From bf33a27103aa8493756b3de363d5e17a5eb5d289 Mon Sep 17 00:00:00 2001
From: Kyattsukuro <nikl.free44@gmail.com>
Date: Mon, 24 Nov 2025 19:41:12 +0100
Subject: [PATCH 1/9] adds sso_identifier to /admin/users

---
 src/api/admin.rs | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/api/admin.rs b/src/api/admin.rs
index 02c976cc..c96e6069 100644
--- a/src/api/admin.rs
+++ b/src/api/admin.rs
@@ -356,7 +356,7 @@ fn logout(cookies: &CookieJar<'_>) -> Redirect {
 async fn get_users_json(_token: AdminToken, conn: DbConn) -> Json<Value> {
     let users = User::get_all(&conn).await;
     let mut users_json = Vec::with_capacity(users.len());
-    for (u, _) in users {
+    for (u, sso_u) in users {
         let mut usr = u.to_json(&conn).await;
         usr["userEnabled"] = json!(u.enabled);
         usr["createdAt"] = json!(format_naive_datetime_local(&u.created_at, DT_FMT));
@@ -364,9 +364,10 @@ async fn get_users_json(_token: AdminToken, conn: DbConn) -> Json<Value> {
             Some(dt) => json!(format_naive_datetime_local(&dt, DT_FMT)),
             None => json!(None::<String>),
         };
+        usr["sso_identifier"] = json!(sso_u.map(|u| u.identifier.to_string()).unwrap_or(String::new()));
+
         users_json.push(usr);
     }
-
     Json(Value::Array(users_json))
 }
 

From cf268df07ee4b08686bcbe2be44570c6c300fad7 Mon Sep 17 00:00:00 2001
From: Kyattsukuro <nikl.free44@gmail.com>
Date: Fri, 8 May 2026 13:01:15 +0200
Subject: [PATCH 2/9] return same json object for all user queries

---
 src/api/admin.rs      | 79 +++++++++++++++++++------------------------
 src/db/models/user.rs | 11 ++++++
 2 files changed, 46 insertions(+), 44 deletions(-)

diff --git a/src/api/admin.rs b/src/api/admin.rs
index c96e6069..e31f3215 100644
--- a/src/api/admin.rs
+++ b/src/api/admin.rs
@@ -23,7 +23,7 @@ use crate::{
         backup_sqlite, get_sql_server_version,
         models::{
             Attachment, Cipher, Collection, Device, Event, EventType, Group, Invitation, Membership, MembershipId,
-            MembershipType, OrgPolicy, Organization, OrganizationId, SsoUser, TwoFactor, User, UserId,
+            MembershipType, OrgPolicy, Organization, OrganizationId, SsoUser, TwoFactor, User, UserId
         },
         DbConn, DbConnType, ACTIVE_DB_TYPE,
     },
@@ -297,8 +297,8 @@ struct InviteData {
     email: String,
 }
 
-async fn get_user_or_404(user_id: &UserId, conn: &DbConn) -> ApiResult<User> {
-    if let Some(user) = User::find_by_uuid(user_id, conn).await {
+async fn get_user_or_404(user_id: &UserId, conn: &DbConn) -> ApiResult<(User, Option<SsoUser>)> {
+    if let Some(user) = SsoUser::find_by_uuid(user_id, conn).await {
         Ok(user)
     } else {
         err_code!("User doesn't exist", Status::NotFound.code);
@@ -352,57 +352,48 @@ fn logout(cookies: &CookieJar<'_>) -> Redirect {
     Redirect::to(admin_path())
 }
 
-#[get("/users")]
-async fn get_users_json(_token: AdminToken, conn: DbConn) -> Json<Value> {
-    let users = User::get_all(&conn).await;
+async fn get_users_property(users: Vec<(User, Option<SsoUser>)>, conn: &DbConn) -> Vec<Value>  {
     let mut users_json = Vec::with_capacity(users.len());
     for (u, sso_u) in users {
-        let mut usr = u.to_json(&conn).await;
-        usr["userEnabled"] = json!(u.enabled);
-        usr["createdAt"] = json!(format_naive_datetime_local(&u.created_at, DT_FMT));
-        usr["lastActive"] = match u.last_active(&conn).await {
+        let mut usr = u.to_json(conn).await;
+        usr["cipher_count"] = json!(Cipher::count_owned_by_user(&u.uuid, conn).await);
+        usr["attachment_count"] = json!(Attachment::count_by_user(&u.uuid, conn).await);
+        usr["attachment_size"] = json!(get_display_size(Attachment::size_by_user(&u.uuid, conn).await));
+        usr["user_enabled"] = json!(u.enabled);
+        usr["created_at"] = json!(format_naive_datetime_local(&u.created_at, DT_FMT));
+        usr["last_active"] = match u.last_active(conn).await {
             Some(dt) => json!(format_naive_datetime_local(&dt, DT_FMT)),
-            None => json!(None::<String>),
+            None => json!("Never"),
         };
+
         usr["sso_identifier"] = json!(sso_u.map(|u| u.identifier.to_string()).unwrap_or(String::new()));
 
         users_json.push(usr);
     }
+    return users_json
+}
+
+#[get("/users")]
+async fn get_users_json(_token: AdminToken, conn: DbConn) -> Json<Value> {
+    let users = User::get_all(&conn).await;
+    let users_json = get_users_property(users, &conn).await;
     Json(Value::Array(users_json))
 }
 
+
 #[get("/users/overview")]
 async fn users_overview(_token: AdminToken, conn: DbConn) -> ApiResult<Html<String>> {
     let users = User::get_all(&conn).await;
-    let mut users_json = Vec::with_capacity(users.len());
-    for (u, sso_u) in users {
-        let mut usr = u.to_json(&conn).await;
-        usr["cipher_count"] = json!(Cipher::count_owned_by_user(&u.uuid, &conn).await);
-        usr["attachment_count"] = json!(Attachment::count_by_user(&u.uuid, &conn).await);
-        usr["attachment_size"] = json!(get_display_size(Attachment::size_by_user(&u.uuid, &conn).await));
-        usr["user_enabled"] = json!(u.enabled);
-        usr["created_at"] = json!(format_naive_datetime_local(&u.created_at, DT_FMT));
-        usr["last_active"] = match u.last_active(&conn).await {
-            Some(dt) => json!(format_naive_datetime_local(&dt, DT_FMT)),
-            None => json!("Never"),
-        };
-
-        usr["sso_identifier"] = json!(sso_u.map(|u| u.identifier.to_string()).unwrap_or(String::new()));
-
-        users_json.push(usr);
-    }
-
+    let users_json = get_users_property(users, &conn).await;
     let text = AdminTemplateData::new("admin/users", json!(users_json)).render()?;
     Ok(Html(text))
 }
 
 #[get("/users/by-mail/<mail>")]
 async fn get_user_by_mail_json(mail: &str, _token: AdminToken, conn: DbConn) -> JsonResult {
-    if let Some(u) = User::find_by_mail(mail, &conn).await {
-        let mut usr = u.to_json(&conn).await;
-        usr["userEnabled"] = json!(u.enabled);
-        usr["createdAt"] = json!(format_naive_datetime_local(&u.created_at, DT_FMT));
-        Ok(Json(usr))
+    if let Some((u, sso)) = SsoUser::find_by_mail(mail, &conn).await {
+        let user_json = get_users_property(vec!((u, sso)), &conn).await[0].clone();
+        Ok(Json(user_json))
     } else {
         err_code!("User doesn't exist", Status::NotFound.code);
     }
@@ -410,16 +401,15 @@ async fn get_user_by_mail_json(mail: &str, _token: AdminToken, conn: DbConn) ->
 
 #[get("/users/<user_id>")]
 async fn get_user_json(user_id: UserId, _token: AdminToken, conn: DbConn) -> JsonResult {
-    let u = get_user_or_404(&user_id, &conn).await?;
-    let mut usr = u.to_json(&conn).await;
-    usr["userEnabled"] = json!(u.enabled);
-    usr["createdAt"] = json!(format_naive_datetime_local(&u.created_at, DT_FMT));
-    Ok(Json(usr))
+    let u_sso = get_user_or_404(&user_id, &conn).await?;
+    let user_json = get_users_property(vec!(u_sso), &conn).await[0].clone();
+
+    Ok(Json(user_json))
 }
 
 #[post("/users/<user_id>/delete", format = "application/json")]
 async fn delete_user(user_id: UserId, token: AdminToken, conn: DbConn) -> EmptyResult {
-    let user = get_user_or_404(&user_id, &conn).await?;
+    let (user, _) = get_user_or_404(&user_id, &conn).await?;
 
     // Get the membership records before deleting the actual user
     let memberships = Membership::find_any_state_by_user(&user_id, &conn).await;
@@ -464,7 +454,7 @@ async fn delete_sso_user(user_id: UserId, token: AdminToken, conn: DbConn) -> Em
 
 #[post("/users/<user_id>/deauth", format = "application/json")]
 async fn deauth_user(user_id: UserId, _token: AdminToken, conn: DbConn, nt: Notify<'_>) -> EmptyResult {
-    let mut user = get_user_or_404(&user_id, &conn).await?;
+    let (mut user, _) = get_user_or_404(&user_id, &conn).await?;
 
     nt.send_logout(&user, None, &conn).await;
 
@@ -485,7 +475,8 @@ async fn deauth_user(user_id: UserId, _token: AdminToken, conn: DbConn, nt: Noti
 
 #[post("/users/<user_id>/disable", format = "application/json")]
 async fn disable_user(user_id: UserId, _token: AdminToken, conn: DbConn, nt: Notify<'_>) -> EmptyResult {
-    let mut user = get_user_or_404(&user_id, &conn).await?;
+    let (mut user, _) = get_user_or_404(&user_id, &conn).await?;
+    Device::delete_all_by_user(&user.uuid, &conn).await?;
     user.reset_security_stamp(&conn).await?;
     user.enabled = false;
 
@@ -500,7 +491,7 @@ async fn disable_user(user_id: UserId, _token: AdminToken, conn: DbConn, nt: Not
 
 #[post("/users/<user_id>/enable", format = "application/json")]
 async fn enable_user(user_id: UserId, _token: AdminToken, conn: DbConn) -> EmptyResult {
-    let mut user = get_user_or_404(&user_id, &conn).await?;
+    let (mut user, _) = get_user_or_404(&user_id, &conn).await?;
     user.enabled = true;
 
     user.save(&conn).await
@@ -508,7 +499,7 @@ async fn enable_user(user_id: UserId, _token: AdminToken, conn: DbConn) -> Empty
 
 #[post("/users/<user_id>/remove-2fa", format = "application/json")]
 async fn remove_2fa(user_id: UserId, token: AdminToken, conn: DbConn) -> EmptyResult {
-    let mut user = get_user_or_404(&user_id, &conn).await?;
+    let (mut user, _) = get_user_or_404(&user_id, &conn).await?;
     TwoFactor::delete_all_by_user(&user.uuid, &conn).await?;
     two_factor::enforce_2fa_policy(&user, &ACTING_ADMIN_USER.into(), 14, &token.ip.ip, &conn).await?;
     user.totp_recover = None;
diff --git a/src/db/models/user.rs b/src/db/models/user.rs
index ebc72101..12affc57 100644
--- a/src/db/models/user.rs
+++ b/src/db/models/user.rs
@@ -554,6 +554,17 @@ impl SsoUser {
         }}
     }
 
+    pub async fn find_by_uuid(uuid: &UserId, conn: &DbConn) -> Option<(User, Option<Self>)> {
+        db_run! { conn: {
+            users::table
+                .left_join(sso_users::table)
+                .select(<(User, Option<Self>)>::as_select())
+                .filter(users::uuid.eq(uuid))
+                .first::<(User, Option<Self>)>(conn)
+                .ok()
+        }}
+    }
+
     pub async fn delete(user_uuid: &UserId, conn: &DbConn) -> EmptyResult {
         db_run! { conn: {
             diesel::delete(sso_users::table.filter(sso_users::user_uuid.eq(user_uuid)))

From b05bce0d94505048b9d0ffc345a4e27a234b2093 Mon Sep 17 00:00:00 2001
From: Kyattsukuro <nikl.free44@gmail.com>
Date: Sat, 29 Nov 2025 19:40:36 +0100
Subject: [PATCH 3/9] pass formatting checks

---
 src/api/admin.rs | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/src/api/admin.rs b/src/api/admin.rs
index e31f3215..f409b5ae 100644
--- a/src/api/admin.rs
+++ b/src/api/admin.rs
@@ -23,7 +23,7 @@ use crate::{
         backup_sqlite, get_sql_server_version,
         models::{
             Attachment, Cipher, Collection, Device, Event, EventType, Group, Invitation, Membership, MembershipId,
-            MembershipType, OrgPolicy, Organization, OrganizationId, SsoUser, TwoFactor, User, UserId
+            MembershipType, OrgPolicy, Organization, OrganizationId, SsoUser, TwoFactor, User, UserId,
         },
         DbConn, DbConnType, ACTIVE_DB_TYPE,
     },
@@ -352,7 +352,7 @@ fn logout(cookies: &CookieJar<'_>) -> Redirect {
     Redirect::to(admin_path())
 }
 
-async fn get_users_property(users: Vec<(User, Option<SsoUser>)>, conn: &DbConn) -> Vec<Value>  {
+async fn get_users_property(users: Vec<(User, Option<SsoUser>)>, conn: &DbConn) -> Vec<Value> {
     let mut users_json = Vec::with_capacity(users.len());
     for (u, sso_u) in users {
         let mut usr = u.to_json(conn).await;
@@ -370,7 +370,7 @@ async fn get_users_property(users: Vec<(User, Option<SsoUser>)>, conn: &DbConn)
 
         users_json.push(usr);
     }
-    return users_json
+    users_json
 }
 
 #[get("/users")]
@@ -380,7 +380,6 @@ async fn get_users_json(_token: AdminToken, conn: DbConn) -> Json<Value> {
     Json(Value::Array(users_json))
 }
 
-
 #[get("/users/overview")]
 async fn users_overview(_token: AdminToken, conn: DbConn) -> ApiResult<Html<String>> {
     let users = User::get_all(&conn).await;
@@ -392,7 +391,7 @@ async fn users_overview(_token: AdminToken, conn: DbConn) -> ApiResult<Html<Stri
 #[get("/users/by-mail/<mail>")]
 async fn get_user_by_mail_json(mail: &str, _token: AdminToken, conn: DbConn) -> JsonResult {
     if let Some((u, sso)) = SsoUser::find_by_mail(mail, &conn).await {
-        let user_json = get_users_property(vec!((u, sso)), &conn).await[0].clone();
+        let user_json = get_users_property(vec![(u, sso)], &conn).await[0].clone();
         Ok(Json(user_json))
     } else {
         err_code!("User doesn't exist", Status::NotFound.code);
@@ -402,7 +401,7 @@ async fn get_user_by_mail_json(mail: &str, _token: AdminToken, conn: DbConn) ->
 #[get("/users/<user_id>")]
 async fn get_user_json(user_id: UserId, _token: AdminToken, conn: DbConn) -> JsonResult {
     let u_sso = get_user_or_404(&user_id, &conn).await?;
-    let user_json = get_users_property(vec!(u_sso), &conn).await[0].clone();
+    let user_json = get_users_property(vec![u_sso], &conn).await[0].clone();
 
     Ok(Json(user_json))
 }

From c65e7a60481b09285747918f4e787a387393356c Mon Sep 17 00:00:00 2001
From: Kyattsukuro <nikl.free44@gmail.com>
Date: Tue, 3 Feb 2026 14:20:06 +0100
Subject: [PATCH 4/9] Resolves conflicts:  
 src/static/templates/admin/users.hbs

---
 src/api/admin.rs                     | 14 +++++++-------
 src/static/templates/admin/users.hbs | 16 ++++++++--------
 2 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/src/api/admin.rs b/src/api/admin.rs
index f409b5ae..4315c32e 100644
--- a/src/api/admin.rs
+++ b/src/api/admin.rs
@@ -356,17 +356,17 @@ async fn get_users_property(users: Vec<(User, Option<SsoUser>)>, conn: &DbConn)
     let mut users_json = Vec::with_capacity(users.len());
     for (u, sso_u) in users {
         let mut usr = u.to_json(conn).await;
-        usr["cipher_count"] = json!(Cipher::count_owned_by_user(&u.uuid, conn).await);
-        usr["attachment_count"] = json!(Attachment::count_by_user(&u.uuid, conn).await);
-        usr["attachment_size"] = json!(get_display_size(Attachment::size_by_user(&u.uuid, conn).await));
-        usr["user_enabled"] = json!(u.enabled);
-        usr["created_at"] = json!(format_naive_datetime_local(&u.created_at, DT_FMT));
-        usr["last_active"] = match u.last_active(conn).await {
+        usr["cipherCount"] = json!(Cipher::count_owned_by_user(&u.uuid, conn).await);
+        usr["attachmentCount"] = json!(Attachment::count_by_user(&u.uuid, conn).await);
+        usr["attachmentSize"] = json!(get_display_size(Attachment::size_by_user(&u.uuid, conn).await));
+        usr["userEnabled"] = json!(u.enabled);
+        usr["createdAt"] = json!(format_naive_datetime_local(&u.created_at, DT_FMT));
+        usr["lastActive"] = match u.last_active(conn).await {
             Some(dt) => json!(format_naive_datetime_local(&dt, DT_FMT)),
             None => json!("Never"),
         };
 
-        usr["sso_identifier"] = json!(sso_u.map(|u| u.identifier.to_string()).unwrap_or(String::new()));
+        usr["ssoIdentifier"] = json!(sso_u.map(|u| u.identifier.to_string()).unwrap_or(String::new()));
 
         users_json.push(usr);
     }
diff --git a/src/static/templates/admin/users.hbs b/src/static/templates/admin/users.hbs
index 4c91bc0e..efbf7241 100644
--- a/src/static/templates/admin/users.hbs
+++ b/src/static/templates/admin/users.hbs
@@ -26,7 +26,7 @@
                                 <strong>{{name}}</strong>
                                 <span class="d-block">{{email}}</span>
                                 <span class="d-block">
-                                    {{#unless user_enabled}}
+                                    {{#unless userEnabled}}
                                         <span class="badge bg-danger me-2" title="User is disabled">Disabled</span>
                                     {{/unless}}
                                     {{#if twoFactorEnabled}}
@@ -43,22 +43,22 @@
                         </td>
                         {{#if ../sso_enabled}}
                         <td>
-                            <span class="d-block text-break text-wrap">{{sso_identifier}}</span>
+                            <span class="d-block">{{ssoIdentifier}}</span>
                         </td>
                         {{/if}}
                         <td>
-                            <span class="d-block">{{created_at}}</span>
+                            <span class="d-block">{{createdAt}}</span>
                         </td>
                         <td>
-                            <span class="d-block">{{last_active}}</span>
+                            <span class="d-block">{{lastActive}}</span>
                         </td>
                         <td>
-                            <span class="d-block">{{cipher_count}}</span>
+                            <span class="d-block">{{cipherCount}}</span>
                         </td>
                         <td>
-                            <span class="d-block"><strong>Amount:</strong> {{attachment_count}}</span>
+                            <span class="d-block"><strong>Amount:</strong> {{attachmentCount}}</span>
                             {{#if attachment_count}}
-                            <span class="d-block"><strong>Size:</strong> {{attachment_size}}</span>
+                            <span class="d-block"><strong>Size:</strong> {{attachmentSize}}</span>
                             {{/if}}
                         </td>
                         <td>
@@ -78,7 +78,7 @@
                                 {{#if ../sso_enabled}}
                                 <button type="button" class="btn btn-sm btn-link p-0 border-0 float-right" vw-delete-sso-user>Delete SSO Association</button><br>
                                 {{/if}}
-                                {{#if user_enabled}}
+                                {{#if userEnabled}}
                                 <button type="button" class="btn btn-sm btn-link p-0 border-0 float-right" vw-disable-user>Disable User</button><br>
                                 {{else}}
                                 <button type="button" class="btn btn-sm btn-link p-0 border-0 float-right" vw-enable-user>Enable User</button><br>

From 79bb470d4f78c5b58274d716403f7e12d5b68fff Mon Sep 17 00:00:00 2001
From: Kyattsukuro <nikl.free44@gmail.com>
Date: Tue, 3 Feb 2026 15:04:18 +0100
Subject: [PATCH 5/9] moved SsoUser from get_user_or_404 to get_sso_user

---
 src/api/admin.rs | 23 ++++++++++++++---------
 1 file changed, 14 insertions(+), 9 deletions(-)

diff --git a/src/api/admin.rs b/src/api/admin.rs
index 4315c32e..2e097fca 100644
--- a/src/api/admin.rs
+++ b/src/api/admin.rs
@@ -297,14 +297,18 @@ struct InviteData {
     email: String,
 }
 
-async fn get_user_or_404(user_id: &UserId, conn: &DbConn) -> ApiResult<(User, Option<SsoUser>)> {
-    if let Some(user) = SsoUser::find_by_uuid(user_id, conn).await {
+async fn get_user_or_404(user_id: &UserId, conn: &DbConn) -> ApiResult<User> {
+    if let Some(user) = User::find_by_uuid(user_id, conn).await {
         Ok(user)
     } else {
         err_code!("User doesn't exist", Status::NotFound.code);
     }
 }
 
+async fn get_sso_user(user_id: &UserId, conn: &DbConn) -> Option<SsoUser> {
+    SsoUser::find_by_uuid(user_id, conn).await.and_then(|user_and_sso| user_and_sso.1)
+}
+
 #[post("/invite", format = "application/json", data = "<data>")]
 async fn invite_user(data: Json<InviteData>, _token: AdminToken, conn: DbConn) -> JsonResult {
     let data: InviteData = data.into_inner();
@@ -400,15 +404,16 @@ async fn get_user_by_mail_json(mail: &str, _token: AdminToken, conn: DbConn) ->
 
 #[get("/users/<user_id>")]
 async fn get_user_json(user_id: UserId, _token: AdminToken, conn: DbConn) -> JsonResult {
-    let u_sso = get_user_or_404(&user_id, &conn).await?;
-    let user_json = get_users_property(vec![u_sso], &conn).await[0].clone();
+    let user = get_user_or_404(&user_id, &conn).await?;
+    let sso_user = get_sso_user(&user_id, &conn).await;
+    let user_json = get_users_property(vec![(user, sso_user)], &conn).await[0].clone();
 
     Ok(Json(user_json))
 }
 
 #[post("/users/<user_id>/delete", format = "application/json")]
 async fn delete_user(user_id: UserId, token: AdminToken, conn: DbConn) -> EmptyResult {
-    let (user, _) = get_user_or_404(&user_id, &conn).await?;
+    let user = get_user_or_404(&user_id, &conn).await?;
 
     // Get the membership records before deleting the actual user
     let memberships = Membership::find_any_state_by_user(&user_id, &conn).await;
@@ -453,7 +458,7 @@ async fn delete_sso_user(user_id: UserId, token: AdminToken, conn: DbConn) -> Em
 
 #[post("/users/<user_id>/deauth", format = "application/json")]
 async fn deauth_user(user_id: UserId, _token: AdminToken, conn: DbConn, nt: Notify<'_>) -> EmptyResult {
-    let (mut user, _) = get_user_or_404(&user_id, &conn).await?;
+    let mut user = get_user_or_404(&user_id, &conn).await?;
 
     nt.send_logout(&user, None, &conn).await;
 
@@ -474,7 +479,7 @@ async fn deauth_user(user_id: UserId, _token: AdminToken, conn: DbConn, nt: Noti
 
 #[post("/users/<user_id>/disable", format = "application/json")]
 async fn disable_user(user_id: UserId, _token: AdminToken, conn: DbConn, nt: Notify<'_>) -> EmptyResult {
-    let (mut user, _) = get_user_or_404(&user_id, &conn).await?;
+    let mut user = get_user_or_404(&user_id, &conn).await?;
     Device::delete_all_by_user(&user.uuid, &conn).await?;
     user.reset_security_stamp(&conn).await?;
     user.enabled = false;
@@ -490,7 +495,7 @@ async fn disable_user(user_id: UserId, _token: AdminToken, conn: DbConn, nt: Not
 
 #[post("/users/<user_id>/enable", format = "application/json")]
 async fn enable_user(user_id: UserId, _token: AdminToken, conn: DbConn) -> EmptyResult {
-    let (mut user, _) = get_user_or_404(&user_id, &conn).await?;
+    let mut user = get_user_or_404(&user_id, &conn).await?;
     user.enabled = true;
 
     user.save(&conn).await
@@ -498,7 +503,7 @@ async fn enable_user(user_id: UserId, _token: AdminToken, conn: DbConn) -> Empty
 
 #[post("/users/<user_id>/remove-2fa", format = "application/json")]
 async fn remove_2fa(user_id: UserId, token: AdminToken, conn: DbConn) -> EmptyResult {
-    let (mut user, _) = get_user_or_404(&user_id, &conn).await?;
+    let mut user = get_user_or_404(&user_id, &conn).await?;
     TwoFactor::delete_all_by_user(&user.uuid, &conn).await?;
     two_factor::enforce_2fa_policy(&user, &ACTING_ADMIN_USER.into(), 14, &token.ip.ip, &conn).await?;
     user.totp_recover = None;

From 7f419705de4463f927cc6a7688a380a1a7691126 Mon Sep 17 00:00:00 2001
From: Kyattsukuro <nikl.free44@gmail.com>
Date: Wed, 4 Feb 2026 22:46:25 +0100
Subject: [PATCH 6/9] removed get_sso_user

---
 src/api/admin.rs      |  6 +-----
 src/db/models/user.rs | 10 ++++------
 2 files changed, 5 insertions(+), 11 deletions(-)

diff --git a/src/api/admin.rs b/src/api/admin.rs
index 2e097fca..e87c29fb 100644
--- a/src/api/admin.rs
+++ b/src/api/admin.rs
@@ -305,10 +305,6 @@ async fn get_user_or_404(user_id: &UserId, conn: &DbConn) -> ApiResult<User> {
     }
 }
 
-async fn get_sso_user(user_id: &UserId, conn: &DbConn) -> Option<SsoUser> {
-    SsoUser::find_by_uuid(user_id, conn).await.and_then(|user_and_sso| user_and_sso.1)
-}
-
 #[post("/invite", format = "application/json", data = "<data>")]
 async fn invite_user(data: Json<InviteData>, _token: AdminToken, conn: DbConn) -> JsonResult {
     let data: InviteData = data.into_inner();
@@ -405,7 +401,7 @@ async fn get_user_by_mail_json(mail: &str, _token: AdminToken, conn: DbConn) ->
 #[get("/users/<user_id>")]
 async fn get_user_json(user_id: UserId, _token: AdminToken, conn: DbConn) -> JsonResult {
     let user = get_user_or_404(&user_id, &conn).await?;
-    let sso_user = get_sso_user(&user_id, &conn).await;
+    let sso_user = SsoUser::find_by_uuid(&user_id, &conn).await;
     let user_json = get_users_property(vec![(user, sso_user)], &conn).await[0].clone();
 
     Ok(Json(user_json))
diff --git a/src/db/models/user.rs b/src/db/models/user.rs
index 12affc57..1ac554de 100644
--- a/src/db/models/user.rs
+++ b/src/db/models/user.rs
@@ -554,13 +554,11 @@ impl SsoUser {
         }}
     }
 
-    pub async fn find_by_uuid(uuid: &UserId, conn: &DbConn) -> Option<(User, Option<Self>)> {
+    pub async fn find_by_uuid(uuid: &UserId, conn: &DbConn) -> Option<Self> {
         db_run! { conn: {
-            users::table
-                .left_join(sso_users::table)
-                .select(<(User, Option<Self>)>::as_select())
-                .filter(users::uuid.eq(uuid))
-                .first::<(User, Option<Self>)>(conn)
+            sso_users::table
+                .filter(sso_users::user_uuid.eq(uuid))
+                .first::<Self>(conn)
                 .ok()
         }}
     }

From b60b97b96daccbafff1e13854629d515b1647275 Mon Sep 17 00:00:00 2001
From: Kyattsukuro <nikl.free44@gmail.com>
Date: Wed, 4 Feb 2026 22:56:49 +0100
Subject: [PATCH 7/9] in enrich_users_json, moved never active notice to
 template

---
 src/api/admin.rs                     | 12 ++++++------
 src/static/templates/admin/users.hbs |  8 +++++++-
 2 files changed, 13 insertions(+), 7 deletions(-)

diff --git a/src/api/admin.rs b/src/api/admin.rs
index e87c29fb..1cf2ba04 100644
--- a/src/api/admin.rs
+++ b/src/api/admin.rs
@@ -352,7 +352,7 @@ fn logout(cookies: &CookieJar<'_>) -> Redirect {
     Redirect::to(admin_path())
 }
 
-async fn get_users_property(users: Vec<(User, Option<SsoUser>)>, conn: &DbConn) -> Vec<Value> {
+async fn enrich_users_json(users: Vec<(User, Option<SsoUser>)>, conn: &DbConn) -> Vec<Value> {
     let mut users_json = Vec::with_capacity(users.len());
     for (u, sso_u) in users {
         let mut usr = u.to_json(conn).await;
@@ -363,7 +363,7 @@ async fn get_users_property(users: Vec<(User, Option<SsoUser>)>, conn: &DbConn)
         usr["createdAt"] = json!(format_naive_datetime_local(&u.created_at, DT_FMT));
         usr["lastActive"] = match u.last_active(conn).await {
             Some(dt) => json!(format_naive_datetime_local(&dt, DT_FMT)),
-            None => json!("Never"),
+            None => json!(None::<String>),
         };
 
         usr["ssoIdentifier"] = json!(sso_u.map(|u| u.identifier.to_string()).unwrap_or(String::new()));
@@ -376,14 +376,14 @@ async fn get_users_property(users: Vec<(User, Option<SsoUser>)>, conn: &DbConn)
 #[get("/users")]
 async fn get_users_json(_token: AdminToken, conn: DbConn) -> Json<Value> {
     let users = User::get_all(&conn).await;
-    let users_json = get_users_property(users, &conn).await;
+    let users_json = enrich_users_json(users, &conn).await;
     Json(Value::Array(users_json))
 }
 
 #[get("/users/overview")]
 async fn users_overview(_token: AdminToken, conn: DbConn) -> ApiResult<Html<String>> {
     let users = User::get_all(&conn).await;
-    let users_json = get_users_property(users, &conn).await;
+    let users_json = enrich_users_json(users, &conn).await;
     let text = AdminTemplateData::new("admin/users", json!(users_json)).render()?;
     Ok(Html(text))
 }
@@ -391,7 +391,7 @@ async fn users_overview(_token: AdminToken, conn: DbConn) -> ApiResult<Html<Stri
 #[get("/users/by-mail/<mail>")]
 async fn get_user_by_mail_json(mail: &str, _token: AdminToken, conn: DbConn) -> JsonResult {
     if let Some((u, sso)) = SsoUser::find_by_mail(mail, &conn).await {
-        let user_json = get_users_property(vec![(u, sso)], &conn).await[0].clone();
+        let user_json = enrich_users_json(vec![(u, sso)], &conn).await[0].clone();
         Ok(Json(user_json))
     } else {
         err_code!("User doesn't exist", Status::NotFound.code);
@@ -402,7 +402,7 @@ async fn get_user_by_mail_json(mail: &str, _token: AdminToken, conn: DbConn) ->
 async fn get_user_json(user_id: UserId, _token: AdminToken, conn: DbConn) -> JsonResult {
     let user = get_user_or_404(&user_id, &conn).await?;
     let sso_user = SsoUser::find_by_uuid(&user_id, &conn).await;
-    let user_json = get_users_property(vec![(user, sso_user)], &conn).await[0].clone();
+    let user_json = enrich_users_json(vec![(user, sso_user)], &conn).await[0].clone();
 
     Ok(Json(user_json))
 }
diff --git a/src/static/templates/admin/users.hbs b/src/static/templates/admin/users.hbs
index efbf7241..5229cbf6 100644
--- a/src/static/templates/admin/users.hbs
+++ b/src/static/templates/admin/users.hbs
@@ -50,7 +50,13 @@
                             <span class="d-block">{{createdAt}}</span>
                         </td>
                         <td>
-                            <span class="d-block">{{lastActive}}</span>
+                            <span class="d-block">
+                            {{#if lastActive}}
+                                {{lastActive}}
+                            {{else}}
+                                Never
+                            {{/if}}
+                            </span>
                         </td>
                         <td>
                             <span class="d-block">{{cipherCount}}</span>

From 8f0cee604a374bb70eda5e93dadcec840c191a0a Mon Sep 17 00:00:00 2001
From: Kyattsukuro <nikl.free44@gmail.com>
Date: Sun, 5 Apr 2026 13:55:56 +0200
Subject: [PATCH 8/9] use camel case for attachmentCount, use safer way to get
 user JSON

---
 src/api/admin.rs                             | 18 ++++++++++++++----
 src/static/templates/admin/organizations.hbs |  4 ++--
 src/static/templates/admin/users.hbs         |  2 +-
 3 files changed, 17 insertions(+), 7 deletions(-)

diff --git a/src/api/admin.rs b/src/api/admin.rs
index 1cf2ba04..1f2f2f54 100644
--- a/src/api/admin.rs
+++ b/src/api/admin.rs
@@ -390,8 +390,13 @@ async fn users_overview(_token: AdminToken, conn: DbConn) -> ApiResult<Html<Stri
 
 #[get("/users/by-mail/<mail>")]
 async fn get_user_by_mail_json(mail: &str, _token: AdminToken, conn: DbConn) -> JsonResult {
-    if let Some((u, sso)) = SsoUser::find_by_mail(mail, &conn).await {
-        let user_json = enrich_users_json(vec![(u, sso)], &conn).await[0].clone();
+    if let Some((user, sso_user)) = SsoUser::find_by_mail(mail, &conn).await {
+        let user_json = enrich_users_json(vec![(user, sso_user)], &conn)
+            .await
+            .into_iter()
+            .next()
+            .clone()
+            .ok_or(Error::new("Could not build user JSON", "").with_code(Status::InternalServerError.code))?;
         Ok(Json(user_json))
     } else {
         err_code!("User doesn't exist", Status::NotFound.code);
@@ -402,7 +407,12 @@ async fn get_user_by_mail_json(mail: &str, _token: AdminToken, conn: DbConn) ->
 async fn get_user_json(user_id: UserId, _token: AdminToken, conn: DbConn) -> JsonResult {
     let user = get_user_or_404(&user_id, &conn).await?;
     let sso_user = SsoUser::find_by_uuid(&user_id, &conn).await;
-    let user_json = enrich_users_json(vec![(user, sso_user)], &conn).await[0].clone();
+    let user_json = enrich_users_json(vec![(user, sso_user)], &conn)
+        .await
+        .into_iter()
+        .next()
+        .clone()
+        .ok_or(Error::new("Could not build user JSON", "").with_code(Status::InternalServerError.code))?;
 
     Ok(Json(user_json))
 }
@@ -592,7 +602,7 @@ async fn organizations_overview(_token: AdminToken, conn: DbConn) -> ApiResult<H
         org["collection_count"] = json!(Collection::count_by_org(&o.uuid, &conn).await);
         org["group_count"] = json!(Group::count_by_org(&o.uuid, &conn).await);
         org["event_count"] = json!(Event::count_by_org(&o.uuid, &conn).await);
-        org["attachment_count"] = json!(Attachment::count_by_org(&o.uuid, &conn).await);
+        org["attachmentCount"] = json!(Attachment::count_by_org(&o.uuid, &conn).await);
         org["attachment_size"] = json!(get_display_size(Attachment::size_by_org(&o.uuid, &conn).await));
         organizations_json.push(org);
     }
diff --git a/src/static/templates/admin/organizations.hbs b/src/static/templates/admin/organizations.hbs
index c1e57d3d..43bb5660 100644
--- a/src/static/templates/admin/organizations.hbs
+++ b/src/static/templates/admin/organizations.hbs
@@ -33,8 +33,8 @@
                             <span class="d-block">{{cipher_count}}</span>
                         </td>
                         <td>
-                            <span class="d-block"><strong>Amount:</strong> {{attachment_count}}</span>
-                            {{#if attachment_count}}
+                            <span class="d-block"><strong>Amount:</strong> {{attachmentCount}}</span>
+                            {{#if attachmentCount}}
                             <span class="d-block"><strong>Size:</strong> {{attachment_size}}</span>
                             {{/if}}
                         </td>
diff --git a/src/static/templates/admin/users.hbs b/src/static/templates/admin/users.hbs
index 5229cbf6..1eaf546f 100644
--- a/src/static/templates/admin/users.hbs
+++ b/src/static/templates/admin/users.hbs
@@ -63,7 +63,7 @@
                         </td>
                         <td>
                             <span class="d-block"><strong>Amount:</strong> {{attachmentCount}}</span>
-                            {{#if attachment_count}}
+                            {{#if attachmentCount}}
                             <span class="d-block"><strong>Size:</strong> {{attachmentSize}}</span>
                             {{/if}}
                         </td>

From 4c7df150752278f34c6b78a7c207e4fc8f57724e Mon Sep 17 00:00:00 2001
From: Kyattsukuro <nikl.free44@gmail.com>
Date: Fri, 8 May 2026 13:40:30 +0200
Subject: [PATCH 9/9] revertet changing names of organisation attachment_count

---
 src/api/admin.rs                             | 2 +-
 src/static/templates/admin/organizations.hbs | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/api/admin.rs b/src/api/admin.rs
index 1f2f2f54..345b8b0f 100644
--- a/src/api/admin.rs
+++ b/src/api/admin.rs
@@ -602,7 +602,7 @@ async fn organizations_overview(_token: AdminToken, conn: DbConn) -> ApiResult<H
         org["collection_count"] = json!(Collection::count_by_org(&o.uuid, &conn).await);
         org["group_count"] = json!(Group::count_by_org(&o.uuid, &conn).await);
         org["event_count"] = json!(Event::count_by_org(&o.uuid, &conn).await);
-        org["attachmentCount"] = json!(Attachment::count_by_org(&o.uuid, &conn).await);
+        org["attachment_count"] = json!(Attachment::count_by_org(&o.uuid, &conn).await);
         org["attachment_size"] = json!(get_display_size(Attachment::size_by_org(&o.uuid, &conn).await));
         organizations_json.push(org);
     }
diff --git a/src/static/templates/admin/organizations.hbs b/src/static/templates/admin/organizations.hbs
index 43bb5660..c1e57d3d 100644
--- a/src/static/templates/admin/organizations.hbs
+++ b/src/static/templates/admin/organizations.hbs
@@ -33,8 +33,8 @@
                             <span class="d-block">{{cipher_count}}</span>
                         </td>
                         <td>
-                            <span class="d-block"><strong>Amount:</strong> {{attachmentCount}}</span>
-                            {{#if attachmentCount}}
+                            <span class="d-block"><strong>Amount:</strong> {{attachment_count}}</span>
+                            {{#if attachment_count}}
                             <span class="d-block"><strong>Size:</strong> {{attachment_size}}</span>
                             {{/if}}
                         </td>