@getstrata/bootstrap 0.2.61 → 0.2.63

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @getstrata/bootstrap changelog
 
+## 0.2.63
+
+- `HttpKernel.wrapWebGuest()` `home` accepts `string | ((user) => string | Promise<string>)` so signed-in guest redirects can follow the current team. Default remains `/organizations`.
+
+## 0.2.62
+
+- `HttpKernel.wrapWebPasswordConfirm()` is Laravel `password.confirm` for HTML routes. Peer `@getstrata/core` `^0.5.75`.
+
 ## 0.2.61
 
 - `HttpKernel.wrapVerified()` / `wrapWebVerified()` / `wrapWebAuthenticatedAllowUnverified()`. When `FEATURE_EMAIL_VERIFICATION=true`, `wrapWebAuthenticated` and `wrapWebAbility` require a verified email. Peer `@getstrata/core` `^0.5.74`.

package/README.md

@@ -32,7 +32,7 @@ import { createHttpKernel, createAppContext, coreProviders } from "@getstrata/bo
 
 Sibling HTMX apps should bind `createCookieSessionAuthManager` from `@getstrata/bootstrap/web/session` instead of HMAC `SessionGuard`. Use `signIn` / `signOut` (or the redirect helpers) instead of calling `CookieSessionStore` from controllers. Pass `mapUser` to map roles in the app. Pass `loadSessionUser` when the default `learn_subscriber` / `is_admin` SELECT does not match your schema. WorkHub’s table is `sessions` (`0031_create_sessions`); its loader is `loadWorkhubSessionUser` (maps `users.role`, decrypts email). WorkHub web login itself stays on HMAC `SessionGuard`.
 
-`wrapWeb` applies the web group (CSRF + flash) and `withErrorHandling`, so CSRF `ForbiddenError` becomes an HTML 403 in `FRONTEND_MODE=server-htmx`. `wrapWebGuest` is Laravel `guest` / `RedirectIfAuthenticated` (signed-in users go to `/organizations` by default). `wrapWebLogin` / `wrapWebRegister` include that web group plus throttle — do not wrap them with `wrapWeb` again. The throttle callback should return an HTML form at 429 (WorkHub’s `/login` and `/register` do).
+`wrapWeb` applies the web group (CSRF + flash) and `withErrorHandling`, so CSRF `ForbiddenError` becomes an HTML 403 in `FRONTEND_MODE=server-htmx`. `wrapWebGuest` is Laravel `guest` / `RedirectIfAuthenticated` (signed-in users go to `/organizations` by default; pass a string or `(user) => path` to override). `wrapWebLogin` / `wrapWebRegister` include that web group plus throttle — do not wrap them with `wrapWeb` again. The throttle callback should return an HTML form at 429 (WorkHub’s `/login` and `/register` do).
 
 These subpaths remain WorkHub-oriented and are not a generic starter API: `@getstrata/bootstrap/createRoutes` (includes SCIM), `@getstrata/bootstrap/schedule`, and `@getstrata/bootstrap/createWebRoutes` (redirects `/` to `/organizations`).
 

package/dist/bootstrap/httpKernel.d.ts

@@ -1,7 +1,9 @@
+import type { AuthUser } from "@getstrata/core/auth/authContext";
 import type { Policy } from "@getstrata/core/auth/policy";
 import type { Middleware, RouteHandler } from "@getstrata/core/http/middleware";
 import type { AppDependencies } from "./contracts";
 type MiddlewareGroupName = "api" | "authenticated" | "web";
+type WebGuestHome = string | ((user: AuthUser) => string | Promise<string>);
 declare class HttpKernel {
     private readonly dependencies;
     constructor(dependencies: AppDependencies);
@@ -11,12 +13,14 @@ declare class HttpKernel {
     wrapApi(handler: RouteHandler): RouteHandler;
     wrapWeb(handler: RouteHandler): RouteHandler;
     /** Laravel `guest` / `RedirectIfAuthenticated` — signed-in users go to `home`. */
-    wrapWebGuest(handler: RouteHandler, home?: string): RouteHandler;
+    wrapWebGuest(handler: RouteHandler, home?: WebGuestHome): RouteHandler;
     wrapWebPublicRead(handler: RouteHandler): RouteHandler;
     wrapWebAuthenticated(handler: RouteHandler): RouteHandler;
     /** Signed-in HTML without Laravel `verified` (logout, verification notice). */
     wrapWebAuthenticatedAllowUnverified(handler: RouteHandler): RouteHandler;
     wrapWebVerified(handler: RouteHandler): RouteHandler;
+    /** Laravel `password.confirm` — requires a fresh signed confirmation cookie. */
+    wrapWebPasswordConfirm(handler: RouteHandler): RouteHandler;
     wrapWebAbility(ability: string, handler: RouteHandler): RouteHandler;
     wrapWebGlobalAdmin(handler: RouteHandler): RouteHandler;
     wrapAuthenticated(handler: RouteHandler): RouteHandler;
@@ -34,5 +38,5 @@ declare class HttpKernel {
     private wrapThrottle;
 }
 declare function createHttpKernel(dependencies: AppDependencies): HttpKernel;
-export type { MiddlewareGroupName };
+export type { MiddlewareGroupName, WebGuestHome };
 export { createHttpKernel, HttpKernel };

package/dist/entries/buildModuleRoutes.js

@@ -25,6 +25,7 @@ import { requestIdMiddleware } from "@getstrata/core/http/middleware";
 import { createRequireAbilityMiddleware } from "@getstrata/core/http/requireAbilityMiddleware";
 import { createRequireAuthMiddleware } from "@getstrata/core/http/requireAuthMiddleware";
 import { createRequireGlobalAdminMiddleware } from "@getstrata/core/http/requireGlobalAdminMiddleware";
+import { createRequirePasswordConfirmMiddleware } from "@getstrata/core/http/requirePasswordConfirmMiddleware";
 import { createRequireVerifiedMiddleware } from "@getstrata/core/http/requireVerifiedMiddleware";
 import { createRequireWebAuthMiddleware } from "@getstrata/core/http/requireWebAuthMiddleware";
 import { withErrorHandling } from "@getstrata/core/http/response";
@@ -188,7 +189,8 @@ class HttpKernel {
         if (isEmailVerificationRequired() && !hasVerifiedEmail(user)) {
           return Response.redirect("/email/verify", 302);
         }
-        return Response.redirect(home, 302);
+        const location = typeof home === "function" ? await home(user) : home;
+        return Response.redirect(location, 302);
       }
       return handler(request);
     });
@@ -208,6 +210,11 @@ class HttpKernel {
   wrapWebVerified(handler) {
     return this.wrapWebAuth(handler, { verified: true });
   }
+  wrapWebPasswordConfirm(handler) {
+    return this.wrapWebAuth(withMiddleware(createRequirePasswordConfirmMiddleware())(handler), {
+      verified: true
+    });
+  }
   wrapWebAbility(ability, handler) {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
     const abilityChecker = resolveAbilityChecker(this.dependencies.container);

package/dist/entries/buildWebModuleRoutes.js

@@ -28,6 +28,7 @@ import { requestIdMiddleware } from "@getstrata/core/http/middleware";
 import { createRequireAbilityMiddleware } from "@getstrata/core/http/requireAbilityMiddleware";
 import { createRequireAuthMiddleware } from "@getstrata/core/http/requireAuthMiddleware";
 import { createRequireGlobalAdminMiddleware } from "@getstrata/core/http/requireGlobalAdminMiddleware";
+import { createRequirePasswordConfirmMiddleware } from "@getstrata/core/http/requirePasswordConfirmMiddleware";
 import { createRequireVerifiedMiddleware } from "@getstrata/core/http/requireVerifiedMiddleware";
 import { createRequireWebAuthMiddleware } from "@getstrata/core/http/requireWebAuthMiddleware";
 import { withErrorHandling } from "@getstrata/core/http/response";
@@ -191,7 +192,8 @@ class HttpKernel {
         if (isEmailVerificationRequired() && !hasVerifiedEmail(user)) {
           return Response.redirect("/email/verify", 302);
         }
-        return Response.redirect(home, 302);
+        const location = typeof home === "function" ? await home(user) : home;
+        return Response.redirect(location, 302);
       }
       return handler(request);
     });
@@ -211,6 +213,11 @@ class HttpKernel {
   wrapWebVerified(handler) {
     return this.wrapWebAuth(handler, { verified: true });
   }
+  wrapWebPasswordConfirm(handler) {
+    return this.wrapWebAuth(withMiddleware(createRequirePasswordConfirmMiddleware())(handler), {
+      verified: true
+    });
+  }
   wrapWebAbility(ability, handler) {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
     const abilityChecker = resolveAbilityChecker(this.dependencies.container);

package/dist/entries/context.js

@@ -475,15 +475,160 @@ var storageProvider = {
 var storage_default = storageProvider;
 
 // ../../src/bootstrap/providers/view.ts
+import { resolveMembershipLookup } from "@getstrata/core/auth/membershipContext";
 import { currentRequestMeta } from "@getstrata/core/http/requestMetaContext";
+import { appDisplayName } from "@getstrata/core/runtime/appKeyPrefix";
 import { isViewsEnabled } from "@getstrata/core/runtime/frontendMode";
 import {
   configureWebErrorView,
+  configureWebLayoutData,
   DEFAULT_VIEWS_DIRECTORY,
   EtaViewEngine,
   errorTemplateName,
   resolveWebLayoutData
 } from "@getstrata/core/view";
+
+// ../../src/modules/organization/repository.ts
+import { BaseRepository } from "@getstrata/core/database/baseRepository";
+import { NotFoundError } from "@getstrata/core/errors/http";
+import { currentTenantId } from "@getstrata/core/tenant/tenantContext";
+
+// ../../src/modules/organization/table.ts
+import { defineTable } from "@getstrata/core/database/table";
+
+// ../../src/domain/workhub.ts
+var ORGANIZATION_TABLE = "organization";
+
+// ../../src/modules/organization/table.ts
+var organizationTable = defineTable({
+  name: ORGANIZATION_TABLE,
+  primaryKey: "id",
+  columns: ["id", "tenant_id", "name", "slug", "created_at", "updated_at", "deleted_at"],
+  softDeletes: true,
+  defaultOrderBy: { column: "id", direction: "ASC" }
+});
+
+// ../../src/modules/organization/repository.ts
+class OrganizationRepository extends BaseRepository {
+  constructor() {
+    super(organizationTable);
+  }
+  async findBySlug(slug) {
+    return await this.firstOrNull({ slug });
+  }
+  async listForTenant(options) {
+    return await this.findAll({
+      limit: options.limit,
+      offset: options.offset,
+      where: { tenant_id: options.tenantId ?? currentTenantId() }
+    });
+  }
+  async countForTenant(tenantId = currentTenantId()) {
+    return await this.countWhere({ tenant_id: tenantId });
+  }
+  async findForTenantOrThrow(id, tenantId = currentTenantId()) {
+    const organization = await this.findById(id);
+    if (!organization || organization.tenant_id !== tenantId) {
+      throw new NotFoundError(`SCIM group ${id} not found.`);
+    }
+    return organization;
+  }
+}
+var repository_default = OrganizationRepository;
+
+// ../../src/modules/user/repository.ts
+import {
+  emailLookupForQuery,
+  protectEmail,
+  revealEmail
+} from "@getstrata/core/crypto/fieldEncryption";
+import { revealMfaSecret } from "@getstrata/core/crypto/mfaSecret";
+import { BaseRepository as BaseRepository2 } from "@getstrata/core/database/baseRepository";
+import { currentTenantId as currentTenantId2 } from "@getstrata/core/tenant/tenantContext";
+
+// ../../src/modules/user/table.ts
+import { defineTable as defineTable2 } from "@getstrata/core/database/table";
+var userTable = defineTable2({
+  name: "users",
+  primaryKey: "id",
+  columns: [
+    "id",
+    "name",
+    "email",
+    "email_lookup",
+    "role",
+    "tenant_id",
+    "password_hash",
+    "email_verified_at",
+    "mfa_secret",
+    "mfa_enabled",
+    "mfa_recovery_codes",
+    "profile_photo_path",
+    "session_valid_after",
+    "current_organization_id",
+    "created_at",
+    "updated_at"
+  ],
+  defaultOrderBy: { column: "id", direction: "ASC" }
+});
+
+// ../../src/modules/user/repository.ts
+class UserRepository extends BaseRepository2 {
+  constructor() {
+    super(userTable);
+  }
+  decode(record) {
+    return {
+      ...record,
+      email: revealEmail(record.email),
+      mfa_secret: revealMfaSecret(record.mfa_secret)
+    };
+  }
+  async findById(id) {
+    const record = await super.findById(id);
+    return record ? this.decode(record) : null;
+  }
+  async findAll(options = {}) {
+    const records = await super.findAll(options);
+    return records.map((record) => this.decode(record));
+  }
+  async create(values) {
+    const email = values.email;
+    if (!email) {
+      throw new Error("Email is required.");
+    }
+    const protectedEmail = protectEmail(email);
+    const record = await super.create({
+      ...values,
+      tenant_id: values.tenant_id ?? currentTenantId2(),
+      email: protectedEmail.storedEmail,
+      email_lookup: protectedEmail.emailLookup,
+      password_hash: values.password_hash ?? ""
+    });
+    return this.decode(record);
+  }
+  async updateByIdOrThrow(id, values, errorFactory) {
+    const changes = { ...values };
+    if (values.email !== undefined) {
+      const protectedEmail = protectEmail(values.email);
+      changes.email = protectedEmail.storedEmail;
+      changes.email_lookup = protectedEmail.emailLookup;
+    }
+    const record = await super.updateByIdOrThrow(id, changes, errorFactory);
+    return this.decode(record);
+  }
+  async findByEmail(email) {
+    const records = await this.findWhere({ email_lookup: emailLookupForQuery(email) }, { limit: 1 });
+    const record = records[0];
+    return record ? this.decode(record) : null;
+  }
+  async countForTenant(tenantId = currentTenantId2()) {
+    return await this.countWhere({ tenant_id: tenantId });
+  }
+}
+var repository_default2 = UserRepository;
+
+// ../../src/bootstrap/providers/view.ts
 var CORE_VIEW_TOKEN = "core.view";
 var VIEW_DIRECTORY_CONFIG_KEY = "view.directory";
 var viewProvider = {
@@ -496,6 +641,25 @@ var viewProvider = {
     config.set(VIEW_DIRECTORY_CONFIG_KEY, viewsDirectory);
     const engine = new EtaViewEngine(viewsDirectory, (request) => resolveWebLayoutData(container, request ?? currentRequestMeta().request));
     container.set(CORE_VIEW_TOKEN, engine);
+    configureWebLayoutData({
+      extra: async (user) => {
+        const appName = appDisplayName();
+        if (!user || typeof user.id !== "number") {
+          return { appName, currentOrganization: null, organizations: [] };
+        }
+        try {
+          const record = await new repository_default2().findByIdOrThrow(user.id);
+          const memberships = await resolveMembershipLookup().listForUser(record.id);
+          const organizationsRepo = new repository_default;
+          const organizations = (await Promise.all(memberships.map((membership) => organizationsRepo.findById(membership.organization_id)))).filter((organization) => Boolean(organization && !organization.deleted_at));
+          const currentId = record.current_organization_id ?? null;
+          const currentOrganization = organizations.find((organization) => organization.id === currentId) ?? organizations[0] ?? null;
+          return { appName, currentOrganization, organizations };
+        } catch {
+          return { appName, currentOrganization: null, organizations: [] };
+        }
+      }
+    });
     configureWebErrorView({
       render: async (input) => engine.render(errorTemplateName(input.status), {
         title: input.title,

package/dist/entries/createRoutes.js

@@ -65,6 +65,7 @@ import { requestIdMiddleware } from "@getstrata/core/http/middleware";
 import { createRequireAbilityMiddleware } from "@getstrata/core/http/requireAbilityMiddleware";
 import { createRequireAuthMiddleware } from "@getstrata/core/http/requireAuthMiddleware";
 import { createRequireGlobalAdminMiddleware } from "@getstrata/core/http/requireGlobalAdminMiddleware";
+import { createRequirePasswordConfirmMiddleware } from "@getstrata/core/http/requirePasswordConfirmMiddleware";
 import { createRequireVerifiedMiddleware } from "@getstrata/core/http/requireVerifiedMiddleware";
 import { createRequireWebAuthMiddleware } from "@getstrata/core/http/requireWebAuthMiddleware";
 import { withErrorHandling } from "@getstrata/core/http/response";
@@ -228,7 +229,8 @@ class HttpKernel {
         if (isEmailVerificationRequired() && !hasVerifiedEmail(user)) {
           return Response.redirect("/email/verify", 302);
         }
-        return Response.redirect(home, 302);
+        const location = typeof home === "function" ? await home(user) : home;
+        return Response.redirect(location, 302);
       }
       return handler(request);
     });
@@ -248,6 +250,11 @@ class HttpKernel {
   wrapWebVerified(handler) {
     return this.wrapWebAuth(handler, { verified: true });
   }
+  wrapWebPasswordConfirm(handler) {
+    return this.wrapWebAuth(withMiddleware(createRequirePasswordConfirmMiddleware())(handler), {
+      verified: true
+    });
+  }
   wrapWebAbility(ability, handler) {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
     const abilityChecker = resolveAbilityChecker(this.dependencies.container);
@@ -791,7 +798,7 @@ function assertScimIfMatch(request, etagSource) {
 // ../../src/modules/scim/service.ts
 import { hashPassword as hashPassword3 } from "@getstrata/core/auth/password";
 import { resolveService } from "@getstrata/core/contracts/di";
-import { NotFoundError as NotFoundError5 } from "@getstrata/core/errors/http";
+import { NotFoundError as NotFoundError7 } from "@getstrata/core/errors/http";
 import { currentTenantId as currentTenantId4 } from "@getstrata/core/tenant/tenantContext";
 
 // ../../src/domain/scim.ts
@@ -1044,6 +1051,7 @@ import {
 import { OidcProvider } from "@getstrata/core/auth/oauth/oidcProvider";
 import { GitHubOAuthProvider, MockOAuthProvider } from "@getstrata/core/auth/oauth/providers";
 import { SamlProvider } from "@getstrata/core/auth/oauth/samlProvider";
+import { getRequiredDependency } from "@getstrata/core/contracts/di";
 
 // ../../src/modules/user/apiTokenRepository.ts
 import { BaseRepository as BaseRepository2 } from "@getstrata/core/database/baseRepository";
@@ -1067,9 +1075,16 @@ var apiTokenTable = defineTable2({
 });
 
 // ../../src/modules/user/authService.ts
+import { currentAuthUser } from "@getstrata/core/auth/authContext";
 import { hashPassword, verifyPassword } from "@getstrata/core/auth/password";
+import { normalizeEmail } from "@getstrata/core/crypto/fieldEncryption";
 import { protectMfaSecret, revealMfaSecret } from "@getstrata/core/crypto/mfaSecret";
-import { UnauthorizedError, ValidationError } from "@getstrata/core/errors/http";
+import { UnauthorizedError as UnauthorizedError2, ValidationError } from "@getstrata/core/errors/http";
+import {
+  generateRecoveryCodes,
+  hashRecoveryCode,
+  recoveryCodeMatches
+} from "@getstrata/core/security/recoveryCodes";
 import { logSecurityEvent } from "@getstrata/core/security/securityEvents";
 import { resolveDefaultTokenExpiryDays } from "@getstrata/core/security/tokenExpiry";
 import { buildOtpauthUrl, generateTotpSecret, verifyTotp } from "@getstrata/core/security/totp";
@@ -1078,6 +1093,7 @@ import { currentTenantId as currentTenantId2 } from "@getstrata/core/tenant/tena
 // ../../src/core/auth/abilityCatalog.ts
 var MEMBER_ABILITIES = [
   "organizations:read",
+  "organizations:create",
   "projects:read",
   "projects:create",
   "tasks:read",
@@ -1087,7 +1103,8 @@ var MEMBER_ABILITIES = [
   "attachments:read",
   "attachments:create",
   "auth:tokens:read",
-  "auth:tokens:write"
+  "auth:tokens:write",
+  "auth:tokens:delete"
 ];
 var ADMIN_ABILITIES = [
   ...MEMBER_ABILITIES,
@@ -1105,6 +1122,14 @@ var ADMIN_ABILITIES = [
   "webhooks:write",
   "audit:read"
 ];
+// ../../src/modules/user/mfaRequiredError.ts
+import { UnauthorizedError } from "@getstrata/core/errors/http";
+
+// ../../src/modules/user/currentOrganizationService.ts
+import { assertResourceInCurrentTenant } from "@getstrata/core/auth/membershipScope";
+import { resolveMembershipService } from "@getstrata/core/auth/membershipService";
+import { NotFoundError as NotFoundError3 } from "@getstrata/core/errors/http";
+
 // ../../src/modules/user/notificationRepository.ts
 import { BaseRepository as BaseRepository3 } from "@getstrata/core/database/baseRepository";
 
@@ -1118,7 +1143,7 @@ var notificationTable = defineTable3({
 });
 
 // ../../src/modules/user/notificationService.ts
-import { NotFoundError as NotFoundError3 } from "@getstrata/core/errors/http";
+import { NotFoundError as NotFoundError4 } from "@getstrata/core/errors/http";
 
 // ../../src/modules/user/oauthIdentityRepository.ts
 import { BaseRepository as BaseRepository4 } from "@getstrata/core/database/baseRepository";
@@ -1137,11 +1162,16 @@ import { ValidationError as ValidationError2 } from "@getstrata/core/errors/http
 import { absoluteTemporarySignedUrl } from "@getstrata/core/http/signedUrl";
 import { mailer } from "@getstrata/core/mail/mailer";
 import { sendMarkdownMail } from "@getstrata/core/mail/markdownMailable";
+import { appDisplayName } from "@getstrata/core/runtime/appKeyPrefix";
 import { logSecurityEvent as logSecurityEvent2 } from "@getstrata/core/security/securityEvents";
 import { timingSafeCompareString } from "@getstrata/core/security/timingSafeCompare";
 var RESET_TTL_SECONDS = 60 * 60;
 var VERIFY_TTL_SECONDS = 60 * 60 * 24;
 
+// ../../src/modules/user/profilePhotoService.ts
+import { BadRequestError, NotFoundError as NotFoundError5 } from "@getstrata/core/errors/http";
+import { isImageMimeType, resizeImageContents } from "@getstrata/core/media/imageTransform";
+
 // ../../src/modules/user/repository.ts
 import {
   emailLookupForQuery,
@@ -1168,15 +1198,76 @@ var userTable = defineTable5({
     "email_verified_at",
     "mfa_secret",
     "mfa_enabled",
+    "mfa_recovery_codes",
+    "profile_photo_path",
+    "session_valid_after",
+    "current_organization_id",
     "created_at",
     "updated_at"
   ],
   defaultOrderBy: { column: "id", direction: "ASC" }
 });
 
+// ../../src/modules/user/repository.ts
+class UserRepository extends BaseRepository5 {
+  constructor() {
+    super(userTable);
+  }
+  decode(record) {
+    return {
+      ...record,
+      email: revealEmail(record.email),
+      mfa_secret: revealMfaSecret2(record.mfa_secret)
+    };
+  }
+  async findById(id) {
+    const record = await super.findById(id);
+    return record ? this.decode(record) : null;
+  }
+  async findAll(options = {}) {
+    const records = await super.findAll(options);
+    return records.map((record) => this.decode(record));
+  }
+  async create(values) {
+    const email = values.email;
+    if (!email) {
+      throw new Error("Email is required.");
+    }
+    const protectedEmail = protectEmail(email);
+    const record = await super.create({
+      ...values,
+      tenant_id: values.tenant_id ?? currentTenantId3(),
+      email: protectedEmail.storedEmail,
+      email_lookup: protectedEmail.emailLookup,
+      password_hash: values.password_hash ?? ""
+    });
+    return this.decode(record);
+  }
+  async updateByIdOrThrow(id, values, errorFactory) {
+    const changes = { ...values };
+    if (values.email !== undefined) {
+      const protectedEmail = protectEmail(values.email);
+      changes.email = protectedEmail.storedEmail;
+      changes.email_lookup = protectedEmail.emailLookup;
+    }
+    const record = await super.updateByIdOrThrow(id, changes, errorFactory);
+    return this.decode(record);
+  }
+  async findByEmail(email) {
+    const records = await this.findWhere({ email_lookup: emailLookupForQuery(email) }, { limit: 1 });
+    const record = records[0];
+    return record ? this.decode(record) : null;
+  }
+  async countForTenant(tenantId = currentTenantId3()) {
+    return await this.countWhere({ tenant_id: tenantId });
+  }
+}
+var repository_default2 = UserRepository;
+
 // ../../src/modules/user/tokenService.ts
+import { ADMIN_ABILITIES as ADMIN_ABILITIES2 } from "@getstrata/core/auth/abilityCatalog";
 import { hashApiToken as hashApiToken2 } from "@getstrata/core/auth/tokenHash";
-import { ForbiddenError, NotFoundError as NotFoundError4 } from "@getstrata/core/errors/http";
+import { ForbiddenError, NotFoundError as NotFoundError6, ValidationError as ValidationError3 } from "@getstrata/core/errors/http";
 import { resolveDefaultTokenExpiryDays as resolveDefaultTokenExpiryDays2 } from "@getstrata/core/security/tokenExpiry";
 
 // ../../src/modules/user/provider.ts
@@ -1234,7 +1325,7 @@ class ScimService {
   async findUserRecord(id) {
     const user = await this.users.findById(id);
     if (!user || user.tenant_id !== currentTenantId4()) {
-      throw new NotFoundError5(`SCIM user ${id} not found.`);
+      throw new NotFoundError7(`SCIM user ${id} not found.`);
     }
     return user;
   }
@@ -1276,7 +1367,7 @@ class ScimService {
     const user = await this.findUserRecord(id);
     const deleted = await this.users.deleteById(id);
     if (!deleted) {
-      throw new NotFoundError5(`SCIM user ${id} not found.`);
+      throw new NotFoundError7(`SCIM user ${id} not found.`);
     }
     return { id: user.id, updated_at: user.updated_at };
   }

package/dist/entries/createWebRoutes.js

@@ -33,6 +33,7 @@ import { requestIdMiddleware } from "@getstrata/core/http/middleware";
 import { createRequireAbilityMiddleware } from "@getstrata/core/http/requireAbilityMiddleware";
 import { createRequireAuthMiddleware } from "@getstrata/core/http/requireAuthMiddleware";
 import { createRequireGlobalAdminMiddleware } from "@getstrata/core/http/requireGlobalAdminMiddleware";
+import { createRequirePasswordConfirmMiddleware } from "@getstrata/core/http/requirePasswordConfirmMiddleware";
 import { createRequireVerifiedMiddleware } from "@getstrata/core/http/requireVerifiedMiddleware";
 import { createRequireWebAuthMiddleware } from "@getstrata/core/http/requireWebAuthMiddleware";
 import { withErrorHandling } from "@getstrata/core/http/response";
@@ -196,7 +197,8 @@ class HttpKernel {
         if (isEmailVerificationRequired() && !hasVerifiedEmail(user)) {
           return Response.redirect("/email/verify", 302);
         }
-        return Response.redirect(home, 302);
+        const location = typeof home === "function" ? await home(user) : home;
+        return Response.redirect(location, 302);
       }
       return handler(request);
     });
@@ -216,6 +218,11 @@ class HttpKernel {
   wrapWebVerified(handler) {
     return this.wrapWebAuth(handler, { verified: true });
   }
+  wrapWebPasswordConfirm(handler) {
+    return this.wrapWebAuth(withMiddleware(createRequirePasswordConfirmMiddleware())(handler), {
+      verified: true
+    });
+  }
   wrapWebAbility(ability, handler) {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
     const abilityChecker = resolveAbilityChecker(this.dependencies.container);