@awesome-lang-auth/node 1.10.1 → 1.10.3

package/README.detailed.md

@@ -110,6 +110,7 @@ export class MyUserStore implements IUserStore {
 
   // ---- Required: token field updates -----------------------------------------------
 
+  /** Single-device fallback when no ISessionStore is configured. With a sessionStore, tokens are per-session and not written here. */
   async updateRefreshToken(userId: string, token: string | null, expiry: Date | null): Promise<void> { /* ... */ }
   async updateResetToken(userId: string, token: string | null, expiry: Date | null): Promise<void> { /* ... */ }
   async updatePassword(userId: string, hashedPassword: string): Promise<void> { /* ... */ }
@@ -430,7 +431,7 @@ If they are on **completely different domains**:
 import { AuthConfig } from '@awesome-lang-auth/node';
 
 const config: AuthConfig = {
-  // Required
+  // Required (refreshTokenSecret must differ from accessTokenSecret when a sessionStore is configured)
   accessTokenSecret: process.env.ACCESS_TOKEN_SECRET!,
   refreshTokenSecret: process.env.REFRESH_TOKEN_SECRET!,
 
@@ -728,8 +729,18 @@ app.use('/auth', auth.router({
 When `findOrCreateUser` throws an `AuthError` with code `'OAUTH_ACCOUNT_CONFLICT'`, the built-in OAuth callback automatically redirects to:
 
 ```
-{siteUrl}/auth/account-conflict?provider=google&code=OAUTH_ACCOUNT_CONFLICT&email=user%40example.com
+{siteUrl}{apiPrefix}/ui/account-conflict?provider=google&code=OAUTH_ACCOUNT_CONFLICT&email=user%40example.com
 ```
+(or `{siteUrl}{apiPrefix}/account-conflict?...` when `ui.enabled` is false; `apiPrefix` defaults to `/auth`).
+
+Note that `return_path` is ignored on account conflict redirects to prevent path pollution. If `allowedOrigins` is empty, any origin from state passes (same as `resolveOAuthRedirect`). (Note: a separate follow-up issue tracks the 2FA redirect path `${redirectTo}/auth/2fa?tempToken=...`).
+
+#### OAuth State Nonce CSRF Protection
+
+To protect against Login CSRF attacks where an attacker tricks a victim's browser into completing an OAuth callback with the attacker's authorization code:
+1. `GET /auth/oauth/<provider>` generates a secure random nonce, encodes it in the `state` parameter, and sets an `HttpOnly`, `SameSite=Lax` cookie (`oauth_nonce_<provider>` / `oauth_state`, valid for 10 minutes) scoped to the strategy callback path.
+2. `GET /auth/oauth/<provider>/callback` strictly validates that the cookie is present and that its nonce matches the nonce in the `state` query parameter using constant-time comparison (`crypto.timingSafeEqual`).
+3. If the cookie is missing, `state` is missing, or the nonces do not match, the callback rejects the request immediately with `400 {"error":"Invalid OAuth state","code":"INVALID_OAUTH_STATE"}` and never invokes `handleCallback`.
 
 When you also attach `{ email, providerAccountId }` to the thrown `AuthError`’s `data` field **and** provide a `pendingLinkStore` in `RouterOptions`, the library stashes the conflicting provider details automatically so the front-end can drive the full conflict-resolution flow without any custom server routes:
 
@@ -777,7 +788,7 @@ app.use('/auth', createAuthRouter(userStore, config, {
 **End-to-end unauthenticated conflict-linking flow:**
 
 1. User tries to sign in with Google; `findOrCreateUser` detects the email already belongs to an existing account and throws `AuthError('...', 'OAUTH_ACCOUNT_CONFLICT', 409, { email, providerAccountId })`.
-2. Library calls `pendingLinkStore.stash(email, 'google', providerAccountId)` and redirects the browser to `{siteUrl}/auth/account-conflict?provider=google&email=user%40example.com`.
+2. Library calls `pendingLinkStore.stash(email, 'google', providerAccountId)` and redirects the browser to `{siteUrl}{apiPrefix}/ui/account-conflict?provider=google&code=OAUTH_ACCOUNT_CONFLICT&email=user%40example.com` (or `{siteUrl}{apiPrefix}/account-conflict?...` if UI is disabled).
 3. Frontend prompts the user to verify ownership (e.g. sends a magic link / password check).  Once verified, the front-end has a `linkToken` from `POST /auth/link-request`.
 4. Frontend calls `POST /auth/link-verify` with `{ token, loginAfterLinking: true }`. The library retrieves the stashed `providerAccountId`, links the account, clears the stash, and returns a full session.
 
@@ -1812,7 +1823,7 @@ The `X-Auth-Strategy: bearer` header is respected by all token-issuing endpoints
 
 ### Logout (bearer)
 
-`POST /auth/logout` ends the session named by the `Authorization: Bearer` access token and/or by a `refreshToken` in the JSON body (as for `/auth/refresh`): it revokes the stateful session (with a `sessionStore`) and clears the stored refresh token, so that refresh token is refused afterwards. A refresh token in the body counts only while it is the user's current one. Send both when you have them; an expired access token alone cannot identify the session.
+`POST /auth/logout` ends the session named by the `Authorization: Bearer` access token and/or by a `refreshToken` in the JSON body (as for `/auth/refresh`): with a `sessionStore`, each session refreshes independently and logout revokes the specific session while its session exists in the store without invalidating other devices. Without a `sessionStore`, single-device fallback applies where a refresh token in the body counts only while it is the user's current one. Send both when you have them; an expired access token alone cannot identify the session.
 
 ```typescript
 await fetch('/auth/logout', {
@@ -2953,6 +2964,11 @@ Unauthenticated requests get `401 { "error": "Unauthorized" }`, whatever their `
 
 > **Security note:** By configuring an `accessPolicy` (e.g., `'first-user'`, `'is-admin-flag'`) and `jwtSecret`, the Admin UI requests a session. When an unauthenticated browser opens the panel (`GET <apiPrefix>/admin/`), it is redirected to `${loginPath}?redirect=<URL-encoded admin path>` if `loginPath` is set; otherwise the panel shows its own sign-in form. For further security in production, mount the admin router behind a VPN or IP allow-list.
 
+> **Input robustness:**
+> - Query parameters `limit`, `offset`, and `filter` in admin list endpoints accept a single string value. If a parameter is repeated (e.g. `?filter=a&filter=b`), the first value is used. Invalid or non-numeric values fall back to defaults (`offset: 0`, `limit: 20` or endpoint default).
+> - Cookies with malformed percent-encoding (`URIError`) are safely kept raw and do not cause 500 errors.
+> - Endpoints expecting a JSON body safely handle missing bodies or non-JSON payloads (`400` with descriptive error instead of `500`).
+
 ## RouterOptions
 
 All options passed to `auth.router(options)` (or `createAuthRouter(store, config, options)`):
@@ -3143,7 +3159,7 @@ buildTokenPayload: async (user) => ({
 
 You can control the performance/security trade-off via the `session.checkOn` option (with an `ISessionStore` passed to the router):
 
-- `none`: Purely stateless. Very fast, but tokens remain valid until they expire even if the session is deleted.
+- `none`: Purely stateless for access-token verification. Note that `POST /refresh` always validates session existence in the store even when `checkOn: 'none'`; a deleted or revoked session can no longer refresh (`401 SESSION_REVOKED`).
 - `refresh` (default): Validates the session only when a new Access Token is requested. Fast, and ensures that once a session is revoked, the user cannot get new tokens.
 - `allcalls`: Validates the session ID on **every single request** via middleware: the auth router's own protected routes (`/me`, `/sessions`, `/change-password`, ...) and `auth.middleware()` when it has a store (`auth.middleware({ sessionStore })`, or a call made after `auth.router({ sessionStore })`). A revoked session gets `401 SESSION_REVOKED` on the next call. Highest security, handles instant "kill-switch" revocation. Recommended with high-performance stores (Redis/In-Memory).
 

package/dist/interfaces/session-store.interface.d.ts

@@ -88,5 +88,10 @@ export interface ISessionStore {
      * @returns The number of sessions that were deleted.
      */
     deleteExpiredSessions?(): Promise<number>;
+    /**
+     * Optional: update the stored refresh token hash for an existing session.
+     * Called during token refresh and session rotation.
+     */
+    updateSessionRefreshTokenHash?(sessionHandle: string, refreshTokenHash: string): Promise<void>;
 }
 //# sourceMappingURL=session-store.interface.d.ts.map

package/dist/interfaces/session-store.interface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-store.interface.d.ts","sourceRoot":"","sources":["../../src/interfaces/session-store.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAEtD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,MAAM,WAAW,aAAa;IAC5B;;OAEG;IACH,aAAa,CACX,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,eAAe,CAAC,GACvC,OAAO,CAAC,WAAW,CAAC,CAAC;IAExB;;;OAGG;IACH,UAAU,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAE/D;;;;OAIG;IACH,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAE9E;;;OAGG;IACH,uBAAuB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9D;;;;;;OAMG;IACH,aAAa,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEpD;;;OAGG;IACH,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE3E;;;;;;OAMG;IACH,cAAc,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAEvE;;;;;;OAMG;IACH,qBAAqB,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CAC3C"}
+{"version":3,"file":"session-store.interface.d.ts","sourceRoot":"","sources":["../../src/interfaces/session-store.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAEtD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,MAAM,WAAW,aAAa;IAC5B;;OAEG;IACH,aAAa,CACX,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,eAAe,CAAC,GACvC,OAAO,CAAC,WAAW,CAAC,CAAC;IAExB;;;OAGG;IACH,UAAU,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAE/D;;;;OAIG;IACH,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAE9E;;;OAGG;IACH,uBAAuB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9D;;;;;;OAMG;IACH,aAAa,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEpD;;;OAGG;IACH,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE3E;;;;;;OAMG;IACH,cAAc,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAEvE;;;;;;OAMG;IACH,qBAAqB,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAE1C;;;OAGG;IACH,6BAA6B,CAAC,CAAC,aAAa,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChG"}

package/dist/models/auth-config.model.d.ts

@@ -363,11 +363,26 @@ export interface AuthConfig {
          *
          * - `allcalls`: Verify the session on every single request. Maximum security, requires a low-latency store (Redis).
          * - `refresh`: Verify the session only during token refresh. High performance with good security.
-         * - `none`: Sessions are created and tracked in the store but never verified during requests.
+         * - `none`: Access tokens are verified statelessly without session lookup. Note: `POST /refresh` always validates session existence in the store even under `'none'`; a revoked or rotated session can never refresh (`401 SESSION_REVOKED`).
          *
          * @default 'refresh'
          */
         checkOn?: 'allcalls' | 'refresh' | 'none';
+        /**
+         * If `true`, a user can only have one active session at a time.
+         * Logging in from a new device/client automatically revokes all previous active sessions
+         * for this user in the `sessionStore` (`revokeAllSessionsForUser`), disconnecting previous devices.
+         *
+         * If `false` (default), multiple concurrent sessions across different devices
+         * are allowed simultaneously. Each device maintains its own session and refresh token.
+         *
+         * @default false
+         */
+        singleSessionPerUser?: boolean;
+        /**
+         * Alias for `singleSessionPerUser`.
+         */
+        singleSession?: boolean;
     };
     /**
      * Optional template store for custom email and UI translations.

package/dist/models/auth-config.model.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-config.model.d.ts","sourceRoot":"","sources":["../../src/models/auth-config.model.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAExE;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,YAAY;IAC3B,6EAA6E;IAC7E,QAAQ,EAAE,MAAM,CAAC;IACjB,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,4BAA4B;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,sCAAsC;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kCAAkC;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,WAAW,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CAC3B;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;;OAKG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAE5B;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CACrC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAC;IAEjB;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAEhB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,UAAU;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE;QACd,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;QACrC,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd;;;;;;WAMG;QACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;IACF;;;;;;;;;;;OAWG;IACH,IAAI,CAAC,EAAE;QACL,qBAAqB;QACrB,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC;IACF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,GAAG,CAAC,EAAE;QACJ,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,oBAAoB,CAAC,EAAE,MAAM,CAAC;KAC/B,CAAC;IACF,KAAK,CAAC,EAAE;QACN;;;;;;;;;;;;;;;;;;WAkBG;QACH,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;QAE5B;;;;;WAKG;QACH,MAAM,CAAC,EAAE,YAAY,CAAC;QAEtB;;;WAGG;QACH,aAAa,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QAE1F;;;WAGG;QACH,iBAAiB,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QAE9F;;;WAGG;QACH,WAAW,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QAE1F;;;WAGG;QACH,qBAAqB,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QAElG;;;;WAIG;QACH,gBAAgB,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;KACnF,CAAC;IACF,KAAK,CAAC,EAAE;QACN,MAAM,CAAC,EAAE;YACP,QAAQ,EAAE,MAAM,CAAC;YACjB,YAAY,EAAE,MAAM,CAAC;YACrB,WAAW,EAAE,MAAM,CAAC;YACpB,SAAS,CAAC,EAAE,MAAM,CAAC;SACpB,CAAC;QACF,MAAM,CAAC,EAAE;YACP,QAAQ,EAAE,MAAM,CAAC;YACjB,YAAY,EAAE,MAAM,CAAC;YACrB,WAAW,EAAE,MAAM,CAAC;SACrB,CAAC;KACH,CAAC;IACF,SAAS,CAAC,EAAE;QACV,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;IACF;;;;;;;;;;;;;;OAcG;IACH,qBAAqB,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,QAAQ,CAAC;IAEnD;;;;;OAKG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAEnC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEhE;;OAEG;IACH,EAAE,CAAC,EAAE;QACH,mEAAmE;QACnE,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB;;;;;;;;;;;;;;;;;;WAkBG;QACH,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,6FAA6F;QAC7F,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,mFAAmF;QACnF,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB;;;;WAIG;QACH,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,qEAAqE;QACrE,UAAU,CAAC,EAAE,MAAM,CAAC;QAGpB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAElB;;;WAGG;QACH,OAAO,CAAC,EAAE,MAAM,CAAC;QAEjB;;;;WAIG;QACH,OAAO,CAAC,EAAE,MAAM,CAAC;QAEjB;;;WAGG;QACH,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IACF;;OAEG;IACH,OAAO,CAAC,EAAE;QACR;;;;;;;;WAQG;QACH,OAAO,CAAC,EAAE,UAAU,GAAG,SAAS,GAAG,MAAM,CAAC;KAC3C,CAAC;IACF;;OAEG;IACH,aAAa,CAAC,EAAE,cAAc,CAAC;IAE/B;;;OAGG;IACH,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAE9B;;;OAGG;IACH,cAAc,CAAC,EAAE,oBAAoB,CAAC;CACvC"}
+{"version":3,"file":"auth-config.model.d.ts","sourceRoot":"","sources":["../../src/models/auth-config.model.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAExE;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,YAAY;IAC3B,6EAA6E;IAC7E,QAAQ,EAAE,MAAM,CAAC;IACjB,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,4BAA4B;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,sCAAsC;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kCAAkC;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,WAAW,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CAC3B;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;;OAKG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAE5B;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CACrC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAC;IAEjB;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAEhB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,UAAU;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE;QACd,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;QACrC,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd;;;;;;WAMG;QACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;IACF;;;;;;;;;;;OAWG;IACH,IAAI,CAAC,EAAE;QACL,qBAAqB;QACrB,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC;IACF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,GAAG,CAAC,EAAE;QACJ,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,oBAAoB,CAAC,EAAE,MAAM,CAAC;KAC/B,CAAC;IACF,KAAK,CAAC,EAAE;QACN;;;;;;;;;;;;;;;;;;WAkBG;QACH,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;QAE5B;;;;;WAKG;QACH,MAAM,CAAC,EAAE,YAAY,CAAC;QAEtB;;;WAGG;QACH,aAAa,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QAE1F;;;WAGG;QACH,iBAAiB,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QAE9F;;;WAGG;QACH,WAAW,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QAE1F;;;WAGG;QACH,qBAAqB,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QAElG;;;;WAIG;QACH,gBAAgB,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;KACnF,CAAC;IACF,KAAK,CAAC,EAAE;QACN,MAAM,CAAC,EAAE;YACP,QAAQ,EAAE,MAAM,CAAC;YACjB,YAAY,EAAE,MAAM,CAAC;YACrB,WAAW,EAAE,MAAM,CAAC;YACpB,SAAS,CAAC,EAAE,MAAM,CAAC;SACpB,CAAC;QACF,MAAM,CAAC,EAAE;YACP,QAAQ,EAAE,MAAM,CAAC;YACjB,YAAY,EAAE,MAAM,CAAC;YACrB,WAAW,EAAE,MAAM,CAAC;SACrB,CAAC;KACH,CAAC;IACF,SAAS,CAAC,EAAE;QACV,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;IACF;;;;;;;;;;;;;;OAcG;IACH,qBAAqB,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,QAAQ,CAAC;IAEnD;;;;;OAKG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAEnC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEhE;;OAEG;IACH,EAAE,CAAC,EAAE;QACH,mEAAmE;QACnE,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB;;;;;;;;;;;;;;;;;;WAkBG;QACH,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,6FAA6F;QAC7F,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,mFAAmF;QACnF,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB;;;;WAIG;QACH,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,qEAAqE;QACrE,UAAU,CAAC,EAAE,MAAM,CAAC;QAGpB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAElB;;;WAGG;QACH,OAAO,CAAC,EAAE,MAAM,CAAC;QAEjB;;;;WAIG;QACH,OAAO,CAAC,EAAE,MAAM,CAAC;QAEjB;;;WAGG;QACH,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IACF;;OAEG;IACH,OAAO,CAAC,EAAE;QACR;;;;;;;;WAQG;QACH,OAAO,CAAC,EAAE,UAAU,GAAG,SAAS,GAAG,MAAM,CAAC;QAE1C;;;;;;;;;WASG;QACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;QAE/B;;WAEG;QACH,aAAa,CAAC,EAAE,OAAO,CAAC;KACzB,CAAC;IACF;;OAEG;IACH,aAAa,CAAC,EAAE,cAAc,CAAC;IAE/B;;;OAGG;IACH,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAE9B;;;OAGG;IACH,cAAc,CAAC,EAAE,oBAAoB,CAAC;CACvC"}

package/dist/models/session.model.d.ts

@@ -24,5 +24,7 @@ export interface SessionInfo {
     ipAddress?: string;
     /** Arbitrary session-level data (e.g. device name, geo-location, etc.). */
     data?: Record<string, unknown>;
+    /** SHA-256 hash of the active refresh token for this session (multi-device support). */
+    refreshTokenHash?: string;
 }
 //# sourceMappingURL=session.model.d.ts.map

package/dist/models/session.model.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.model.d.ts","sourceRoot":"","sources":["../../src/models/session.model.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,8EAA8E;IAC9E,aAAa,EAAE,MAAM,CAAC;IACtB,4CAA4C;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,qDAAqD;IACrD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oCAAoC;IACpC,SAAS,EAAE,IAAI,CAAC;IAChB,gCAAgC;IAChC,SAAS,EAAE,IAAI,CAAC;IAChB,8EAA8E;IAC9E,YAAY,CAAC,EAAE,IAAI,CAAC;IACpB,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2CAA2C;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC"}
+{"version":3,"file":"session.model.d.ts","sourceRoot":"","sources":["../../src/models/session.model.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,8EAA8E;IAC9E,aAAa,EAAE,MAAM,CAAC;IACtB,4CAA4C;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,qDAAqD;IACrD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oCAAoC;IACpC,SAAS,EAAE,IAAI,CAAC;IAChB,gCAAgC;IAChC,SAAS,EAAE,IAAI,CAAC;IAChB,8EAA8E;IAC9E,YAAY,CAAC,EAAE,IAAI,CAAC;IACpB,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2CAA2C;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,wFAAwF;IACxF,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B"}

package/dist/router/admin.router.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin.router.d.ts","sourceRoot":"","sources":["../../src/router/admin.router.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAqB,cAAc,EAAuB,MAAM,SAAS,CAAC;AAMzF,OAAO,EAAE,UAAU,EAAE,MAAM,oCAAoC,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,uCAAuC,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,iDAAiD,CAAC;AACzF,OAAO,EAAE,YAAY,EAAE,MAAM,sCAAsC,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,6CAA6C,CAAC;AACjF,OAAO,EAAE,cAAc,EAAgB,MAAM,wCAAwC,CAAC;AACtF,OAAO,EAAE,oBAAoB,EAAE,MAAM,+CAA+C,CAAC;AACrF,OAAO,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,MAAM,uCAAuC,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAKxE,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAUxD,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG;IAAE,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAEjE;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,iBAAiB,GACzB,YAAY,GACZ,eAAe,GACf,MAAM,GACN,CAAC,CAAC,IAAI,EAAE,mBAAmB,EAAE,SAAS,CAAC,EAAE,sBAAsB,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;AAEpG,MAAM,WAAW,YAAY;IAC3B;;;;;;;;;;;;;OAaG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;;;;;;;;;;OAYG;IACH,YAAY,CAAC,EAAE,iBAAiB,CAAC;IAEjC;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,yEAAyE;IACzE,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B,0FAA0F;IAC1F,SAAS,CAAC,EAAE,sBAAsB,CAAC;IACnC,kFAAkF;IAClF,WAAW,CAAC,EAAE,YAAY,CAAC;IAC3B;;;OAGG;IACH,iBAAiB,CAAC,EAAE,kBAAkB,CAAC;IACvC,4EAA4E;IAC5E,aAAa,CAAC,EAAE,cAAc,CAAC;IAC/B;;;OAGG;IACH,mBAAmB,CAAC,EAAE,oBAAoB,CAAC;IAE3C;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE;QACT,KAAK,EAAE,MAAM,CAAC;QACd,8BAA8B;QAC9B,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC;IAEF;;;OAGG;IACH,WAAW,CAAC,EAAE,YAAY,CAAC;IAE3B;;;;OAIG;IACH,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B,4EAA4E;IAC5E,aAAa,CAAC,EAAE,cAAc,CAAC;IAC/B,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;;;;;;;OAaG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;OAGG;IACH,QAAQ,CAAC,EAAE,YAAY,CAAC;IAExB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAE3B;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;OAEG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IAEjB;;OAEG;IACH,WAAW,CAAC,EAAE,cAAc,CAAC;CAC9B;AAiXD,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,UAAU,EACrB,OAAO,EAAE,YAAY,GACpB,MAAM,CAsmCR"}
+{"version":3,"file":"admin.router.d.ts","sourceRoot":"","sources":["../../src/router/admin.router.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAqB,cAAc,EAAuB,MAAM,SAAS,CAAC;AAMzF,OAAO,EAAE,UAAU,EAAE,MAAM,oCAAoC,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,uCAAuC,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,iDAAiD,CAAC;AACzF,OAAO,EAAE,YAAY,EAAE,MAAM,sCAAsC,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,6CAA6C,CAAC;AACjF,OAAO,EAAE,cAAc,EAAgB,MAAM,wCAAwC,CAAC;AACtF,OAAO,EAAE,oBAAoB,EAAE,MAAM,+CAA+C,CAAC;AACrF,OAAO,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,MAAM,uCAAuC,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAKxE,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAsBxD,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG;IAAE,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAEjE;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,iBAAiB,GACzB,YAAY,GACZ,eAAe,GACf,MAAM,GACN,CAAC,CAAC,IAAI,EAAE,mBAAmB,EAAE,SAAS,CAAC,EAAE,sBAAsB,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;AAEpG,MAAM,WAAW,YAAY;IAC3B;;;;;;;;;;;;;OAaG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;;;;;;;;;;OAYG;IACH,YAAY,CAAC,EAAE,iBAAiB,CAAC;IAEjC;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,yEAAyE;IACzE,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B,0FAA0F;IAC1F,SAAS,CAAC,EAAE,sBAAsB,CAAC;IACnC,kFAAkF;IAClF,WAAW,CAAC,EAAE,YAAY,CAAC;IAC3B;;;OAGG;IACH,iBAAiB,CAAC,EAAE,kBAAkB,CAAC;IACvC,4EAA4E;IAC5E,aAAa,CAAC,EAAE,cAAc,CAAC;IAC/B;;;OAGG;IACH,mBAAmB,CAAC,EAAE,oBAAoB,CAAC;IAE3C;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE;QACT,KAAK,EAAE,MAAM,CAAC;QACd,8BAA8B;QAC9B,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC;IAEF;;;OAGG;IACH,WAAW,CAAC,EAAE,YAAY,CAAC;IAE3B;;;;OAIG;IACH,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B,4EAA4E;IAC5E,aAAa,CAAC,EAAE,cAAc,CAAC;IAC/B,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;;;;;;;OAaG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;OAGG;IACH,QAAQ,CAAC,EAAE,YAAY,CAAC;IAExB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAE3B;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;OAEG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IAEjB;;OAEG;IACH,WAAW,CAAC,EAAE,cAAc,CAAC;CAC9B;AAwXD,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,UAAU,EACrB,OAAO,EAAE,YAAY,GACpB,MAAM,CA0mCR"}

package/dist/router/admin.router.js

@@ -16,6 +16,23 @@ const webhook_action_1 = require("../tools/webhook-action");
 const openapi_1 = require("./openapi");
 const auth_event_names_1 = require("../events/auth-event-names");
 const router_events_1 = require("./router-events");
+/*
+ * Admin login lives here (typically /auth/admin/login when mounted via
+ * AuthConfigurator.buildAllRouters). End-user login lives in ui.router.ts at
+ * /auth/ui/login. Keep these two audiences distinct in code and docs.
+ */
+function toSingleString(val, fallback = '') {
+    if (typeof val === 'string')
+        return val;
+    if (Array.isArray(val) && val.length > 0 && typeof val[0] === 'string')
+        return val[0];
+    return fallback;
+}
+function toSafeInt(val, fallback) {
+    const str = toSingleString(val);
+    const parsed = parseInt(str, 10);
+    return Number.isFinite(parsed) && parsed >= 0 ? parsed : fallback;
+}
 /**
  * Id of the admin the `accessPolicy` guard authorized for this request (the
  * actor of a privilege change).  Only the policy guard sets it, in
@@ -134,8 +151,15 @@ function buildPolicyGuard(policy, userStore, jwtSecret, rbacStore, loginPath, co
                 const cookieHeader = req.headers.cookie ?? '';
                 cookies = cookieHeader.split(';').reduce((acc, part) => {
                     const [key, ...val] = part.trim().split('=');
-                    if (key)
-                        acc[key.trim()] = decodeURIComponent(val.join('='));
+                    if (key) {
+                        const rawVal = val.join('=');
+                        try {
+                            acc[key.trim()] = decodeURIComponent(rawVal);
+                        }
+                        catch {
+                            acc[key.trim()] = rawVal;
+                        }
+                    }
                     return acc;
                 }, {});
             }
@@ -371,7 +395,7 @@ function createAdminRouter(userStore, options) {
     // ── Local Login Handler (Self-contained Auth) ──────────────────────────
     if (sessionBased && secret) {
         router.post('/login', async (req, res) => {
-            const { email, password } = req.body;
+            const { email, password } = (req.body ?? {});
             if (!password) {
                 res.status(400).json({ error: 'Password required' });
                 return;
@@ -587,9 +611,9 @@ function createAdminRouter(userStore, options) {
     // GET /admin/api/users?limit=&offset=
     router.get('/api/users', guard, async (req, res) => {
         try {
-            const limit = Math.min(parseInt(req.query['limit'] || '20', 10), 100);
-            const offset = parseInt(req.query['offset'] || '0', 10);
-            const filter = (req.query['filter'] || '').toLowerCase().trim();
+            const limit = Math.min(Math.max(toSafeInt(req.query['limit'], 20), 1), 100);
+            const offset = Math.max(toSafeInt(req.query['offset'], 0), 0);
+            const filter = toSingleString(req.query['filter']).toLowerCase().trim();
             if (!userStore.listUsers) {
                 res.status(501).json({ error: 'IUserStore.listUsers is not implemented', users: [], total: 0 });
                 return;
@@ -662,7 +686,7 @@ function createAdminRouter(userStore, options) {
     // POST /admin/api/2fa-policy — bulk set / clear the require-2FA flag on all users
     router.post('/api/2fa-policy', guard, async (req, res) => {
         try {
-            const { required } = req.body;
+            const { required } = (req.body ?? {});
             if (typeof required !== 'boolean') {
                 res.status(400).json({ error: '"required" must be a boolean' });
                 return;
@@ -762,7 +786,7 @@ function createAdminRouter(userStore, options) {
             return;
         }
         try {
-            const { role, tenantId } = req.body;
+            const { role, tenantId } = (req.body ?? {});
             if (!role) {
                 res.status(400).json({ error: 'role is required' });
                 return;
@@ -1024,9 +1048,9 @@ function createAdminRouter(userStore, options) {
             return;
         }
         try {
-            const limit = Math.min(parseInt(req.query['limit'] || '20', 10), 100);
-            const offset = parseInt(req.query['offset'] || '0', 10);
-            const filter = (req.query['filter'] || '').toLowerCase().trim();
+            const limit = Math.min(Math.max(toSafeInt(req.query['limit'], 20), 1), 100);
+            const offset = Math.max(toSafeInt(req.query['offset'], 0), 0);
+            const filter = toSingleString(req.query['filter']).toLowerCase().trim();
             if (!options.sessionStore.getAllSessions) {
                 res.status(501).json({ error: 'ISessionStore.getAllSessions is not implemented', sessions: [], total: 0 });
                 return;
@@ -1092,7 +1116,7 @@ function createAdminRouter(userStore, options) {
             return;
         }
         try {
-            const { name, permissions } = req.body;
+            const { name, permissions } = (req.body ?? {});
             if (!name) {
                 res.status(400).json({ error: 'name is required' });
                 return;
@@ -1140,7 +1164,7 @@ function createAdminRouter(userStore, options) {
             return;
         }
         try {
-            const { name, isActive } = req.body;
+            const { name, isActive } = (req.body ?? {});
             if (!name) {
                 res.status(400).json({ error: 'name is required' });
                 return;
@@ -1188,7 +1212,7 @@ function createAdminRouter(userStore, options) {
             return;
         }
         try {
-            const { userId } = req.body;
+            const { userId } = (req.body ?? {});
             if (!userId) {
                 res.status(400).json({ error: 'userId is required' });
                 return;
@@ -1222,9 +1246,9 @@ function createAdminRouter(userStore, options) {
             return;
         }
         try {
-            const limit = Math.min(parseInt(req.query['limit'] || '20', 10), 100);
-            const offset = parseInt(req.query['offset'] || '0', 10);
-            const filter = (req.query['filter'] || '').toLowerCase().trim();
+            const limit = Math.min(Math.max(toSafeInt(req.query['limit'], 20), 1), 100);
+            const offset = Math.max(toSafeInt(req.query['offset'], 0), 0);
+            const filter = toSingleString(req.query['filter']).toLowerCase().trim();
             if (!options.apiKeyStore.listAll) {
                 res.status(501).json({ error: 'IApiKeyStore.listAll is not implemented', keys: [], total: 0 });
                 return;
@@ -1265,7 +1289,7 @@ function createAdminRouter(userStore, options) {
             return;
         }
         try {
-            const { name, serviceId, scopes, allowedIps, expiresAt } = req.body;
+            const { name, serviceId, scopes, allowedIps, expiresAt } = (req.body ?? {});
             if (!name) {
                 res.status(400).json({ error: 'name is required' });
                 return;
@@ -1339,8 +1363,8 @@ function createAdminRouter(userStore, options) {
             return;
         }
         try {
-            const limit = Math.min(parseInt(req.query['limit'] || '20', 10), 100);
-            const offset = parseInt(req.query['offset'] || '0', 10);
+            const limit = Math.min(Math.max(toSafeInt(req.query['limit'], 20), 1), 100);
+            const offset = Math.max(toSafeInt(req.query['offset'], 0), 0);
             if (!options.webhookStore.listAll) {
                 res.status(501).json({ error: 'IWebhookStore.listAll is not implemented', webhooks: [], total: 0 });
                 return;
@@ -1369,7 +1393,7 @@ function createAdminRouter(userStore, options) {
             return;
         }
         try {
-            const { url, events, secret, tenantId, isActive, maxRetries, retryDelayMs } = req.body;
+            const { url, events, secret, tenantId, isActive, maxRetries, retryDelayMs } = (req.body ?? {});
             if (!url) {
                 res.status(400).json({ error: 'url is required' });
                 return;
@@ -1440,7 +1464,7 @@ function createAdminRouter(userStore, options) {
         // POST /admin/api/templates/mail — create or update a mail template
         router.post('/api/templates/mail', guard, async (req, res) => {
             try {
-                const { id, baseHtml, baseText, translations } = req.body;
+                const { id, baseHtml, baseText, translations } = (req.body ?? {});
                 if (!id) {
                     res.status(400).json({ error: 'id is required' });
                     return;
@@ -1465,7 +1489,7 @@ function createAdminRouter(userStore, options) {
         // POST /admin/api/templates/ui — update UI translations for a page
         router.post('/api/templates/ui', guard, async (req, res) => {
             try {
-                const { page, translations } = req.body;
+                const { page, translations } = (req.body ?? {});
                 if (!page || !translations) {
                     res.status(400).json({ error: 'page and translations are required' });
                     return;