@portaidentity/server 1.7.3 → 1.8.0

package/dist/routes/roles.js

@@ -11,7 +11,7 @@
  *   GET    /                       — List all roles for an application
  *   GET    /:roleId                — Get a role by ID
  *   PUT    /:roleId                — Update a role
- *   DELETE /:roleId                — Delete a role (?force=true)
+ *   DELETE /:roleId                — Delete a role
  *   GET    /:roleId/permissions    — List permissions for a role
  *   PUT    /:roleId/permissions    — Assign permissions to a role
  *   DELETE /:roleId/permissions    — Remove permissions from a role
@@ -26,23 +26,26 @@ import Router from '@koa/router';
 import { z } from 'zod';
 import { requireAdminAuth } from '../middleware/admin-auth.js';
 import { requirePermission } from '../middleware/require-permission.js';
-import { ADMIN_PERMISSIONS } from '../lib/admin-permissions.js';
+import { ADMIN_PERMISSIONS, ALL_ADMIN_ROLES } from '../lib/admin-permissions.js';
+import { getApplicationBySlug } from '../applications/service.js';
 import * as roleService from '../rbac/role-service.js';
 import * as userRoleService from '../rbac/user-role-service.js';
 import { RoleNotFoundError, PermissionNotFoundError, RbacValidationError } from '../rbac/errors.js';
+const ADMIN_APPLICATION_SLUG = 'porta-admin';
+const ADMIN_ROLE_SLUGS = new Set(ALL_ADMIN_ROLES.map((role) => role.slug));
 // ---------------------------------------------------------------------------
 // Validation schemas
 // ---------------------------------------------------------------------------
 /** Schema for creating a new role */
 const createRoleSchema = z.object({
     name: z.string().min(1).max(255),
-    slug: z.string().min(1).max(100).optional(),
+    slug: z.string().trim().min(1).max(100).optional(),
     description: z.string().max(1000).optional(),
 });
 /** Schema for updating a role (all fields optional) */
 const updateRoleSchema = z.object({
     name: z.string().min(1).max(255).optional(),
-    slug: z.string().min(1).max(100).optional(),
+    slug: z.string().trim().min(1).max(100).optional(),
     description: z.string().max(1000).nullable().optional(),
 });
 /** Schema for assigning/removing permissions (array of UUIDs) */
@@ -55,6 +58,13 @@ const listUsersWithRoleSchema = z.object({
     page: z.coerce.number().int().min(1).default(1),
     pageSize: z.coerce.number().int().min(1).max(100).default(20),
 });
+/** Parent-qualified parameters accepted by role deletion. */
+const identifierSchema = z.object({
+    appId: z.string().uuid(),
+    roleId: z.string().uuid(),
+});
+/** Application parent parameter accepted by collection routes. */
+const applicationIdentifierSchema = z.object({ appId: z.string().uuid() });
 // ---------------------------------------------------------------------------
 // Error handler helper
 // ---------------------------------------------------------------------------
@@ -79,6 +89,20 @@ function handleError(ctx, err) {
     }
     throw err;
 }
+/** Reject generic route mutations of a canonical Porta Admin role. */
+async function requireMutableRole(applicationId, roleId) {
+    const role = await roleService.findRoleById(applicationId, roleId);
+    // The mutation service remains responsible for authoritative not-found handling and repeats the
+    // canonical check after locking. This route lookup exists only for an early sanitized rejection.
+    if (!role)
+        return;
+    if (!ADMIN_ROLE_SLUGS.has(role.slug))
+        return;
+    const adminApplication = await getApplicationBySlug(ADMIN_APPLICATION_SLUG);
+    if (adminApplication?.id === role.applicationId) {
+        throw new RbacValidationError('Canonical Porta Admin roles cannot be modified');
+    }
+}
 // ---------------------------------------------------------------------------
 // Router factory
 // ---------------------------------------------------------------------------
@@ -101,11 +125,12 @@ export function createRoleRouter() {
     // -------------------------------------------------------------------------
     router.post('/', requirePermission(ADMIN_PERMISSIONS.ROLE_CREATE), async (ctx) => {
         try {
+            applicationIdentifierSchema.parse(ctx.params);
             const body = createRoleSchema.parse(ctx.request.body);
             const role = await roleService.createRole({
                 applicationId: ctx.params.appId,
                 ...body,
-            });
+            }, ctx.state.adminUser?.id);
             ctx.status = 201;
             ctx.body = { data: role };
         }
@@ -118,6 +143,7 @@ export function createRoleRouter() {
     // -------------------------------------------------------------------------
     router.get('/', requirePermission(ADMIN_PERMISSIONS.ROLE_READ), async (ctx) => {
         try {
+            applicationIdentifierSchema.parse(ctx.params);
             const roles = await roleService.listRolesByApplication(ctx.params.appId);
             ctx.body = { data: roles };
         }
@@ -129,20 +155,28 @@ export function createRoleRouter() {
     // GET /:roleId — Get role by ID
     // -------------------------------------------------------------------------
     router.get('/:roleId', requirePermission(ADMIN_PERMISSIONS.ROLE_READ), async (ctx) => {
-        const role = await roleService.findRoleById(ctx.params.roleId);
-        if (!role) {
-            ctx.throw(404, 'Role not found');
+        try {
+            identifierSchema.parse(ctx.params);
+            const role = await roleService.findRoleById(ctx.params.appId, ctx.params.roleId);
+            if (!role) {
+                ctx.throw(404, 'Role not found');
+            }
+            ctx.body = { data: role };
+        }
+        catch (err) {
+            handleError(ctx, err);
         }
-        ctx.body = { data: role };
     });
     // -------------------------------------------------------------------------
     // PUT /:roleId — Update role
     // -------------------------------------------------------------------------
     router.put('/:roleId', requirePermission(ADMIN_PERMISSIONS.ROLE_UPDATE), async (ctx) => {
         try {
+            identifierSchema.parse(ctx.params);
             const body = updateRoleSchema.parse(ctx.request.body);
-            const role = await roleService.updateRole(ctx.params.roleId, body);
-            ctx.body = { data: role };
+            await requireMutableRole(ctx.params.appId, ctx.params.roleId);
+            const result = await roleService.updateRole(ctx.params.appId, ctx.params.roleId, body, ctx.state.adminUser?.id);
+            ctx.body = { data: result };
         }
         catch (err) {
             handleError(ctx, err);
@@ -150,13 +184,14 @@ export function createRoleRouter() {
     });
     // -------------------------------------------------------------------------
     // DELETE /:roleId — Delete role
-    // Supports ?force=true to delete even when users are assigned
     // -------------------------------------------------------------------------
-    router.delete('/:roleId', requirePermission(ADMIN_PERMISSIONS.ROLE_ARCHIVE), async (ctx) => {
+    router.delete('/:roleId', requirePermission(ADMIN_PERMISSIONS.ROLE_DELETE), async (ctx) => {
         try {
-            const force = ctx.query.force === 'true';
-            await roleService.deleteRole(ctx.params.roleId, force);
-            ctx.status = 204;
+            identifierSchema.parse(ctx.params);
+            await requireMutableRole(ctx.params.appId, ctx.params.roleId);
+            const result = await roleService.deleteRole(ctx.params.appId, ctx.params.roleId, ctx.state.adminUser?.id);
+            ctx.status = 200;
+            ctx.body = { data: result };
         }
         catch (err) {
             handleError(ctx, err);
@@ -167,7 +202,8 @@ export function createRoleRouter() {
     // -------------------------------------------------------------------------
     router.get('/:roleId/permissions', requirePermission(ADMIN_PERMISSIONS.ROLE_READ), async (ctx) => {
         try {
-            const permissions = await roleService.getPermissionsForRole(ctx.params.roleId);
+            identifierSchema.parse(ctx.params);
+            const permissions = await roleService.getPermissionsForRole(ctx.params.appId, ctx.params.roleId);
             ctx.body = { data: permissions };
         }
         catch (err) {
@@ -179,8 +215,10 @@ export function createRoleRouter() {
     // -------------------------------------------------------------------------
     router.put('/:roleId/permissions', requirePermission(ADMIN_PERMISSIONS.ROLE_UPDATE), async (ctx) => {
         try {
+            identifierSchema.parse(ctx.params);
             const body = permissionIdsSchema.parse(ctx.request.body);
-            await roleService.assignPermissionsToRole(ctx.params.roleId, body.permissionIds);
+            await requireMutableRole(ctx.params.appId, ctx.params.roleId);
+            await roleService.assignPermissionsToRole(ctx.params.appId, ctx.params.roleId, body.permissionIds, ctx.state.adminUser?.id);
             ctx.status = 204;
         }
         catch (err) {
@@ -192,9 +230,12 @@ export function createRoleRouter() {
     // -------------------------------------------------------------------------
     router.delete('/:roleId/permissions', requirePermission(ADMIN_PERMISSIONS.ROLE_UPDATE), async (ctx) => {
         try {
+            identifierSchema.parse(ctx.params);
             const body = permissionIdsSchema.parse(ctx.request.body);
-            await roleService.removePermissionsFromRole(ctx.params.roleId, body.permissionIds);
-            ctx.status = 204;
+            await requireMutableRole(ctx.params.appId, ctx.params.roleId);
+            const result = await roleService.removePermissionsFromRole(ctx.params.appId, ctx.params.roleId, body.permissionIds, ctx.state.adminUser?.id);
+            ctx.status = 200;
+            ctx.body = { data: result };
         }
         catch (err) {
             handleError(ctx, err);
@@ -206,8 +247,9 @@ export function createRoleRouter() {
     // -------------------------------------------------------------------------
     router.get('/:roleId/users', requirePermission(ADMIN_PERMISSIONS.ROLE_READ), async (ctx) => {
         try {
+            identifierSchema.parse(ctx.params);
             const query = listUsersWithRoleSchema.parse(ctx.query);
-            const result = await userRoleService.getUsersWithRole(ctx.params.roleId, query.orgId, {
+            const result = await userRoleService.getUsersWithRole(ctx.params.appId, ctx.params.roleId, query.orgId, {
                 page: query.page,
                 pageSize: query.pageSize,
             });

package/dist/routes/roles.js.map

@@ -1 +1 @@
-{"version":3,"file":"roles.js","sourceRoot":"","sources":["../../src/routes/roles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,WAAW,MAAM,yBAAyB,CAAC;AACvD,OAAO,KAAK,eAAe,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAEpG,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,qCAAqC;AACrC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC3C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAC;AAEH,uDAAuD;AACvD,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC3C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC3C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACxD,CAAC,CAAC;AAEH,iEAAiE;AACjE,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CACjD,CAAC,CAAC;AAEH,mEAAmE;AACnE,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IACxB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/C,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC9D,CAAC,CAAC;AAEH,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E;;;GAGG;AACH,SAAS,WAAW,CAClB,GAAqF,EACrF,GAAY;IAEZ,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;QACrC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,GAAG,YAAY,uBAAuB,EAAE,CAAC;QAC3C,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;QACvC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,GAAG,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC9B,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;QAChD,OAAO,SAAkB,CAAC;IAC5B,CAAC;IACD,MAAM,GAAG,CAAC;AACZ,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAC,CAAC;IAE9E,0CAA0C;IAC1C,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAE/B,4EAA4E;IAC5E,uBAAuB;IACvB,4EAA4E;IAC5E,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC/E,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACtD,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,UAAU,CAAC;gBACxC,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK;gBAC/B,GAAG,IAAI;aACR,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,qCAAqC;IACrC,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC5E,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,sBAAsB,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACzE,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,gCAAgC;IAChC,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACnF,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QACnC,CAAC;QACD,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,6BAA6B;IAC7B,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACrF,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACtD,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACnE,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,gCAAgC;IAChC,8DAA8D;IAC9D,4EAA4E;IAC5E,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACzF,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,MAAM,CAAC;YACzC,MAAM,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACvD,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,yDAAyD;IACzD,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CACR,sBAAsB,EACtB,iBAAiB,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAC9C,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC/E,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,4EAA4E;IAC5E,0DAA0D;IAC1D,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CACR,sBAAsB,EACtB,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAChD,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACzD,MAAM,WAAW,CAAC,uBAAuB,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;YACjF,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,4EAA4E;IAC5E,+DAA+D;IAC/D,4EAA4E;IAC5E,MAAM,CAAC,MAAM,CACX,sBAAsB,EACtB,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAChD,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACzD,MAAM,WAAW,CAAC,yBAAyB,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;YACnF,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,4EAA4E;IAC5E,yEAAyE;IACzE,sCAAsC;IACtC,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACzF,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,uBAAuB,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACvD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE;gBACpF,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;aACzB,CAAC,CAAC;YACH,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QACxD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"roles.js","sourceRoot":"","sources":["../../src/routes/roles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,KAAK,WAAW,MAAM,yBAAyB,CAAC;AACvD,OAAO,KAAK,eAAe,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAEpG,MAAM,sBAAsB,GAAG,aAAa,CAAC;AAC7C,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAE3E,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,qCAAqC;AACrC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAClD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAC;AAEH,uDAAuD;AACvD,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC3C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAClD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACxD,CAAC,CAAC;AAEH,iEAAiE;AACjE,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CACjD,CAAC,CAAC;AAEH,mEAAmE;AACnE,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IACxB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/C,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC9D,CAAC,CAAC;AAEH,6DAA6D;AAC7D,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IACxB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;CAC1B,CAAC,CAAC;AAEH,kEAAkE;AAClE,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AAE3E,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E;;;GAGG;AACH,SAAS,WAAW,CAClB,GAAqF,EACrF,GAAY;IAEZ,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;QACrC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,GAAG,YAAY,uBAAuB,EAAE,CAAC;QAC3C,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;QACvC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,GAAG,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC9B,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;QAChD,OAAO,SAAkB,CAAC;IAC5B,CAAC;IACD,MAAM,GAAG,CAAC;AACZ,CAAC;AAED,sEAAsE;AACtE,KAAK,UAAU,kBAAkB,CAAC,aAAqB,EAAE,MAAc;IACrE,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IACnE,gGAAgG;IAChG,iGAAiG;IACjG,IAAI,CAAC,IAAI;QAAE,OAAO;IAClB,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO;IAC7C,MAAM,gBAAgB,GAAG,MAAM,oBAAoB,CAAC,sBAAsB,CAAC,CAAC;IAC5E,IAAI,gBAAgB,EAAE,EAAE,KAAK,IAAI,CAAC,aAAa,EAAE,CAAC;QAChD,MAAM,IAAI,mBAAmB,CAAC,gDAAgD,CAAC,CAAC;IAClF,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAC,CAAC;IAE9E,0CAA0C;IAC1C,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAE/B,4EAA4E;IAC5E,uBAAuB;IACvB,4EAA4E;IAC5E,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC/E,IAAI,CAAC;YACH,2BAA2B,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC9C,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACtD,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,UAAU,CACvC;gBACE,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK;gBAC/B,GAAG,IAAI;aACR,EACD,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,CACxB,CAAC;YACF,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,qCAAqC;IACrC,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC5E,IAAI,CAAC;YACH,2BAA2B,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC9C,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,sBAAsB,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACzE,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,gCAAgC;IAChC,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACnF,IAAI,CAAC;YACH,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACnC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACjF,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;YACnC,CAAC;YACD,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,6BAA6B;IAC7B,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACrF,IAAI,CAAC;YACH,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACnC,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACtD,MAAM,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC9D,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,UAAU,CACzC,GAAG,CAAC,MAAM,CAAC,KAAK,EAChB,GAAG,CAAC,MAAM,CAAC,MAAM,EACjB,IAAI,EACJ,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,CACxB,CAAC;YACF,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,gCAAgC;IAChC,4EAA4E;IAC5E,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACxF,IAAI,CAAC;YACH,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACnC,MAAM,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC9D,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,UAAU,CACzC,GAAG,CAAC,MAAM,CAAC,KAAK,EAChB,GAAG,CAAC,MAAM,CAAC,MAAM,EACjB,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,CACxB,CAAC;YACF,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,yDAAyD;IACzD,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CACR,sBAAsB,EACtB,iBAAiB,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAC9C,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,IAAI,CAAC;YACH,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACnC,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,qBAAqB,CACzD,GAAG,CAAC,MAAM,CAAC,KAAK,EAChB,GAAG,CAAC,MAAM,CAAC,MAAM,CAClB,CAAC;YACF,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,4EAA4E;IAC5E,0DAA0D;IAC1D,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CACR,sBAAsB,EACtB,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAChD,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,IAAI,CAAC;YACH,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACnC,MAAM,IAAI,GAAG,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACzD,MAAM,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC9D,MAAM,WAAW,CAAC,uBAAuB,CACvC,GAAG,CAAC,MAAM,CAAC,KAAK,EAChB,GAAG,CAAC,MAAM,CAAC,MAAM,EACjB,IAAI,CAAC,aAAa,EAClB,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,CACxB,CAAC;YACF,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,4EAA4E;IAC5E,+DAA+D;IAC/D,4EAA4E;IAC5E,MAAM,CAAC,MAAM,CACX,sBAAsB,EACtB,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAChD,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,IAAI,CAAC;YACH,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACnC,MAAM,IAAI,GAAG,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACzD,MAAM,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC9D,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,yBAAyB,CACxD,GAAG,CAAC,MAAM,CAAC,KAAK,EAChB,GAAG,CAAC,MAAM,CAAC,MAAM,EACjB,IAAI,CAAC,aAAa,EAClB,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,CACxB,CAAC;YACF,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,4EAA4E;IAC5E,yEAAyE;IACzE,sCAAsC;IACtC,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACzF,IAAI,CAAC;YACH,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACnC,MAAM,KAAK,GAAG,uBAAuB,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACvD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,gBAAgB,CACnD,GAAG,CAAC,MAAM,CAAC,KAAK,EAChB,GAAG,CAAC,MAAM,CAAC,MAAM,EACjB,KAAK,CAAC,KAAK,EACX;gBACE,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;aACzB,CACF,CAAC;YACF,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QACxD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/routes/sessions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../src/routes/sessions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AA6BjC;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAuD5C;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,CAehD"}
+{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../src/routes/sessions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AA0CjC;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CA2D5C;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,CAehD"}

package/dist/routes/sessions.js

@@ -35,6 +35,15 @@ const listSessionsSchema = z.object({
     page: z.coerce.number().int().min(1).default(1),
     pageSize: z.coerce.number().int().min(1).max(100).default(20),
 });
+/** Public UUID accepted by single-session administrative operations. */
+const publicSessionIdSchema = z.string().uuid();
+/** Validate a public session identifier without exposing parser details. */
+function publicSessionId(ctx, value) {
+    const result = publicSessionIdSchema.safeParse(value);
+    if (!result.success)
+        ctx.throw(400, 'Session request is invalid');
+    return result.data;
+}
 // ---------------------------------------------------------------------------
 // Router factory
 // ---------------------------------------------------------------------------
@@ -64,7 +73,7 @@ export function createSessionRouter() {
     // GET /:sessionId — Get session detail
     // -------------------------------------------------------------------------
     router.get('/:sessionId', requirePermission(ADMIN_PERMISSIONS.SESSION_READ), async (ctx) => {
-        const session = await sessionTracking.getSession(ctx.params.sessionId);
+        const session = await sessionTracking.getSessionByPublicId(publicSessionId(ctx, ctx.params.sessionId));
         if (!session) {
             ctx.throw(404, 'Session not found');
             return;
@@ -80,19 +89,21 @@ export function createSessionRouter() {
     //   3. Audit log entry for session revocation
     // -------------------------------------------------------------------------
     router.delete('/:sessionId', requirePermission(ADMIN_PERMISSIONS.SESSION_REVOKE), async (ctx) => {
-        const { sessionId } = ctx.params;
+        const requestedSessionId = publicSessionId(ctx, ctx.params.sessionId);
         // 1. Mark revoked in PG tracking table
-        await sessionTracking.revokeSession(sessionId);
+        const redisSessionId = await sessionTracking.revokeSessionByPublicId(requestedSessionId);
         // 2. Delete from Redis to kill the live session
-        await afterDatabaseCommit(async () => {
-            try {
-                const redis = getRedis();
-                await redis.del(`oidc:Session:${sessionId}`);
-            }
-            catch {
-                // Redis deletion failure is non-fatal — session will expire naturally.
-            }
-        });
+        if (redisSessionId !== null) {
+            await afterDatabaseCommit(async () => {
+                try {
+                    const redis = getRedis();
+                    await redis.del(`oidc:Session:${redisSessionId}`);
+                }
+                catch {
+                    // Redis deletion failure is non-fatal — session will expire naturally.
+                }
+            });
+        }
         ctx.status = 204;
     });
     return router;

package/dist/routes/sessions.js.map

@@ -1 +1 @@
-{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../../src/routes/sessions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,eAAe,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACpC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC5C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACtC,UAAU,EAAE,CAAC;SACV,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;SACvB,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC;SAC9B,QAAQ,EAAE;IACb,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/C,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC9D,CAAC,CAAC;AAEH,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAC;IAE7D,0CAA0C;IAC1C,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAE/B,4EAA4E;IAC5E,oCAAoC;IACpC,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC/E,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACzD,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,uCAAuC;IACvC,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACzF,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACvE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;YACpC,OAAO;QACT,CAAC;QACD,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,wCAAwC;IACxC,EAAE;IACF,sBAAsB;IACtB,4DAA4D;IAC5D,0DAA0D;IAC1D,8CAA8C;IAC9C,4EAA4E;IAC5E,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC9F,MAAM,EAAE,SAAS,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QAEjC,uCAAuC;QACvC,MAAM,eAAe,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAE/C,gDAAgD;QAChD,MAAM,mBAAmB,CAAC,KAAK,IAAI,EAAE;YACnC,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;gBACzB,MAAM,KAAK,CAAC,GAAG,CAAC,gBAAgB,SAAS,EAAE,CAAC,CAAC;YAC/C,CAAC;YAAC,MAAM,CAAC;gBACP,uEAAuE;YACzE,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB;IACrC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAC,CAAC;IAE3E,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAE/B,4EAA4E;IAC5E,4CAA4C;IAC5C,4EAA4E;IAC5E,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACpF,MAAM,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QAC9B,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAC/D,GAAG,CAAC,IAAI,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../../src/routes/sessions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,eAAe,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACpC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC5C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACtC,UAAU,EAAE,CAAC;SACV,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;SACvB,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC;SAC9B,QAAQ,EAAE;IACb,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/C,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC9D,CAAC,CAAC;AAEH,wEAAwE;AACxE,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;AAEhD,4EAA4E;AAC5E,SAAS,eAAe,CACtB,GAA0D,EAC1D,KAAa;IAEb,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACtD,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC;IAClE,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAC;IAE7D,0CAA0C;IAC1C,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAE/B,4EAA4E;IAC5E,oCAAoC;IACpC,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC/E,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACzD,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,uCAAuC;IACvC,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACzF,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,oBAAoB,CACxD,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAC3C,CAAC;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;YACpC,OAAO;QACT,CAAC;QACD,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,wCAAwC;IACxC,EAAE;IACF,sBAAsB;IACtB,4DAA4D;IAC5D,0DAA0D;IAC1D,8CAA8C;IAC9C,4EAA4E;IAC5E,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC9F,MAAM,kBAAkB,GAAG,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAEtE,uCAAuC;QACvC,MAAM,cAAc,GAAG,MAAM,eAAe,CAAC,uBAAuB,CAAC,kBAAkB,CAAC,CAAC;QAEzF,gDAAgD;QAChD,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;YAC5B,MAAM,mBAAmB,CAAC,KAAK,IAAI,EAAE;gBACnC,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;oBACzB,MAAM,KAAK,CAAC,GAAG,CAAC,gBAAgB,cAAc,EAAE,CAAC,CAAC;gBACpD,CAAC;gBAAC,MAAM,CAAC;oBACP,uEAAuE;gBACzE,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;QAED,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB;IACrC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAC,CAAC;IAE3E,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAE/B,4EAA4E;IAC5E,4CAA4C;IAC5C,4EAA4E;IAC5E,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACpF,MAAM,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QAC9B,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAC/D,GAAG,CAAC,IAAI,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/routes/two-factor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"two-factor.d.ts","sourceRoot":"","sources":["../../src/routes/two-factor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,KAAK,QAAQ,MAAM,eAAe,CAAC;AA4J1C;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,GAAG,MAAM,CA6BhE"}
+{"version":3,"file":"two-factor.d.ts","sourceRoot":"","sources":["../../src/routes/two-factor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,KAAK,QAAQ,MAAM,eAAe,CAAC;AA+I1C;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,GAAG,MAAM,CA6BhE"}

package/dist/routes/two-factor.js

@@ -21,10 +21,12 @@ import { generateCsrfToken, verifyCsrfToken, setCsrfCookie, getCsrfFromCookie, }
 import { checkRateLimit, buildRateLimitKey } from '../auth/rate-limiter.js';
 import { resolveLocale, getTranslationFunction } from '../auth/i18n.js';
 import { renderPage } from '../auth/template-engine.js';
+import { resolveEffectiveBranding } from '../auth/effective-branding.js';
 import { sendOtpCodeEmail } from '../auth/email-service.js';
 import { recordLogin } from '../users/service.js';
 import { findUserById } from '../users/repository.js';
 import { verifyOtp, verifyTotp, verifyRecoveryCode as verifyRecoveryCodeService, sendOtpCode, setupTotp, getPendingTotpSetupInfo, setupEmailOtp, confirmTotpSetup, } from '../two-factor/service.js';
+import { UnsupportedTotpConfigurationError } from '../two-factor/errors.js';
 import { writeAuditLog } from '../lib/audit-log.js';
 import { logger } from '../lib/logger.js';
 import { resolveOrganizationForInteraction } from './interactions.js';
@@ -38,21 +40,6 @@ const RESEND_RATE_LIMIT = { max: 3, windowSeconds: 300 };
 // ---------------------------------------------------------------------------
 // Helpers
 // ---------------------------------------------------------------------------
-/**
- * Build branding context from organization data.
- *
- * @param org - Organization with branding fields
- * @returns Branding context for templates
- */
-function buildBrandingFromOrg(org) {
-    return {
-        logoUrl: org.brandingLogoUrl,
-        faviconUrl: org.brandingFaviconUrl,
-        primaryColor: org.brandingPrimaryColor ?? '#3B82F6',
-        companyName: org.brandingCompanyName ?? org.name,
-        customCss: org.brandingCustomCss,
-    };
-}
 /**
  * Build a base template context for 2FA pages.
  *
@@ -60,11 +47,11 @@ function buildBrandingFromOrg(org) {
  * @param locale - Resolved locale
  * @param csrfToken - CSRF token for form protection
  * @param orgSlug - Organization slug
- * @returns Base template context
+ * @returns Base template context.
  */
-function buildBaseContext(ctx, locale, csrfToken, orgSlug) {
+async function buildBaseContext(ctx, locale, csrfToken, orgSlug) {
     return {
-        branding: buildBrandingFromOrg(ctx.state.organization),
+        branding: await resolveEffectiveBranding(ctx.state.organization),
         locale,
         csrfToken,
         orgSlug,
@@ -79,6 +66,7 @@ function buildBaseContext(ctx, locale, csrfToken, orgSlug) {
  * @param statusCode - HTTP status (default: 200)
  */
 async function renderAndRespond(ctx, pageName, context, statusCode = 200) {
+    ctx.state.brandingImageSources = context.branding.imageSources;
     const html = await renderPage(pageName, context);
     ctx.status = statusCode;
     ctx.type = 'text/html';
@@ -182,7 +170,7 @@ async function showTwoFactor(ctx, provider) {
         const csrfToken = generateCsrfToken();
         setCsrfCookie(ctx, csrfToken);
         const context = {
-            ...buildBaseContext(ctx, locale, csrfToken, org.slug),
+            ...(await buildBaseContext(ctx, locale, csrfToken, org.slug)),
             t,
             interaction: {
                 uid: interaction.uid,
@@ -216,7 +204,10 @@ async function showTwoFactor(ctx, provider) {
 async function verifyTwoFactor(ctx, provider) {
     const body = ctx.request.body;
     const code = (body.code ?? '').trim();
-    const codeType = body.codeType ?? 'otp'; // 'otp', 'totp', or 'recovery'
+    const submittedCodeType = body.codeType;
+    const codeType = submittedCodeType === 'totp' || submittedCodeType === 'recovery' || submittedCodeType === 'otp'
+        ? submittedCodeType
+        : 'otp';
     const submittedCsrf = body._csrf ?? '';
     const storedCsrf = getCsrfFromCookie(ctx) ?? '';
     try {
@@ -273,7 +264,12 @@ async function verifyTwoFactor(ctx, provider) {
                 verified = await verifyOtp(pending.pendingAccountId, code);
             }
         }
-        catch {
+        catch (error) {
+            if (error instanceof UnsupportedTotpConfigurationError) {
+                logUnsupportedTotpConfiguration();
+                await renderTwoFactorWithError(ctx, interaction.uid, pending, locale, t, t('errors.two_factor_unavailable'), 503);
+                return;
+            }
             // Verification service threw an error (invalid code, expired, exhausted, etc.)
             logger.debug({ event: 'two-factor-code-rejected', codeType }, 'Two-factor code rejected');
             verified = false;
@@ -351,13 +347,7 @@ async function resendOtpCode(ctx, provider) {
                 email: pending.email,
                 givenName: user?.givenName,
                 familyName: user?.familyName,
-            }, {
-                id: org.id,
-                slug: org.slug,
-                brandingLogoUrl: org.brandingLogoUrl,
-                brandingPrimaryColor: org.brandingPrimaryColor,
-                brandingCompanyName: org.brandingCompanyName,
-            }, otpCode, 10, locale);
+            }, org, otpCode, 10, locale);
         }
         catch {
             logger.warn({ event: 'two-factor-otp-resend-failed' }, 'OTP resend failed');
@@ -423,7 +413,7 @@ async function showTwoFactorSetup(ctx, provider) {
         // Check for error indicator from failed verification redirect
         const errorParam = ctx.query.error ?? '';
         const context = {
-            ...buildBaseContext(ctx, locale, csrfToken, org.slug),
+            ...(await buildBaseContext(ctx, locale, csrfToken, org.slug)),
             t,
             interaction: {
                 uid: interaction.uid,
@@ -501,13 +491,7 @@ async function processTwoFactorSetup(ctx, provider) {
                     email: pending.email,
                     givenName: user?.givenName,
                     familyName: user?.familyName,
-                }, {
-                    id: org.id,
-                    slug: org.slug,
-                    brandingLogoUrl: org.brandingLogoUrl,
-                    brandingPrimaryColor: org.brandingPrimaryColor,
-                    brandingCompanyName: org.brandingCompanyName,
-                }, otpCode, 10, locale);
+                }, org, otpCode, 10, locale);
             }
             catch {
                 logger.warn({ event: 'two-factor-setup-otp-failed' }, 'Setup OTP delivery failed');
@@ -519,12 +503,42 @@ async function processTwoFactorSetup(ctx, provider) {
             ctx.redirect(`/interaction/${interaction.uid}/two-factor`);
             return;
         }
+        // TOTP confirmation uses the same attempt budget as normal 2FA verification.
+        // Email setup returns above because it does not verify a user-entered code.
+        const rateLimitKey = buildRateLimitKey('2fa_verify', org.id, pending.pendingAccountId);
+        const rateLimitResult = await checkRateLimit(rateLimitKey, VERIFY_RATE_LIMIT);
+        if (!rateLimitResult.allowed) {
+            ctx.set('Retry-After', String(rateLimitResult.retryAfter));
+            writeAuditLog({
+                organizationId: org.id,
+                userId: pending.pendingAccountId,
+                eventType: 'rate_limit.2fa_verify',
+                eventCategory: 'security',
+                description: 'TOTP setup verification rate limit exceeded',
+                ipAddress: ctx.ip,
+            });
+            const t = getTranslationFunction(locale, org.slug);
+            await renderTotpSetupWithError(ctx, interaction.uid, pending, locale, t, t('errors.rate_limit_exceeded'), 429);
+            return;
+        }
         // TOTP setup confirmation — verify the code from authenticator app
         if (!code) {
             ctx.redirect(`/interaction/${interaction.uid}/two-factor/setup`);
             return;
         }
-        const confirmed = await confirmTotpSetup(pending.pendingAccountId, code);
+        let confirmed;
+        try {
+            confirmed = await confirmTotpSetup(pending.pendingAccountId, code);
+        }
+        catch (error) {
+            if (error instanceof UnsupportedTotpConfigurationError) {
+                logUnsupportedTotpConfiguration();
+                const t = getTranslationFunction(locale, org.slug);
+                await renderTotpSetupWithError(ctx, interaction.uid, pending, locale, t, t('errors.two_factor_unavailable'), 503);
+                return;
+            }
+            throw error;
+        }
         if (!confirmed) {
             writeAuditLog({
                 organizationId: org.id,
@@ -558,6 +572,45 @@ async function processTwoFactorSetup(ctx, provider) {
         ctx.body = 'Interaction expired';
     }
 }
+/** Record the fixed diagnostic for unsupported persisted TOTP parameters. */
+function logUnsupportedTotpConfiguration() {
+    logger.error({ event: 'totp-configuration-unsupported' }, 'TOTP configuration is unsupported');
+}
+/**
+ * Render pending TOTP enrollment data with an error without creating new secrets.
+ *
+ * @param ctx - Koa context
+ * @param uid - Interaction UID
+ * @param pending - Pending two-factor state
+ * @param locale - Resolved locale
+ * @param t - Translation function
+ * @param errorMessage - Error to display
+ * @param statusCode - HTTP response status
+ * @throws Error when the pending enrollment record no longer exists
+ */
+async function renderTotpSetupWithError(ctx, uid, pending, locale, t, errorMessage, statusCode) {
+    const setup = await getPendingTotpSetupInfo(pending.pendingAccountId, pending.email, ctx.state.organization.slug);
+    if (!setup) {
+        throw new Error('Pending TOTP setup is unavailable');
+    }
+    const csrfToken = generateCsrfToken();
+    setCsrfCookie(ctx, csrfToken);
+    const context = {
+        ...(await buildBaseContext(ctx, locale, csrfToken, ctx.state.organization.slug)),
+        t,
+        interaction: {
+            uid,
+            prompt: 'two-factor-setup',
+            params: {},
+            client: { clientName: '' },
+        },
+        method: 'totp',
+        qrCodeDataUri: setup.qrCodeDataUri,
+        totpSecret: setup.totpSecret,
+        flash: { error: errorMessage },
+    };
+    await renderAndRespond(ctx, 'two-factor-setup', context, statusCode);
+}
 // ---------------------------------------------------------------------------
 // Helper: render 2FA verify page with error
 // ---------------------------------------------------------------------------
@@ -576,7 +629,7 @@ async function renderTwoFactorWithError(ctx, uid, pending, locale, t, errorMessa
     const csrfToken = generateCsrfToken();
     setCsrfCookie(ctx, csrfToken);
     const context = {
-        ...buildBaseContext(ctx, locale, csrfToken, ctx.state.organization.slug),
+        ...(await buildBaseContext(ctx, locale, csrfToken, ctx.state.organization.slug)),
         t,
         interaction: {
             uid,