@taskforcehq/taskforce 0.3.301 → 0.3.303

package/dist/server/routes/auth.js

@@ -20,7 +20,9 @@
  *   POST /api/taskforce/auth/invite/join
  *   POST /api/taskforce/auth/logout
  *   GET  /api/taskforce/account/access-status
+ *   GET  /api/taskforce/account/profile-summary
  *   GET  /api/taskforce/account/entitlements
+ *   GET  /api/taskforce/account/team-management-access
  *   GET  /api/taskforce/account/plan-preview
  *   GET  /api/taskforce/auth/workspace-members
  *   GET  /api/taskforce/workspace/assignee-options
@@ -33,15 +35,160 @@
  *   DELETE /api/taskforce/admin/users/:id
  *   GET  /api/taskforce/admin/workspace-audit-logs
  */
+import * as fs from 'fs';
+import * as path from 'path';
+import { randomUUID } from 'crypto';
 import { parseJsonBody } from '../routes.js';
 import { hasValidSession, createClearSessionCookie, createSessionTokenCookie, resolveRequestAccess, resolveSessionCookieAttributesForRequest, } from '../auth.js';
 import { resolveEffectiveEmailConfig, sendEmail } from '../email.js';
 import { resolveDeploymentConfig } from '../../config/deployment.js';
 import { resolveRuntimeModeContract } from '../../shared/runtimeContract.js';
-import { resolveErrorStatusCode } from './shared.js';
+import { requestHeader, resolveErrorStatusCode } from './shared.js';
+import { normalizeTaskDataRelativePath } from '../../storage/objectStorageClient.js';
 // === SECTION: Registration ===
 export function registerAuthRoutes(deps) {
-    const { addRoute, core, context, requestWorkspaceId, requestUserId, ensureAppAccess, ensureAuthenticatedUser, ensureWorkspaceAdminRole, ensureCloudPlanData, requireCloudRuntime, auditAuthAction, resolveAdminRequestActor, shouldExposeDevAuthTokens, resolveRuntimeConfigBaseUrl, resolvePublicAuthBaseUrl, } = deps;
+    const { addRoute, core, context, requestWorkspaceId, requestUserId, ensureAppAccess, ensureAuthenticatedUser, ensureWorkspaceAdminRole, ensureCloudPlanData, requireCloudRuntime, auditAuthAction, resolveAdminRequestActor, shouldExposeDevAuthTokens, resolveRuntimeConfigBaseUrl, resolvePublicAuthBaseUrl, resolveEffectiveObjectStorageConfig, getObjectStorageClient, } = deps;
+    const normalizeTeamWorkspaceRole = (value) => {
+        const role = String(value || '').trim().toLowerCase();
+        if (role === 'owner' || role === 'admin' || role === 'member' || role === 'read-only')
+            return role;
+        return null;
+    };
+    const resolveBooleanSetting = (value, fallback) => {
+        if (typeof value === 'boolean')
+            return value;
+        if (typeof value === 'number')
+            return value !== 0;
+        const normalized = String(value || '').trim().toLowerCase();
+        if (!normalized)
+            return fallback;
+        if (['1', 'true', 'yes', 'on'].includes(normalized))
+            return true;
+        if (['0', 'false', 'no', 'off'].includes(normalized))
+            return false;
+        return fallback;
+    };
+    const resolveTeamPlanModeFromEntitlements = (payload) => {
+        const state = String(payload?.state || '').trim().toLowerCase();
+        const teamAllowed = payload?.features?.['collaboration.team_management']?.allowed === true;
+        const stateAllows = state === 'active' || state === 'trialing' || state === 'grace';
+        return teamAllowed && stateAllows ? 'team' : 'personal';
+    };
+    const resolveBillingConflictCodeForUser = (userIdRaw, gateRaw) => {
+        const userId = String(userIdRaw || '').trim();
+        const gate = String(gateRaw || '').trim().toLowerCase();
+        if (!userId || !gate || gate === 'ok')
+            return null;
+        const db = core.getDatabaseAdapter();
+        const tenantId = core.getTenantId();
+        try {
+            const row = db.prepare(`
+                SELECT session_id, status, expires_at
+                FROM billing_checkout_attempts
+                WHERE tenant_id = ? AND user_id = ?
+                ORDER BY created_at DESC, session_id DESC
+                LIMIT 1
+            `).get(tenantId, userId);
+            const sessionId = String(row?.session_id || '').trim();
+            const status = String(row?.status || '').trim().toLowerCase();
+            const expiresAt = String(row?.expires_at || '').trim();
+            if (!sessionId)
+                return null;
+            if (status === 'open' && expiresAt) {
+                const expiresAtMs = Date.parse(expiresAt);
+                if (Number.isFinite(expiresAtMs) && expiresAtMs <= Date.now()) {
+                    db.prepare(`
+                        UPDATE billing_checkout_attempts
+                        SET status = 'expired', updated_at = ?
+                        WHERE tenant_id = ? AND session_id = ?
+                    `).run(new Date().toISOString(), tenantId, sessionId);
+                    return 'CHECKOUT_SESSION_EXPIRED';
+                }
+            }
+            if (status === 'expired')
+                return 'CHECKOUT_SESSION_EXPIRED';
+            if (status === 'superseded')
+                return 'CHECKOUT_SESSION_SUPERSEDED';
+        }
+        catch {
+            return null;
+        }
+        return null;
+    };
+    const buildAccountProfileSummary = (req) => {
+        const userId = requestUserId(req);
+        const workspaceId = requestWorkspaceId(req);
+        const access = core.getAccountAccessStatus(userId);
+        const resolvedAccess = core.resolveUserAccess(userId, workspaceId, 'member');
+        const hintedRole = normalizeTeamWorkspaceRole(requestHeader(req, 'x-taskforce-workspace-role', ''));
+        const workspaceRole = normalizeTeamWorkspaceRole(resolvedAccess?.role || hintedRole || null);
+        const canManageWorkspace = workspaceRole === 'owner' || workspaceRole === 'admin';
+        const db = core.getDatabaseAdapter();
+        const tenantId = core.getTenantId();
+        let billingRow;
+        try {
+            billingRow = db.prepare(`
+                SELECT stripe_status, stripe_customer_id, stripe_subscription_id, stripe_price_id, billing_interval,
+                       trial_end, current_period_end, effective_until, entitlement_state, tier
+                FROM user_billing
+                WHERE tenant_id = ? AND user_id = ?
+                LIMIT 1
+            `).get(tenantId, userId);
+        }
+        catch {
+            billingRow = undefined;
+        }
+        const planId = String(access.entitlement?.planId || billingRow?.tier || '').trim() || null;
+        const planVersionId = String(access.entitlement?.planVersionId || '').trim() || null;
+        let planRow;
+        if (planId) {
+            try {
+                planRow = db.prepare(`
+                    SELECT display_name
+                    FROM plan_catalog
+                    WHERE tenant_id = ? AND plan_id = ?
+                    LIMIT 1
+                `).get(tenantId, planId);
+            }
+            catch {
+                planRow = undefined;
+            }
+        }
+        let teamPlanMode = 'unknown';
+        try {
+            const entitlements = core.getAccountEntitlementsPayload({ userId, workspaceId });
+            teamPlanMode = resolveTeamPlanModeFromEntitlements(entitlements);
+        }
+        catch (error) {
+            if (error?.code === 'ENTITLEMENT_NOT_FOUND' && (access.gate === 'plan_selection_required' || access.gate === 'checkout_pending')) {
+                teamPlanMode = 'personal';
+            }
+        }
+        const billingConflictCode = resolveBillingConflictCodeForUser(userId, access.gate);
+        return {
+            stripeStatus: billingRow?.stripe_status || null,
+            stripeCustomerId: billingRow?.stripe_customer_id || null,
+            stripeSubscriptionId: billingRow?.stripe_subscription_id || null,
+            stripePriceId: billingRow?.stripe_price_id || null,
+            billingInterval: billingRow?.billing_interval || null,
+            trialEnd: billingRow?.trial_end || null,
+            currentPeriodEnd: billingRow?.current_period_end || null,
+            effectiveUntil: billingRow?.effective_until || null,
+            entitlementState: access.entitlement?.state || billingRow?.entitlement_state || null,
+            planVersionId,
+            planId,
+            planName: planRow?.display_name ? String(planRow.display_name) : planId,
+            gate: access.gate,
+            message: access.message,
+            billingConflictCode,
+            planSelectionRequired: access.planSelectionRequired,
+            workspaceId,
+            workspaceRole,
+            canManageWorkspace,
+            teamPlanMode,
+            teamManagementAllowed: canManageWorkspace && teamPlanMode === 'team'
+        };
+    };
     // === SECTION: Email delivery helpers ===
     const getEmailConfig = () => {
         if (context.authConfig?.runtimeMode !== 'cloud') {
@@ -55,30 +202,94 @@ export function registerAuthRoutes(deps) {
         const authSettings = globalSettings.auth || {};
         const authRateLimitMaxRequestsRaw = Number(authSettings.authRateLimitMaxRequests);
         const authRateLimitWindowMsRaw = Number(authSettings.authRateLimitWindowMs);
-        const signupSettings = core.getSignupMonetizationSettings();
+        const onboardingPolicy = core.getOnboardingPolicy();
         return {
-            allowSelfRegistration: authSettings.allowSelfRegistration !== false,
-            requireVerifiedEmail: authSettings.requireVerifiedEmail !== false,
-            defaultNewUserBetaAccess: authSettings.defaultNewUserBetaAccess === true,
-            authRateLimitEnabled: authSettings.authRateLimitEnabled !== false,
+            allowSelfRegistration: resolveBooleanSetting(authSettings.allowSelfRegistration, true),
+            requireVerifiedEmail: resolveBooleanSetting(authSettings.requireVerifiedEmail, true),
+            defaultNewUserBetaAccess: resolveBooleanSetting(authSettings.defaultNewUserBetaAccess, false),
+            authRateLimitEnabled: resolveBooleanSetting(authSettings.authRateLimitEnabled, true),
             authRateLimitMaxRequests: Number.isFinite(authRateLimitMaxRequestsRaw) && authRateLimitMaxRequestsRaw >= 1
                 ? Math.floor(authRateLimitMaxRequestsRaw)
                 : 10,
             authRateLimitWindowMs: Number.isFinite(authRateLimitWindowMsRaw) && authRateLimitWindowMsRaw >= 1000
                 ? Math.floor(authRateLimitWindowMsRaw)
                 : 15 * 60_000,
-            signupMonetizationStrategy: signupSettings.strategy,
-            defaultSignupPlanVersionId: signupSettings.defaultSignupPlanVersionId
+            onboardingPolicyMode: onboardingPolicy.mode,
+            onboardingPlanVersionId: onboardingPolicy.planVersionId
         };
     };
     const getSiteBehavior = () => {
         const globalSettings = core.getGlobalSettings();
         const siteSettings = globalSettings.site || {};
         return {
-            showRunTaskforceLocally: siteSettings.showRunTaskforceLocally !== false,
-            pricingPageEnabled: siteSettings.pricingPageEnabled !== false
+            showRunTaskforceLocally: resolveBooleanSetting(siteSettings.showRunTaskforceLocally, true),
+            pricingPageEnabled: resolveBooleanSetting(siteSettings.pricingPageEnabled, true)
         };
     };
+    const buildPasswordSessionCookieForUser = (req, authConfig, userIdRaw, options) => {
+        const userId = String(userIdRaw || '').trim();
+        const fallbackRole = String(options?.fallbackRole || authConfig.defaultRole || 'member').trim() || 'member';
+        const resolvedWorkspaceId = core.resolvePreferredUserWorkspaceId(userId, {
+            preferredWorkspaceId: options?.preferredWorkspaceId || null,
+            persistedWorkspaceId: options?.persistedWorkspaceId || null
+        });
+        const access = resolvedWorkspaceId
+            ? core.resolveUserAccess(userId, resolvedWorkspaceId, fallbackRole)
+            : null;
+        return createSessionTokenCookie(`pwd:${userId}`, authConfig, {
+            role: (access?.role || fallbackRole),
+            workspaceId: access?.workspaceId || '',
+            userId,
+            ...resolveSessionCookieAttributesForRequest(req, authConfig)
+        });
+    };
+    const AVATAR_DRAFT_RETENTION_MS = 24 * 60 * 60 * 1000;
+    const MAX_AVATAR_UPLOAD_BYTES = 5 * 1024 * 1024;
+    const AVATAR_MIME_EXTENSION = {
+        'image/png': '.png',
+        'image/jpeg': '.jpg',
+        'image/webp': '.webp',
+        'image/gif': '.gif'
+    };
+    const buildUserAvatarStoragePath = (userIdRaw, draftIdRaw, originalNameRaw, mimeTypeRaw) => {
+        const userId = String(userIdRaw || '').trim().replace(/[^a-zA-Z0-9._-]/g, '-') || 'user';
+        const draftId = String(draftIdRaw || '').trim().replace(/[^a-zA-Z0-9._-]/g, '-') || randomUUID().replace(/-/g, '');
+        const originalName = String(originalNameRaw || '').trim();
+        const mimeType = String(mimeTypeRaw || '').trim().toLowerCase();
+        const originalExt = originalName ? path.extname(originalName).toLowerCase() : '';
+        const ext = originalExt || AVATAR_MIME_EXTENSION[mimeType] || '.bin';
+        const stem = (originalName ? path.basename(originalName, originalExt) : 'avatar')
+            .replace(/[^a-zA-Z0-9._-]/g, '-')
+            .replace(/-+/g, '-')
+            .replace(/^-+|-+$/g, '')
+            .slice(0, 64) || 'avatar';
+        return `users/${userId}/profile/avatar/${draftId}-${stem}${ext}`;
+    };
+    const deleteStoredAvatarObject = async (relativePathRaw) => {
+        const relativePath = normalizeTaskDataRelativePath(String(relativePathRaw || '').trim());
+        if (!relativePath)
+            return;
+        const objectStorageClient = getObjectStorageClient();
+        const effectiveObjectStorage = resolveEffectiveObjectStorageConfig();
+        if (objectStorageClient && effectiveObjectStorage.provider === 'r2') {
+            await objectStorageClient.deleteObject(relativePath).catch(() => { });
+            return;
+        }
+        const { basePath } = core.getPaths();
+        const resolvedPath = path.resolve(basePath, relativePath);
+        if (!resolvedPath.startsWith(path.resolve(basePath)))
+            return;
+        if (fs.existsSync(resolvedPath)) {
+            fs.rmSync(resolvedPath, { force: true });
+        }
+    };
+    const cleanupStaleAvatarDrafts = async (userId) => {
+        const cutoff = new Date(Date.now() - AVATAR_DRAFT_RETENTION_MS).toISOString();
+        const staleDrafts = core.cleanupStaleUserAvatarUploadDrafts(userId, cutoff);
+        for (const draft of staleDrafts) {
+            await deleteStoredAvatarObject(draft.storageKey);
+        }
+    };
     const logAuthLink = (kind, email, token, req) => {
         const base = resolvePublicAuthBaseUrl(req);
         const urlPath = kind === 'verify-email'
@@ -187,8 +398,10 @@ export function registerAuthRoutes(deps) {
         let userId = access?.userId || 'anonymous';
         let email = null;
         let displayName = null;
+        let avatarUrl = null;
         let betaAccess = true;
         if (authenticated && access?.userId) {
+            await cleanupStaleAvatarDrafts(access.userId);
             betaAccess = core.getUserBetaAccess(access.userId);
             const resolved = core.resolveUserAccess(access.userId, workspaceId, role);
             if (resolved) {
@@ -204,6 +417,7 @@ export function registerAuthRoutes(deps) {
             const identity = core.resolveUserIdentity(userId);
             email = identity?.email || null;
             displayName = identity?.displayName || null;
+            avatarUrl = identity?.avatarUrl || null;
         }
         res.writeHead(200, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({
@@ -213,6 +427,7 @@ export function registerAuthRoutes(deps) {
             role,
             email,
             displayName,
+            avatarUrl,
             betaAccess
         }));
     });
@@ -229,28 +444,67 @@ export function registerAuthRoutes(deps) {
     addRoute('POST', '/api/taskforce/auth/profile', async (req, res) => {
         if (!requireCloudRuntime(res, 'Authentication'))
             return;
-        if (!ensureAuthenticatedUser(req)) {
-            res.writeHead(401, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ success: false, error: 'Authentication required.' }));
+        const authConfig = context.authConfig;
+        if (!authConfig) {
+            res.writeHead(500, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Auth context unavailable.' }));
             return;
         }
-        const userId = String(requestUserId(req) || '').trim();
-        if (!userId || userId === 'anonymous') {
+        const access = resolveRequestAccess(req, authConfig);
+        const userId = String(access.userId || '').trim();
+        if (!access.authenticated || !userId || userId === 'anonymous') {
             res.writeHead(401, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({ success: false, error: 'Authentication required.' }));
             return;
         }
         const body = await parseJsonBody(req);
         try {
-            const updated = core.updateUserDisplayName(userId, String(body?.displayName || ''));
+            await cleanupStaleAvatarDrafts(userId);
+            const avatarDraftId = typeof body?.avatarDraftId === 'string' ? body.avatarDraftId.trim() : '';
+            const clearAvatar = body?.clearAvatar === true;
+            let avatarUrl;
+            if (avatarDraftId) {
+                const draft = core.getUserAvatarUploadDraft(userId, avatarDraftId);
+                if (!draft || draft.discardedAt || !draft.finalizedAt) {
+                    res.writeHead(400, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ success: false, error: 'Avatar draft is invalid or expired.', code: 'AVATAR_DRAFT_INVALID' }));
+                    return;
+                }
+                avatarUrl = `/api/taskforce/context/${encodeURIComponent(draft.storageKey)}`;
+            }
+            else if (clearAvatar) {
+                avatarUrl = null;
+            }
+            const previousIdentity = core.resolveUserIdentity(userId);
+            const updated = core.updateUserProfile(userId, {
+                displayName: String(body?.displayName || ''),
+                ...((avatarDraftId || clearAvatar) ? { avatarUrl: avatarUrl || null } : {})
+            });
             if (!updated) {
                 res.writeHead(404, { 'Content-Type': 'application/json' });
                 res.end(JSON.stringify({ success: false, error: 'User not found.', code: 'USER_NOT_FOUND' }));
                 return;
             }
+            if (avatarDraftId) {
+                core.markUserAvatarUploadDraftConsumed(userId, avatarDraftId);
+            }
+            if (avatarDraftId || clearAvatar) {
+                const previousAvatarUrl = String(previousIdentity?.avatarUrl || '').trim();
+                const nextAvatarUrl = String(updated.avatarUrl || '').trim();
+                const currentDraft = avatarDraftId ? core.getUserAvatarUploadDraft(userId, avatarDraftId) : null;
+                const currentStorageKey = String(currentDraft?.storageKey || '').trim();
+                if (previousAvatarUrl.startsWith('/api/taskforce/context/')
+                    && previousAvatarUrl !== nextAvatarUrl) {
+                    const previousStorageKey = normalizeTaskDataRelativePath(decodeURIComponent(previousAvatarUrl.slice('/api/taskforce/context/'.length)));
+                    if (previousStorageKey && previousStorageKey !== currentStorageKey) {
+                        await deleteStoredAvatarObject(previousStorageKey);
+                    }
+                }
+            }
             auditAuthAction(req, 'auth-profile-updated', {
                 userId,
-                displayName: updated.displayName || null
+                displayName: updated.displayName || null,
+                avatarUrl: updated.avatarUrl || null
             });
             res.writeHead(200, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({
@@ -258,7 +512,8 @@ export function registerAuthRoutes(deps) {
                 profile: {
                     userId: updated.userId,
                     email: updated.email,
-                    displayName: updated.displayName || null
+                    displayName: updated.displayName || null,
+                    avatarUrl: updated.avatarUrl || null
                 }
             }));
         }
@@ -268,6 +523,161 @@ export function registerAuthRoutes(deps) {
             res.end(JSON.stringify({ success: false, error: String(error?.message || 'Unable to update profile.'), code: error?.code }));
         }
     });
+    addRoute('POST', '/api/taskforce/auth/profile/avatar/init', async (req, res) => {
+        if (!requireCloudRuntime(res, 'Authentication'))
+            return;
+        const authConfig = context.authConfig;
+        if (!authConfig) {
+            res.writeHead(500, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Auth context unavailable.' }));
+            return;
+        }
+        const access = resolveRequestAccess(req, authConfig);
+        const userId = String(access.userId || '').trim();
+        if (!access.authenticated || !userId || userId === 'anonymous') {
+            res.writeHead(401, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Authentication required.' }));
+            return;
+        }
+        const objectStorageClient = getObjectStorageClient();
+        const effectiveObjectStorage = resolveEffectiveObjectStorageConfig();
+        if (!objectStorageClient || effectiveObjectStorage.provider !== 'r2' || !effectiveObjectStorage.r2) {
+            res.writeHead(501, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Avatar uploads require object storage.' }));
+            return;
+        }
+        const body = await parseJsonBody(req);
+        const originalName = String(body?.originalName || '').trim();
+        const mimeType = String(body?.mimeType || '').trim().toLowerCase();
+        const size = Number(body?.size || 0);
+        if (!originalName || !mimeType.startsWith('image/') || !(mimeType in AVATAR_MIME_EXTENSION)) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'A supported image file is required.', code: 'AVATAR_FILE_INVALID' }));
+            return;
+        }
+        if (!Number.isFinite(size) || size <= 0 || size > MAX_AVATAR_UPLOAD_BYTES) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Avatar must be 5 MB or smaller.', code: 'AVATAR_SIZE_INVALID' }));
+            return;
+        }
+        await cleanupStaleAvatarDrafts(userId);
+        const draftId = `avatar-draft-${randomUUID().replace(/-/g, '')}`;
+        const relativePath = buildUserAvatarStoragePath(userId, draftId, originalName, mimeType);
+        core.createUserAvatarUploadDraft({
+            userId,
+            draftId,
+            storageKey: relativePath,
+            mimeType,
+            originalFilename: originalName,
+            sizeBytes: size,
+            storageProvider: 'r2'
+        });
+        const uploadUrl = objectStorageClient.createSignedPutUrl(relativePath, effectiveObjectStorage.r2.signedUploadTtlSeconds, mimeType);
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({
+            success: true,
+            mode: 'direct',
+            draftId,
+            uploadUrl,
+            method: 'PUT',
+            headers: { 'Content-Type': mimeType },
+            relativePath,
+            path: `/api/taskforce/context/${encodeURIComponent(relativePath)}`
+        }));
+    });
+    addRoute('POST', '/api/taskforce/auth/profile/avatar/finalize', async (req, res) => {
+        if (!requireCloudRuntime(res, 'Authentication'))
+            return;
+        const authConfig = context.authConfig;
+        if (!authConfig) {
+            res.writeHead(500, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Auth context unavailable.' }));
+            return;
+        }
+        const access = resolveRequestAccess(req, authConfig);
+        const userId = String(access.userId || '').trim();
+        if (!access.authenticated || !userId || userId === 'anonymous') {
+            res.writeHead(401, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Authentication required.' }));
+            return;
+        }
+        const body = await parseJsonBody(req);
+        const draftId = String(body?.draftId || '').trim();
+        const relativePath = normalizeTaskDataRelativePath(String(body?.relativePath || '').trim());
+        if (!draftId || !relativePath) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'draftId and relativePath are required.' }));
+            return;
+        }
+        await cleanupStaleAvatarDrafts(userId);
+        const draft = core.getUserAvatarUploadDraft(userId, draftId);
+        if (!draft || draft.discardedAt || draft.storageKey !== relativePath) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Avatar draft is invalid or expired.', code: 'AVATAR_DRAFT_INVALID' }));
+            return;
+        }
+        const objectStorageClient = getObjectStorageClient();
+        if (objectStorageClient) {
+            const uploaded = await objectStorageClient.getObject(relativePath);
+            if (!uploaded) {
+                res.writeHead(404, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ success: false, error: 'Uploaded avatar not found.', code: 'AVATAR_UPLOAD_MISSING' }));
+                return;
+            }
+        }
+        else {
+            const { basePath } = core.getPaths();
+            const resolvedPath = path.resolve(basePath, relativePath);
+            if (!resolvedPath.startsWith(path.resolve(basePath)) || !fs.existsSync(resolvedPath)) {
+                res.writeHead(404, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ success: false, error: 'Uploaded avatar not found.', code: 'AVATAR_UPLOAD_MISSING' }));
+                return;
+            }
+        }
+        const finalized = core.markUserAvatarUploadDraftFinalized(userId, draftId);
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({
+            success: true,
+            draftId,
+            avatarUrl: `/api/taskforce/context/${encodeURIComponent(relativePath)}`,
+            profile: finalized
+        }));
+    });
+    addRoute('POST', '/api/taskforce/auth/profile/avatar/discard', async (req, res) => {
+        if (!requireCloudRuntime(res, 'Authentication'))
+            return;
+        const authConfig = context.authConfig;
+        if (!authConfig) {
+            res.writeHead(500, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Auth context unavailable.' }));
+            return;
+        }
+        const access = resolveRequestAccess(req, authConfig);
+        const userId = String(access.userId || '').trim();
+        if (!access.authenticated || !userId || userId === 'anonymous') {
+            res.writeHead(401, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Authentication required.' }));
+            return;
+        }
+        const body = await parseJsonBody(req);
+        const draftId = String(body?.draftId || '').trim();
+        if (!draftId) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'draftId is required.' }));
+            return;
+        }
+        await cleanupStaleAvatarDrafts(userId);
+        const draft = core.getUserAvatarUploadDraft(userId, draftId);
+        if (!draft) {
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: true, discarded: false }));
+            return;
+        }
+        core.discardUserAvatarUploadDraft(userId, draftId);
+        await deleteStoredAvatarObject(draft.storageKey);
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ success: true, discarded: true }));
+    });
     // === SECTION: Login and register ===
     // POST /api/taskforce/auth/login - Exchange email/password for secure session cookie
     addRoute('POST', '/api/taskforce/auth/login', async (req, res) => {
@@ -366,7 +776,7 @@ export function registerAuthRoutes(deps) {
         res.writeHead(400, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({ success: false, error: 'Email and password are required.' }));
     });
-    // POST /api/taskforce/auth/register - Create account and exchange for secure session cookie
+    // POST /api/taskforce/auth/register - Create account and optionally start a session
     addRoute('POST', '/api/taskforce/auth/register', async (req, res) => {
         if (!requireCloudRuntime(res, 'Authentication'))
             return;
@@ -416,13 +826,6 @@ export function registerAuthRoutes(deps) {
                 role,
                 betaAccess: authBehavior.defaultNewUserBetaAccess
             });
-            const sessionWorkspaceId = created.workspaceId || '';
-            const cookie = createSessionTokenCookie(`pwd:${created.userId}`, authConfig, {
-                role: created.role,
-                workspaceId: sessionWorkspaceId,
-                userId: created.userId,
-                ...resolveSessionCookieAttributesForRequest(req, authConfig)
-            });
             let emailSent = true;
             let emailError;
             let verificationToken;
@@ -442,7 +845,13 @@ export function registerAuthRoutes(deps) {
                 role: created.role,
                 emailSent
             });
-            res.setHeader('Set-Cookie', cookie);
+            if (!authBehavior.requireVerifiedEmail) {
+                res.setHeader('Set-Cookie', buildPasswordSessionCookieForUser(req, authConfig, created.userId, {
+                    preferredWorkspaceId: created.workspaceId || null,
+                    persistedWorkspaceId: created.workspaceId || null,
+                    fallbackRole: created.role
+                }));
+            }
             res.writeHead(201, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({
                 success: true,
@@ -450,6 +859,8 @@ export function registerAuthRoutes(deps) {
                 role: created.role,
                 workspaceSetupRequired: !created.workspaceId,
                 planSelectionRequired: created.planSelectionRequired === true,
+                checkoutPending: created.checkoutPending === true,
+                commercialState: created.commercialState,
                 verificationRequired: authBehavior.requireVerifiedEmail,
                 emailSent,
                 emailError,
@@ -517,6 +928,12 @@ export function registerAuthRoutes(deps) {
     addRoute('POST', '/api/taskforce/auth/verify-email/confirm', async (req, res) => {
         if (!requireCloudRuntime(res, 'Authentication'))
             return;
+        const authConfig = context.authConfig;
+        if (!authConfig?.enabled) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Authentication is not configured.' }));
+            return;
+        }
         const body = await parseJsonBody(req);
         const token = String(body?.token || '').trim();
         if (!token) {
@@ -524,6 +941,15 @@ export function registerAuthRoutes(deps) {
             res.end(JSON.stringify({ success: false, error: 'Token is required.' }));
             return;
         }
+        const inspection = core.inspectOneTimeAuthToken(token, 'email_verification');
+        if (!inspection.userId) {
+            auditAuthAction(req, 'auth-verify-confirm-failed', {
+                tokenProvided: true
+            });
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Invalid or expired token.' }));
+            return;
+        }
         const verified = core.verifyEmailWithToken(token);
         if (!verified) {
             auditAuthAction(req, 'auth-verify-confirm-failed', {
@@ -536,6 +962,11 @@ export function registerAuthRoutes(deps) {
         auditAuthAction(req, 'auth-verify-confirm-success', {
             tokenProvided: true
         });
+        const cookie = buildPasswordSessionCookieForUser(req, authConfig, inspection.userId, {
+            preferredWorkspaceId: inspection.workspaceId || null,
+            persistedWorkspaceId: inspection.workspaceId || null
+        });
+        res.setHeader('Set-Cookie', cookie);
         res.writeHead(200, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({ success: true }));
     });
@@ -821,6 +1252,24 @@ export function registerAuthRoutes(deps) {
             res.end(JSON.stringify({ error: String(error?.message || 'Unable to resolve account access status'), code: error?.code, details: error?.details }));
         }
     });
+    // GET /api/taskforce/account/profile-summary - Fast authoritative summary for the visible account surface.
+    addRoute('GET', '/api/taskforce/account/profile-summary', async (req, res) => {
+        if (!ensureAuthenticatedUser(req)) {
+            res.writeHead(401, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Authentication required.' }));
+            return;
+        }
+        try {
+            const payload = buildAccountProfileSummary(req);
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify(payload));
+        }
+        catch (error) {
+            const statusCode = resolveErrorStatusCode(error, 400);
+            res.writeHead(statusCode, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: String(error?.message || 'Unable to resolve account profile summary'), code: error?.code, details: error?.details }));
+        }
+    });
     // GET /api/taskforce/account/entitlements - Resolve effective plan/features for the active workspace.
     addRoute('GET', '/api/taskforce/account/entitlements', async (req, res) => {
         if (!ensureAuthenticatedUser(req)) {
@@ -838,11 +1287,11 @@ export function registerAuthRoutes(deps) {
         catch (error) {
             if (error?.code === 'ENTITLEMENT_NOT_FOUND') {
                 const access = core.getAccountAccessStatus(requestUserId(req));
-                if (access.gate === 'plan_selection_required') {
+                if (access.gate === 'plan_selection_required' || access.gate === 'checkout_pending') {
                     res.writeHead(403, { 'Content-Type': 'application/json' });
                     res.end(JSON.stringify({
                         error: access.message,
-                        code: 'PLAN_SELECTION_REQUIRED',
+                        code: access.gate === 'checkout_pending' ? 'CHECKOUT_PENDING' : 'PLAN_SELECTION_REQUIRED',
                         details: {
                             gate: access.gate,
                             planSelectionRequired: access.planSelectionRequired,
@@ -857,6 +1306,32 @@ export function registerAuthRoutes(deps) {
             res.end(JSON.stringify({ error: String(error?.message || 'Unable to resolve entitlements'), code: error?.code, details: error?.details }));
         }
     });
+    // GET /api/taskforce/account/team-management-access - Resolve authoritative team-management access for the active workspace.
+    addRoute('GET', '/api/taskforce/account/team-management-access', async (req, res) => {
+        if (!ensureAuthenticatedUser(req)) {
+            res.writeHead(401, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Authentication required.' }));
+            return;
+        }
+        try {
+            const payload = buildAccountProfileSummary(req);
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({
+                workspaceId: payload.workspaceId,
+                role: payload.workspaceRole,
+                canManageWorkspace: payload.canManageWorkspace,
+                teamPlanMode: payload.teamPlanMode,
+                allowed: payload.teamManagementAllowed,
+                gate: payload.gate,
+                planSelectionRequired: payload.planSelectionRequired
+            }));
+        }
+        catch (error) {
+            const statusCode = resolveErrorStatusCode(error, 400);
+            res.writeHead(statusCode, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: String(error?.message || 'Unable to resolve team management access'), code: error?.code, details: error?.details }));
+        }
+    });
     // GET /api/taskforce/account/plan-preview - Read-only payload for upgrade/support CTAs.
     addRoute('GET', '/api/taskforce/account/plan-preview', async (req, res) => {
         if (!ensureCloudPlanData(req, res))