, treat the
-        // auto-enroll policy as inactive so invites/registration are not forced to
-        // supply a reset-password key (see check_reset_password_applicable).
-        if !CONFIG.mail_enabled() {
-            return false;
-        }
-
         match OrgPolicy::find_by_org_and_type(org_uuid, OrgPolicyType::ResetPassword, conn).await {
             Some(policy) => match serde_json::from_str::<ResetPasswordDataModel>(&policy.data) {
                 Ok(opts) => {

src/db/models/organization.rs

@@ -353,16 +353,25 @@ impl Organization {
         }
 
         db_run! { conn:
-            mysql {
+            sqlite, mysql {
-                diesel::insert_into(organizations::table)
+                match diesel::replace_into(organizations::table)
                     .values(self)
-                    .on_conflict(diesel::dsl::DuplicatedKeys)
-                    .do_update()
-                    .set(self)
                     .execute(conn)
-                    .map_res("Error saving organization")
+                {
+                    Ok(_) => Ok(()),
+                    // Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
+                    Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
+                        diesel::update(organizations::table)
+                            .filter(organizations::uuid.eq(&self.uuid))
+                            .set(self)
+                            .execute(conn)
+                            .map_res("Error saving organization")
+                    }
+                    Err(e) => Err(e.into()),
+                }.map_res("Error saving organization")
+
             }
-            postgresql, sqlite {
+            postgresql {
                 diesel::insert_into(organizations::table)
                     .values(self)
                     .on_conflict(organizations::uuid)
@@ -744,16 +753,24 @@ impl Membership {
         User::update_uuid_revision(&self.user_uuid, conn).await;
 
         db_run! { conn:
-            mysql {
+            sqlite, mysql {
-                diesel::insert_into(users_organizations::table)
+                match diesel::replace_into(users_organizations::table)
                     .values(self)
-                    .on_conflict(diesel::dsl::DuplicatedKeys)
-                    .do_update()
-                    .set(self)
                     .execute(conn)
-                    .map_res("Error adding user to organization")
+                {
+                    Ok(_) => Ok(()),
+                    // Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
+                    Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
+                        diesel::update(users_organizations::table)
+                            .filter(users_organizations::uuid.eq(&self.uuid))
+                            .set(self)
+                            .execute(conn)
+                            .map_res("Error adding user to organization")
+                    },
+                    Err(e) => Err(e.into()),
+                }.map_res("Error adding user to organization")
             }
-            postgresql, sqlite {
+            postgresql {
                 diesel::insert_into(users_organizations::table)
                     .values(self)
                     .on_conflict(users_organizations::uuid)
@@ -1169,16 +1186,25 @@ impl Membership {
 impl OrganizationApiKey {
     pub async fn save(&self, conn: &DbConn) -> EmptyResult {
         db_run! { conn:
-            mysql {
+            sqlite, mysql {
-                diesel::insert_into(organization_api_key::table)
+                match diesel::replace_into(organization_api_key::table)
                     .values(self)
-                    .on_conflict(diesel::dsl::DuplicatedKeys)
-                    .do_update()
-                    .set(self)
                     .execute(conn)
-                    .map_res("Error saving organization")
+                {
+                    Ok(_) => Ok(()),
+                    // Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
+                    Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
+                        diesel::update(organization_api_key::table)
+                            .filter(organization_api_key::uuid.eq(&self.uuid))
+                            .set(self)
+                            .execute(conn)
+                            .map_res("Error saving organization")
+                    }
+                    Err(e) => Err(e.into()),
+                }.map_res("Error saving organization")
+
             }
-            postgresql, sqlite {
+            postgresql {
                 diesel::insert_into(organization_api_key::table)
                     .values(self)
                     .on_conflict((organization_api_key::uuid, organization_api_key::org_uuid))

src/db/models/send.rs

@@ -202,16 +202,24 @@ impl Send {
         self.revision_date = Utc::now().naive_utc();
 
         db_run! { conn:
-            mysql {
+            sqlite, mysql {
-                diesel::insert_into(sends::table)
+                match diesel::replace_into(sends::table)
                     .values(&*self)
-                    .on_conflict(diesel::dsl::DuplicatedKeys)
-                    .do_update()
-                    .set(&*self)
                     .execute(conn)
-                    .map_res("Error saving send")
+                {
+                    Ok(_) => Ok(()),
+                    // Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
+                    Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
+                        diesel::update(sends::table)
+                            .filter(sends::uuid.eq(&self.uuid))
+                            .set(&*self)
+                            .execute(conn)
+                            .map_res("Error saving send")
+                    }
+                    Err(e) => Err(e.into()),
+                }.map_res("Error saving send")
             }
-            postgresql, sqlite {
+            postgresql {
                 diesel::insert_into(sends::table)
                     .values(&*self)
                     .on_conflict(sends::uuid)

src/db/models/user.rs

@@ -463,17 +463,15 @@ impl Invitation {
         }
 
         db_run! { conn:
-            // Not checking for ForeignKey Constraints here
+            sqlite, mysql {
-            // Table invitations does not have any ForeignKey Constraints.
+                // Not checking for ForeignKey Constraints here
-            mysql {
+                // Table invitations does not have any ForeignKey Constraints.
-                diesel::insert_into(invitations::table)
+                diesel::replace_into(invitations::table)
                     .values(self)
-                    .on_conflict(diesel::dsl::DuplicatedKeys)
-                    .do_nothing()
                     .execute(conn)
                     .map_res("Error saving invitation")
             }
-            postgresql, sqlite {
+            postgresql {
                 diesel::insert_into(invitations::table)
                     .values(self)
                     .on_conflict(invitations::email)
@@ -530,13 +528,13 @@ pub struct UserId(String);
 impl SsoUser {
     pub async fn save(&self, conn: &DbConn) -> EmptyResult {
         db_run! { conn:
-            mysql {
+            sqlite, mysql {
-                diesel::insert_into(sso_users::table)
+                diesel::replace_into(sso_users::table)
                     .values(self)
                     .execute(conn)
                     .map_res("Error saving SSO user")
             }
-            postgresql, sqlite {
+            postgresql {
                 diesel::insert_into(sso_users::table)
                     .values(self)
                     .execute(conn)

src/http_client.rs

@@ -14,10 +14,7 @@ use reqwest::{
 };
 use url::Host;
 
-use crate::{
+use crate::{CONFIG, util::is_global};
-    CONFIG,
-    util::{get_env_bool, is_global},
-};
 
 pub fn make_http_request(method: reqwest::Method, url: &str) -> Result<reqwest::RequestBuilder, crate::Error> {
     static INSTANCE: LazyLock<Client> =
@@ -39,7 +36,7 @@ pub fn get_reqwest_client_builder(enforce_block: bool) -> ClientBuilder {
     let mut headers = header::HeaderMap::new();
     headers.insert(header::USER_AGENT, header::HeaderValue::from_static("Vaultwarden"));
 
-    let redirect_policy = reqwest::redirect::Policy::custom(move |attempt| {
+    let redirect_policy = reqwest::redirect::Policy::custom(|attempt| {
         if attempt.previous().len() >= 5 {
             return attempt.error("Too many redirects");
         }
@@ -48,7 +45,7 @@ pub fn get_reqwest_client_builder(enforce_block: bool) -> ClientBuilder {
             return attempt.error("Invalid host");
         };
 
-        if enforce_block && let Err(e) = should_block_host(&host) {
+        if let Err(e) = should_block_host(&host) {
             return attempt.error(e);
         }
 
@@ -62,14 +59,6 @@ pub fn get_reqwest_client_builder(enforce_block: bool) -> ClientBuilder {
         .timeout(Duration::from_secs(10))
 }
 
-fn dns_prefer_ipv6() -> bool {
-    // CONFIG may require DNS to initialize, so avoid forcing it during bootstrap.
-    match LazyLock::get(&CONFIG) {
-        Some(config) => config.dns_prefer_ipv6(),
-        None => get_env_bool("DNS_PREFER_IPV6").unwrap_or(false),
-    }
-}
-
 fn should_block_ip(ip: IpAddr) -> bool {
     if !CONFIG.http_request_block_non_global_ips() {
         return false;
@@ -269,8 +258,12 @@ impl CustomDnsResolver {
     fn new() -> Arc<Self> {
         TokioResolver::builder(TokioRuntimeProvider::default())
             .and_then(|mut builder| {
-                // Query both families; the preferred order is applied per lookup below.
+                // Hickory's default since v0.26 is `Ipv6AndIpv4`, which sorts IPv6 first
-                builder.options_mut().ip_strategy = hickory_resolver::config::LookupIpStrategy::Ipv4AndIpv6;
+                // This might cause issues on IPv4 only systems or containers
+                // Unless someone enabled DNS_PREFER_IPV6, use Ipv4AndIpv6, which returns IPv4 first which was our previous default
+                if !CONFIG.dns_prefer_ipv6() {
+                    builder.options_mut().ip_strategy = hickory_resolver::config::LookupIpStrategy::Ipv4AndIpv6;
+                }
                 builder.build()
             })
             .inspect_err(|e| warn!("Error creating Hickory resolver, falling back to default: {e:?}"))
@@ -296,17 +289,6 @@ impl CustomDnsResolver {
     }
 }
 
-fn sort_addresses(addresses: &mut [SocketAddr], prefer_ipv6: bool) {
-    // `sort_by_key` orders `false` before `true`.
-    // When IPv6 is preferred, IPv6 addresses return `false` for `is_ipv4()` and sort first.
-    // When IPv4 is preferred, IPv4 addresses return `false` for `is_ipv6()` and sort first.
-    if prefer_ipv6 {
-        addresses.sort_by_key(SocketAddr::is_ipv4);
-    } else {
-        addresses.sort_by_key(SocketAddr::is_ipv6);
-    }
-}
-
 fn pre_resolve(name: &str, enforce_block: bool) -> Result<(), CustomHttpClientError> {
     let Ok(host) = get_valid_host(name) else {
         return Err(CustomHttpClientError::Invalid {
@@ -338,9 +320,7 @@ impl Resolve for CustomDns {
         let this = Arc::clone(&self.resolver);
         Box::pin(async move {
             let name = name.as_str();
-            let mut results = this.resolve_domain(name, enforce_block).await?;
+            let results = this.resolve_domain(name, enforce_block).await?;
-            // Recheck after bootstrap so long-lived clients adopt the loaded config.
-            sort_addresses(&mut results, dns_prefer_ipv6());
             if results.is_empty() {
                 warn!("Unable to resolve {name} to any valid IP address");
             }
@@ -359,29 +339,10 @@ pub(crate) mod aws {
     };
     use reqwest::Client;
 
-    use super::get_reqwest_client_builder;
-
     // Adapter that wraps reqwest to be compatible with the AWS SDK
     #[derive(Debug)]
     pub(crate) struct AwsReqwestConnector {
-        client: Client,
+        pub(crate) client: Client,
-    }
-
-    impl AwsReqwestConnector {
-        pub(crate) fn new() -> Self {
-            let client = get_reqwest_client_builder(false).build().expect("Failed to build AWS HTTP client");
-            Self {
-                client,
-            }
-        }
-    }
-
-    fn connector_error(error: reqwest::Error) -> ConnectorError {
-        if error.is_timeout() {
-            ConnectorError::timeout(Box::new(error))
-        } else {
-            ConnectorError::io(Box::new(error))
-        }
     }
 
     impl HttpConnector for AwsReqwestConnector {
@@ -401,10 +362,10 @@ pub(crate) mod aws {
                     req_builder = req_builder.body(body_bytes.to_vec());
                 }
 
-                let response = req_builder.send().await.map_err(connector_error)?;
+                let response = req_builder.send().await.map_err(|e| ConnectorError::io(Box::new(e)))?;
 
                 let status = response.status().into();
-                let bytes = response.bytes().await.map_err(connector_error)?;
+                let bytes = response.bytes().await.map_err(|e| ConnectorError::io(Box::new(e)))?;
 
                 Ok(HttpResponse::new(status, bytes.into()))
             };
@@ -430,7 +391,7 @@ pub(crate) mod aws {
 mod tests {
     use super::*;
     use crate::util::is_global_hardcoded;
-    use std::net::{Ipv4Addr, Ipv6Addr};
+    use std::net::Ipv4Addr;
     use url::Host;
 
     // ===
@@ -443,26 +404,6 @@ mod tests {
         }
     }
 
-    #[test]
-    fn dns_setup_does_not_initialize_config() {
-        assert!(LazyLock::get(&CONFIG).is_none());
-        drop(CustomDns::instance(false));
-        assert!(LazyLock::get(&CONFIG).is_none());
-    }
-
-    #[test]
-    fn dns_preference_orders_addresses() {
-        let ipv4 = SocketAddr::new(IpAddr::V4(Ipv4Addr::LOCALHOST), 0);
-        let ipv6 = SocketAddr::new(IpAddr::V6(Ipv6Addr::LOCALHOST), 0);
-        let mut addresses = [ipv6, ipv4];
-
-        sort_addresses(&mut addresses, false);
-        assert_eq!(addresses, [ipv4, ipv6]);
-
-        sort_addresses(&mut addresses, true);
-        assert_eq!(addresses, [ipv6, ipv4]);
-    }
-
     #[test]
     fn dotted_decimal_loopback_normalizes() {
         let ip = parse_to_ip("127.0.0.1").unwrap();

src/mail.rs

@@ -633,24 +633,14 @@ pub async fn send_test(address: &str) -> EmptyResult {
     send_email(address, &subject, body_html, body_text).await
 }
 
-pub async fn send_admin_account_recovery(
+pub async fn send_admin_reset_password(address: &str, user_name: &str, org_name: &str) -> EmptyResult {
-    address: &str,
-    user_name: &str,
-    org_name: &str,
-    reset_password: bool,
-    reset_2fa: bool,
-    fallback_2fa_email: bool,
-) -> EmptyResult {
     let (subject, body_html, body_text) = get_text(
-        "email/admin_account_recovery",
+        "email/admin_reset_password",
         json!({
             "url": CONFIG.domain(),
             "img_src": CONFIG._smtp_img_src(),
             "user_name": user_name,
             "org_name": org_name,
-            "reset_password": reset_password,
-            "reset_2fa": reset_2fa,
-            "fallback_2fa_email": fallback_2fa_email,
         }),
     )?;
     send_email(address, &subject, body_html, body_text).await

src/main.rs

@@ -137,7 +137,9 @@ fn parse_args() {
 
     if let Some(command) = pargs.subcommand().unwrap_or_default() {
         if command == "hash" {
-            use argon2::{Algorithm::Argon2id, Argon2, ParamsBuilder, PasswordHasher, Version::V0x13};
+            use argon2::{
+                Algorithm::Argon2id, Argon2, ParamsBuilder, PasswordHasher, Version::V0x13, password_hash::SaltString,
+            };
 
             let mut argon2_params = ParamsBuilder::new();
             let preset: Option<String> = pargs.opt_value_from_str(["-p", "--preset"]).unwrap_or_default();
@@ -170,10 +172,10 @@ fn parse_args() {
             }
 
             let argon2 = Argon2::new(Argon2id, V0x13, argon2_params.build().unwrap());
-            let salt = crypto::get_random_bytes::<32>();
+            let salt = SaltString::encode_b64(&crypto::get_random_bytes::<32>()).unwrap();
 
             let argon2_timer = tokio::time::Instant::now();
-            if let Ok(password_hash) = argon2.hash_password_with_salt(password.as_bytes(), &salt) {
+            if let Ok(password_hash) = argon2.hash_password(password.as_bytes(), &salt) {
                 println!(
                     "\n\
                     ADMIN_TOKEN='{password_hash}'\n\n\

src/static/scripts/admin_organizations.js

@@ -1,5 +1,5 @@
 "use strict";
-/* global DataTable, _post:readable, BASE_URL:readable, reload:readable, jdenticon:readable */
+/* global jQuery, _post:readable, BASE_URL:readable, reload:readable, jdenticon:readable */
 
 function deleteOrganization(event) {
     event.preventDefault();
@@ -41,9 +41,8 @@ function initActions() {
 
 // onLoad events
 document.addEventListener("DOMContentLoaded", (/*event*/) => {
-    const columnCount = document.getElementById("orgs-table").querySelectorAll("thead th").length;
+    jQuery("#orgs-table").DataTable({
-    new DataTable("#orgs-table", {
+        "drawCallback": function() {
-        "drawCallback": function () {
             initActions();
         },
         "stateSave": true,
@@ -54,7 +53,7 @@ document.addEventListener("DOMContentLoaded", (/*event*/) => {
         ],
         "pageLength": -1, // Default show all
         "columnDefs": [{
-            "targets": [columnCount - 2, columnCount - 1], // Do not include the last two columns into the search/order features
+            "targets": [4,5],
             "searchable": false,
             "orderable": false
         }]
@@ -67,4 +66,4 @@ document.addEventListener("DOMContentLoaded", (/*event*/) => {
     if (btnReload) {
         btnReload.addEventListener("click", reload);
     }
-});
+});

src/static/scripts/admin_users.js

@@ -1,5 +1,5 @@
 "use strict";
-/* global DataTable, _post:readable, _delete:readable, BASE_URL:readable, reload:readable, jdenticon:readable */
+/* global jQuery, _post:readable, _delete:readable, BASE_URL:readable, reload:readable, jdenticon:readable */
 
 function deleteUser(event) {
     event.preventDefault();
@@ -141,7 +141,7 @@ function inviteUser(event) {
     );
 }
 
-function resendUserInvite(event) {
+function resendUserInvite (event) {
     event.preventDefault();
     event.stopPropagation();
     const id = event.target.parentNode.dataset.vwUserUuid;
@@ -179,9 +179,37 @@ const ORG_TYPES = {
     },
 };
 
+// Special sort function to sort dates in ISO format
+jQuery.extend(jQuery.fn.dataTableExt.oSort, {
+    "date-iso-pre": function(a) {
+        let x;
+        const sortDate = a.replace(/(<([^>]+)>)/gi, "").trim();
+        if (sortDate !== "") {
+            const dtParts = sortDate.split(" ");
+            const timeParts = (undefined != dtParts[1]) ? dtParts[1].split(":") : ["00", "00", "00"];
+            const dateParts = dtParts[0].split("-");
+            x = (dateParts[0] + dateParts[1] + dateParts[2] + timeParts[0] + timeParts[1] + ((undefined != timeParts[2]) ? timeParts[2] : 0)) * 1;
+            if (isNaN(x)) {
+                x = 0;
+            }
+        } else {
+            x = Infinity;
+        }
+        return x;
+    },
+
+    "date-iso-asc": function(a, b) {
+        return a - b;
+    },
+
+    "date-iso-desc": function(a, b) {
+        return b - a;
+    }
+});
+
 const userOrgTypeDialog = document.getElementById("userOrgTypeDialog");
 // Fill the form and title
-userOrgTypeDialog.addEventListener("show.bs.modal", function (event) {
+userOrgTypeDialog.addEventListener("show.bs.modal", function(event) {
     // Get shared values
     const userEmail = event.relatedTarget.parentNode.dataset.vwUserEmail;
     const userUuid = event.relatedTarget.parentNode.dataset.vwUserUuid;
@@ -199,7 +227,7 @@ userOrgTypeDialog.addEventListener("show.bs.modal", function (event) {
 }, false);
 
 // Prevent accidental submission of the form with valid elements after the modal has been hidden.
-userOrgTypeDialog.addEventListener("hide.bs.modal", function () {
+userOrgTypeDialog.addEventListener("hide.bs.modal", function() {
     document.getElementById("userOrgTypeDialogOrgName").textContent = "";
     document.getElementById("userOrgTypeDialogUserEmail").textContent = "";
     document.getElementById("userOrgTypeUserUuid").value = "";
@@ -221,7 +249,7 @@ function updateUserOrgType(event) {
 
 function initUserTable() {
     // Color all the org buttons per type
-    document.querySelectorAll("button[data-vw-org-type]").forEach(function (e) {
+    document.querySelectorAll("button[data-vw-org-type]").forEach(function(e) {
         const orgType = ORG_TYPES[e.dataset.vwOrgType];
         e.style.backgroundColor = orgType.bg;
         if (orgType.font !== undefined) {
@@ -257,37 +285,12 @@ function initUserTable() {
     }
 }
 
-// Special sort function to sort dates in ISO format and have anything else as 0
-DataTable.ext.type.order["date-iso-pre"] = function (a) {
-    let x;
-    const sortDate = a.replace(/(<([^>]+)>)/gi, "").trim();
-    if (sortDate !== "") {
-        const dtParts = sortDate.split(" ");
-        const timeParts = (undefined != dtParts[1]) ? dtParts[1].split(":") : ["00", "00", "00"];
-        const dateParts = dtParts[0].split("-");
-        x = (dateParts[0] + dateParts[1] + dateParts[2] + timeParts[0] + timeParts[1] + ((undefined != timeParts[2]) ? timeParts[2] : 0)) * 1;
-        if (isNaN(x)) {
-            x = 0;
-        }
-    } else {
-        x = Infinity;
-    }
-    return x;
-};
-
 // onLoad events
 document.addEventListener("DOMContentLoaded", (/*event*/) => {
-    DataTable.ext.type.detect.unshift(function (data) {
+    const size = jQuery("#users-table > thead th").length;
-        if (typeof data !== "string") { return null; }
+    const ssoOffset = size-7;
-        return data.indexOf("data-sort-type=\"date-iso\"") !== -1
+    jQuery("#users-table").DataTable({
-            ? "date-iso"
+        "drawCallback": function() {
-            : null;
-    });
-
-    const columnCount = document.getElementById("users-table").querySelectorAll("thead th").length;
-    new DataTable("#users-table", {
-        "typeDetect": true,
-        "drawCallback": function () {
             initUserTable();
         },
         "stateSave": true,
@@ -298,7 +301,10 @@ document.addEventListener("DOMContentLoaded", (/*event*/) => {
         ],
         "pageLength": -1, // Default show all
         "columnDefs": [{
-            "targets": columnCount - 1, // Do not include the last column into the search/order features
+            "targets": [1 + ssoOffset, 2 + ssoOffset],
+            "type": "date-iso"
+        }, {
+            "targets": size-1,
             "searchable": false,
             "orderable": false
         }]

src/static/scripts/datatables.css

@@ -4,32 +4,25 @@
  *
  * To rebuild or modify this file with the latest versions of the included
  * software please visit:
- *   https://datatables.net/download/#bs5/dt-3.0.3
+ *   https://datatables.net/download/#bs5/dt-2.3.8
  *
  * Included libraries:
- *   DataTables 3.0.3
+ *   DataTables 2.3.8
  */
 
-/*! DataTables Bootstrap 5 integration
- * © SpryMedia Ltd - datatables.net/license
- */
 :root {
-  --dt_background-selected: 13, 110, 253;
+  --dt-row-selected: 13, 110, 253;
-  --dt_color-selected: 255, 255, 255;
+  --dt-row-selected-text: 255, 255, 255;
-  --dt_link_color-selected: 228, 228, 228;
+  --dt-row-selected-link: 228, 228, 228;
-  --dt-row_background: transparent;
+  --dt-row-stripe: 0, 0, 0;
-  --dt-row_background-selected: var(--dt_background-selected);
+  --dt-row-hover: 0, 0, 0;
-  --dt-row-text_color-selected: var(--dt_color-selected);
+  --dt-column-ordering: 0, 0, 0;
-  --dt-row-link_color-selected: var(--dt_link_color-selected);
+  --dt-header-align-items: center;
-  --dt-row_background-stripe: 0, 0, 0;
+  --dt-header-vertical-align: middle;
-  --dt-row_background-hover: 0, 0, 0;
+  --dt-html-background: white;
-  --dt-column-ordering_background: 0, 0, 0;
-  --dt-header-cell_align-items: center;
-  --dt-header-cell_vertical-align: middle;
-  --dt-html_background: white;
 }
 :root.dark {
-  --dt-html_background: rgb(33, 37, 41);
+  --dt-html-background: rgb(33, 37, 41);
 }
 
 table.dataTable tbody td.dt-control {
@@ -51,13 +44,16 @@ table.dataTable tbody tr.dt-hasChild td.dt-control:before {
   border-bottom: 0px solid transparent;
   border-right: 5px solid transparent;
 }
+table.dataTable tfoot:empty {
+  display: none;
+}
 
-:root.dark table.dataTable td.dt-control:before,
+html.dark table.dataTable td.dt-control:before,
 :root[data-bs-theme=dark] table.dataTable td.dt-control:before,
 :root[data-theme=dark] table.dataTable td.dt-control:before {
   border-left-color: rgba(255, 255, 255, 0.5);
 }
-:root.dark table.dataTable tr.dt-hasChild td.dt-control:before,
+html.dark table.dataTable tr.dt-hasChild td.dt-control:before,
 :root[data-bs-theme=dark] table.dataTable tr.dt-hasChild td.dt-control:before,
 :root[data-theme=dark] table.dataTable tr.dt-hasChild td.dt-control:before {
   border-top-color: rgba(255, 255, 255, 0.5);
@@ -88,25 +84,6 @@ div.dt-scroll-body tfoot tr td div.dt-scroll-sizing {
   overflow: hidden !important;
 }
 
-/*! DataTables Bootstrap 5 integration
- * © SpryMedia Ltd - datatables.net/license
- */
-:root {
-  --dt-order-arrow_color: rgb(51, 51, 51);
-  --dt-order-arrow_color-current: rgb(51, 51, 51);
-  --dt-order-arrow-height: 7px;
-  --dt-order-arrow_opacity: 0.125;
-  --dt-order-arrow_opacity-current: 0.65;
-  --dt-order-arrow-width: 8px;
-  --dt-order-arrow-gap: 1px;
-  --dt-order-header_outline-hover: 2px solid rgba(0, 0, 0, 0.05);
-}
-:root.dark, :root[data-bs-theme=dark], :root[data-theme=dark] {
-  --dt-order-arrow_color: rgb(229, 233, 238);
-  --dt-order-arrow_color-current: rgb(229, 233, 238);
-  --dt-order-header_outline-hover: 2px solid rgba(255, 255, 255, 0.05);
-}
-
 table.dataTable thead > tr > th:active,
 table.dataTable thead > tr > td:active {
   outline: none;
@@ -114,18 +91,20 @@ table.dataTable thead > tr > td:active {
 table.dataTable thead > tr > th.dt-orderable-asc .dt-column-order:before, table.dataTable thead > tr > th.dt-ordering-asc .dt-column-order:before,
 table.dataTable thead > tr > td.dt-orderable-asc .dt-column-order:before,
 table.dataTable thead > tr > td.dt-ordering-asc .dt-column-order:before {
-  bottom: calc(50% + var(--dt-order-arrow-gap));
+  position: absolute;
-  border-bottom: var(--dt-order-arrow-height) solid var(--dt-order-arrow_color);
+  display: block;
-  border-left: calc(var(--dt-order-arrow-width) / 2) solid transparent;
+  bottom: 50%;
-  border-right: calc(var(--dt-order-arrow-width) / 2) solid transparent;
+  content: "\25B2";
+  content: "\25B2"/"";
 }
 table.dataTable thead > tr > th.dt-orderable-desc .dt-column-order:after, table.dataTable thead > tr > th.dt-ordering-desc .dt-column-order:after,
 table.dataTable thead > tr > td.dt-orderable-desc .dt-column-order:after,
 table.dataTable thead > tr > td.dt-ordering-desc .dt-column-order:after {
-  top: calc(50% + 1px);
+  position: absolute;
-  border-top: var(--dt-order-arrow-height) solid var(--dt-order-arrow_color);
+  display: block;
-  border-left: calc(var(--dt-order-arrow-width) / 2) solid transparent;
+  top: 50%;
-  border-right: calc(var(--dt-order-arrow-width) / 2) solid transparent;
+  content: "\25BC";
+  content: "\25BC"/"";
 }
 table.dataTable thead > tr > th.dt-orderable-asc .dt-column-order, table.dataTable thead > tr > th.dt-orderable-desc .dt-column-order, table.dataTable thead > tr > th.dt-ordering-asc .dt-column-order, table.dataTable thead > tr > th.dt-ordering-desc .dt-column-order,
 table.dataTable thead > tr > td.dt-orderable-asc .dt-column-order,
@@ -133,8 +112,8 @@ table.dataTable thead > tr > td.dt-orderable-desc .dt-column-order,
 table.dataTable thead > tr > td.dt-ordering-asc .dt-column-order,
 table.dataTable thead > tr > td.dt-ordering-desc .dt-column-order {
   position: relative;
-  width: var(--dt-order-arrow-width);
+  width: 12px;
-  align-self: stretch;
+  height: 20px;
 }
 table.dataTable thead > tr > th.dt-orderable-asc .dt-column-order:before, table.dataTable thead > tr > th.dt-orderable-asc .dt-column-order:after, table.dataTable thead > tr > th.dt-orderable-desc .dt-column-order:before, table.dataTable thead > tr > th.dt-orderable-desc .dt-column-order:after, table.dataTable thead > tr > th.dt-ordering-asc .dt-column-order:before, table.dataTable thead > tr > th.dt-ordering-asc .dt-column-order:after, table.dataTable thead > tr > th.dt-ordering-desc .dt-column-order:before, table.dataTable thead > tr > th.dt-ordering-desc .dt-column-order:after,
 table.dataTable thead > tr > td.dt-orderable-asc .dt-column-order:before,
@@ -145,14 +124,10 @@ table.dataTable thead > tr > td.dt-ordering-asc .dt-column-order:before,
 table.dataTable thead > tr > td.dt-ordering-asc .dt-column-order:after,
 table.dataTable thead > tr > td.dt-ordering-desc .dt-column-order:before,
 table.dataTable thead > tr > td.dt-ordering-desc .dt-column-order:after {
-  position: absolute;
-  display: block;
-  content: " ";
-  height: 0;
-  width: 0;
   left: 0;
-  color: var(--dt-order-arrow_color);
+  opacity: 0.125;
-  opacity: var(--dt-order-arrow_opacity);
+  line-height: 9px;
+  font-size: 0.8em;
 }
 table.dataTable thead > tr > th.dt-orderable-asc, table.dataTable thead > tr > th.dt-orderable-desc,
 table.dataTable thead > tr > td.dt-orderable-asc,
@@ -162,18 +137,13 @@ table.dataTable thead > tr > td.dt-orderable-desc {
 table.dataTable thead > tr > th.dt-orderable-asc:hover, table.dataTable thead > tr > th.dt-orderable-desc:hover,
 table.dataTable thead > tr > td.dt-orderable-asc:hover,
 table.dataTable thead > tr > td.dt-orderable-desc:hover {
-  outline: var(--dt-order-header_outline-hover);
+  outline: 2px solid rgba(0, 0, 0, 0.05);
   outline-offset: -2px;
 }
-table.dataTable thead > tr > th.dt-ordering-asc .dt-column-order:before,
+table.dataTable thead > tr > th.dt-ordering-asc .dt-column-order:before, table.dataTable thead > tr > th.dt-ordering-desc .dt-column-order:after,
-table.dataTable thead > tr > td.dt-ordering-asc .dt-column-order:before {
+table.dataTable thead > tr > td.dt-ordering-asc .dt-column-order:before,
-  border-bottom-color: var(--dt-order-arrow_color-current);
-  opacity: var(--dt-order-arrow_opacity-current);
-}
-table.dataTable thead > tr > th.dt-ordering-desc .dt-column-order:after,
 table.dataTable thead > tr > td.dt-ordering-desc .dt-column-order:after {
-  border-top-color: var(--dt-order-arrow_color-current);
+  opacity: 0.6;
-  opacity: var(--dt-order-arrow_opacity-current);
 }
 table.dataTable thead > tr > th.dt-orderable-none:not(.dt-ordering-asc, .dt-ordering-desc) .dt-column-order:empty, table.dataTable thead > tr > th.sorting_desc_disabled .dt-column-order:after, table.dataTable thead > tr > th.sorting_asc_disabled .dt-column-order:before,
 table.dataTable thead > tr > td.dt-orderable-none:not(.dt-ordering-asc, .dt-ordering-desc) .dt-column-order:empty,
@@ -196,7 +166,7 @@ table.dataTable tfoot > tr > td div.dt-column-header,
 table.dataTable tfoot > tr > td div.dt-column-footer {
   display: flex;
   justify-content: space-between;
-  align-items: var(--dt-header-cell_align-items);
+  align-items: var(--dt-header-align-items);
   gap: 4px;
 }
 table.dataTable thead > tr > th div.dt-column-header .dt-column-title,
@@ -232,14 +202,7 @@ div.dt-scroll-body > table.dataTable > thead > tr > td {
 :root[data-bs-theme=dark] table.dataTable thead > tr > th.dt-orderable-desc:hover,
 :root[data-bs-theme=dark] table.dataTable thead > tr > td.dt-orderable-asc:hover,
 :root[data-bs-theme=dark] table.dataTable thead > tr > td.dt-orderable-desc:hover {
-  outline: var(--dt-order-header_outline-hover);
+  outline: 2px solid rgba(255, 255, 255, 0.05);
-}
-
-/*! DataTables Bootstrap 5 integration
- * © SpryMedia Ltd - datatables.net/license
- */
-:root {
-  --dt-processing-circle_background: var(--dt_background-selected);
 }
 
 div.dt-processing {
@@ -265,7 +228,8 @@ div.dt-processing > div:last-child > div {
   width: 13px;
   height: 13px;
   border-radius: 50%;
-  background: rgb(var(--dt-processing-circle_background));
+  background: rgb(13, 110, 253);
+  background: rgb(var(--dt-row-selected));
   animation-timing-function: cubic-bezier(0, 1, 1, 0);
 }
 div.dt-processing > div:last-child > div:nth-child(1) {
@@ -378,7 +342,7 @@ table.dataTable thead td,
 table.dataTable tfoot th,
 table.dataTable tfoot td {
   text-align: left;
-  vertical-align: var(--dt-header-cell_vertical-align);
+  vertical-align: var(--dt-header-vertical-align);
 }
 table.dataTable thead th.dt-head-left,
 table.dataTable thead td.dt-head-left,
@@ -461,16 +425,11 @@ table.dataTable tbody td.dt-body-nowrap {
   white-space: nowrap;
 }
 
-:root {
+/*! Bootstrap 5 integration for DataTables
-  --dt_background-selected: 13, 110, 253;
+ *
-}
+ * ©2020 SpryMedia Ltd, all rights reserved.
-
+ * License: MIT datatables.net/license/mit
-:root[data-bs-theme=dark] {
+ */
-  --dt-row_background-hover: 255, 255, 255;
-  --dt-row_background-stripe: 255, 255, 255;
-  --dt-column-ordering_background: 255, 255, 255;
-}
-
 table.table.dataTable {
   clear: both;
   margin-bottom: 0;
@@ -484,26 +443,31 @@ table.table.dataTable > :not(caption) > * > * {
   background-color: var(--bs-table-bg);
 }
 table.table.dataTable > tbody > tr {
-  background-color: var(--dt-row_background);
+  background-color: transparent;
 }
 table.table.dataTable > tbody > tr.selected > * {
-  box-shadow: inset 0 0 0 9999px rgb(var(--dt-row_background-selected));
+  box-shadow: inset 0 0 0 9999px rgb(13, 110, 253);
-  color: rgb(var(--dt-row-text_color-selected));
+  box-shadow: inset 0 0 0 9999px rgb(var(--dt-row-selected));
+  color: rgb(255, 255, 255);
+  color: rgb(var(--dt-row-selected-text));
 }
 table.table.dataTable > tbody > tr.selected a {
-  color: rgb(var(--dt-row-link_color-selected));
+  color: rgb(228, 228, 228);
+  color: rgb(var(--dt-row-selected-link));
 }
 table.table.dataTable.table-striped > tbody > tr:nth-of-type(2n+1) > * {
-  box-shadow: inset 0 0 0 9999px rgba(var(--dt-row_background-stripe), 0.05);
+  box-shadow: inset 0 0 0 9999px rgba(var(--dt-row-stripe), 0.05);
 }
 table.table.dataTable.table-striped > tbody > tr:nth-of-type(2n+1).selected > * {
-  box-shadow: inset 0 0 0 9999px rgba(var(--dt-row_background-selected), 0.95);
+  box-shadow: inset 0 0 0 9999px rgba(13, 110, 253, 0.95);
+  box-shadow: inset 0 0 0 9999px rgba(var(--dt-row-selected), 0.95);
 }
 table.table.dataTable.table-hover > tbody > tr:hover > * {
-  box-shadow: inset 0 0 0 9999px rgba(var(--dt-row_background-hover), 0.075);
+  box-shadow: inset 0 0 0 9999px rgba(var(--dt-row-hover), 0.075);
 }
 table.table.dataTable.table-hover > tbody > tr.selected:hover > * {
-  box-shadow: inset 0 0 0 9999px rgba(var(--dt-row_background-selected), 0.975);
+  box-shadow: inset 0 0 0 9999px rgba(13, 110, 253, 0.975);
+  box-shadow: inset 0 0 0 9999px rgba(var(--dt-row-selected), 0.975);
 }
 
 div.dt-container div.dt-layout-start > *:not(:last-child) {
@@ -652,4 +616,10 @@ div.table-responsive > div.dt-container > div.row > div[class^=col-]:last-child
   padding-right: 0;
 }
 
+:root[data-bs-theme=dark] {
+  --dt-row-hover: 255, 255, 255;
+  --dt-row-stripe: 255, 255, 255;
+  --dt-column-ordering: 255, 255, 255;
+}
+
 

src/static/templates/admin/organizations.hbs

@@ -10,7 +10,7 @@
                         <th class="vw-entries">Entries</th>
                         <th class="vw-attachments">Attachments</th>
                         <th class="vw-misc">Misc</th>
-                        <th class="vw-actions text-end">Actions</th>
+                        <th class="vw-actions">Actions</th>
                     </tr>
                 </thead>
                 <tbody>
@@ -59,6 +59,7 @@
 </main>
 
 <link rel="stylesheet" href="{{urlpath}}/vw_static/datatables.css" />
+<script src="{{urlpath}}/vw_static/jquery-4.0.0.slim.js"></script>
 <script src="{{urlpath}}/vw_static/datatables.js"></script>
 <script src="{{urlpath}}/vw_static/admin_organizations.js"></script>
 <script src="{{urlpath}}/vw_static/jdenticon-3.3.0.js"></script>

src/static/templates/admin/users.hbs

@@ -14,7 +14,7 @@
                         <th class="vw-entries">Entries</th>
                         <th class="vw-attachments">Attachments</th>
                         <th class="vw-organizations">Organizations</th>
-                        <th class="vw-actions text-end">Actions</th>
+                        <th class="vw-actions">Actions</th>
                     </tr>
                 </thead>
                 <tbody>
@@ -47,10 +47,10 @@
                         </td>
                         {{/if}}
                         <td>
-                            <span class="d-block" data-sort-type="date-iso">{{created_at}}</span>
+                            <span class="d-block">{{created_at}}</span>
                         </td>
                         <td>
-                            <span class="d-block" data-sort-type="date-iso">{{last_active}}</span>
+                            <span class="d-block">{{last_active}}</span>
                         </td>
                         <td>
                             <span class="d-block">{{cipher_count}}</span>
@@ -153,6 +153,7 @@
 </main>
 
 <link rel="stylesheet" href="{{urlpath}}/vw_static/datatables.css" />
+<script src="{{urlpath}}/vw_static/jquery-4.0.0.slim.js"></script>
 <script src="{{urlpath}}/vw_static/datatables.js"></script>
 <script src="{{urlpath}}/vw_static/admin_users.js"></script>
 <script src="{{urlpath}}/vw_static/jdenticon-3.3.0.js"></script>

src/static/templates/email/admin_account_recovery.hbs

@@ -1,12 +0,0 @@
-Admin account recovery from {{org_name}} organization
-<!---------------->
-{{#if reset_password}}
-The master password for {{user_name}} has been changed.
-{{/if}}
-{{#if reset_2fa}}
-Your two-step verification providers have been reset.{{#if fallback_2fa_email}} Email two factor has been activated as a fallback.{{/if}}
-{{/if}}
-
-If you did not initiate this request, please reach out to your administrator immediately.
-
-{{> email/email_footer_text }}

src/static/templates/email/admin_reset_password.hbs

@@ -0,0 +1,4 @@
+Master Password Has Been Changed
+<!---------------->
+The master password for {{user_name}} has been changed by an administrator in your {{org_name}} organization. If you did not initiate this request, please reach out to your administrator immediately.
+{{> email/email_footer_text }}

src/static/templates/email/admin_reset_password.html.hbs

@@ -1,17 +1,10 @@
-Admin account recovery from {{org_name}} organization
+Master Password Has Been Changed
 <!---------------->
 {{> email/email_header }}
 <table width="100%" cellpadding="0" cellspacing="0" style="margin: 0; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; color: #333; line-height: 25px; -webkit-font-smoothing: antialiased; -webkit-text-size-adjust: none;">
     <tr style="margin: 0; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; color: #333; line-height: 25px; -webkit-font-smoothing: antialiased; -webkit-text-size-adjust: none;">
         <td class="content-block" style="font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; color: #333; line-height: 25px; margin: 0; -webkit-font-smoothing: antialiased; padding: 0 0 10px; -webkit-text-size-adjust: none;" valign="top">
-            {{#if reset_password}}
+            The master password for <b style="margin: 0; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; color: #333; line-height: 25px; -webkit-font-smoothing: antialiased; -webkit-text-size-adjust: none;">{{user_name}}</b> has been changed by an administrator in your <b style="margin: 0; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; color: #333; line-height: 25px; -webkit-font-smoothing: antialiased; -webkit-text-size-adjust: none;">{{org_name}}</b> organization. If you did not initiate this request, please reach out to your administrator immediately.
-                The master password for <b style="margin: 0; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; color: #333; line-height: 25px; -webkit-font-smoothing: antialiased; -webkit-text-size-adjust: none;">{{user_name}}</b> has been changed.
-            {{/if}}
-            {{#if reset_2fa}}
-                Your two-step verification providers have been reset.{{#if fallback_2fa_email}} Email two factor has been activated as a fallback.{{/if}}
-            {{/if}}
-            <br>
-            If you did not initiate this request, please reach out to your administrator immediately.
         </td>
     </tr>
 </table>

src/storage.rs

@@ -77,18 +77,10 @@ pub(crate) fn operator_for_path(path: &str) -> Result<opendal::Operator, crate::
 
 #[cfg(s3)]
 mod s3 {
-    use std::sync::LazyLock;
-
-    use opendal_http_transport_reqwest::ReqwestTransport;
     use reqwest::Url;
 
     use crate::error::Error;
 
-    static HTTP_CLIENT: LazyLock<reqwest::Client> = LazyLock::new(|| {
-        // Storage endpoints are administrator-configured and may be private.
-        crate::http_client::get_reqwest_client_builder(false).build().expect("Failed to build OpenDAL HTTP client")
-    });
-
     pub(super) fn is_uri(path: &str) -> bool {
         path.starts_with("s3://")
     }
@@ -185,7 +177,12 @@ mod s3 {
 
                 let chain = DEFAULT_CREDENTIAL_CHAIN
                     .get_or_init(|| {
-                        let conf = ProviderConfig::default().with_http_client(AwsReqwestConnector::new());
+                        let reqwest_client = reqwest::Client::builder().build().unwrap();
+                        let connector = AwsReqwestConnector {
+                            client: reqwest_client,
+                        };
+
+                        let conf = ProviderConfig::default().with_http_client(connector);
 
                         DefaultCredentialsChain::builder().configure(conf).build()
                     })
@@ -239,9 +236,7 @@ mod s3 {
                 builder.credential_provider_chain(ProvideCredentialChain::new().push(OpenDALS3CredentialProvider));
         }
 
-        let http_transport = opendal::HttpTransporter::new(ReqwestTransport::new(HTTP_CLIENT.clone()));
+        Ok(opendal::Operator::new(builder)?)
-        let context = opendal::OperationContext::new().with_http_transport(http_transport);
-        Ok(opendal::Operator::new(builder)?.with_context(context))
     }
 
     fn uri_has_option(uri: &opendal::OperatorUri, names: &[&str]) -> bool {

src/util.rs

@@ -537,7 +537,10 @@ pub fn is_valid_email(email: &str) -> bool {
     let Ok(email_url) = url::Url::parse(&format!("https://{}", email.domain())) else {
         return false;
     };
-    email_url.domain().is_some() && email_url.path() == "/" && email_url.query().is_none()
+    if email_url.path().ne("/") || email_url.domain().is_none() || email_url.query().is_some() {
+        return false;
+    }
+    true
 }
 
 //