@cobaltcore-dev/aurora 1.1.0 → 1.2.0

package/dist/server/index.js

@@ -7,11 +7,7 @@ var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 var __commonJS = (cb, mod) => function __require() {
-  try {
-    return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
-  } catch (e) {
-    throw mod = 0, e;
-  }
+  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
 };
 var __export = (target, all) => {
   for (var name in all)
@@ -260,7 +256,7 @@ var require_error = __commonJS({
       }
     };
     exports2.SignalOpenstackError = SignalOpenstackError4;
-    var SignalOpenstackApiError = class SignalOpenstackApiError extends Error {
+    var SignalOpenstackApiError2 = class SignalOpenstackApiError extends Error {
       static {
         __name(this, "SignalOpenstackApiError");
       }
@@ -271,7 +267,7 @@ var require_error = __commonJS({
         this.statusCode = statusCode;
       }
     };
-    exports2.SignalOpenstackApiError = SignalOpenstackApiError;
+    exports2.SignalOpenstackApiError = SignalOpenstackApiError2;
   }
 });
 
@@ -27346,7 +27342,7 @@ var require_esm = __commonJS({
     Object.defineProperty(exports2, "__esModule", {
       value: true
     });
-    exports2.validateAndEncodeResourceId = exports2.encodeOpenstackPath = exports2.encodeOpenstackPathSegment = exports2.redactSensitiveData = exports2.loggerConfig = exports2.logger = exports2.SignalOpenstackError = exports2.SignalOpenstackSession = void 0;
+    exports2.validateAndEncodeResourceId = exports2.encodeOpenstackPath = exports2.encodeOpenstackPathSegment = exports2.redactSensitiveData = exports2.loggerConfig = exports2.logger = exports2.SignalOpenstackApiError = exports2.SignalOpenstackError = exports2.SignalOpenstackSession = void 0;
     var session_1 = require_session();
     Object.defineProperty(exports2, "SignalOpenstackSession", {
       enumerable: true,
@@ -27361,6 +27357,12 @@ var require_esm = __commonJS({
         return error_1.SignalOpenstackError;
       }, "get")
     });
+    Object.defineProperty(exports2, "SignalOpenstackApiError", {
+      enumerable: true,
+      get: /* @__PURE__ */ __name(function() {
+        return error_1.SignalOpenstackApiError;
+      }, "get")
+    });
     var logger_1 = require_logger();
     Object.defineProperty(exports2, "logger", {
       enumerable: true,
@@ -28593,11 +28595,69 @@ var import_zod2 = require("zod");
 // src/server/trpc.ts
 var import_server = require("@trpc/server");
 var import_zod = require("zod");
+var import_signal_openstack = __toESM(require_esm());
 var t = import_server.initTRPC.context().create();
+var openstackErrorMiddleware = t.middleware(async ({ next }) => {
+  const result = await next();
+  if (!result.ok) {
+    const cause = result.error.cause;
+    if (cause instanceof import_signal_openstack.SignalOpenstackApiError) {
+      if (cause.statusCode === 401) {
+        return {
+          ...result,
+          error: new import_server.TRPCError({
+            code: "UNAUTHORIZED",
+            message: "Session expired or invalid. Please log in again.",
+            cause
+          })
+        };
+      }
+      if (cause.statusCode === 400) {
+        return {
+          ...result,
+          error: new import_server.TRPCError({
+            code: "BAD_REQUEST",
+            message: "The OpenStack request was invalid.",
+            cause
+          })
+        };
+      }
+      if (cause.statusCode === 404) {
+        return {
+          ...result,
+          error: new import_server.TRPCError({
+            code: "NOT_FOUND",
+            message: "Resource not found or not accessible. This can happen if you switched domains in another tab.",
+            cause
+          })
+        };
+      }
+      if (cause.statusCode === 403) {
+        return {
+          ...result,
+          error: new import_server.TRPCError({
+            code: "FORBIDDEN",
+            message: "Access denied. You may not have the required role assignment.",
+            cause
+          })
+        };
+      }
+      return {
+        ...result,
+        error: new import_server.TRPCError({
+          code: "INTERNAL_SERVER_ERROR",
+          message: "An unexpected OpenStack error occurred",
+          cause
+        })
+      };
+    }
+  }
+  return result;
+});
 var router = t.router;
 var auroraRouter = t.router;
 var mergeRouters = t.mergeRouters;
-var publicProcedure = t.procedure;
+var publicProcedure = t.procedure.use(openstackErrorMiddleware);
 var createCallerFactory = t.createCallerFactory;
 var protectedProcedure = publicProcedure.use(/* @__PURE__ */ __name(async function isAuthenticated(opts) {
   if (opts.ctx.validateSession() === false) {
@@ -28717,6 +28777,7 @@ var sessionRouter = {
       domain
     };
   }),
+  // Errors from rescopeSession are handled by openstackErrorMiddleware
   setCurrentScope: protectedProcedure.input(discriminatedSchema).mutation(async ({ input, ctx }) => {
     switch (input.type) {
       case "domain": {
@@ -28724,9 +28785,15 @@ var sessionRouter = {
           domainId: input.domainId
         });
         const token = session?.getToken();
+        if (!token?.tokenData.domain) {
+          throw new import_server2.TRPCError({
+            code: "NOT_FOUND",
+            message: "Failed to rescope to the requested domain."
+          });
+        }
         return {
           project: null,
-          domain: token?.tokenData.domain
+          domain: token.tokenData.domain
         };
       }
       case "project": {
@@ -28734,9 +28801,15 @@ var sessionRouter = {
           projectId: input.projectId
         });
         const token = session?.getToken();
+        if (!token?.tokenData.project) {
+          throw new import_server2.TRPCError({
+            code: "NOT_FOUND",
+            message: "Failed to rescope to the requested project."
+          });
+        }
         return {
-          project: token?.tokenData.project,
-          domain: token?.tokenData.project?.domain
+          project: token.tokenData.project,
+          domain: token.tokenData.project.domain
         };
       }
       case "unscoped": {
@@ -29859,7 +29932,8 @@ var imagesPaginatedResponseSchema = import_zod4.z.object({
   images: import_zod4.z.array(imageSchema),
   first: import_zod4.z.string().optional(),
   next: import_zod4.z.string().optional(),
-  schema: import_zod4.z.string().optional()
+  schema: import_zod4.z.string().optional(),
+  totalCount: import_zod4.z.number().optional()
 });
 
 // src/server/Compute/routers/imageRouter.ts
@@ -29874,22 +29948,26 @@ var imageRouter = {
       validateGlanceService(glance);
       const FRONTEND_PAGE_SIZE = 50;
       const OPENSTACK_PAGE_SIZE = 100;
-      const MIN_RESULTS_WHEN_SEARCHING = 50;
       const MAX_PAGES_TO_SEARCH = 1e3;
       const allImages = [];
       const hasSearchTerm = queryInput.name && queryInput.name.trim();
       const queryParams = new URLSearchParams();
-      const minimalQuery = {
+      const apiQuery = {
         sort_key: queryInput.sort_key,
         sort_dir: queryInput.sort_dir,
         sort: queryInput.sort,
         limit: OPENSTACK_PAGE_SIZE,
-        marker
+        // Only pass single-value filters to API (multi-value filters start with "in:")
+        status: queryInput.status?.startsWith("in:") ? void 0 : queryInput.status,
+        visibility: queryInput.visibility === "all" ? void 0 : queryInput.visibility,
+        disk_format: queryInput.disk_format?.startsWith("in:") ? void 0 : queryInput.disk_format,
+        container_format: queryInput.container_format?.startsWith("in:") ? void 0 : queryInput.container_format,
+        protected: queryInput.protected,
+        owner: queryInput.owner
       };
-      applyImageQueryParams(queryParams, minimalQuery);
+      applyImageQueryParams(queryParams, apiQuery);
       let currentUrl = `v2/images?${queryParams.toString()}`;
       let pageCount = 0;
-      let nextMarker;
       while (currentUrl && pageCount < MAX_PAGES_TO_SEARCH) {
         const response = await glance.get(currentUrl).catch((error) => {
           throw mapErrorResponseToTRPCError(error, {
@@ -29902,41 +29980,7 @@ var imageRouter = {
         }
         allImages.push(...parsedData.data.images);
         pageCount++;
-        if (hasSearchTerm) {
-          let filteredSoFar = filterBySearchParams(allImages, queryInput.name, [
-            "name"
-          ]);
-          if (queryInput.visibility && queryInput.visibility !== "all") {
-            filteredSoFar = filteredSoFar.filter((img) => img.visibility === queryInput.visibility);
-          }
-          if (queryInput.status) {
-            const values = parseMultiValue(queryInput.status);
-            filteredSoFar = filteredSoFar.filter((img) => values.includes(img.status ?? ""));
-          }
-          if (queryInput.disk_format) {
-            const values = parseMultiValue(queryInput.disk_format);
-            filteredSoFar = filteredSoFar.filter((img) => values.includes(img.disk_format ?? ""));
-          }
-          if (queryInput.container_format) {
-            const values = parseMultiValue(queryInput.container_format);
-            filteredSoFar = filteredSoFar.filter((img) => values.includes(img.container_format ?? ""));
-          }
-          if (queryInput.protected !== void 0 && queryInput.protected !== null) {
-            const wantProtected = queryInput.protected === "true";
-            filteredSoFar = filteredSoFar.filter((img) => !!img.protected === wantProtected);
-          }
-          if (queryInput.owner) {
-            filteredSoFar = filteredSoFar.filter((img) => img.owner === queryInput.owner);
-          }
-          if (filteredSoFar.length >= MIN_RESULTS_WHEN_SEARCHING) {
-            nextMarker = parsedData.data.next;
-            break;
-          }
-        }
-        if (!hasSearchTerm) {
-          nextMarker = parsedData.data.next;
-          break;
-        }
+        validateRelativeUrl(parsedData.data.next, "pagination URL");
         currentUrl = parsedData.data.next;
       }
       let filteredImages = allImages;
@@ -29967,16 +30011,21 @@ var imageRouter = {
       if (queryInput.owner) {
         filteredImages = filteredImages.filter((img) => img.owner === queryInput.owner);
       }
-      const startIndex = 0;
-      const endIndex = FRONTEND_PAGE_SIZE;
+      let startIndex = 0;
+      if (marker) {
+        const markerIndex = filteredImages.findIndex((img) => img.id === marker);
+        startIndex = markerIndex >= 0 ? markerIndex + 1 : 0;
+      }
+      const endIndex = startIndex + FRONTEND_PAGE_SIZE;
       const paginatedImages = filteredImages.slice(startIndex, endIndex);
-      const hasMore = filteredImages.length > FRONTEND_PAGE_SIZE || !!nextMarker;
-      const nextPageMarker = filteredImages.length > FRONTEND_PAGE_SIZE ? filteredImages[FRONTEND_PAGE_SIZE - 1]?.id : nextMarker;
+      const hasMore = endIndex < filteredImages.length;
+      const nextPageMarker = hasMore ? filteredImages[endIndex - 1]?.id : void 0;
       return {
         images: paginatedImages,
         first: void 0,
         next: hasMore ? nextPageMarker : void 0,
-        schema: "/v2/schemas/images"
+        schema: "/v2/schemas/images",
+        totalCount: filteredImages.length
       };
     }, "list images");
   }),
@@ -30112,16 +30161,25 @@ var imageRouter = {
       validateGlanceService(glance);
       const fileStream = import_node_stream.Readable.fromWeb(input);
       const { validatedImageId, validatedFileSize, validatedFile } = validateUploadInput(imageId, fileSize, fileStream);
-      uploadProgress.set(validatedImageId, {
+      const token = openstackSession.getToken();
+      const tokenProjectId = token?.tokenData.project?.id;
+      if (!tokenProjectId) {
+        throw new import_server6.TRPCError({
+          code: "UNAUTHORIZED",
+          message: "Project scope required for upload progress tracking"
+        });
+      }
+      const scopedUploadId = `${tokenProjectId}:${validatedImageId}`;
+      uploadProgress.set(scopedUploadId, {
         uploaded: 0,
         total: validatedFileSize
       });
       try {
-        const progress = uploadProgress.get(validatedImageId);
+        const progress = uploadProgress.get(scopedUploadId);
         const progressTracker = new import_node_stream.Transform({
           transform(chunk, _encoding, callback) {
             progress.uploaded += chunk.length;
-            uploadProgressEmitter.emit(`progress:${validatedImageId}`, {
+            uploadProgressEmitter.emit(`progress:${scopedUploadId}`, {
               uploaded: progress.uploaded,
               total: progress.total,
               percent: progress.total > 0 ? Math.round(progress.uploaded / progress.total * 100) : 0
@@ -30155,24 +30213,39 @@ var imageRouter = {
           progressTracker.destroy();
           throw ImageErrorHandlers.upload(uploadResponse, validatedImageId, "application/octet-stream");
         }
-        uploadProgressEmitter.emit(`progress:${validatedImageId}:complete`);
+        uploadProgressEmitter.emit(`progress:${scopedUploadId}:complete`);
         return {
           success: true,
           imageId: validatedImageId
         };
       } catch (error) {
-        uploadProgressEmitter.emit(`progress:${validatedImageId}:error`, error);
+        uploadProgressEmitter.emit(`progress:${scopedUploadId}:error`, error);
         throw ImageErrorHandlers.upload(error, validatedImageId, "application/octet-stream");
       } finally {
-        uploadProgress.delete(validatedImageId);
+        uploadProgress.delete(scopedUploadId);
       }
     }, "upload image");
   }),
   watchUploadProgress: projectScopedProcedure.input(import_zod5.z.object({
     uploadId: import_zod5.z.string()
-  })).subscription(async function* ({ input }) {
+  })).subscription(async function* ({ input, ctx }) {
     const uploadId = input.uploadId;
-    const current = uploadProgress.get(uploadId);
+    if (uploadId.includes(":")) {
+      throw new import_server6.TRPCError({
+        code: "BAD_REQUEST",
+        message: "Invalid uploadId format"
+      });
+    }
+    const token = ctx.openstack?.getToken();
+    const projectId = token?.tokenData.project?.id;
+    if (!projectId) {
+      throw new import_server6.TRPCError({
+        code: "UNAUTHORIZED",
+        message: "Project scope required for upload progress tracking"
+      });
+    }
+    const scopedUploadId = `${projectId}:${uploadId}`;
+    const current = uploadProgress.get(scopedUploadId);
     if (current) {
       yield {
         ...current,
@@ -30200,9 +30273,9 @@ var imageRouter = {
       waitResolver?.();
       waitResolver = null;
     }, "onError");
-    uploadProgressEmitter.on(`progress:${uploadId}`, onProgress);
-    uploadProgressEmitter.on(`progress:${uploadId}:complete`, onComplete);
-    uploadProgressEmitter.on(`progress:${uploadId}:error`, onError);
+    uploadProgressEmitter.on(`progress:${scopedUploadId}`, onProgress);
+    uploadProgressEmitter.on(`progress:${scopedUploadId}:complete`, onComplete);
+    uploadProgressEmitter.on(`progress:${scopedUploadId}:error`, onError);
     try {
       while (!isComplete && !isError) {
         while (queue.length > 0) {
@@ -30229,9 +30302,9 @@ var imageRouter = {
         throw error;
       }
     } finally {
-      uploadProgressEmitter.off(`progress:${uploadId}`, onProgress);
-      uploadProgressEmitter.off(`progress:${uploadId}:complete`, onComplete);
-      uploadProgressEmitter.off(`progress:${uploadId}:error`, onError);
+      uploadProgressEmitter.off(`progress:${scopedUploadId}`, onProgress);
+      uploadProgressEmitter.off(`progress:${scopedUploadId}:complete`, onComplete);
+      uploadProgressEmitter.off(`progress:${scopedUploadId}:error`, onError);
     }
   }),
   updateImage: projectScopedProcedure.input(updateImageInputSchema).mutation(async ({ input, ctx }) => {
@@ -30772,7 +30845,7 @@ var ERROR_CODES = {
 };
 
 // src/server/Compute/helpers/flavorHelpers.ts
-var import_signal_openstack = __toESM(require_esm());
+var import_signal_openstack2 = __toESM(require_esm());
 function isErrorWithStatus(error) {
   return typeof error === "object" && error !== null && ("statusCode" in error || "status" in error);
 }
@@ -31127,9 +31200,9 @@ async function getFlavorById(compute, flavorId) {
   }
   let encodedId;
   try {
-    encodedId = (0, import_signal_openstack.validateAndEncodeResourceId)(flavorId, "Flavor");
+    encodedId = (0, import_signal_openstack2.validateAndEncodeResourceId)(flavorId, "Flavor");
   } catch (error) {
-    if (error instanceof import_signal_openstack.SignalOpenstackError) {
+    if (error instanceof import_signal_openstack2.SignalOpenstackError) {
       throw new import_server7.TRPCError({
         code: "BAD_REQUEST",
         message: ERROR_CODES.GET_FLAVOR_DETAILS_INVALID_ID,
@@ -31243,9 +31316,9 @@ async function deleteFlavor(compute, flavorId) {
   }
   let encodedId;
   try {
-    encodedId = (0, import_signal_openstack.validateAndEncodeResourceId)(flavorId, "Flavor");
+    encodedId = (0, import_signal_openstack2.validateAndEncodeResourceId)(flavorId, "Flavor");
   } catch (error) {
-    if (error instanceof import_signal_openstack.SignalOpenstackError) {
+    if (error instanceof import_signal_openstack2.SignalOpenstackError) {
       throw new import_server7.TRPCError({
         code: "BAD_REQUEST",
         message: ERROR_CODES.DELETE_FLAVOR_INVALID_ID,
@@ -31274,9 +31347,9 @@ __name(deleteFlavor, "deleteFlavor");
 async function createExtraSpecs(compute, flavorId, extra_specs) {
   let encodedId;
   try {
-    encodedId = (0, import_signal_openstack.validateAndEncodeResourceId)(flavorId, "Flavor");
+    encodedId = (0, import_signal_openstack2.validateAndEncodeResourceId)(flavorId, "Flavor");
   } catch (error) {
-    if (error instanceof import_signal_openstack.SignalOpenstackError) {
+    if (error instanceof import_signal_openstack2.SignalOpenstackError) {
       throw new import_server7.TRPCError({
         code: "BAD_REQUEST",
         message: ERROR_CODES.CREATE_EXTRA_SPECS_FAILED,
@@ -31314,9 +31387,9 @@ __name(createExtraSpecs, "createExtraSpecs");
 async function getExtraSpecs(compute, flavorId) {
   let encodedId;
   try {
-    encodedId = (0, import_signal_openstack.validateAndEncodeResourceId)(flavorId, "Flavor");
+    encodedId = (0, import_signal_openstack2.validateAndEncodeResourceId)(flavorId, "Flavor");
   } catch (error) {
-    if (error instanceof import_signal_openstack.SignalOpenstackError) {
+    if (error instanceof import_signal_openstack2.SignalOpenstackError) {
       throw new import_server7.TRPCError({
         code: "BAD_REQUEST",
         message: ERROR_CODES.GET_EXTRA_SPECS_FAILED,
@@ -31352,10 +31425,10 @@ __name(getExtraSpecs, "getExtraSpecs");
 async function deleteExtraSpec(compute, flavorId, key) {
   let encodedId, encodedKey;
   try {
-    encodedId = (0, import_signal_openstack.validateAndEncodeResourceId)(flavorId, "Flavor");
-    encodedKey = (0, import_signal_openstack.encodeOpenstackPathSegment)(key, "Extra spec key");
+    encodedId = (0, import_signal_openstack2.validateAndEncodeResourceId)(flavorId, "Flavor");
+    encodedKey = (0, import_signal_openstack2.encodeOpenstackPathSegment)(key, "Extra spec key");
   } catch (error) {
-    if (error instanceof import_signal_openstack.SignalOpenstackError) {
+    if (error instanceof import_signal_openstack2.SignalOpenstackError) {
       throw new import_server7.TRPCError({
         code: "BAD_REQUEST",
         message: ERROR_CODES.DELETE_EXTRA_SPEC_FAILED,
@@ -31380,9 +31453,9 @@ __name(deleteExtraSpec, "deleteExtraSpec");
 async function getFlavorAccess(compute, flavorId) {
   let encodedId;
   try {
-    encodedId = (0, import_signal_openstack.validateAndEncodeResourceId)(flavorId, "Flavor");
+    encodedId = (0, import_signal_openstack2.validateAndEncodeResourceId)(flavorId, "Flavor");
   } catch (error) {
-    if (error instanceof import_signal_openstack.SignalOpenstackError) {
+    if (error instanceof import_signal_openstack2.SignalOpenstackError) {
       throw new import_server7.TRPCError({
         code: "BAD_REQUEST",
         message: ERROR_CODES.GET_FLAVOR_ACCESS_FAILED,
@@ -31418,9 +31491,9 @@ __name(getFlavorAccess, "getFlavorAccess");
 async function addTenantAccess(compute, flavorId, tenantId) {
   let encodedId;
   try {
-    encodedId = (0, import_signal_openstack.validateAndEncodeResourceId)(flavorId, "Flavor");
+    encodedId = (0, import_signal_openstack2.validateAndEncodeResourceId)(flavorId, "Flavor");
   } catch (error) {
-    if (error instanceof import_signal_openstack.SignalOpenstackError) {
+    if (error instanceof import_signal_openstack2.SignalOpenstackError) {
       throw new import_server7.TRPCError({
         code: "BAD_REQUEST",
         message: ERROR_CODES.ADD_TENANT_ACCESS_FAILED,
@@ -31461,9 +31534,9 @@ __name(addTenantAccess, "addTenantAccess");
 async function removeTenantAccess(compute, flavorId, tenantId) {
   let encodedId;
   try {
-    encodedId = (0, import_signal_openstack.validateAndEncodeResourceId)(flavorId, "Flavor");
+    encodedId = (0, import_signal_openstack2.validateAndEncodeResourceId)(flavorId, "Flavor");
   } catch (error) {
-    if (error instanceof import_signal_openstack.SignalOpenstackError) {
+    if (error instanceof import_signal_openstack2.SignalOpenstackError) {
       throw new import_server7.TRPCError({
         code: "BAD_REQUEST",
         message: ERROR_CODES.REMOVE_TENANT_ACCESS_FAILED,
@@ -31504,7 +31577,7 @@ __name(removeTenantAccess, "removeTenantAccess");
 
 // src/server/Compute/routers/flavorRouter.ts
 var import_server8 = require("@trpc/server");
-var import_signal_openstack2 = __toESM(require_esm());
+var import_signal_openstack3 = __toESM(require_esm());
 var flavorRouter = {
   getFlavorById: projectScopedProcedure.input(import_zod9.z.object({
     project_id: import_zod9.z.string(),
@@ -31749,9 +31822,9 @@ var flavorRouter = {
       }
       let encodedId;
       try {
-        encodedId = (0, import_signal_openstack2.validateAndEncodeResourceId)(flavorId, "Flavor");
+        encodedId = (0, import_signal_openstack3.validateAndEncodeResourceId)(flavorId, "Flavor");
       } catch (error) {
-        if (error instanceof import_signal_openstack2.SignalOpenstackError) {
+        if (error instanceof import_signal_openstack3.SignalOpenstackError) {
           throw new import_server8.TRPCError({
             code: "BAD_REQUEST",
             message: ERROR_CODES.GET_FLAVOR_ACCESS_FAILED,
@@ -34421,7 +34494,7 @@ var cephUploadProcedure = protectedProcedure.use(/* @__PURE__ */ __name(async fu
 
 // src/server/Storage/helpers/s3ErrorMapper.ts
 var import_server13 = require("@trpc/server");
-var import_signal_openstack3 = __toESM(require_esm());
+var import_signal_openstack4 = __toESM(require_esm());
 var S3_ERROR_MAP = {
   NoSuchBucket: "NOT_FOUND",
   NoSuchKey: "NOT_FOUND",
@@ -34429,6 +34502,7 @@ var S3_ERROR_MAP = {
   NoSuchVersion: "NOT_FOUND",
   NoSuchBucketPolicy: "NOT_FOUND",
   NoSuchCORSConfiguration: "NOT_FOUND",
+  NoSuchLifecycleConfiguration: "NOT_FOUND",
   BucketAlreadyExists: "CONFLICT",
   BucketAlreadyOwnedByYou: "CONFLICT",
   BucketNotEmpty: "PRECONDITION_FAILED",
@@ -34458,7 +34532,7 @@ function mapS3ErrorToTRPCError(error, context) {
   const errorCode = s3Error.Code ?? s3Error.name ?? "";
   const trpcCode = S3_ERROR_MAP[errorCode] ?? "INTERNAL_SERVER_ERROR";
   if (!S3_ERROR_MAP[errorCode] && errorCode) {
-    import_signal_openstack3.logger.warn("Unmapped S3 error code", {
+    import_signal_openstack4.logger.warn("Unmapped S3 error code", {
       errorCode,
       operation: context.operation,
       errorName: s3Error.name
@@ -34884,6 +34958,187 @@ var setCorsInputSchema = projectScopedInputSchema.extend({
 var deleteCorsInputSchema = projectScopedInputSchema.extend({
   bucketName: existingBucketNameSchema
 });
+var lifecycleRuleStatusSchema = import_zod13.z.enum([
+  "Enabled",
+  "Disabled"
+]);
+var lifecycleExpirationSchema = import_zod13.z.object({
+  Days: import_zod13.z.number().int().min(1).max(3650).optional(),
+  Date: import_zod13.z.string().datetime({
+    offset: true
+  }).optional(),
+  ExpiredObjectDeleteMarker: import_zod13.z.boolean().optional()
+}).refine((val) => {
+  return val.Days !== void 0 || val.Date !== void 0 || val.ExpiredObjectDeleteMarker !== void 0;
+}, "Expiration must specify either Days, Date, or ExpiredObjectDeleteMarker").refine((val) => {
+  return !(val.Days !== void 0 && val.Date !== void 0);
+}, "Expiration cannot specify both Days and Date").refine((val) => !(val.ExpiredObjectDeleteMarker !== void 0 && (val.Days !== void 0 || val.Date !== void 0)), "ExpiredObjectDeleteMarker cannot be combined with Days or Date");
+var lifecycleTransitionSchema = import_zod13.z.object({
+  Days: import_zod13.z.number().int().min(1).optional(),
+  Date: import_zod13.z.string().datetime({
+    offset: true
+  }).optional(),
+  StorageClass: import_zod13.z.string().min(1)
+}).refine((val) => {
+  return val.Days !== void 0 !== (val.Date !== void 0);
+}, "Transition must specify exactly one of Days or Date");
+var lifecycleNoncurrentVersionExpirationSchema = import_zod13.z.object({
+  NoncurrentDays: import_zod13.z.number().int().min(1),
+  NewerNoncurrentVersions: import_zod13.z.number().int().min(1).optional()
+});
+var lifecycleNoncurrentVersionTransitionSchema = import_zod13.z.object({
+  NoncurrentDays: import_zod13.z.number().int().min(1),
+  StorageClass: import_zod13.z.string().min(1),
+  NewerNoncurrentVersions: import_zod13.z.number().int().min(1).optional()
+});
+var lifecycleAbortIncompleteMultipartUploadSchema = import_zod13.z.object({
+  DaysAfterInitiation: import_zod13.z.number().int().min(1)
+});
+var lifecycleTagSchema = import_zod13.z.object({
+  Key: import_zod13.z.string().min(1).max(128),
+  Value: import_zod13.z.string().max(256)
+});
+var lifecycleFilterAndSchema = import_zod13.z.object({
+  Prefix: import_zod13.z.string().optional(),
+  Tags: import_zod13.z.array(lifecycleTagSchema).optional(),
+  ObjectSizeGreaterThan: import_zod13.z.number().int().min(0).optional(),
+  ObjectSizeLessThan: import_zod13.z.number().int().min(0).optional()
+}).refine((val) => {
+  const predicateCount = (val.Prefix !== void 0 && val.Prefix !== "" ? 1 : 0) + (val.Tags?.length ?? 0) + (val.ObjectSizeGreaterThan !== void 0 ? 1 : 0) + (val.ObjectSizeLessThan !== void 0 ? 1 : 0);
+  return predicateCount >= 2;
+}, {
+  message: "And filter must contain at least 2 predicates"
+});
+var lifecycleFilterSchema = import_zod13.z.object({
+  Prefix: import_zod13.z.string().optional(),
+  Tag: lifecycleTagSchema.optional(),
+  ObjectSizeGreaterThan: import_zod13.z.number().int().min(0).optional(),
+  ObjectSizeLessThan: import_zod13.z.number().int().min(0).optional(),
+  And: lifecycleFilterAndSchema.optional()
+}).refine((val) => {
+  const topLevelConditions = [
+    val.Prefix !== void 0,
+    val.Tag !== void 0,
+    val.ObjectSizeGreaterThan !== void 0,
+    val.ObjectSizeLessThan !== void 0
+  ].filter(Boolean).length;
+  if (topLevelConditions > 1) {
+    return false;
+  }
+  if (val.And && topLevelConditions > 0) {
+    return false;
+  }
+  return true;
+}, {
+  message: "Multiple filter conditions (Prefix, Tag, ObjectSize) must be wrapped in an And clause"
+});
+var lifecycleRuleSchema = import_zod13.z.object({
+  ID: import_zod13.z.string().max(255, "Rule ID must be at most 255 characters").optional(),
+  Status: lifecycleRuleStatusSchema,
+  Prefix: import_zod13.z.string().optional(),
+  Filter: lifecycleFilterSchema.optional(),
+  Expiration: lifecycleExpirationSchema.optional(),
+  Transitions: import_zod13.z.array(lifecycleTransitionSchema).optional(),
+  NoncurrentVersionExpiration: lifecycleNoncurrentVersionExpirationSchema.optional(),
+  NoncurrentVersionTransitions: import_zod13.z.array(lifecycleNoncurrentVersionTransitionSchema).optional(),
+  AbortIncompleteMultipartUpload: lifecycleAbortIncompleteMultipartUploadSchema.optional()
+}).refine((val) => {
+  return val.Expiration !== void 0 || val.Transitions !== void 0 && val.Transitions.length > 0 || val.NoncurrentVersionExpiration !== void 0 || val.NoncurrentVersionTransitions !== void 0 && val.NoncurrentVersionTransitions.length > 0 || val.AbortIncompleteMultipartUpload !== void 0;
+}, {
+  message: "Rule must have at least one action (Expiration, Transition, NoncurrentVersion, or AbortIncompleteMultipartUpload)"
+}).refine((val) => {
+  return !(val.Filter !== void 0 && val.Prefix !== void 0);
+}, {
+  message: "Rule cannot have both Filter and legacy Prefix field set (use Filter.Prefix instead)"
+}).refine((val) => {
+  if (val.Expiration?.ExpiredObjectDeleteMarker !== true) {
+    return true;
+  }
+  const hasTagFilter = val.Filter?.Tag !== void 0 || val.Filter?.And?.Tags !== void 0 && val.Filter.And.Tags.length > 0;
+  return !hasTagFilter;
+}, {
+  message: "ExpiredObjectDeleteMarker cannot be combined with tag-based filters"
+}).refine((val) => {
+  if (val.AbortIncompleteMultipartUpload === void 0) return true;
+  const hasTagFilter = val.Filter?.Tag !== void 0 || val.Filter?.And?.Tags !== void 0 && val.Filter.And.Tags.length > 0;
+  return !hasTagFilter;
+}, {
+  message: "AbortIncompleteMultipartUpload cannot be combined with tag-based filters"
+});
+var lifecycleRuleReadSchema = import_zod13.z.object({
+  ID: import_zod13.z.string().optional(),
+  Status: import_zod13.z.string(),
+  Prefix: import_zod13.z.string().optional(),
+  Filter: import_zod13.z.object({
+    Prefix: import_zod13.z.string().optional(),
+    Tag: import_zod13.z.object({
+      Key: import_zod13.z.string(),
+      Value: import_zod13.z.string()
+    }).optional(),
+    ObjectSizeGreaterThan: import_zod13.z.number().optional(),
+    ObjectSizeLessThan: import_zod13.z.number().optional(),
+    And: import_zod13.z.object({
+      Prefix: import_zod13.z.string().optional(),
+      Tags: import_zod13.z.array(import_zod13.z.object({
+        Key: import_zod13.z.string(),
+        Value: import_zod13.z.string()
+      })).optional(),
+      ObjectSizeGreaterThan: import_zod13.z.number().optional(),
+      ObjectSizeLessThan: import_zod13.z.number().optional()
+    }).optional()
+  }).passthrough().optional(),
+  Expiration: import_zod13.z.object({
+    Days: import_zod13.z.number().optional(),
+    Date: import_zod13.z.union([
+      import_zod13.z.string(),
+      import_zod13.z.date()
+    ]).optional(),
+    ExpiredObjectDeleteMarker: import_zod13.z.boolean().optional()
+  }).passthrough().optional(),
+  Transitions: import_zod13.z.array(import_zod13.z.object({
+    Days: import_zod13.z.number().optional(),
+    Date: import_zod13.z.union([
+      import_zod13.z.string(),
+      import_zod13.z.date()
+    ]).optional(),
+    StorageClass: import_zod13.z.string()
+  }).passthrough()).optional(),
+  NoncurrentVersionExpiration: import_zod13.z.object({
+    NoncurrentDays: import_zod13.z.number().optional(),
+    NewerNoncurrentVersions: import_zod13.z.number().optional()
+  }).passthrough().optional(),
+  NoncurrentVersionTransitions: import_zod13.z.array(import_zod13.z.object({
+    NoncurrentDays: import_zod13.z.number().optional(),
+    StorageClass: import_zod13.z.string(),
+    NewerNoncurrentVersions: import_zod13.z.number().optional()
+  }).passthrough()).optional(),
+  AbortIncompleteMultipartUpload: import_zod13.z.object({
+    DaysAfterInitiation: import_zod13.z.number().optional()
+  }).passthrough().optional()
+});
+var lifecycleConfigurationSchema = import_zod13.z.object({
+  Rules: import_zod13.z.array(lifecycleRuleSchema).min(1, "At least one lifecycle rule is required").max(100, "Maximum 100 lifecycle rules per bucket")
+}).refine((val) => {
+  const ids = val.Rules.map((r) => r.ID).filter((id) => id !== void 0 && id !== "");
+  const uniqueIds = new Set(ids);
+  return ids.length === uniqueIds.size;
+}, {
+  message: "Rule IDs must be unique within a lifecycle configuration"
+});
+var getLifecycleInputSchema = projectScopedInputSchema.extend({
+  bucketName: existingBucketNameSchema
+});
+var getLifecycleOutputSchema = import_zod13.z.object({
+  rules: import_zod13.z.array(lifecycleRuleReadSchema).nullable(),
+  skippedRuleCount: import_zod13.z.number().int().min(0)
+});
+var setLifecycleInputSchema = projectScopedInputSchema.extend({
+  bucketName: existingBucketNameSchema,
+  lifecycleConfiguration: lifecycleConfigurationSchema
+});
+var deleteLifecycleInputSchema = projectScopedInputSchema.extend({
+  bucketName: existingBucketNameSchema
+});
 
 // src/server/Storage/routers/ceph/containerRouter.ts
 var containerRouter = {
@@ -36796,17 +37051,18 @@ function checkPolicySetRateLimit(bucketName, projectId) {
   const key = `${projectId}:${bucketName}`;
   const now = Date.now();
   const windowMs = 5 * 60 * 1e3;
-  for (const [k, v] of policySetRateLimits.entries()) {
-    if (now > v.resetAt) {
-      policySetRateLimits.delete(k);
-    }
-  }
   const limit = policySetRateLimits.get(key);
   if (!limit || now > limit.resetAt) {
     policySetRateLimits.set(key, {
       count: 1,
       resetAt: now + windowMs
     });
+    setTimeout(() => {
+      const current = policySetRateLimits.get(key);
+      if (current && current.resetAt <= Date.now()) {
+        policySetRateLimits.delete(key);
+      }
+    }, windowMs).unref();
     return;
   }
   if (limit.count >= 10) {
@@ -37024,17 +37280,18 @@ function checkCorsSetRateLimit(bucketName, projectId) {
   const key = `${projectId}:${bucketName}`;
   const now = Date.now();
   const windowMs = 60 * 1e3;
-  for (const [k, v] of corsSetRateLimits.entries()) {
-    if (now > v.resetAt) {
-      corsSetRateLimits.delete(k);
-    }
-  }
   const limit = corsSetRateLimits.get(key);
   if (!limit || now > limit.resetAt) {
     corsSetRateLimits.set(key, {
       count: 1,
       resetAt: now + windowMs
     });
+    setTimeout(() => {
+      const current = corsSetRateLimits.get(key);
+      if (current && current.resetAt <= Date.now()) {
+        corsSetRateLimits.delete(key);
+      }
+    }, windowMs).unref();
     return;
   }
   if (limit.count >= 10) {
@@ -37153,6 +37410,274 @@ var corsRouter = {
   })
 };
 
+// src/server/Storage/routers/ceph/lifecycleRouter.ts
+var import_client_s37 = require("@aws-sdk/client-s3");
+var import_server18 = require("@trpc/server");
+
+// src/server/Storage/helpers/lifecycleMapper.ts
+function toMidnightUTC(date) {
+  return new Date(Date.UTC(date.getUTCFullYear(), date.getUTCMonth(), date.getUTCDate()));
+}
+__name(toMidnightUTC, "toMidnightUTC");
+function toSdkLifecycleRules(wireRules) {
+  return wireRules.map((rule) => {
+    const result = {
+      Status: rule.Status,
+      ID: rule.ID,
+      Prefix: rule.Prefix,
+      Filter: rule.Filter
+    };
+    if (rule.Expiration) {
+      result.Expiration = {
+        Days: rule.Expiration.Days,
+        ExpiredObjectDeleteMarker: rule.Expiration.ExpiredObjectDeleteMarker,
+        // Only normalize Expiration.Date to midnight UTC (AWS requirement)
+        Date: rule.Expiration.Date !== void 0 ? typeof rule.Expiration.Date === "string" ? toMidnightUTC(new Date(rule.Expiration.Date)) : toMidnightUTC(rule.Expiration.Date) : void 0
+      };
+    }
+    if (rule.Transitions) {
+      result.Transitions = rule.Transitions.map((t2) => ({
+        Days: t2.Days,
+        StorageClass: t2.StorageClass,
+        Date: t2.Date !== void 0 ? typeof t2.Date === "string" ? new Date(t2.Date) : t2.Date : void 0
+      }));
+    }
+    if (rule.NoncurrentVersionExpiration) {
+      result.NoncurrentVersionExpiration = {
+        NoncurrentDays: rule.NoncurrentVersionExpiration.NoncurrentDays,
+        NewerNoncurrentVersions: rule.NoncurrentVersionExpiration.NewerNoncurrentVersions
+      };
+    }
+    if (rule.NoncurrentVersionTransitions) {
+      result.NoncurrentVersionTransitions = rule.NoncurrentVersionTransitions.map((t2) => ({
+        NoncurrentDays: t2.NoncurrentDays,
+        StorageClass: t2.StorageClass,
+        NewerNoncurrentVersions: t2.NewerNoncurrentVersions
+      }));
+    }
+    if (rule.AbortIncompleteMultipartUpload) {
+      result.AbortIncompleteMultipartUpload = {
+        DaysAfterInitiation: rule.AbortIncompleteMultipartUpload.DaysAfterInitiation
+      };
+    }
+    return result;
+  });
+}
+__name(toSdkLifecycleRules, "toSdkLifecycleRules");
+var toIso = /* @__PURE__ */ __name((d) => d === void 0 ? void 0 : d instanceof Date ? d.toISOString() : String(d), "toIso");
+function toWireLifecycleRule(rule) {
+  const result = {
+    Status: rule.Status ?? "Enabled"
+  };
+  if (rule.ID !== void 0) result.ID = rule.ID;
+  if (rule.Prefix !== void 0) result.Prefix = rule.Prefix;
+  if (rule.Filter !== void 0) result.Filter = rule.Filter;
+  if (rule.Expiration) {
+    result.Expiration = {
+      Days: rule.Expiration.Days,
+      ExpiredObjectDeleteMarker: rule.Expiration.ExpiredObjectDeleteMarker,
+      Date: toIso(rule.Expiration.Date)
+    };
+  }
+  if (rule.Transitions) {
+    result.Transitions = rule.Transitions.map((t2) => ({
+      Days: t2.Days,
+      StorageClass: t2.StorageClass,
+      Date: toIso(t2.Date)
+    }));
+  }
+  if (rule.NoncurrentVersionExpiration) {
+    result.NoncurrentVersionExpiration = {
+      NoncurrentDays: rule.NoncurrentVersionExpiration.NoncurrentDays,
+      NewerNoncurrentVersions: rule.NoncurrentVersionExpiration.NewerNoncurrentVersions
+    };
+  }
+  if (rule.NoncurrentVersionTransitions) {
+    result.NoncurrentVersionTransitions = rule.NoncurrentVersionTransitions.map((t2) => ({
+      NoncurrentDays: t2.NoncurrentDays,
+      StorageClass: t2.StorageClass,
+      NewerNoncurrentVersions: t2.NewerNoncurrentVersions
+    }));
+  }
+  if (rule.AbortIncompleteMultipartUpload) {
+    result.AbortIncompleteMultipartUpload = {
+      DaysAfterInitiation: rule.AbortIncompleteMultipartUpload.DaysAfterInitiation
+    };
+  }
+  return result;
+}
+__name(toWireLifecycleRule, "toWireLifecycleRule");
+
+// src/server/Storage/routers/ceph/lifecycleRouter.ts
+var lifecycleSetRateLimits = /* @__PURE__ */ new Map();
+function checkLifecycleSetRateLimit(bucketName, projectId) {
+  const key = `${projectId}:${bucketName}`;
+  const now = Date.now();
+  const windowMs = 60 * 1e3;
+  const limit = lifecycleSetRateLimits.get(key);
+  if (!limit || now >= limit.resetAt) {
+    lifecycleSetRateLimits.set(key, {
+      count: 1,
+      resetAt: now + windowMs
+    });
+    setTimeout(() => {
+      const current = lifecycleSetRateLimits.get(key);
+      if (current && current.resetAt <= Date.now()) {
+        lifecycleSetRateLimits.delete(key);
+      }
+    }, windowMs).unref();
+    return;
+  }
+  if (limit.count >= 10) {
+    throw new import_server18.TRPCError({
+      code: "TOO_MANY_REQUESTS",
+      message: "Lifecycle modification rate limit exceeded. Maximum 10 lifecycle changes per minute per bucket."
+    });
+  }
+  limit.count++;
+}
+__name(checkLifecycleSetRateLimit, "checkLifecycleSetRateLimit");
+var lifecycleRouter = {
+  /**
+  * Get the current lifecycle configuration for a bucket.
+  *
+  * Returns an array of lifecycle rules, or null if no lifecycle configuration is set.
+  * Not having a lifecycle configuration is a normal state (not an error).
+  *
+  * Rules are mapped and validated individually  a rule that fails the lenient read schema
+  * (e.g. authored outside Aurora) is skipped rather than failing the whole response;
+  * `skippedRuleCount` reports how many were skipped so the client can warn and disable mutations.
+  *
+  * @returns { rules: LifecycleRule[] | null; skippedRuleCount: number }
+  * @throws TRPCError NOT_FOUND - bucket does not exist
+  * @throws TRPCError FORBIDDEN - no credentials or access denied
+  */
+  get: cephProtectedProcedure.input(getLifecycleInputSchema).query(async ({ ctx, input }) => {
+    const s3 = ctx.getCephClient();
+    const { bucketName } = input;
+    try {
+      const response = await s3.send(new import_client_s37.GetBucketLifecycleConfigurationCommand({
+        Bucket: bucketName
+      }));
+      const rawRules = response.Rules ?? null;
+      if (!rawRules) {
+        return {
+          rules: null,
+          skippedRuleCount: 0
+        };
+      }
+      const rules = [];
+      let skippedRuleCount = 0;
+      for (const rawRule of rawRules) {
+        try {
+          const parsed = lifecycleRuleReadSchema.safeParse(toWireLifecycleRule(rawRule));
+          if (parsed.success) {
+            rules.push(parsed.data);
+            continue;
+          }
+          skippedRuleCount++;
+        } catch {
+          skippedRuleCount++;
+        }
+      }
+      return {
+        rules,
+        skippedRuleCount
+      };
+    } catch (error) {
+      const s3Error = error;
+      if (s3Error.name === "NoSuchLifecycleConfiguration" || s3Error.Code === "NoSuchLifecycleConfiguration") {
+        return {
+          rules: null,
+          skippedRuleCount: 0
+        };
+      }
+      throw mapS3ErrorToTRPCError(error, {
+        operation: "get lifecycle configuration",
+        bucket: bucketName
+      });
+    }
+  }),
+  /**
+  * Set (create or replace) a lifecycle configuration for a bucket.
+  *
+  * Accepts a lifecycle configuration with an array of rules. Validates structure
+  * before sending to S3. Replaces any existing lifecycle configuration completely.
+  *
+  * Rules are validated for:
+  * - At least one action (Expiration, Transition, NoncurrentVersion, or AbortIncompleteMultipartUpload)
+  * - ID: max 255 characters (optional)
+  * - Filter: proper structure for Prefix, Tag, ObjectSize conditions
+  * - Total rules: 1-100 per bucket
+  *
+  * @returns boolean - true on success
+  * @throws TRPCError BAD_REQUEST - invalid lifecycle configuration structure
+  * @throws TRPCError NOT_FOUND - bucket does not exist
+  * @throws TRPCError FORBIDDEN - no credentials or access denied
+  * @throws TRPCError TOO_MANY_REQUESTS - rate limit exceeded (10 changes per minute per bucket)
+  */
+  set: cephProtectedProcedure.input(setLifecycleInputSchema).mutation(async ({ ctx, input }) => {
+    const s3 = ctx.getCephClient();
+    const { bucketName, lifecycleConfiguration, project_id } = input;
+    checkLifecycleSetRateLimit(bucketName, project_id);
+    const transformedRules = toSdkLifecycleRules(lifecycleConfiguration.Rules).map((rule) => {
+      const transformed = {
+        ...rule
+      };
+      if (transformed.Prefix !== void 0 && transformed.Filter === void 0) {
+        transformed.Filter = {
+          Prefix: transformed.Prefix
+        };
+      }
+      delete transformed.Prefix;
+      return transformed;
+    });
+    try {
+      await s3.send(new import_client_s37.PutBucketLifecycleConfigurationCommand({
+        Bucket: bucketName,
+        LifecycleConfiguration: {
+          Rules: transformedRules
+        }
+      }));
+      return true;
+    } catch (error) {
+      throw mapS3ErrorToTRPCError(error, {
+        operation: "set lifecycle configuration",
+        bucket: bucketName
+      });
+    }
+  }),
+  /**
+  * Delete (remove) a lifecycle configuration from a bucket.
+  *
+  * Removes all lifecycle rules from the bucket. The bucket reverts to having no lifecycle config.
+  * Not an error if no lifecycle configuration was set (idempotent).
+  *
+  * @returns boolean - true on success
+  * @throws TRPCError NOT_FOUND - bucket does not exist
+  * @throws TRPCError FORBIDDEN - no credentials or access denied
+  */
+  delete: cephProtectedProcedure.input(deleteLifecycleInputSchema).mutation(async ({ ctx, input }) => {
+    const s3 = ctx.getCephClient();
+    const { bucketName } = input;
+    try {
+      await s3.send(new import_client_s37.DeleteBucketLifecycleCommand({
+        Bucket: bucketName
+      }));
+      return true;
+    } catch (error) {
+      const s3Error = error;
+      if (s3Error.name === "NoSuchLifecycleConfiguration" || s3Error.Code === "NoSuchLifecycleConfiguration") {
+        return true;
+      }
+      throw mapS3ErrorToTRPCError(error, {
+        operation: "delete lifecycle configuration",
+        bucket: bucketName
+      });
+    }
+  })
+};
+
 // src/server/Storage/routers/permissionRouter.ts
 var STORAGE_MAPPINGS = {
   // Container Operations (works for both Swift containers and Ceph buckets)
@@ -37192,6 +37717,10 @@ var STORAGE_MAPPINGS = {
     engine: "storage",
     rule: "storage:container_update_access_control"
   },
+  "storage:containers:update_versioning": {
+    engine: "storage",
+    rule: "storage:container_versioning_update"
+  },
   // Object Operations
   "storage:objects:read": {
     engine: "storage",
@@ -37225,6 +37754,10 @@ var STORAGE_MAPPINGS = {
     engine: "storage",
     rule: "storage:object_move"
   },
+  "storage:objects:share": {
+    engine: "storage",
+    rule: "storage:object_share"
+  },
   // Folder Operations
   "storage:folders:create_object": {
     engine: "storage",
@@ -37237,6 +37770,47 @@ var STORAGE_MAPPINGS = {
   "storage:folders:delete": {
     engine: "storage",
     rule: "storage:folder_delete"
+  },
+  // Object Version Operations
+  "storage:object_versions:delete": {
+    engine: "storage",
+    rule: "storage:object_version_delete"
+  },
+  "storage:object_versions:restore": {
+    engine: "storage",
+    rule: "storage:object_version_restore"
+  },
+  // Container Policy Operations
+  "storage:container_policies:update": {
+    engine: "storage",
+    rule: "storage:container_policy_update"
+  },
+  "storage:container_policies:delete": {
+    engine: "storage",
+    rule: "storage:container_policy_delete"
+  },
+  // CORS Operations
+  "storage:container_cors_rules:update": {
+    engine: "storage",
+    rule: "storage:container_cors_update"
+  },
+  "storage:container_cors_rules:delete": {
+    engine: "storage",
+    rule: "storage:container_cors_delete"
+  },
+  // Lifecycle Operations
+  "storage:container_lifecycle_rules:update": {
+    engine: "storage",
+    rule: "storage:container_lifecycle_update"
+  },
+  "storage:container_lifecycle_rules:delete": {
+    engine: "storage",
+    rule: "storage:container_lifecycle_delete"
+  },
+  // Credential Operations
+  "storage:credentials:create": {
+    engine: "storage",
+    rule: "storage:credential_create"
   }
 };
 var buildStoragePermissionRouter = /* @__PURE__ */ __name((policyDir) => createPermissionRouter({
@@ -37273,6 +37847,9 @@ var buildObjectStorageRouters = /* @__PURE__ */ __name((policyDir) => ({
       }),
       cors: auroraRouter({
         ...corsRouter
+      }),
+      lifecycle: auroraRouter({
+        ...lifecycleRouter
       })
     }),
     ...buildStoragePermissionRouter(policyDir)
@@ -37281,7 +37858,7 @@ var buildObjectStorageRouters = /* @__PURE__ */ __name((policyDir) => ({
 
 // src/server/Project/routers/projectRouter.ts
 var import_zod20 = require("zod");
-var import_server18 = require("@trpc/server");
+var import_server19 = require("@trpc/server");
 
 // src/server/Project/types/models.ts
 var import_zod19 = require("zod");
@@ -37318,10 +37895,10 @@ var projectsResponseSchema = import_zod19.z.object({
 });
 
 // src/server/Project/routers/projectRouter.ts
-var import_signal_openstack4 = __toESM(require_esm());
+var import_signal_openstack5 = __toESM(require_esm());
 async function callIdentityAPI(identityEndpoint, authToken, path3) {
   if (!identityEndpoint) {
-    throw new import_server18.TRPCError({
+    throw new import_server19.TRPCError({
       code: "INTERNAL_SERVER_ERROR",
       message: "Identity endpoint not configured"
     });
@@ -37337,7 +37914,7 @@ async function callIdentityAPI(identityEndpoint, authToken, path3) {
     }
   });
   if (!response.ok) {
-    throw new import_server18.TRPCError({
+    throw new import_server19.TRPCError({
       code: "INTERNAL_SERVER_ERROR",
       message: `Identity API call failed: ${response.status} ${response.statusText}`
     });
@@ -37377,14 +37954,14 @@ var projectRouter = {
   */
   getAuthProjects: protectedProcedure.query(async ({ ctx }) => {
     if (!ctx.openstack) {
-      throw new import_server18.TRPCError({
+      throw new import_server19.TRPCError({
         code: "UNAUTHORIZED",
         message: "No authenticated session"
       });
     }
     const token = ctx.openstack.getToken();
     if (!token?.authToken) {
-      throw new import_server18.TRPCError({
+      throw new import_server19.TRPCError({
         code: "UNAUTHORIZED",
         message: "No auth token available"
       });
@@ -37427,14 +38004,14 @@ var projectRouter = {
     search: import_zod20.z.string().optional()
   }).optional()).query(async ({ ctx, input }) => {
     if (!ctx.openstack) {
-      throw new import_server18.TRPCError({
+      throw new import_server19.TRPCError({
         code: "UNAUTHORIZED",
         message: "No authenticated session"
       });
     }
     const token = ctx.openstack.getToken();
     if (!token?.authToken) {
-      throw new import_server18.TRPCError({
+      throw new import_server19.TRPCError({
         code: "UNAUTHORIZED",
         message: "No auth token available"
       });
@@ -37458,21 +38035,21 @@ var projectRouter = {
     projectId: import_zod20.z.string()
   })).query(async ({ ctx, input }) => {
     if (!ctx.openstack) {
-      throw new import_server18.TRPCError({
+      throw new import_server19.TRPCError({
         code: "UNAUTHORIZED",
         message: "No authenticated session"
       });
     }
     const token = ctx.openstack.getToken();
     if (!token?.authToken) {
-      throw new import_server18.TRPCError({
+      throw new import_server19.TRPCError({
         code: "UNAUTHORIZED",
         message: "No auth token available"
       });
     }
     let encodedId;
     try {
-      encodedId = (0, import_signal_openstack4.validateAndEncodeResourceId)(input.projectId, "Project");
+      encodedId = (0, import_signal_openstack5.validateAndEncodeResourceId)(input.projectId, "Project");
     } catch {
       return null;
     }
@@ -37491,22 +38068,25 @@ var projectRouters = {
   })
 };
 
+// src/server/Network/routers/floatingIpRouter.ts
+var import_server24 = require("@trpc/server");
+
 // src/server/helpers/errorHandling.ts
-var import_server19 = require("@trpc/server");
-var import_signal_openstack5 = __toESM(require_esm());
+var import_server20 = require("@trpc/server");
+var import_signal_openstack6 = __toESM(require_esm());
 function wrapError3(error, operation) {
-  if (error instanceof import_server19.TRPCError) {
+  if (error instanceof import_server20.TRPCError) {
     return error;
   }
-  if (error instanceof import_signal_openstack5.SignalOpenstackError) {
-    return new import_server19.TRPCError({
+  if (error instanceof import_signal_openstack6.SignalOpenstackError) {
+    return new import_server20.TRPCError({
       code: "BAD_REQUEST",
       message: error.message,
       cause: error
     });
   }
   const baseErrorMessage = `Error during ${operation}`;
-  return new import_server19.TRPCError({
+  return new import_server20.TRPCError({
     code: "INTERNAL_SERVER_ERROR",
     message: typeof error !== "string" && error.message ? `${baseErrorMessage}: ${error.message}` : baseErrorMessage,
     cause: error
@@ -37546,11 +38126,11 @@ function appendQueryParamsFromObject(source, options) {
 __name(appendQueryParamsFromObject, "appendQueryParamsFromObject");
 
 // src/server/helpers/validateOpenstackService.ts
-var import_server20 = require("@trpc/server");
+var import_server21 = require("@trpc/server");
 var capitalize = /* @__PURE__ */ __name((str) => str.charAt(0).toUpperCase() + str.slice(1), "capitalize");
 function validateOpenstackService(service, serviceName) {
   if (!service) {
-    throw new import_server20.TRPCError({
+    throw new import_server21.TRPCError({
       code: "INTERNAL_SERVER_ERROR",
       message: `${capitalize(serviceName)} service is not available`
     });
@@ -37559,7 +38139,7 @@ function validateOpenstackService(service, serviceName) {
 __name(validateOpenstackService, "validateOpenstackService");
 
 // src/server/Network/routers/floatingIpRouter.ts
-var import_signal_openstack6 = __toESM(require_esm());
+var import_signal_openstack7 = __toESM(require_esm());
 
 // src/server/Network/types/floatingIp.ts
 var import_zod22 = require("zod");
@@ -37672,8 +38252,7 @@ var FloatingIpIdInputSchema = import_zod22.z.object({
   floatingip_id: import_zod22.z.string()
 });
 var FloatingIpCreateRequestSchema = import_zod22.z.object({
-  tenant_id: import_zod22.z.string(),
-  project_id: import_zod22.z.string(),
+  project_id: import_zod22.z.string().trim().min(1, "project_id must be a non-empty string"),
   floating_network_id: import_zod22.z.string(),
   fixed_ip_address: import_zod22.z.string().optional(),
   floating_ip_address: import_zod22.z.string().optional(),
@@ -37807,10 +38386,10 @@ var AvailablePortsResponseSchema = import_zod22.z.object({
 });
 
 // src/server/Network/helpers/errorHandling.ts
-var import_server22 = require("@trpc/server");
+var import_server23 = require("@trpc/server");
 
 // src/server/Network/helpers/index.ts
-var import_server21 = require("@trpc/server");
+var import_server22 = require("@trpc/server");
 var HTTP_STATUS_ERROR_MAP = {
   400: "BAD_REQUEST",
   401: "UNAUTHORIZED",
@@ -37830,7 +38409,7 @@ var parseOrThrow = /* @__PURE__ */ __name((schema, data, context) => {
   const parsed = schema.safeParse(data);
   if (!parsed.success) {
     console.error(`Zod Parsing Error in ${context}:`, parsed.error.issues);
-    throw new import_server21.TRPCError({
+    throw new import_server22.TRPCError({
       code: "PARSE_ERROR",
       message: `Failed to parse response in ${context}`
     });
@@ -37840,27 +38419,27 @@ var parseOrThrow = /* @__PURE__ */ __name((schema, data, context) => {
 
 // src/server/Network/helpers/errorHandling.ts
 var DEFAULT_HANDLERS = {
-  400: (response, resourceLabel) => new import_server22.TRPCError({
+  400: (response, resourceLabel) => new import_server23.TRPCError({
     code: HTTP_STATUS_ERROR_MAP[400],
     message: `Invalid request data for ${resourceLabel}: ${response.statusText || "Unknown error"}`
   }),
-  401: (response, resourceLabel) => new import_server22.TRPCError({
+  401: (response, resourceLabel) => new import_server23.TRPCError({
     code: HTTP_STATUS_ERROR_MAP[401],
     message: `Unauthorized access to ${resourceLabel}: ${response.statusText || "Unknown error"}`
   }),
-  403: (response, resourceLabel) => new import_server22.TRPCError({
+  403: (response, resourceLabel) => new import_server23.TRPCError({
     code: HTTP_STATUS_ERROR_MAP[403],
     message: `Access forbidden to ${resourceLabel}: ${response.statusText || "Unknown error"}`
   }),
-  404: (response, resourceLabel) => new import_server22.TRPCError({
+  404: (response, resourceLabel) => new import_server23.TRPCError({
     code: HTTP_STATUS_ERROR_MAP[404],
     message: `${resourceLabel} not found: ${response.statusText || "Unknown error"}`
   }),
-  409: (response, resourceLabel) => new import_server22.TRPCError({
+  409: (response, resourceLabel) => new import_server23.TRPCError({
     code: HTTP_STATUS_ERROR_MAP[409],
     message: `Conflict - ${resourceLabel} is in use: ${response.statusText || "Unknown error"}`
   }),
-  412: (response, resourceLabel) => new import_server22.TRPCError({
+  412: (response, resourceLabel) => new import_server23.TRPCError({
     code: HTTP_STATUS_ERROR_MAP[412],
     message: `Precondition failed - revision number mismatch in ${resourceLabel}: ${response.statusText || "Unknown error"}`
   })
@@ -37875,7 +38454,7 @@ var ErrorHandler = /* @__PURE__ */ __name((resourceName, customHandlers) => {
     if (response.status && handlers[response.status]) {
       return handlers[response.status](response, resourceLabel);
     }
-    return new import_server22.TRPCError({
+    return new import_server23.TRPCError({
       code: DEFAULT_ERROR_NAME,
       message: `Failed to process ${resourceLabel}: ${response.statusText || "Unknown error"}`
     });
@@ -37921,10 +38500,18 @@ var floatingIpRouter = {
   create: projectScopedProcedure.input(FloatingIpCreateRequestSchema).mutation(async ({ input, ctx }) => {
     return withErrorHandling3(async () => {
       const network = getNetworkService(ctx);
+      const token = ctx.openstack?.getToken();
+      const projectId = token?.tokenData.project?.id;
+      if (!projectId) {
+        throw new import_server24.TRPCError({
+          code: "UNAUTHORIZED",
+          message: "No project scope in session"
+        });
+      }
       const requestBody = {
         floatingip: {
-          tenant_id: input.tenant_id,
-          project_id: input.project_id,
+          tenant_id: projectId,
+          project_id: projectId,
           floating_network_id: input.floating_network_id,
           ...input.fixed_ip_address !== void 0 && {
             fixed_ip_address: input.fixed_ip_address
@@ -37967,7 +38554,7 @@ var floatingIpRouter = {
     return withErrorHandling3(async () => {
       const { floatingip_id } = input;
       const network = getNetworkService(ctx);
-      const encodedId = (0, import_signal_openstack6.validateAndEncodeResourceId)(floatingip_id, "Floating IP");
+      const encodedId = (0, import_signal_openstack7.validateAndEncodeResourceId)(floatingip_id, "Floating IP");
       const response = await network.get(`${FLOATING_IPS_BASE_URL}/${encodedId}`);
       if (!response.ok) {
         throw FloatingIpErrorHandlers.get(response, floatingip_id);
@@ -37994,7 +38581,7 @@ var floatingIpRouter = {
           }
         }
       };
-      const encodedId = (0, import_signal_openstack6.validateAndEncodeResourceId)(floatingip_id, "Floating IP");
+      const encodedId = (0, import_signal_openstack7.validateAndEncodeResourceId)(floatingip_id, "Floating IP");
       const response = await network.put(`${FLOATING_IPS_BASE_URL}/${encodedId}`, requestBody);
       if (!response.ok) {
         throw FloatingIpErrorHandlers.update(response, floatingip_id);
@@ -38007,7 +38594,7 @@ var floatingIpRouter = {
     return withErrorHandling3(async () => {
       const { floatingip_id } = input;
       const network = getNetworkService(ctx);
-      const encodedId = (0, import_signal_openstack6.validateAndEncodeResourceId)(floatingip_id, "Floating IP");
+      const encodedId = (0, import_signal_openstack7.validateAndEncodeResourceId)(floatingip_id, "Floating IP");
       const response = await network.del(`${FLOATING_IPS_BASE_URL}/${encodedId}`);
       if (!response.ok) {
         throw FloatingIpErrorHandlers.delete(response, floatingip_id);
@@ -38163,7 +38750,7 @@ var createSecurityGroupRuleInputSchema = projectScopedInputSchema.extend({
 });
 
 // src/server/Network/helpers/securityGroupHelpers.ts
-var import_server23 = require("@trpc/server");
+var import_server25 = require("@trpc/server");
 var SecurityGroupErrorHandlers = {
   /**
   * Handles errors specific to security group list operations
@@ -38173,17 +38760,17 @@ var SecurityGroupErrorHandlers = {
   list: /* @__PURE__ */ __name((response) => {
     switch (response.status) {
       case 401:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[401],
           message: "Unauthorized access"
         });
       case 403:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[403],
           message: `Access forbidden: ${response.statusText || "Unknown error"}`
         });
       default:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: DEFAULT_ERROR_NAME,
           message: `Failed to list security groups: ${response.statusText || "Unknown error"}`
         });
@@ -38198,22 +38785,22 @@ var SecurityGroupErrorHandlers = {
   getById: /* @__PURE__ */ __name((response, securityGroupId) => {
     switch (response.status) {
       case 401:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[401],
           message: "Unauthorized access"
         });
       case 403:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[403],
           message: `Access forbidden: ${response.statusText || "Unknown error"}`
         });
       case 404:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[404],
           message: `Security group not found: ${securityGroupId}`
         });
       default:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: DEFAULT_ERROR_NAME,
           message: `Failed to fetch security group: ${response.statusText || "Unknown error"}`
         });
@@ -38227,32 +38814,32 @@ var SecurityGroupErrorHandlers = {
   create: /* @__PURE__ */ __name((response) => {
     switch (response.status) {
       case 401:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[401],
           message: "Unauthorized access"
         });
       case 403:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[403],
           message: `Access forbidden: ${response.statusText || "Unknown error"}`
         });
       case 409:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[409],
           message: `Conflict: ${response.statusText || "Security group already exists"}`
         });
       case 413:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: "BAD_REQUEST",
           message: `Quota exceeded for security groups. Please delete an existing security group or contact your administrator to increase your quota.`
         });
       case 400:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: "BAD_REQUEST",
           message: `Invalid request: ${response.statusText || "Unknown error"}`
         });
       default:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: "INTERNAL_SERVER_ERROR",
           message: `Failed to create security group: ${response.statusText || "Unknown error"}`
         });
@@ -38267,22 +38854,22 @@ var SecurityGroupErrorHandlers = {
   delete: /* @__PURE__ */ __name((response, securityGroupId) => {
     switch (response.status) {
       case 401:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[401],
           message: "Unauthorized access"
         });
       case 404:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[404],
           message: `Security group not found: ${securityGroupId}`
         });
       case 409:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[409],
           message: "Cannot delete security group because it is in use by one or more ports. Please remove all associations before deleting."
         });
       default:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: DEFAULT_ERROR_NAME,
           message: `Failed to delete security group: ${response.statusText || "Unknown error"}`
         });
@@ -38297,39 +38884,39 @@ var SecurityGroupErrorHandlers = {
   update: /* @__PURE__ */ __name((response, securityGroupId) => {
     const errorMessage = response.statusText || "";
     if (errorMessage.toLowerCase().includes("stateful") && errorMessage.toLowerCase().includes("in use")) {
-      return new import_server23.TRPCError({
+      return new import_server25.TRPCError({
         code: "CONFLICT",
         message: "Cannot update the 'stateful' attribute because this security group is in use by one or more ports."
       });
     }
     switch (response.status) {
       case 401:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[401],
           message: "Unauthorized access"
         });
       case 403:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[403],
           message: `Access forbidden: ${errorMessage || "Unknown error"}`
         });
       case 404:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[404],
           message: `Security group not found: ${securityGroupId}`
         });
       case 409:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[409],
           message: `Conflict: ${errorMessage || "Security group conflict"}`
         });
       case 400:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[400],
           message: `Invalid request: ${errorMessage || "Unknown error"}`
         });
       default:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: DEFAULT_ERROR_NAME,
           message: `Failed to update security group: ${errorMessage || "Unknown error"}`
         });
@@ -38347,48 +38934,48 @@ var SecurityGroupRuleErrorHandlers = {
     switch (response.status) {
       case 400:
         if (statusText.toLowerCase().includes("cidr")) {
-          return new import_server23.TRPCError({
+          return new import_server25.TRPCError({
             code: "BAD_REQUEST",
             message: "Invalid CIDR format. Please provide a valid IP address block (e.g., 0.0.0.0/0)"
           });
         }
         if (statusText.toLowerCase().includes("port")) {
-          return new import_server23.TRPCError({
+          return new import_server25.TRPCError({
             code: "BAD_REQUEST",
             message: "Invalid port range. Ports must be between 1 and 65535, and min must be <= max"
           });
         }
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: "BAD_REQUEST",
           message: `Invalid request: ${statusText}`
         });
       case 401:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: "UNAUTHORIZED",
           message: "Unauthorized access"
         });
       case 403:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: "FORBIDDEN",
           message: `Access forbidden: ${statusText}`
         });
       case 404:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: "NOT_FOUND",
           message: "Security group not found"
         });
       case 409:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: "CONFLICT",
           message: "A rule with these parameters already exists in this security group"
         });
       case 413:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: "BAD_REQUEST",
           message: "Quota exceeded for security group rules. Please delete existing rules or contact your administrator."
         });
       default:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: "INTERNAL_SERVER_ERROR",
           message: `Failed to create security group rule: ${statusText}`
         });
@@ -38407,22 +38994,22 @@ var SecurityGroupRuleErrorHandlers = {
   delete: /* @__PURE__ */ __name((response, ruleId) => {
     switch (response.status) {
       case 401:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: "UNAUTHORIZED",
           message: "Unauthorized access"
         });
       case 404:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: "NOT_FOUND",
           message: `Security group rule not found: ${ruleId}`
         });
       case 412:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: "PRECONDITION_FAILED",
           message: `Cannot delete security group rule: precondition failed`
         });
       default:
-        return new import_server23.TRPCError({
+        return new import_server25.TRPCError({
           code: "INTERNAL_SERVER_ERROR",
           message: `Failed to delete security group rule: ${response.statusText || "Unknown error"}`
         });
@@ -38433,7 +39020,7 @@ var parseOpenStackResponse = /* @__PURE__ */ __name((data, schema, operation, er
   const parsed = schema.safeParse(data);
   if (!parsed.success) {
     console.error(`Zod Parsing Error in ${operation}:`, parsed.error.format());
-    throw new import_server23.TRPCError({
+    throw new import_server25.TRPCError({
       code: "INTERNAL_SERVER_ERROR",
       message: errorMessage
     });
@@ -38488,7 +39075,7 @@ var sortSecurityGroups = /* @__PURE__ */ __name((items, sortKey, sortDir = "asc"
 }, "sortSecurityGroups");
 
 // src/server/Network/routers/securityGroupRouter.ts
-var import_signal_openstack7 = __toESM(require_esm());
+var import_signal_openstack8 = __toESM(require_esm());
 var SECURITY_GROUPS_BASE_URL = "v2.0/security-groups";
 var LIST_SECURITY_GROUPS_QUERY_KEY_MAP = {
   tags_any: "tags-any",
@@ -38555,7 +39142,7 @@ var securityGroupRouter = {
     return withErrorHandling3(async () => {
       const { securityGroupId } = input;
       const network = getNetworkService(ctx);
-      const encodedId = (0, import_signal_openstack7.validateAndEncodeResourceId)(securityGroupId, "Security group");
+      const encodedId = (0, import_signal_openstack8.validateAndEncodeResourceId)(securityGroupId, "Security group");
       const response = await network.get(`${SECURITY_GROUPS_BASE_URL}/${encodedId}`);
       if (!response.ok) {
         throw SecurityGroupErrorHandlers.getById(response, securityGroupId);
@@ -38591,7 +39178,7 @@ var securityGroupRouter = {
     return withErrorHandling3(async () => {
       const { securityGroupId } = input;
       const network = getNetworkService(ctx);
-      const encodedId = (0, import_signal_openstack7.validateAndEncodeResourceId)(securityGroupId, "Security group");
+      const encodedId = (0, import_signal_openstack8.validateAndEncodeResourceId)(securityGroupId, "Security group");
       const response = await network.del(`${SECURITY_GROUPS_BASE_URL}/${encodedId}`);
       if (!response?.ok) {
         throw SecurityGroupErrorHandlers.delete(response, securityGroupId);
@@ -38615,7 +39202,7 @@ var securityGroupRouter = {
           }
         }
       };
-      const encodedId = (0, import_signal_openstack7.validateAndEncodeResourceId)(securityGroupId, "Security group");
+      const encodedId = (0, import_signal_openstack8.validateAndEncodeResourceId)(securityGroupId, "Security group");
       const response = await network.put(`${SECURITY_GROUPS_BASE_URL}/${encodedId}`, requestBody);
       if (!response.ok) {
         throw SecurityGroupErrorHandlers.update(response, securityGroupId);
@@ -38720,7 +39307,7 @@ var deleteRBACPolicyInputSchema = projectScopedInputSchema.extend({
 });
 
 // src/server/Network/helpers/rbacPolicyHelpers.ts
-var import_server24 = require("@trpc/server");
+var import_server26 = require("@trpc/server");
 var RBACPolicyErrorHandlers = {
   /**
   * Handles errors specific to RBAC policy list operations
@@ -38730,17 +39317,17 @@ var RBACPolicyErrorHandlers = {
   list: /* @__PURE__ */ __name((response) => {
     switch (response.status) {
       case 401:
-        return new import_server24.TRPCError({
+        return new import_server26.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[401],
           message: "Unauthorized access"
         });
       case 403:
-        return new import_server24.TRPCError({
+        return new import_server26.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[403],
           message: `Access forbidden: ${response.statusText || "Unknown error"}`
         });
       default:
-        return new import_server24.TRPCError({
+        return new import_server26.TRPCError({
           code: DEFAULT_ERROR_NAME,
           message: `Failed to list RBAC policies: ${response.statusText || "Unknown error"}`
         });
@@ -38754,32 +39341,32 @@ var RBACPolicyErrorHandlers = {
   create: /* @__PURE__ */ __name((response) => {
     switch (response.status) {
       case 400:
-        return new import_server24.TRPCError({
+        return new import_server26.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[400],
           message: `Invalid request: ${response.statusText || "Unknown error"}`
         });
       case 401:
-        return new import_server24.TRPCError({
+        return new import_server26.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[401],
           message: "Unauthorized access"
         });
       case 403:
-        return new import_server24.TRPCError({
+        return new import_server26.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[403],
           message: "You don't have permission to share this security group"
         });
       case 404:
-        return new import_server24.TRPCError({
+        return new import_server26.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[404],
           message: "Security group not found or target project does not exist"
         });
       case 409:
-        return new import_server24.TRPCError({
+        return new import_server26.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[409],
           message: "This security group is already shared with the specified project"
         });
       default:
-        return new import_server24.TRPCError({
+        return new import_server26.TRPCError({
           code: "INTERNAL_SERVER_ERROR",
           message: `Failed to create RBAC policy: ${response.statusText || "Unknown error"}`
         });
@@ -38794,27 +39381,27 @@ var RBACPolicyErrorHandlers = {
   update: /* @__PURE__ */ __name((response, policyId) => {
     switch (response.status) {
       case 400:
-        return new import_server24.TRPCError({
+        return new import_server26.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[400],
           message: `Invalid request: ${response.statusText || "Unknown error"}`
         });
       case 401:
-        return new import_server24.TRPCError({
+        return new import_server26.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[401],
           message: "Unauthorized access"
         });
       case 403:
-        return new import_server24.TRPCError({
+        return new import_server26.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[403],
           message: `Access forbidden: ${response.statusText || "Unknown error"}`
         });
       case 404:
-        return new import_server24.TRPCError({
+        return new import_server26.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[404],
           message: `RBAC policy not found: ${policyId}`
         });
       default:
-        return new import_server24.TRPCError({
+        return new import_server26.TRPCError({
           code: "INTERNAL_SERVER_ERROR",
           message: `Failed to update RBAC policy: ${response.statusText || "Unknown error"}`
         });
@@ -38829,22 +39416,22 @@ var RBACPolicyErrorHandlers = {
   delete: /* @__PURE__ */ __name((response, policyId) => {
     switch (response.status) {
       case 401:
-        return new import_server24.TRPCError({
+        return new import_server26.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[401],
           message: "Unauthorized access"
         });
       case 404:
-        return new import_server24.TRPCError({
+        return new import_server26.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[404],
           message: `RBAC policy not found: ${policyId}`
         });
       case 409:
-        return new import_server24.TRPCError({
+        return new import_server26.TRPCError({
           code: HTTP_STATUS_ERROR_MAP[409],
           message: "Cannot delete RBAC policy because it is in use"
         });
       default:
-        return new import_server24.TRPCError({
+        return new import_server26.TRPCError({
           code: DEFAULT_ERROR_NAME,
           message: `Failed to delete RBAC policy: ${response.statusText || "Unknown error"}`
         });
@@ -38855,7 +39442,7 @@ var parseOpenStackResponse2 = /* @__PURE__ */ __name((data, schema, operation, e
   const parsed = schema.safeParse(data);
   if (!parsed.success) {
     console.error(`Zod Parsing Error in ${operation}:`, parsed.error.format());
-    throw new import_server24.TRPCError({
+    throw new import_server26.TRPCError({
       code: "INTERNAL_SERVER_ERROR",
       message: errorMessage
     });
@@ -39179,7 +39766,7 @@ var buildAppRouter = /* @__PURE__ */ __name((policyDir, extraRouters = []) => {
 }, "buildAppRouter");
 
 // src/server/context.ts
-var import_signal_openstack8 = __toESM(require_esm());
+var import_signal_openstack9 = __toESM(require_esm());
 
 // src/server/sessionCookie.ts
 var import_cookie = require("@fastify/cookie");
@@ -39267,7 +39854,7 @@ async function createContext(opts, config) {
     writable: false
   });
   if (currentAuthToken) {
-    openstackSession = await (0, import_signal_openstack8.SignalOpenstackSession)(normalizedEndpoint, {
+    openstackSession = await (0, import_signal_openstack9.SignalOpenstackSession)(normalizedEndpoint, {
       auth: {
         identity: {
           methods: [
@@ -39330,7 +39917,7 @@ async function createContext(opts, config) {
     }
   }, "getUserInfo");
   const createSession = /* @__PURE__ */ __name(async (params) => {
-    openstackSession = await (0, import_signal_openstack8.SignalOpenstackSession)(normalizedEndpoint, {
+    openstackSession = await (0, import_signal_openstack9.SignalOpenstackSession)(normalizedEndpoint, {
       auth: {
         identity: {
           methods: [
@@ -39390,53 +39977,51 @@ async function createContext(opts, config) {
       return openstackSession;
     }
     const rescopeTokenPromise = (async () => {
-      try {
-        const newScope = newScopeProjectId ? {
-          project: {
-            id: newScopeProjectId
-          }
-        } : newScopeDomainId ? {
-          domain: {
-            id: newScopeDomainId
-          }
-        } : "unscoped";
-        await openstackSession.rescope(newScope);
-        const newToken = openstackSession.getToken();
-        const newAuthToken2 = newToken?.authToken;
-        if (newAuthToken2 && newAuthToken2 !== sessionToken) {
-          const oldPendingRescopes = sessionRescopes.get(sessionToken);
-          if (oldPendingRescopes) {
-            const existingRescopes = sessionRescopes.get(newAuthToken2);
-            if (existingRescopes) {
-              for (const [key, value] of oldPendingRescopes.entries()) {
-                if (!existingRescopes.has(key)) {
-                  existingRescopes.set(key, value);
-                }
+      const newScope = newScopeProjectId ? {
+        project: {
+          id: newScopeProjectId
+        }
+      } : newScopeDomainId ? {
+        domain: {
+          id: newScopeDomainId
+        }
+      } : "unscoped";
+      await openstackSession.rescope(newScope);
+      const newToken = openstackSession.getToken();
+      const newAuthToken2 = newToken?.authToken;
+      if (newAuthToken2 && newAuthToken2 !== sessionToken) {
+        const oldPendingRescopes = sessionRescopes.get(sessionToken);
+        if (oldPendingRescopes) {
+          const existingRescopes = sessionRescopes.get(newAuthToken2);
+          if (existingRescopes) {
+            for (const [key, value] of oldPendingRescopes.entries()) {
+              if (!existingRescopes.has(key)) {
+                existingRescopes.set(key, value);
               }
-            } else {
-              sessionRescopes.set(newAuthToken2, oldPendingRescopes);
             }
-            sessionRescopes.delete(sessionToken);
+          } else {
+            sessionRescopes.set(newAuthToken2, oldPendingRescopes);
           }
-        }
-        cachedUserId = void 0;
-        cachedUserInfo = void 0;
-        return newAuthToken2 || null;
-      } catch (err) {
-        console.error("Rescope error:", err);
-        return null;
-      } finally {
-        pendingRescopes.delete(scopeKey);
-        if (pendingRescopes.size === 0) {
           sessionRescopes.delete(sessionToken);
-          const currentToken = openstackSession?.getToken()?.authToken;
-          if (currentToken && currentToken !== sessionToken && sessionRescopes.get(currentToken)?.size === 0) {
-            sessionRescopes.delete(currentToken);
-          }
         }
       }
+      cachedUserId = void 0;
+      cachedUserInfo = void 0;
+      return newAuthToken2 || null;
     })();
+    const cleanupPromise = rescopeTokenPromise.finally(() => {
+      pendingRescopes.delete(scopeKey);
+      if (pendingRescopes.size === 0) {
+        sessionRescopes.delete(sessionToken);
+        const currentToken = openstackSession?.getToken()?.authToken;
+        if (currentToken && currentToken !== sessionToken && sessionRescopes.get(currentToken)?.size === 0) {
+          sessionRescopes.delete(currentToken);
+        }
+      }
+    });
     pendingRescopes.set(scopeKey, rescopeTokenPromise);
+    cleanupPromise.catch(() => {
+    });
     const newAuthToken = await rescopeTokenPromise;
     if (!newAuthToken) {
       return null;
@@ -39586,6 +40171,19 @@ async function createServer(config) {
   }, (_req, payload, done) => {
     done(null, payload);
   });
+  server.register(csrfProtection_default, {
+    tokenRoute: "/csrf-token",
+    cookieKey: "aurora-csrf-protection",
+    tokenHeader: "x-csrf-token",
+    excludePaths: [
+      "/extensions"
+    ],
+    protectionMethods: [
+      "POST",
+      "PUT",
+      "DELETE"
+    ]
+  });
   server.post(`${bffEndpoint}/upload-image-direct`, {
     config: {
       rawBody: false
@@ -39652,19 +40250,6 @@ async function createServer(config) {
       });
     }
   });
-  server.register(csrfProtection_default, {
-    tokenRoute: "/csrf-token",
-    cookieKey: "aurora-csrf-protection",
-    tokenHeader: "x-csrf-token",
-    excludePaths: [
-      "/extensions"
-    ],
-    protectionMethods: [
-      "POST",
-      "PUT",
-      "DELETE"
-    ]
-  });
   server.addHook("onRequest", (request, _reply, done) => {
     if (request.url.includes("/compute.uploadImage")) {
       request.raw.setTimeout(0);