@learncard/network-brain-service 3.18.0 → 3.19.1

package/src/routes/contracts.ts

@@ -77,6 +77,7 @@ import {
 } from '@accesslayer/consentflowcontract/relationships/create';
 import { getProfileByDid, getProfileByProfileId } from '@accesslayer/profile/read';
 import { sendBoost, isDraftBoost } from '@helpers/boost.helpers';
+import { setCredentialSubjectIds } from '@helpers/credentialSubject.helpers';
 import { isRelationshipBlocked } from '@helpers/connection.helpers';
 import { getBoostByUri } from '@accesslayer/boost/read';
 import { canProfileIssueBoost } from '@accesslayer/boost/relationships/read';
@@ -818,17 +819,7 @@ export const contractsRouter = t.router({
                     unsignedVc.issuanceDate = new Date().toISOString();
                 }
                 unsignedVc.issuer = { id: getDidWeb(ctx.domain, profile.profileId) };
-                if (Array.isArray(unsignedVc.credentialSubject)) {
-                    unsignedVc.credentialSubject = unsignedVc.credentialSubject.map(subject => ({
-                        ...subject,
-                        id: getDidWeb(ctx.domain, otherProfile.profileId),
-                    }));
-                } else {
-                    unsignedVc.credentialSubject = {
-                        ...unsignedVc.credentialSubject,
-                        id: getDidWeb(ctx.domain, otherProfile.profileId),
-                    };
-                }
+                setCredentialSubjectIds(unsignedVc, getDidWeb(ctx.domain, otherProfile.profileId));
                 if (unsignedVc?.type?.includes('BoostCredential')) unsignedVc.boostId = boostUri;
                 // Inject OBv3 skill alignments based on boost's framework/skills
                 await injectObv3AlignmentsIntoCredentialForBoost(unsignedVc, boost, ctx.domain);

package/src/routes/credential-refreshes.test.ts

@@ -116,7 +116,10 @@ describe('credential refresh issuer route gating', () => {
                 markConstraintsReady = resolve;
             })
         );
-        mocks.sendRefreshableCredential.mockResolvedValue('lc:network:credential:root');
+        mocks.sendRefreshableCredential.mockResolvedValue({
+            uri: 'lc:network:credential:root',
+            receipt: { refreshId: 'opaque-refresh-id' },
+        });
 
         const caller = credentialRefreshesRouter.createCaller({
             domain: 'network.example.com',
@@ -174,7 +177,10 @@ describe('credential refresh issuer route gating', () => {
 
     it('forwards initial notification suppression to managed delivery', async () => {
         process.env.CREDENTIAL_REFRESH_ENABLED = 'true';
-        mocks.sendRefreshableCredential.mockResolvedValue('lc:network:credential:root');
+        mocks.sendRefreshableCredential.mockResolvedValue({
+            uri: 'lc:network:credential:root',
+            receipt: { refreshId: 'opaque-refresh-id' },
+        });
 
         const caller = credentialRefreshesRouter.createCaller({
             domain: 'network.example.com',

package/src/routes/credential-refreshes.ts

@@ -124,7 +124,7 @@ export const credentialRefreshesRouter = t.router({
         .mutation(async ({ ctx, input }) => {
             const { profile } = ctx.user;
 
-            return sendRefreshableCredential({
+            const { uri } = await sendRefreshableCredential({
                 issuerProfile: profile,
                 refreshId: input.refreshId,
                 credential: input.credential,
@@ -132,6 +132,8 @@ export const credentialRefreshesRouter = t.router({
                 skipNotification: input.skipNotification,
                 domain: ctx.domain,
             });
+
+            return uri;
         }),
 
     publishCredentialRefresh: credentialRefreshRoute
@@ -156,6 +158,7 @@ export const credentialRefreshesRouter = t.router({
                 issuerProfile: profile,
                 input: input as PublishCredentialRefreshInput,
                 domain: ctx.domain,
+                branding: ctx.tenant?.emailBranding,
             });
         }),
 

package/src/routes/credentials.ts

@@ -71,6 +71,7 @@ export const credentialsRouter = t.router({
             // Log credential activity FIRST to get activityId
             const activityId = await logCredentialSent({
                 actorProfileId: profile.profileId,
+                onBehalfOf: ctx.user.onBehalfOf,
                 recipientType: 'profile',
                 recipientIdentifier: targetProfile.profileId,
                 recipientProfileId: targetProfile.profileId,
@@ -118,7 +119,7 @@ export const credentialsRouter = t.router({
             const { profile } = ctx.user;
             const { uri } = input;
 
-            return acceptCredential(profile, uri, input?.options ?? {});
+            return acceptCredential(profile, uri, input?.options ?? {}, ctx.tenant?.emailBranding);
         }),
 
     receivedCredentials: profileRoute

package/src/routes/inbox.ts

@@ -1,3 +1,12 @@
+import { trace } from '@tracing';
+import { submitInboxBatch, getInboxBatch } from '@helpers/inbox-queue.helpers';
+import {
+    assertInboxRefreshEnabled,
+    inboxRefreshRequestDigest,
+    getInboxRefreshReplay,
+    getInboxRefreshReceipt,
+    resumeInboxRefreshDelivery,
+} from '@helpers/inbox-refresh.helpers';
 import { getDidWeb } from '@helpers/did.helpers';
 import { TRPCError } from '@trpc/server';
 import { z } from 'zod';
@@ -6,6 +15,9 @@ import { t, profileRoute, openRoute, verifiedContactRoute, scopedRoute } from '@
 import {
     PaginationOptionsValidator,
     IssueInboxCredentialValidator,
+    IssueInboxCredentialBatchValidator,
+    InboxBatchReceiptValidator,
+    InboxBatchStatusValidator,
     IssueInboxCredentialResponseValidator,
     InboxCredentialValidator,
     PaginatedInboxCredentialsValidator,
@@ -18,15 +30,14 @@ import {
     JWEValidator,
 } from '@learncard/types';
 import { getInboxCredentialMeta } from '@helpers/credential-meta.helpers';
-import { claimIntoInbox, issueToInbox } from '@helpers/inbox.helpers';
-import { prepareCredentialFromBoost, getBoostUri } from '@helpers/boost.helpers';
+import { claimIntoInbox, issueToInbox, resolveInboxCredentialInput } from '@helpers/inbox.helpers';
 import {
     hasMustacheVariables,
     renderBoostTemplate,
     parseRenderedTemplate,
 } from '@helpers/template.helpers';
 import { getProfileByVerifiedContactMethod } from '@accesslayer/contact-method/relationships/read';
-import { getBoostByUri, getBoostsForProfile } from '@accesslayer/boost/read';
+import { getBoostsForProfile } from '@accesslayer/boost/read';
 import {
     generateGuardianApprovalToken,
     generateGuardianApprovalUrl,
@@ -447,55 +458,36 @@ export const inboxRouter = t.router({
         .output(IssueInboxCredentialResponseValidator)
         .mutation(async ({ ctx, input }) => {
             const { profile } = ctx.user;
-            const { recipient, credential: inputCredential, templateUri, configuration } = input;
-
-            // Resolve credential from templateUri if provided
-            let credential = inputCredential;
-            let resolvedBoostUri: string | undefined;
-
-            if (templateUri && !credential) {
-                const boostInstance = await getBoostByUri(templateUri);
-
-                if (!boostInstance) {
-                    throw new TRPCError({
-                        code: 'NOT_FOUND',
-                        message: `Boost not found: ${templateUri}`,
-                    });
-                }
-
-                if (!boostInstance.dataValues.boost) {
-                    throw new TRPCError({
-                        code: 'BAD_REQUEST',
-                        message: `Boost does not contain a credential template: ${templateUri}`,
-                    });
-                }
+            const { recipient, configuration } = input;
 
-                try {
-                    // Use shared helper to prepare credential with templateData rendering,
-                    // issuance date, boostId injection, and OBv3 alignments
-                    resolvedBoostUri = getBoostUri(boostInstance.id, ctx.domain);
-
-                    credential = await prepareCredentialFromBoost(
-                        boostInstance,
-                        resolvedBoostUri,
-                        ctx.domain,
-                        { templateData: configuration?.templateData as Record<string, unknown> }
+            const refreshDigest = input.refresh ? inboxRefreshRequestDigest(input) : undefined;
+            if (input.refresh) {
+                await assertInboxRefreshEnabled(ctx.user.scope);
+                const replay = await getInboxRefreshReplay(
+                    profile.profileId,
+                    input.idempotencyKey,
+                    refreshDigest!
+                );
+                if (replay && (replay.claimUrl || replay.inbox.currentStatus !== 'PENDING')) {
+                    await resumeInboxRefreshDelivery(replay.inbox.refreshId!, ctx.domain);
+                    const receipt = await getInboxRefreshReceipt(
+                        replay.inbox.refreshId!,
+                        ctx.domain
                     );
-                } catch (e) {
-                    console.error('Failed to prepare boost credential', e);
-                    throw new TRPCError({
-                        code: 'BAD_REQUEST',
-                        message: `Failed to prepare boost credential template: ${templateUri}`,
-                    });
+                    return {
+                        issuanceId: replay.inbox.id,
+                        status: replay.inbox.currentStatus,
+                        recipient,
+                        claimUrl: replay.claimUrl,
+                        refresh: receipt,
+                        ...(replay.inbox.currentStatus === 'ISSUED'
+                            ? { recipientDid: receipt.holderDid }
+                            : {}),
+                    };
                 }
             }
 
-            if (!credential) {
-                throw new TRPCError({
-                    code: 'BAD_REQUEST',
-                    message: 'Either credential or templateUri must be provided',
-                });
-            }
+            const { credential, resolvedBoostUri } = await resolveInboxCredentialInput(input, ctx);
 
             // Normalize signing authority name if provided
             const normalizedConfiguration = configuration?.signingAuthority
@@ -513,11 +505,18 @@ export const inboxRouter = t.router({
                     profile,
                     recipient,
                     credential,
-                    normalizedConfiguration,
+                    {
+                        ...normalizedConfiguration,
+                        boostUri: resolvedBoostUri,
+                        refresh: input.refresh,
+                        idempotencyKey: input.idempotencyKey,
+                        refreshRequestDigest: refreshDigest,
+                    },
                     ctx
                 );
 
                 return {
+                    refresh: result.refresh,
                     issuanceId: result.inboxCredential.id,
                     status: result.status,
                     recipient,
@@ -536,6 +535,42 @@ export const inboxRouter = t.router({
             }
         }),
 
+    issueBatch: profileRoute
+        .meta({
+            openapi: {
+                protect: true,
+                method: 'POST',
+                path: '/inbox/issue-batch',
+                tags: ['Universal Inbox'],
+                summary: 'Issue Credentials to Universal Inbox (Batch)',
+                description:
+                    'Queue 1–100 credentials for background issuance. Returns a durable batch ID; poll GET /inbox/batches/{batchId} for ordered results. Request and item idempotency keys are issuer-scoped for 24 hours. Maximum JSON payload: 4 MiB.',
+            },
+            requiredScope: 'inbox:write',
+        })
+        .input(IssueInboxCredentialBatchValidator)
+        .output(InboxBatchReceiptValidator)
+        .mutation(({ ctx, input }) =>
+            trace('route', 'issueBatch', () => submitInboxBatch(ctx.user.profile, input, ctx), {
+                itemCount: input.items.length,
+            })
+        ),
+
+    getBatch: profileRoute
+        .meta({
+            openapi: {
+                protect: true,
+                method: 'GET',
+                path: '/inbox/batches/{batchId}',
+                tags: ['Universal Inbox'],
+                summary: 'Get Inbox Batch Progress',
+            },
+            requiredScope: 'inbox:read',
+        })
+        .input(z.object({ batchId: z.string() }))
+        .output(InboxBatchStatusValidator)
+        .query(({ ctx, input }) => getInboxBatch(ctx.user.profile.profileId, input.batchId)),
+
     claim: verifiedContactRoute
         .meta({
             openapi: {
@@ -682,6 +717,7 @@ export const inboxRouter = t.router({
             // Log initial activity so embed claims appear in the dashboard
             const activityId = await logCredentialSent({
                 actorProfileId: issuerProfile.profileId,
+                onBehalfOf: ctx.user?.onBehalfOf,
                 recipientType: contactMethod.type as 'email' | 'phone',
                 recipientIdentifier: contactMethod.value,
                 integrationId: integration.id,
@@ -825,7 +861,17 @@ export const inboxRouter = t.router({
                 });
             }
 
-            return inboxCredential;
+            return {
+                ...inboxCredential,
+                ...(inboxCredential.refreshId
+                    ? {
+                          refresh: await getInboxRefreshReceipt(
+                              inboxCredential.refreshId,
+                              ctx.domain
+                          ),
+                      }
+                    : {}),
+            };
         }),
 
     // ─── Guardian Credential Approval Routes ─────────────────────────────────────

package/src/routes/index.ts

@@ -9,8 +9,9 @@ import { CreateFastifyContextOptions } from '@trpc/server/adapters/fastify';
 import { OpenApiMeta } from 'trpc-to-openapi';
 import jwtDecode from 'jwt-decode';
 import * as Sentry from '@sentry/serverless';
-import { AUTH_GRANT_AUDIENCE_DOMAIN_PREFIX } from '@learncard/types';
+import { ACT_AS_HEADER, AUTH_GRANT_AUDIENCE_DOMAIN_PREFIX } from '@learncard/types';
 import { ContactMethodType } from '@learncard/types';
+import { MAX_SHARE_LINK_REQUEST_BYTES, utf8ByteLength } from '@learncard/types';
 
 import { RegExpTransformer } from '@learncard/helpers';
 import { resolveTenantFromRequest, type ResolvedTenant } from '@learncard/email-templates';
@@ -48,7 +49,11 @@ export type Context = {
         did: string;
         isChallengeValid: boolean;
         scope?: string;
+        isAuthGrant?: boolean;
+        actAsPolicy?: string;
+        onBehalfOf?: string;
     };
+    actAs?: string;
     contactMethod?: ContactMethodType;
     domain: string;
     tenant: ResolvedTenant;
@@ -84,6 +89,14 @@ export const createContext = async (
         | { req: { headers: Map<string, string> } }
 ): Promise<Context> => {
     const event = 'event' in options ? options.event : options.req;
+    const headerEntries =
+        'get' in event.headers
+            ? Array.from(event.headers as Map<string, string>)
+            : Object.entries(event.headers);
+    const rawActAs = headerEntries.find(
+        ([name]) => name.toLowerCase() === ACT_AS_HEADER.toLowerCase()
+    )?.[1];
+    const actAs = Array.isArray(rawActAs) ? rawActAs.join(',') : rawActAs;
     const authHeader =
         'get' in event.headers
             ? (event.headers as Map<string, string>).get('authorization')
@@ -141,6 +154,7 @@ export const createContext = async (
                 if (!challenge)
                     return {
                         user: { did, isChallengeValid: false, scope: AUTH_GRANT_NO_ACCESS_SCOPE },
+                        actAs,
                         domain,
                         tenant,
                         sourceIp,
@@ -148,6 +162,8 @@ export const createContext = async (
 
                 let isChallengeValid = false;
                 let scope = AUTH_GRANT_FULL_ACCESS_SCOPE;
+                let isAuthGrant = false;
+                let actAsPolicy: string | undefined;
 
                 // If the user is using a provisional auth token for a contact method:
                 if (challenge?.includes(CONTACT_METHOD_SESSION_PREFIX)) {
@@ -159,6 +175,7 @@ export const createContext = async (
                         if (!contactMethod) throw new TRPCError({ code: 'NOT_FOUND' });
                         return {
                             contactMethod,
+                            actAs,
                             domain,
                             tenant,
                             sourceIp,
@@ -166,9 +183,14 @@ export const createContext = async (
                     }
                     // If the user is using a real auth grant i.e. an API Token.
                 } else if (challenge?.includes(AUTH_GRANT_AUDIENCE_DOMAIN_PREFIX)) {
-                    const { isChallengeValid: _isChallengeValid, scope: _scope } =
-                        await isAuthGrantChallengeValidForDID(challenge, did);
-
+                    const {
+                        isChallengeValid: _isChallengeValid,
+                        scope: _scope,
+                        actAs: policy,
+                    } = await isAuthGrantChallengeValidForDID(challenge, did);
+
+                    isAuthGrant = true;
+                    actAsPolicy = policy;
                     isChallengeValid = _isChallengeValid;
                     scope = _scope;
                     // If the user is using a real challenge signed by their private key.
@@ -182,7 +204,8 @@ export const createContext = async (
                 Sentry.setUser({ id: did });
 
                 return {
-                    user: { did, isChallengeValid, scope },
+                    user: { did, isChallengeValid, scope, isAuthGrant, actAsPolicy },
+                    actAs,
                     domain,
                     tenant,
                     _guardianApprovalToken,
@@ -192,17 +215,96 @@ export const createContext = async (
         }
     }
 
-    return { domain, tenant, _guardianApprovalToken, sourceIp };
+    return { domain, tenant, _guardianApprovalToken, sourceIp, actAs };
 };
 
-export const openRoute = t.procedure
-    .use(t.middleware(Sentry.Handlers.trpcMiddleware({ attachRpcInput: true }) as any))
-    .use(({ ctx, next, path }) => {
-        Sentry.configureScope(scope => {
-            scope.setTransactionName(`trpc-${path}`);
-        });
-        return next({ ctx });
+const sentryTransactionNameMiddleware = t.middleware(({ ctx, next, path }) => {
+    Sentry.configureScope(scope => {
+        scope.setTransactionName(`trpc-${path}`);
     });
+    return next({ ctx });
+});
+
+// Sentry's tRPC middleware type predates this repo's generic context. Cast
+// through the tRPC builder's expected parameter type instead of `any`.
+type SentryTrpcMiddleware = Parameters<typeof t.middleware>[0];
+
+const sentryInputCaptureMiddleware = Sentry.Handlers.trpcMiddleware({
+    attachRpcInput: true,
+}) as unknown as SentryTrpcMiddleware;
+
+const sentryNoInputCaptureMiddleware = Sentry.Handlers.trpcMiddleware({
+    attachRpcInput: false,
+}) as unknown as SentryTrpcMiddleware;
+
+/**
+ * Complete-request byte bound for owner share-link routes, enforced on the RAW
+ * input before Zod parsing/stripping. Individual field validators cannot bound a
+ * request whose unknown or duplicate fields are stripped first, so this measures
+ * the whole serialized body (UTF-8) and fails closed over the shared 1 MiB cap.
+ *
+ * It is composed into the base so it runs before authentication and before any
+ * input parser, and can never be skipped by a malformed or unauthenticated call.
+ */
+const enforceShareLinkRequestByteBound = t.middleware(async ({ ctx, next, getRawInput }) => {
+    const raw = await getRawInput();
+
+    let bytes: number;
+    if (raw === undefined || raw === null) {
+        bytes = 0;
+    } else if (typeof raw === 'string') {
+        bytes = utf8ByteLength(raw);
+    } else {
+        let serialized: string;
+        try {
+            serialized = JSON.stringify(raw);
+        } catch {
+            throw new TRPCError({ code: 'BAD_REQUEST', message: 'invalid share-link request' });
+        }
+        bytes = utf8ByteLength(serialized);
+    }
+
+    if (bytes > MAX_SHARE_LINK_REQUEST_BYTES) {
+        throw new TRPCError({
+            code: 'PAYLOAD_TOO_LARGE',
+            message: 'share-link request exceeds the 1 MiB limit',
+        });
+    }
+
+    return next({ ctx });
+});
+
+export const openRoute = t.procedure
+    .use(t.middleware(sentryInputCaptureMiddleware))
+    .use(sentryTransactionNameMiddleware);
+
+/**
+ * LC-2187 public share-link paths must never be cached by an intermediary or a
+ * browser. tRPC has no per-procedure header API, so the actual HTTP adapters
+ * (Fastify and Lambda, both tRPC and OpenAPI) apply `Cache-Control` from the
+ * resolved procedure path through this single helper.
+ */
+export const PUBLIC_SHARE_LINK_ROUTE_PREFIX = 'publicShareLinks.';
+
+export const publicShareLinkCacheControlHeaders = (
+    paths: readonly string[] | undefined
+): Record<string, string> =>
+    (paths ?? []).some(path => path.startsWith(PUBLIC_SHARE_LINK_ROUTE_PREFIX))
+        ? { 'Cache-Control': 'private, no-store' }
+        : {};
+
+/**
+ * Route base for procedures whose input carries owner-private material (titles,
+ * notes, ciphertext envelopes, recovery JWEs) and whose error paths must not
+ * attach raw request bodies to Sentry. It runs the same Sentry error/transaction
+ * handling but with input attachment disabled, so no branch — malformed,
+ * unauthenticated or failing — can capture the payload, and it enforces the
+ * complete-request byte bound before input parsing.
+ */
+export const openRouteWithoutInputCapture = t.procedure
+    .use(t.middleware(sentryNoInputCaptureMiddleware))
+    .use(sentryTransactionNameMiddleware)
+    .use(enforceShareLinkRequestByteBound);
 
 export const resolveProfileFromContextDid = async (
     didFromContext: string | undefined,
@@ -245,23 +347,82 @@ export const resolveProfileFromContextDid = async (
     return getProfileByDid(did);
 };
 
-export const didRoute = openRoute.use(async ({ ctx, next }) => {
-    if (!ctx.user?.did) {
-        throw new TRPCError({ code: 'UNAUTHORIZED' });
+type ActingUser = NonNullable<Context['user']> & { profile: ProfileType | null };
+
+const resolveActAs = async (
+    user: ActingUser,
+    actAs: string | undefined,
+    domain: string
+): Promise<ActingUser> => {
+    const requested = actAs?.trim();
+    if (!requested) return user;
+
+    const { profile } = user;
+    const prefix = `did:web:${domain}:users:`;
+    const profileId = requested.startsWith(prefix) ? requested.slice(prefix.length) : requested;
+    if (!profileId || /[:/?#]/.test(profileId)) {
+        throw new TRPCError({ code: 'BAD_REQUEST', message: 'Invalid act-as profile identifier' });
     }
 
-    const profile = await resolveProfileFromContextDid(ctx.user.did, ctx.domain);
+    // Two DB lookups per request when the act-as header is present (target profile,
+    // then its managers) — acceptable at backend issuance volume; not worth caching.
+    const target = await getProfileByProfileId(profileId);
+    if (!target)
+        throw new TRPCError({ code: 'NOT_FOUND', message: 'Act-as target profile not found' });
 
-    if (profile) Sentry.setUser({ id: profile.profileId, username: profile.displayName });
+    const managers = await getProfilesThatManageAProfile(target.profileId);
+    if (!profile || !managers.some(manager => manager.profileId === profile.profileId)) {
+        throw new TRPCError({
+            code: 'FORBIDDEN',
+            message: `You do not manage profile "${profileId}".`,
+        });
+    }
 
-    return next({ ctx: { ...ctx, user: { ...ctx.user, profile } } });
-});
+    const policy = user.actAsPolicy;
+    const permitted =
+        policy === '*' ||
+        policy
+            ?.split(',')
+            .map(id => id.trim())
+            .includes(target.profileId);
+    if (user.isAuthGrant && !permitted) {
+        throw new TRPCError({
+            code: 'FORBIDDEN',
+            message: `This API token may not act as "${profileId}". Grant actAs on the token.`,
+        });
+    }
 
-export const didAndChallengeRoute = didRoute.use(({ ctx, next }) => {
-    if (!ctx.user?.isChallengeValid) throw new TRPCError({ code: 'UNAUTHORIZED' });
+    Sentry.setUser({ id: target.profileId, username: target.displayName });
+    return { ...user, profile: target, did: target.did, onBehalfOf: profile.profileId };
+};
 
-    return next({ ctx: { ...ctx, user: ctx.user } });
-});
+const withDid = (base: typeof openRoute) =>
+    base.use(async ({ ctx, next }) => {
+        if (!ctx.user?.did) {
+            throw new TRPCError({ code: 'UNAUTHORIZED' });
+        }
+
+        const profile = await resolveProfileFromContextDid(ctx.user.did, ctx.domain);
+
+        if (profile) Sentry.setUser({ id: profile.profileId, username: profile.displayName });
+
+        const user = ctx.user.isChallengeValid
+            ? await resolveActAs({ ...ctx.user, profile }, ctx.actAs, ctx.domain)
+            : { ...ctx.user, profile };
+
+        return next({ ctx: { ...ctx, user } });
+    });
+
+export const didRoute = withDid(openRoute);
+
+const withChallenge = (base: typeof didRoute) =>
+    base.use(({ ctx, next }) => {
+        if (!ctx.user?.isChallengeValid) throw new TRPCError({ code: 'UNAUTHORIZED' });
+
+        return next({ ctx: { ...ctx, user: ctx.user } });
+    });
+
+export const didAndChallengeRoute = withChallenge(didRoute);
 
 export const scopedRoute = didAndChallengeRoute.use(({ ctx, next, meta }) => {
     if (!meta?.requiredScope) {
@@ -295,33 +456,41 @@ export const openProfileRoute = didRoute.use(async ({ ctx, next }) => {
     return next({ ctx: { ...ctx, user: { ...ctx.user, profile } } });
 });
 
-export const profileRoute = didAndChallengeRoute.use(async ({ ctx, next, meta }) => {
-    const { profile } = ctx.user;
+const withProfile = (base: typeof didAndChallengeRoute) =>
+    base.use(async ({ ctx, next, meta }) => {
+        const { profile } = ctx.user;
 
-    if (!profile) {
-        throw new TRPCError({
-            code: 'NOT_FOUND',
-            message: 'Profile not found. Please make a profile!',
-        });
-    }
+        if (!profile) {
+            throw new TRPCError({
+                code: 'NOT_FOUND',
+                message: 'Profile not found. Please make a profile!',
+            });
+        }
 
-    if (!meta?.requiredScope) {
-        return next({ ctx: { ...ctx, user: { ...ctx.user, profile } } });
-    }
+        if (!meta?.requiredScope) {
+            return next({ ctx: { ...ctx, user: { ...ctx.user, profile } } });
+        }
 
-    const userScope = ctx.user?.scope || AUTH_GRANT_NO_ACCESS_SCOPE;
+        const userScope = ctx.user?.scope || AUTH_GRANT_NO_ACCESS_SCOPE;
 
-    const hasRequiredScope = userHasRequiredScopes(userScope, meta.requiredScope);
+        const hasRequiredScope = userHasRequiredScopes(userScope, meta.requiredScope);
 
-    if (!hasRequiredScope) {
-        throw new TRPCError({
-            code: 'UNAUTHORIZED',
-            message: `This operation requires ${meta.requiredScope} scope`,
-        });
-    }
+        if (!hasRequiredScope) {
+            throw new TRPCError({
+                code: 'UNAUTHORIZED',
+                message: `This operation requires ${meta.requiredScope} scope`,
+            });
+        }
 
-    return next({ ctx: { ...ctx, user: { ...ctx.user, profile } } });
-});
+        return next({ ctx: { ...ctx, user: { ...ctx.user, profile } } });
+    });
+
+export const profileRoute = withProfile(didAndChallengeRoute);
+
+/** Same auth chain, composed on a base that never attaches private RPC input to Sentry. */
+export const didRouteWithoutInputCapture = withDid(openRouteWithoutInputCapture);
+export const didAndChallengeRouteWithoutInputCapture = withChallenge(didRouteWithoutInputCapture);
+export const profileRouteWithoutInputCapture = withProfile(didAndChallengeRouteWithoutInputCapture);
 
 export const openProfileManagerRoute = openRoute.use(async ({ ctx, next }) => {
     if (!ctx.user?.did) throw new TRPCError({ code: 'UNAUTHORIZED' });
@@ -385,7 +554,8 @@ const GUARDIAN_APPROVAL_CLOCK_SKEW_SECONDS = 60;
 export const guardianGatedRoute = profileRoute.use(async ({ ctx, next }) => {
     const { profile } = ctx.user;
     const guardianApprovalToken = ctx._guardianApprovalToken;
-    const isChildAccount = await isProfileManaged(profile.profileId);
+    // Service profiles (orgs) are managed for admin purposes, not guardianship.
+    const isChildAccount = !profile.isServiceProfile && (await isProfileManaged(profile.profileId));
     let guardianIdentity: { profileId: string; did: string } | undefined;
 
     if (isChildAccount && guardianApprovalToken) {