From c1f8020f6ba7f2ceb5c0263d752cc60a23a89d68 Mon Sep 17 00:00:00 2001
From: Leo Vasanko <git@vasanko.com>
Date: Fri, 13 Feb 2026 20:09:41 +0000
Subject: [PATCH] API cleanup, using msgspec structs rather than raw responses.
 Admin app cleanup, better breadcrumbs.

---
 frontend/auth/App.vue                         |  16 +-
 frontend/auth/admin/AdminApp.vue              | 142 ++++++++++--------
 frontend/src/admin/AdminOrgDetail.vue         |  66 ++++----
 frontend/src/admin/AdminOverview.vue          |  18 ++-
 frontend/src/admin/AdminUserDetail.vue        |  54 +++----
 frontend/src/components/CredentialList.vue    |  16 +-
 frontend/src/components/ProfileView.vue       |  54 +++----
 .../src/components/RegistrationLinkModal.vue  |   1 +
 frontend/src/components/SessionList.vue       |  14 +-
 frontend/src/stores/auth.js                   |   3 +-
 paskia/__main__.py                            |   2 +-
 paskia/aaguid/__init__.py                     |  14 +-
 paskia/db/bootstrap.py                        |   1 +
 paskia/db/migrations.py                       |   6 +
 paskia/db/structs.py                          |   9 +-
 paskia/fastapi/admin.py                       | 118 +++++++--------
 paskia/fastapi/api.py                         |  42 +++---
 paskia/fastapi/mainapp.py                     |   2 +-
 paskia/fastapi/user.py                        |  24 +--
 paskia/util/apistructs.py                     | 141 +++++++++++++++--
 paskia/util/userinfo.py                       |  97 ++++++------
 21 files changed, 505 insertions(+), 335 deletions(-)

diff --git a/frontend/auth/App.vue b/frontend/auth/App.vue
index c1d6533..466c695 100644
--- a/frontend/auth/App.vue
+++ b/frontend/auth/App.vue
@@ -54,7 +54,7 @@ function terminateSession() {
   viewState.value = 'terminal'
 }
 
-const userUuidGetter = () => store.userInfo?.ctx.user.uuid
+const userUuidGetter = () => store.ctx?.user.uuid
 const sessionValidator = new SessionValidator(userUuidGetter, terminateSession)
 
 onMounted(() => sessionValidator.start())
@@ -62,11 +62,23 @@ onUnmounted(() => sessionValidator.stop())
 
 async function loadUserInfo() {
   try {
-    store.userInfo = await apiJson('/auth/api/user-info', { method: 'POST' })
+    const [validateData, userInfoData] = await Promise.all([
+      apiJson('/auth/api/validate', { method: 'POST' }),
+      apiJson('/auth/api/user-info', { method: 'POST' })
+    ])
+    store.userInfo = userInfoData
+    store.ctx = validateData.ctx
+    // Verify that the user UUIDs match between user-info and validate responses
+    if (store.userInfo.user.uuid !== store.ctx.user.uuid) {
+      console.error('User UUID mismatch between user-info and validate responses')
+      window.location.reload()
+      return false
+    }
     viewState.value = 'profile'
     return true
   } catch {
     store.userInfo = null
+    store.ctx = null
     return false
   }
 }
diff --git a/frontend/auth/admin/AdminApp.vue b/frontend/auth/admin/AdminApp.vue
index 069ac18..0c4f3c0 100644
--- a/frontend/auth/admin/AdminApp.vue
+++ b/frontend/auth/admin/AdminApp.vue
@@ -79,11 +79,11 @@ onUnmounted(() => {
 const permissionSummary = computed(() => {
   const summary = {}
   for (const o of orgs.value) {
-    const orgBase = { uuid: o.uuid, display_name: o.display_name }
-    const orgPerms = new Set(o.permissions || [])
+    const orgBase = { uuid: o.uuid, display_name: o.org.display_name }
+    const orgPerms = new Set(Object.keys(o.permissions))
 
     // Org-level permissions (direct) - only count if org can grant them
-    for (const pid of o.permissions || []) {
+    for (const pid of Object.keys(o.permissions)) {
       if (!summary[pid]) summary[pid] = { orgs: [], orgSet: new Set(), userCount: 0 }
       if (!summary[pid].orgSet.has(o.uuid)) {
         summary[pid].orgs.push(orgBase)
@@ -92,8 +92,8 @@ const permissionSummary = computed(() => {
     }
 
     // Role-based permissions (inheritance) - only count if org can grant them
-    for (const r of o.roles) {
-      for (const pid of r.permissions) {
+    for (const [roleUuid, r] of Object.entries(o.roles)) {
+      for (const pid of Object.keys(r.permissions || {})) {
         // Only count if the org can grant this permission
         if (!orgPerms.has(pid)) continue
 
@@ -102,7 +102,7 @@ const permissionSummary = computed(() => {
           summary[pid].orgs.push(orgBase)
           summary[pid].orgSet.add(o.uuid)
         }
-        summary[pid].userCount += r.users.length
+        summary[pid].userCount += roleUserCount(o, roleUuid)
       }
     }
   }
@@ -129,18 +129,32 @@ function parseHash() {
 
 async function loadOrgs() {
   const data = await apiJson('/auth/api/admin/orgs')
-  orgs.value = data.map(o => {
-    const roles = o.roles.map(r => ({ ...r, org: o.uuid, users: [] }))
-    const roleMap = Object.fromEntries(roles.map(r => [r.display_name, r]))
-    for (const u of o.users || []) {
-      if (roleMap[u.role]) roleMap[u.role].users.push(u)
-    }
-    return { ...o, roles }
-  })
+  orgs.value = Object.entries(data).map(([uuid, o]) => ({ uuid, ...o }))
+}
+
+// Helper to get users for a role as sorted array of [uuid, user]
+function roleUsers(org, roleUuid) {
+  return Object.entries(org.users)
+    .filter(([_, u]) => u.role === roleUuid)
+    .sort(([, a], [, b]) => {
+      const nameA = a.display_name.toLowerCase()
+      const nameB = b.display_name.toLowerCase()
+      return nameA.localeCompare(nameB)
+    })
+}
+
+// Helper to count users in a role
+function roleUserCount(org, roleUuid) {
+  return Object.values(org.users).filter(u => u.role === roleUuid).length
+}
+
+// Helper to count total users in an org
+function orgUserCount(org) {
+  return Object.keys(org.users).length
 }
 
 async function loadPermissions() {
-  permissions.value = await apiJson('/auth/api/admin/permissions')
+  permissions.value = Object.values(await apiJson('/auth/api/admin/permissions'))
 }
 
 async function loadUserInfo() {
@@ -186,7 +200,6 @@ async function load() {
       if (!window.location.hash || window.location.hash === '#overview') {
         currentOrgId.value = orgs.value[0].uuid
         window.location.hash = `#org/${currentOrgId.value}`
-        authStore.showMessage(`Navigating to ${orgs.value[0].display_name} Administration`, 'info', 3000)
       } else {
         parseHash()
       }
@@ -201,7 +214,7 @@ async function load() {
 // Org actions
 function createOrg() { openDialog('org-create', {}) }
 
-function updateOrg(org) { openDialog('org-update', { org, name: org.display_name }) }
+function updateOrg(org) { openDialog('org-update', { org, name: org.org.display_name }) }
 
 function editUserName(user) { openDialog('user-update-name', { user, name: user.display_name }) }
 
@@ -211,13 +224,13 @@ async function performOrgDeletion(orgUuid) {
 }
 
 function deleteOrg(org) {
-  const userCount = org.roles.reduce((acc, r) => acc + r.users.length, 0)
+  const userCount = orgUserCount(org)
 
   if (userCount === 0) {
     // No users in the organization, safe to delete directly
     performOrgDeletion(org.uuid)
       .then(() => {
-        authStore.showMessage(`Organization "${org.display_name}" deleted.`, 'success', 2500)
+        authStore.showMessage(`Organization "${org.org.display_name}" deleted.`, 'success', 2500)
       })
       .catch(e => {
         authStore.showMessage(e.message || 'Failed to delete organization', 'error')
@@ -226,13 +239,14 @@ function deleteOrg(org) {
   }
 
   // Build detailed breakdown of users by role
-  const roleParts = org.roles
-    .filter(r => r.users.length > 0)
-    .map(r => `${r.users.length} ${r.display_name}`)
+  const roleParts = Object.entries(org.roles)
+    .map(([uuid, r]) => [roleUserCount(org, uuid), r.display_name])
+    .filter(([count]) => count > 0)
+    .map(([count, name]) => `${count} ${name}`)
 
   const affects = roleParts.join(', ')
 
-  openDialog('confirm', { message: `Delete organization "${org.display_name}", including accounts of ${affects})?`, action: async () => {
+  openDialog('confirm', { message: `Delete organization "${org.org.display_name}", including accounts of ${affects})?`, action: async () => {
     await performOrgDeletion(org.uuid)
   } })
 }
@@ -240,7 +254,7 @@ function deleteOrg(org) {
 function createUserInRole(org, role) { openDialog('user-create', { org, role }) }
 
 function deleteUser(user, userDetail) {
-  const credentialCount = userDetail?.credentials?.length || 0
+  const credentialCount = Object.keys(userDetail?.credentials || {}).length
   const userUuid = user.uuid
   const userName = user.display_name
   const orgUuid = user.org  // org UUID is stored in selectedUser
@@ -271,10 +285,10 @@ async function performUserDeletion(userUuid, userName, orgUuid) {
   }
 }
 
-async function moveUserToRole(user, targetRoleUuid) {
-  if (user.role_uuid === targetRoleUuid) return
+async function moveUserToRole(userUuid, user, targetRoleUuid) {
+  if (user.role === targetRoleUuid) return
   try {
-    await apiJson(`/auth/api/admin/users/${user.uuid}/role`, {
+    await apiJson(`/auth/api/admin/users/${userUuid}/role`, {
       method: 'PATCH',
       body: { role_uuid: targetRoleUuid }
     })
@@ -284,9 +298,9 @@ async function moveUserToRole(user, targetRoleUuid) {
   }
 }
 
-function onUserDragStart(e, user, org) {
+function onUserDragStart(e, userUuid, org) {
   e.dataTransfer.effectAllowed = 'move'
-  e.dataTransfer.setData('text/plain', JSON.stringify({ user_uuid: user.uuid, org }))
+  e.dataTransfer.setData('text/plain', JSON.stringify({ user_uuid: userUuid, org }))
 }
 
 function onRoleDragOver(e) {
@@ -294,13 +308,13 @@ function onRoleDragOver(e) {
   e.dataTransfer.dropEffect = 'move'
 }
 
-function onRoleDrop(e, org, role) {
+function onRoleDrop(e, org, roleUuid) {
   e.preventDefault()
   try {
     const data = JSON.parse(e.dataTransfer.getData('text/plain'))
     if (data.org !== org.uuid) return // only within same org
-    const user = org.roles.flatMap(r => r.users).find(u => u.uuid === data.user_uuid)
-    if (user) moveUserToRole(user, role.uuid)
+    const user = org.users[data.user_uuid]
+    if (user) moveUserToRole(data.user_uuid, user, roleUuid)
   } catch (_) { /* ignore */ }
 }
 
@@ -309,9 +323,9 @@ function createRole(org) { openDialog('role-create', { org }) }
 
 function updateRole(role) { openDialog('role-update', { role, name: role.display_name }) }
 
-function deleteRole(role) {
+function deleteRole(roleUuid, role) {
   // UI only allows deleting empty roles, so no confirmation needed
-  apiJson(`/auth/api/admin/roles/${role.uuid}`, { method: 'DELETE' })
+  apiJson(`/auth/api/admin/roles/${roleUuid}`, { method: 'DELETE' })
     .then(() => {
       authStore.showMessage(`Role "${role.display_name}" deleted.`, 'success', 2500)
       loadOrgs()
@@ -321,17 +335,20 @@ function deleteRole(role) {
     })
 }
 
-async function toggleRolePermission(role, pid, checked) {
+async function toggleRolePermission(roleUuid, role, pid, checked) {
   // Optimistic update
-  const prevPermissions = [...role.permissions]
-  const newPermissions = checked
-    ? [...role.permissions, pid]
-    : role.permissions.filter(p => p !== pid)
+  const prevPermissions = { ...(role.permissions || {}) }
+  const newPermissions = { ...(role.permissions || {}) }
+  if (checked) {
+    newPermissions[pid] = true
+  } else {
+    delete newPermissions[pid]
+  }
   role.permissions = newPermissions
 
   try {
     const method = checked ? 'POST' : 'DELETE'
-    await apiJson(`/auth/api/admin/roles/${role.uuid}/permissions/${pid}`, {
+    await apiJson(`/auth/api/admin/roles/${roleUuid}/permissions/${pid}`, {
       method
     })
     await loadOrgs()
@@ -354,8 +371,8 @@ function deletePermission(p) {
   // Count roles that have this permission
   let roleCount = 0
   for (const org of orgs.value) {
-    for (const role of org.roles) {
-      if (role.permissions.includes(p.uuid)) {
+    for (const role of Object.values(org.roles)) {
+      if (p.uuid in (role.permissions || {})) {
         roleCount++
       }
     }
@@ -400,25 +417,19 @@ function openUser(u) {
 const selectedUser = computed(() => {
   if (!currentUserId.value) return null
   for (const o of orgs.value) {
-    for (const r of o.roles) {
-      const u = r.users.find(x => x.uuid === currentUserId.value)
-      if (u) return { ...u, org: o.uuid, role_display_name: r.display_name }
+    const u = o.users[currentUserId.value]
+    if (u) {
+      const role = o.roles[u.role]
+      return { ...u, uuid: currentUserId.value, org: o.uuid, role_display_name: role?.display_name }
     }
   }
   return null
 })
 
-const pageHeading = computed(() => {
-  if (selectedUser.value) return 'Admin: User'
-  if (selectedOrg.value) return 'Admin: Org'
-  return ((authStore.settings?.rp_name) || 'Master') + ' Admin'
-})
-
 // Breadcrumb entries for admin app.
 const breadcrumbEntries = computed(() => {
   const entries = [
-    { label: 'Auth', href: makeUiHref() },
-    { label: 'Admin', href: adminUiPath() }
+    { label: 'My Profile', href: makeUiHref() }
   ]
   // Determine organization for user view if selectedOrg not explicitly chosen.
   let orgForUser = null
@@ -426,8 +437,15 @@ const breadcrumbEntries = computed(() => {
     orgForUser = orgs.value.find(o => o.uuid === selectedUser.value.org) || null
   }
   const orgToShow = selectedOrg.value || orgForUser
-  if (orgToShow) {
-    entries.push({ label: orgToShow.display_name, href: `#org/${orgToShow.uuid}` })
+  if (orgToShow && isOrgAdmin.value && !isMasterAdmin.value) {
+    // For org admins, combine Admin and org name into one link
+    entries.push({ label: `Admin: ${orgToShow.org.display_name}`, href: `#org/${orgToShow.uuid}` })
+  } else {
+    // For master admins or when not showing an org, separate Admin link
+    entries.push({ label: 'Admin', href: isMasterAdmin.value ? adminUiPath() : (orgs.value.length === 1 ? `#org/${orgs.value[0].uuid}` : adminUiPath()) })
+    if (orgToShow) {
+      entries.push({ label: orgToShow.org.display_name, href: `#org/${orgToShow.uuid}` })
+    }
   }
   if (selectedUser.value) {
     entries.push({ label: selectedUser.value.display_name, href: `#user/${selectedUser.value.uuid}` })
@@ -450,13 +468,18 @@ function generateUserRegistrationLink(u) {
 }
 
 async function toggleOrgPermission(org, permId, checked) {
-  // Build next permission list
-  const has = org.permissions.includes(permId)
+  // Build next permission dict
+  const has = permId in org.permissions
   if (checked && has) return
   if (!checked && !has) return
-  const next = checked ? [...org.permissions, permId] : org.permissions.filter(p => p !== permId)
+  const next = { ...org.permissions }
+  if (checked) {
+    next[permId] = true  // Placeholder, real data comes from loadOrgs
+  } else {
+    delete next[permId]
+  }
   // Optimistic update
-  const prev = [...org.permissions]
+  const prev = { ...org.permissions }
   org.permissions = next
   try {
     const params = new URLSearchParams({ permission_uuid: permId })
@@ -760,7 +783,6 @@ async function submitDialog() {
       />
       <section v-else-if="authenticated && (isMasterAdmin || isOrgAdmin)" class="view-root view-root--wide view-admin">
         <header class="view-header">
-          <h1>{{ pageHeading }}</h1>
           <Breadcrumbs ref="breadcrumbsRef" :entries="breadcrumbEntries" @keydown="handleBreadcrumbKeydown" />
         </header>
 
diff --git a/frontend/src/admin/AdminOrgDetail.vue b/frontend/src/admin/AdminOrgDetail.vue
index ef0f48a..84ef703 100644
--- a/frontend/src/admin/AdminOrgDetail.vue
+++ b/frontend/src/admin/AdminOrgDetail.vue
@@ -16,28 +16,47 @@ const permMatrixRef = ref(null)
 const rolesGridRef = ref(null)
 
 const sortedRoles = computed(() => {
-  return [...props.selectedOrg.roles].sort((a, b) => {
-    const nameA = a.display_name.toLowerCase()
-    const nameB = b.display_name.toLowerCase()
-    if (nameA !== nameB) {
-      return nameA.localeCompare(nameB)
-    }
-    return a.uuid.localeCompare(b.uuid)
-  })
+  return Object.entries(props.selectedOrg.roles)
+    .map(([uuid, r]) => ({ uuid, ...r }))
+    .sort((a, b) => {
+      const nameA = a.display_name.toLowerCase()
+      const nameB = b.display_name.toLowerCase()
+      if (nameA !== nameB) {
+        return nameA.localeCompare(nameB)
+      }
+      return a.uuid.localeCompare(b.uuid)
+    })
 })
 
+// Get users for a role as sorted array of { uuid, ...user }
+function roleUsers(roleUuid) {
+  return Object.entries(props.selectedOrg.users)
+    .filter(([_, u]) => u.role === roleUuid)
+    .map(([uuid, u]) => ({ uuid, ...u }))
+    .sort((a, b) => {
+      const nameA = a.display_name.toLowerCase()
+      const nameB = b.display_name.toLowerCase()
+      return nameA.localeCompare(nameB)
+    })
+}
+
+function roleUserCount(roleUuid) {
+  return Object.values(props.selectedOrg.users).filter(u => u.role === roleUuid).length
+}
+
 // Get org's grantable permissions as full permission objects (with UUIDs)
 const orgPermissions = computed(() => {
-  const uuidSet = new Set(props.selectedOrg.permissions || [])
-  return props.permissions.filter(p => uuidSet.has(p.uuid))
+  return Object.entries(props.selectedOrg.permissions)
+    .map(([uuid, p]) => ({ uuid, ...p }))
+    .sort((a, b) => a.scope.localeCompare(b.scope))
 })
 
 function permissionDisplayName(scope) {
   return props.permissions.find(p => p.scope === scope)?.display_name || scope
 }
 
-function toggleRolePermission(role, pid, checked) {
-  emit('toggleRolePermission', role, pid, checked)
+function toggleRolePermission(roleUuid, role, pid, checked) {
+  emit('toggleRolePermission', roleUuid, role, pid, checked)
 }
 
 // Handle org title header keynav
@@ -287,7 +306,7 @@ defineExpose({ focusFirstElement })
 
 <template>
   <h2 class="org-title" ref="orgTitleRef" @keydown="handleTitleKeydown" :title="selectedOrg.uuid">
-    <span class="org-name">{{ selectedOrg.display_name }}</span>
+    <span class="org-name">{{ selectedOrg.org.display_name }}</span>
     <button @click="$emit('updateOrg', selectedOrg)" class="icon-btn" aria-label="Rename organization" title="Rename organization">✏️</button>
   </h2>
 
@@ -317,8 +336,8 @@ defineExpose({ focusFirstElement })
             >
               <input
                 type="checkbox"
-                :checked="r.permissions.includes(p.uuid)"
-                @change="e => toggleRolePermission(r, p.uuid, e.target.checked)"
+                :checked="p.uuid in (r.permissions || {})"
+                @change="e => toggleRolePermission(r.uuid, r, p.uuid, e.target.checked)"
               />
             </div>
             <div class="matrix-cell add-role-cell" />
@@ -333,34 +352,27 @@ defineExpose({ focusFirstElement })
         :key="r.uuid"
         class="role-column"
         @dragover="$emit('onRoleDragOver', $event)"
-        @drop="e => $emit('onRoleDrop', e, selectedOrg, r)"
+        @drop="e => $emit('onRoleDrop', e, selectedOrg, r.uuid)"
       >
         <div class="role-header" @keydown="e => handleRoleHeaderKeydown(e, roleIndex)">
           <strong class="role-name" :title="r.uuid">
             <span>{{ r.display_name }}</span>
             <button @click="$emit('updateRole', r)" class="icon-btn" aria-label="Edit role" title="Edit role">✏️</button>
-            <button v-if="r.users.length === 0" @click="$emit('deleteRole', r)" class="icon-btn delete-icon" aria-label="Delete role" title="Delete role">❌</button>
+            <button v-if="roleUserCount(r.uuid) === 0" @click="$emit('deleteRole', r.uuid, r)" class="icon-btn delete-icon" aria-label="Delete role" title="Delete role">❌</button>
           </strong>
           <div class="role-actions">
             <button @click="$emit('createUserInRole', selectedOrg, r)" class="plus-btn" aria-label="Add user" title="Add user">➕</button>
           </div>
         </div>
-        <template v-if="r.users.length > 0">
+        <template v-if="roleUserCount(r.uuid) > 0">
           <ul class="user-list" @keydown="handleUserListKeydown">
             <li
-              v-for="u in r.users.slice().sort((a, b) => {
-                const nameA = a.display_name.toLowerCase()
-                const nameB = b.display_name.toLowerCase()
-                if (nameA !== nameB) {
-                  return nameA.localeCompare(nameB)
-                }
-                return a.uuid.localeCompare(b.uuid)
-              })"
+              v-for="u in roleUsers(r.uuid)"
               :key="u.uuid"
               class="user-chip"
               tabindex="0"
               draggable="true"
-              @dragstart="e => $emit('onUserDragStart', e, u, selectedOrg.uuid)"
+              @dragstart="e => $emit('onUserDragStart', e, u.uuid, selectedOrg.uuid)"
               @click="$emit('openUser', u)"
               @keydown.enter="$emit('openUser', u)"
               :title="u.uuid"
diff --git a/frontend/src/admin/AdminOverview.vue b/frontend/src/admin/AdminOverview.vue
index b3c4573..aa37b9e 100644
--- a/frontend/src/admin/AdminOverview.vue
+++ b/frontend/src/admin/AdminOverview.vue
@@ -21,7 +21,7 @@ const permActionsRef = ref(null)
 const permTableRef = ref(null)
 
 const sortedOrgs = computed(() => [...props.orgs].sort((a,b)=> {
-  const nameCompare = a.display_name.localeCompare(b.display_name)
+  const nameCompare = a.org.display_name.localeCompare(b.org.display_name)
   return nameCompare !== 0 ? nameCompare : a.uuid.localeCompare(b.uuid)
 }))
 const sortedPermissions = computed(() => [...props.permissions].sort((a,b)=> a.scope.localeCompare(b.scope)))
@@ -35,13 +35,17 @@ function permissionDisplayName(scope) {
 }
 
 function getRoleNames(org) {
-  return org.roles
+  return Object.values(org.roles)
     .slice()
     .sort((a, b) => a.display_name.localeCompare(b.display_name))
     .map(r => r.display_name)
     .join(', ')
 }
 
+function orgUserCount(org) {
+  return Object.keys(org.users).length
+}
+
 // Table navigation for both org and permissions tables
 function handleTableKeydown(event, tableType) {
   if (props.navigationDisabled) return
@@ -265,11 +269,11 @@ defineExpose({ focusFirstElement })
       <tbody>
         <tr v-for="o in sortedOrgs" :key="o.uuid">
           <td>
-            <a href="#org/{{o.uuid}}" @click.prevent="$emit('openOrg', o)">{{ o.display_name }}</a>
+            <a href="#org/{{o.uuid}}" @click.prevent="$emit('openOrg', o)">{{ o.org.display_name }}</a>
             <button v-if="isMasterAdmin || isOrgAdmin" @click="$emit('updateOrg', o)" class="icon-btn edit-org-btn" aria-label="Rename organization" title="Rename organization">✏️</button>
           </td>
           <td class="role-names">{{ getRoleNames(o) }}</td>
-          <td class="center">{{ o.roles.reduce((acc,r)=>acc + r.users.length,0) }}</td>
+          <td class="center">{{ orgUserCount(o) }}</td>
           <td v-if="isMasterAdmin" class="center">
             <button @click="$emit('deleteOrg', o)" class="icon-btn delete-icon" aria-label="Delete organization" title="Delete organization">❌</button>
           </td>
@@ -291,9 +295,9 @@ defineExpose({ focusFirstElement })
             v-for="o in sortedOrgs"
             :key="'head-' + o.uuid"
             class="grid-head org-head"
-            :title="o.display_name"
+            :title="o.org.display_name"
           >
-            <span>{{ o.display_name }}</span>
+            <span>{{ o.org.display_name }}</span>
           </div>
 
           <template v-for="p in sortedPermissions" :key="p.uuid">
@@ -307,7 +311,7 @@ defineExpose({ focusFirstElement })
             >
               <input
                 type="checkbox"
-                :checked="o.permissions.includes(p.uuid)"
+                :checked="p.uuid in o.permissions"
                 @change="e => $emit('toggleOrgPermission', o, p.uuid, e.target.checked)"
               />
             </div>
diff --git a/frontend/src/admin/AdminUserDetail.vue b/frontend/src/admin/AdminUserDetail.vue
index da9ad62..660a2b0 100644
--- a/frontend/src/admin/AdminUserDetail.vue
+++ b/frontend/src/admin/AdminUserDetail.vue
@@ -20,7 +20,6 @@ const props = defineProps({
 const emit = defineEmits(['generateUserRegistrationLink', 'goOverview', 'openOrg', 'onUserNameSaved', 'closeRegModal', 'editUserName', 'refreshUserDetail', 'navigateOut', 'deleteUser'])
 
 const authStore = useAuthStore()
-const terminatingSessions = ref({})
 const hoveredCredentialUuid = ref(null)
 const hoveredSession = ref(null)
 
@@ -45,7 +44,7 @@ function handleEditName() {
 
 async function handleDelete(credential) {
   try {
-    const data = await apiJson(`/auth/api/admin/users/${props.selectedUser.uuid}/credentials/${credential.credential}`, { method: 'DELETE' })
+    const data = await apiJson(`/auth/api/admin/users/${props.selectedUser.uuid}/credentials/${credential.uuid}`, { method: 'DELETE' })
     if (data.status === 'ok') {
       emit('onUserNameSaved') // Reuse to refresh user detail
     } else {
@@ -57,29 +56,15 @@ async function handleDelete(credential) {
 }
 
 async function handleTerminateSession(session) {
-  const sessionId = session?.id
-  if (!sessionId) return
-  terminatingSessions.value = { ...terminatingSessions.value, [sessionId]: true }
+  const credentialUuid = session?.credential
+  if (!credentialUuid) return
   try {
-    const data = await apiJson(`/auth/api/admin/users/${props.selectedUser.uuid}/sessions/${sessionId}`, { method: 'DELETE' })
-    if (data.status === 'ok') {
-      if (data.current_session_terminated) {
-        sessionStorage.clear()
-        location.reload()
-        return
-      }
-      emit('refreshUserDetail') // Refresh without showing rename message
-      authStore.showMessage('Session terminated', 'success', 2500)
-    } else {
-      authStore.showMessage(data.detail || 'Failed to terminate session', 'error')
-    }
+    await apiJson(`/auth/api/admin/users/${props.selectedUser.uuid}/credentials/${credentialUuid}`, { method: 'DELETE' })
+    emit('refreshUserDetail')
+    authStore.showMessage('Credential deleted', 'success', 2500)
   } catch (err) {
-    console.error('Terminate session error', err)
-    authStore.showMessage(err.message || 'Failed to terminate session', 'error')
-  } finally {
-    const next = { ...terminatingSessions.value }
-    delete next[sessionId]
-    terminatingSessions.value = next
+    console.error('Delete credential error', err)
+    authStore.showMessage(err.message || 'Failed to delete credential', 'error')
   }
 }
 
@@ -180,13 +165,13 @@ defineExpose({ focusFirstElement })
     <div ref="userInfoRef" @keydown="handleUserInfoKeydown">
       <UserBasicInfo
         v-if="userDetail && !userDetail.error"
-        :name="userDetail.display_name || selectedUser.display_name"
-        :visits="userDetail.visits"
-        :created-at="userDetail.created_at"
-        :last-seen="userDetail.last_seen"
+        :name="userDetail.user.display_name"
+        :visits="userDetail.user.visits"
+        :created-at="userDetail.user.created_at"
+        :last-seen="userDetail.user.last_seen"
         :loading="loading"
-        :org-display-name="userDetail.org.display_name"
-        :role-name="userDetail.role"
+        :org-display-name="selectedOrg?.org?.display_name"
+        :role-name="selectedUser?.role_display_name"
         :update-endpoint="`/auth/api/admin/users/${selectedUser.uuid}/display-name`"
         @saved="$emit('onUserNameSaved')"
         @edit-name="handleEditName"
@@ -196,7 +181,7 @@ defineExpose({ focusFirstElement })
             class="btn-primary"
             @click="$emit('generateUserRegistrationLink', selectedUser)"
             :disabled="loading"
-          >{{ userDetail?.credentials?.length ? 'Recovery Link' : 'Registration Link' }}</button>
+          >{{ Object.keys(userDetail?.credentials || {}).length ? 'Recovery Link' : 'Registration Link' }}</button>
           <button
             class="btn-danger"
             @click="handleDeleteUser"
@@ -215,11 +200,11 @@ defineExpose({ focusFirstElement })
         <div class="section-body">
           <CredentialList
             ref="credentialListRef"
-            :credentials="userDetail.credentials"
+            :credentials="Object.entries(userDetail.credentials).map(([uuid, c]) => ({ ...c, uuid })).sort((a, b) => new Date(a.created_at) - new Date(b.created_at))"
             :aaguid-info="userDetail.aaguid_info"
             :allow-delete="true"
             :hovered-credential-uuid="hoveredCredentialUuid"
-            :hovered-session-credential-uuid="hoveredSession?.credential"
+            :hovered-session-credential-uuid="hoveredSession?.credential || null"
             :navigation-disabled="hasActiveModal"
             @delete="handleDelete"
             @credential-hover="hoveredCredentialUuid = $event"
@@ -229,8 +214,7 @@ defineExpose({ focusFirstElement })
       </section>
       <SessionList
         ref="sessionListRef"
-        :sessions="userDetail.sessions || []"
-        :terminating-sessions="terminatingSessions"
+        :sessions="userDetail.sessions"
         :hovered-credential-uuid="hoveredCredentialUuid"
         :navigation-disabled="hasActiveModal"
         :empty-message="'This user has no active sessions.'"
@@ -246,7 +230,7 @@ defineExpose({ focusFirstElement })
     <RegistrationLinkModal
       v-if="showRegModal"
       :endpoint="`/auth/api/admin/users/${selectedUser.uuid}/create-link`"
-      :user-name="userDetail?.display_name || selectedUser.display_name"
+      :user-name="userDetail?.user.display_name || selectedUser.display_name"
       @close="$emit('closeRegModal')"
       @copied="onLinkCopied"
     />
diff --git a/frontend/src/components/CredentialList.vue b/frontend/src/components/CredentialList.vue
index 623199d..2cb41cd 100644
--- a/frontend/src/components/CredentialList.vue
+++ b/frontend/src/components/CredentialList.vue
@@ -5,16 +5,16 @@
     <template v-else>
       <div
         v-for="credential in credentials"
-        :key="credential.credential"
+        :key="credential.uuid"
         :class="['credential-item', {
           'current-session': credential.is_current_session && !hoveredCredentialUuid && !hoveredSessionCredentialUuid,
-          'is-hovered': hoveredCredentialUuid === credential.credential,
-          'is-linked-session': hoveredSessionCredentialUuid === credential.credential
+          'is-hovered': hoveredCredentialUuid === credential.uuid,
+          'is-linked-session': hoveredSessionCredentialUuid === credential.uuid
         }]"
         tabindex="-1"
         @mousedown.prevent
         @click.capture="handleCardClick"
-        @focusin="handleCredentialFocus(credential.credential)"
+        @focusin="handleCredentialFocus(credential.uuid)"
         @focusout="handleCredentialBlur($event)"
         @keydown="handleItemKeydown($event, credential)"
       >
@@ -33,8 +33,8 @@
           <h4 class="item-title">{{ getCredentialAuthName(credential) }}</h4>
           <div class="item-actions">
             <span v-if="credential.is_current_session && !hoveredCredentialUuid && !hoveredSessionCredentialUuid" class="badge badge-current">Current</span>
-            <span v-else-if="hoveredCredentialUuid === credential.credential" class="badge badge-current">Selected</span>
-            <span v-else-if="hoveredSessionCredentialUuid === credential.credential" class="badge badge-current">Linked</span>
+            <span v-else-if="hoveredCredentialUuid === credential.uuid" class="badge badge-current">Selected</span>
+            <span v-else-if="hoveredSessionCredentialUuid === credential.uuid" class="badge badge-current">Linked</span>
             <button
               v-if="allowDelete"
               @click="$emit('delete', credential)"
@@ -147,9 +147,9 @@ const getCredentialAuthName = (credential) => {
 const getCredentialAuthIcon = (credential) => {
   const info = props.aaguidInfo?.[credential.aaguid]
   if (!info) return null
-  const isDarkMode = window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches
+  const isDarkMode = document.documentElement.classList.contains('dark')
   const iconKey = isDarkMode ? 'icon_dark' : 'icon_light'
-  return info[iconKey] || null
+  return info[iconKey] || info.icon || null
 }
 </script>
 
diff --git a/frontend/src/components/ProfileView.vue b/frontend/src/components/ProfileView.vue
index b33a1d2..ab84ae8 100644
--- a/frontend/src/components/ProfileView.vue
+++ b/frontend/src/components/ProfileView.vue
@@ -5,7 +5,6 @@
         <ThemeSelector />
       </div>
       <header class="view-header">
-        <h1>User Profile</h1>
         <Breadcrumbs ref="breadcrumbs" :entries="breadcrumbEntries" @keydown="handleBreadcrumbKeydown" />
         <p class="view-lede">Account dashboard for managing credentials and authenticating with other devices.</p>
       </header>
@@ -13,12 +12,12 @@
 
     <section class="section-block section-block--constrained" ref="userInfoSection">
       <UserBasicInfo
-        v-if="authStore.userInfo?.ctx"
+        v-if="authStore.userInfo?.user"
         ref="userBasicInfo"
-        :name="authStore.userInfo.ctx.user.display_name"
-        :visits="authStore.userInfo.visits"
-        :created-at="authStore.userInfo.created_at"
-        :last-seen="authStore.userInfo.last_seen"
+        :name="authStore.userInfo.user.display_name"
+        :visits="authStore.userInfo.user.visits"
+        :created-at="authStore.userInfo.user.created_at"
+        :last-seen="authStore.userInfo.user.last_seen"
         :loading="authStore.isLoading"
         update-endpoint="/auth/api/user/display-name"
         @saved="authStore.loadUserInfo()"
@@ -48,11 +47,11 @@
       <div class="section-body">
         <CredentialList
           ref="credentialList"
-          :credentials="authStore.userInfo?.credentials || []"
+          :credentials="credentials"
           :aaguid-info="authStore.userInfo?.aaguid_info || {}"
           :loading="authStore.isLoading"
           :hovered-credential-uuid="hoveredCredentialUuid"
-          :hovered-session-credential-uuid="hoveredSession?.credential"
+          :hovered-session-credential-uuid="hoveredSessionCredential"
           :navigation-disabled="hasActiveModal"
           allow-delete
           @delete="handleDelete"
@@ -69,12 +68,11 @@
     <SessionList
       ref="sessionList"
       :sessions="sessions"
-      :terminating-sessions="terminatingSessions"
       :hovered-credential-uuid="hoveredCredentialUuid"
       :navigation-disabled="hasActiveModal"
       :section-class="useWideLayout ? '' : 'section-block--constrained'"
       @terminate="terminateSession"
-      @session-hover="hoveredSession = $event"
+      @session-hover="handleSessionHover"
       @navigate-out="handleSessionNavigateOut"
       section-description="You are currently signed in to the following sessions. If you don't recognize something, consider deleting not only the session but the associated passkey you suspect is compromised, as only this terminates all linked sessions and prevents logging in again."
     />
@@ -148,6 +146,7 @@ const newName = ref('')
 const saving = ref(false)
 const hoveredCredentialUuid = ref(null)
 const hoveredSession = ref(null)
+const hoveredSessionCredential = ref(null)
 const showDeviceInfo = ref(false)
 const pairingEntry = ref(null)
 const credentialList = ref(null)
@@ -169,6 +168,11 @@ onMounted(() => {
 
 onUnmounted(() => { if (updateInterval.value) clearInterval(updateInterval.value) })
 
+const handleSessionHover = (session) => {
+  hoveredSession.value = session
+  hoveredSessionCredential.value = session?.credential || null
+}
+
 const addNewCredential = async () => {
   try {
     await passkey.register(null, null, () => {
@@ -302,7 +306,7 @@ const handleLogoutButtonKeydown = (event) => {
 }
 
 const handleDelete = async (credential) => {
-  const credentialId = credential?.credential
+  const credentialId = credential?.uuid
   if (!credentialId) return
   try {
     await authStore.deleteCredential(credentialId)
@@ -312,35 +316,33 @@ const handleDelete = async (credential) => {
 
 const rpName = computed(() => authStore.settings?.rp_name || 'this service')
 const paskiaVersion = computed(() => authStore.settings?.version || '')
+const credentials = computed(() => {
+  const creds = authStore.userInfo?.credentials || {}
+  return Object.entries(creds).map(([uuid, c]) => ({ ...c, uuid })).sort((a, b) => new Date(a.created_at) - new Date(b.created_at))
+})
 const sessions = computed(() => authStore.userInfo?.sessions || [])
 const currentSessionHost = computed(() => {
   const currentSession = sessions.value.find(session => session.is_current)
   return currentSession?.host || 'this host'
 })
-const terminatingSessions = ref({})
 
 const terminateSession = async (session) => {
-  const sessionId = session?.id
-  if (!sessionId) return
-  terminatingSessions.value = { ...terminatingSessions.value, [sessionId]: true }
-  try { await authStore.terminateSession(sessionId) }
-  catch (error) { authStore.showMessage(error.message || 'Failed to terminate session', 'error', 5000) }
-  finally {
-    const next = { ...terminatingSessions.value }
-    delete next[sessionId]
-    terminatingSessions.value = next
+  if (session.is_current) {
+    await logout()
+  } else {
+    try { await authStore.deleteCredential(session.credential) }
+    catch (error) { authStore.showMessage(error.message || 'Failed to delete credential', 'error', 5000) }
   }
 }
 
 const logoutEverywhere = async () => { await authStore.logoutEverywhere() }
 const logout = async () => { await authStore.logout() }
-const openNameDialog = () => { newName.value = authStore.userInfo?.ctx.user.display_name ?? ''; showNameDialog.value = true }
+const openNameDialog = () => { newName.value = authStore.userInfo?.user.display_name ?? ''; showNameDialog.value = true }
 const isAdmin = computed(() => {
-  const perms = authStore.userInfo?.ctx.permissions
-  return perms.includes('auth:admin') || perms.includes('auth:org:admin')
+  const perms = authStore.ctx?.permissions
+  return perms?.includes('auth:admin') || perms?.includes('auth:org:admin')
 })
 const hasMultipleSessions = computed(() => sessions.value.length > 1)
-const credentials = computed(() => authStore.userInfo?.credentials || [])
 const useWideLayout = computed(() => {
   // Check if any single site has more than 8 sessions
   const groups = {}
@@ -356,7 +358,7 @@ const useWideLayout = computed(() => {
 
   return hasLargeSessionGroup || hasManyCredentials
 })
-const breadcrumbEntries = computed(() => { const entries = [{ label: 'Auth', href: makeUiHref() }]; if (isAdmin.value) entries.push({ label: 'Admin', href: adminUiPath() }); return entries })
+const breadcrumbEntries = computed(() => { const entries = [{ label: 'My Profile', href: makeUiHref() }]; if (isAdmin.value) entries.push({ label: 'Admin', href: adminUiPath() }); return entries })
 
 const saveName = async () => {
   const name = newName.value.trim()
diff --git a/frontend/src/components/RegistrationLinkModal.vue b/frontend/src/components/RegistrationLinkModal.vue
index 7599c28..4a1b234 100644
--- a/frontend/src/components/RegistrationLinkModal.vue
+++ b/frontend/src/components/RegistrationLinkModal.vue
@@ -14,6 +14,7 @@
         </p>
 
         <QRCodeDisplay
+          v-if="linkUrl"
           :url="linkUrl"
           :show-link="true"
           @copied="onCopied"
diff --git a/frontend/src/components/SessionList.vue b/frontend/src/components/SessionList.vue
index feeae17..6dc7adc 100644
--- a/frontend/src/components/SessionList.vue
+++ b/frontend/src/components/SessionList.vue
@@ -15,11 +15,11 @@
             </span>
             <div class="session-list">
               <div
-                v-for="session in group.sessions"
-                :key="session.id"
+                v-for="(session, index) in group.sessions"
+                :key="index"
                 :class="['session-item', {
                   'is-current': session.is_current && !hoveredIp && !hoveredCredentialUuid,
-                  'is-hovered': hoveredSession?.id === session.id,
+                  'is-hovered': hoveredSession === session,
                   'is-linked-credential': hoveredCredentialUuid === session.credential
                 }]"
                 tabindex="-1"
@@ -33,14 +33,13 @@
                   <h4 class="item-title">{{ session.user_agent || '—' }}</h4>
                   <div class="item-actions">
                     <span v-if="session.is_current && !hoveredIp && !hoveredCredentialUuid" class="badge badge-current">Current</span>
-                    <span v-else-if="hoveredSession?.id === session.id" class="badge badge-current">Selected</span>
+                    <span v-else-if="hoveredSession === session" class="badge badge-current">Selected</span>
                     <span v-else-if="hoveredCredentialUuid === session.credential" class="badge badge-current">Linked</span>
                     <span v-else-if="!hoveredCredentialUuid && isSameHost(session.ip)" class="badge">Same IP</span>
                     <button
                       @click="$emit('terminate', session)"
                       class="btn-card-delete"
-                      :disabled="isTerminating(session.id)"
-                      :title="isTerminating(session.id) ? 'Terminating...' : 'Terminate session'"
+                      :title="'Delete associated passkey'"
                       tabindex="-1"
                     >❌</button>
                   </div>
@@ -72,7 +71,6 @@ const props = defineProps({
   sessions: { type: Array, default: () => [] },
   emptyMessage: { type: String, default: 'You currently have no other active sessions.' },
   sectionDescription: { type: String, default: "Review where you're signed in and end any sessions you no longer recognize." },
-  terminatingSessions: { type: Object, default: () => ({}) },
   hoveredCredentialUuid: { type: String, default: null },
   navigationDisabled: { type: Boolean, default: false },
   sectionClass: { type: String, default: '' },
@@ -107,8 +105,6 @@ const handleCardClick = (event) => {
   }
 }
 
-const isTerminating = (sessionId) => !!props.terminatingSessions[sessionId]
-
 const handleGroupKeydown = (event, host) => {
   const group = event.currentTarget
   const sessionList = group.querySelector('.session-list')
diff --git a/frontend/src/stores/auth.js b/frontend/src/stores/auth.js
index 26ebeb3..6670aba 100644
--- a/frontend/src/stores/auth.js
+++ b/frontend/src/stores/auth.js
@@ -8,6 +8,7 @@ export const useAuthStore = defineStore('auth', {
   state: () => ({
     // Auth State
     userInfo: null, // Contains the full user info response: {user, credentials, aaguid_info}
+    ctx: null, // Session context from validate
     isLoading: false,
 
     // Settings
@@ -87,7 +88,7 @@ export const useAuthStore = defineStore('auth', {
     async loadUserInfo() {
       try {
         this.userInfo = await apiJson('/auth/api/user-info', { method: 'POST' })
-        updateThemeFromSession(this.userInfo?.ctx)
+        updateThemeFromSession(this.ctx)
         console.log('User info loaded:', this.userInfo)
       } catch (error) {
         // Suppress toast for 401/403 errors - the auth iframe will handle these
diff --git a/paskia/__main__.py b/paskia/__main__.py
index 085894f..4b9d4a4 100644
--- a/paskia/__main__.py
+++ b/paskia/__main__.py
@@ -235,4 +235,4 @@ def main():
 
 
 if __name__ == "__main__":
-    main()
\ No newline at end of file
+    main()
diff --git a/paskia/aaguid/__init__.py b/paskia/aaguid/__init__.py
index 73e4575..352cdb6 100644
--- a/paskia/aaguid/__init__.py
+++ b/paskia/aaguid/__init__.py
@@ -30,4 +30,16 @@ def filter(aaguids: Iterable[UUID]) -> dict[str, dict]:
         Dictionary mapping AAGUID string to authenticator information for only
         the AAGUIDs that the user has and that we have data for
     """
-    return {(s := str(a)): AAGUID[s] for a in aaguids if (s := str(a)) in AAGUID}
+    result = {}
+    for a in aaguids:
+        s = str(a)
+        if s in AAGUID:
+            info = AAGUID[s].copy()
+            # Rename icon_light to icon
+            if "icon_light" in info:
+                info["icon"] = info.pop("icon_light")
+            # If icons are the same, set dark to None to save space
+            if info.get("icon") == info.get("icon_dark"):
+                info["icon_dark"] = None
+            result[s] = info
+    return result
diff --git a/paskia/db/bootstrap.py b/paskia/db/bootstrap.py
index 43513be..ecf9106 100644
--- a/paskia/db/bootstrap.py
+++ b/paskia/db/bootstrap.py
@@ -102,6 +102,7 @@ def bootstrap(
             created_at=now,
             last_seen=None,
             visits=0,
+            theme="",
         )
         admin_user.uuid = user_uuid
         admin_user.store()
diff --git a/paskia/db/migrations.py b/paskia/db/migrations.py
index 570e380..2b7005d 100644
--- a/paskia/db/migrations.py
+++ b/paskia/db/migrations.py
@@ -20,6 +20,12 @@ def migrate_v2(d: dict, *, rp_id: str = "localhost") -> None:
         d["config"] = {"rp_id": rp_id}
 
 
+def migrate_v3(d: dict, **kwargs) -> None:
+    """Ensure all users have visits field."""
+    for user_data in d["users"].values():
+        user_data.setdefault("visits", 0)
+
+
 migrations = sorted(
     [f for n, f in globals().items() if n.startswith("migrate_v")],
     key=lambda f: int(f.__name__.removeprefix("migrate_v")),
diff --git a/paskia/db/structs.py b/paskia/db/structs.py
index c1e981b..8813593 100644
--- a/paskia/db/structs.py
+++ b/paskia/db/structs.py
@@ -194,7 +194,7 @@ class Role(msgspec.Struct, dict=True, omit_defaults=True):
         return role
 
 
-class User(msgspec.Struct, dict=True, omit_defaults=True):
+class User(msgspec.Struct, dict=True, omit_defaults=False, kw_only=True):
     """User data structure.
 
     Mutable fields: display_name, role_uuid, last_seen, visits, theme
@@ -205,9 +205,9 @@ class User(msgspec.Struct, dict=True, omit_defaults=True):
     display_name: str
     role_uuid: UUID = msgspec.field(name="role")
     created_at: datetime
+    visits: int
     last_seen: datetime | None = None
-    visits: int = 0
-    theme: str = ""  # "" or "auto" = OS default, "light", "dark"
+    theme: str = ""
 
     def __post_init__(self):
         if not hasattr(self, "uuid"):
@@ -274,6 +274,9 @@ class User(msgspec.Struct, dict=True, omit_defaults=True):
             display_name=display_name,
             role_uuid=role_uuid,
             created_at=created_at or datetime.now(UTC),
+            last_seen=None,
+            visits=0,
+            theme="",
         )
         user.uuid = uuid7.create(user.created_at)
         return user
diff --git a/paskia/fastapi/admin.py b/paskia/fastapi/admin.py
index 1a2c5b1..4d0fa28 100644
--- a/paskia/fastapi/admin.py
+++ b/paskia/fastapi/admin.py
@@ -21,7 +21,17 @@ from paskia.util import (
     querysafe,
     vitedev,
 )
-from paskia.util.apistructs import ApiPermission, ApiSession, format_datetime
+from paskia.util.apistructs import (
+    ApiAaguidInfo,
+    ApiCreateLinkResponse,
+    ApiOrgResponse,
+    ApiPermission,
+    ApiUser,
+    ApiUserDetail,
+    ApiUserSession,
+    ApiUuidResponse,
+    format_datetime,
+)
 from paskia.util.hostutil import normalize_host
 
 app = FastAPI(docs_url=None, redoc_url=None, openapi_url=None)
@@ -83,34 +93,15 @@ async def admin_list_orgs(request: Request, auth=AUTH_COOKIE):
         orgs = [o for o in orgs if o.uuid == ctx.org.uuid]
 
     def org_to_dict(o):
-        return {
-            "uuid": o.uuid,
-            "display_name": o.display_name,
-            "permissions": {p.uuid for p in o.permissions},
-            "roles": [
-                {
-                    "uuid": r.uuid,
-                    "org": r.org_uuid,
-                    "display_name": r.display_name,
-                    "permissions": list(r.permissions.keys()),
-                }
-                for r in o.roles
-            ],
-            "users": [
-                {
-                    "uuid": u.uuid,
-                    "display_name": u.display_name,
-                    "role": r.display_name,
-                    "role_uuid": u.role_uuid,
-                    "visits": u.visits,
-                    "last_seen": u.last_seen,
-                }
-                for r in o.roles
-                for u in r.users
-            ],
-        }
+        roles = o.roles
+        return ApiOrgResponse(
+            org=o,
+            permissions={p.uuid: p for p in o.permissions},
+            roles={r.uuid: r for r in roles},
+            users={u.uuid: u for r in roles for u in r.users},
+        )
 
-    return MsgspecResponse([org_to_dict(o) for o in orgs])
+    return MsgspecResponse({o.uuid: org_to_dict(o) for o in orgs})
 
 
 @app.post("/orgs")
@@ -129,7 +120,7 @@ async def admin_create_org(
     for perm in permissions:
         db.add_permission_to_org(str(org.uuid), perm, ctx=ctx)
 
-    return {"uuid": str(org.uuid)}
+    return MsgspecResponse(ApiUuidResponse(uuid=str(org.uuid)))
 
 
 @app.patch("/orgs/{org_uuid}")
@@ -278,7 +269,7 @@ async def admin_create_role(
         permissions=permission_uuids,
     )
     db.create_role(role, ctx=ctx)
-    return {"uuid": str(role.uuid)}
+    return MsgspecResponse(ApiUuidResponse(uuid=str(role.uuid)))
 
 
 @app.patch("/roles/{role_uuid}")
@@ -451,7 +442,7 @@ async def admin_create_user(
         role=role_obj.uuid,
     )
     db.create_user(user, ctx=ctx)
-    return {"uuid": str(user.uuid)}
+    return MsgspecResponse(ApiUuidResponse(uuid=str(user.uuid)))
 
 
 @app.patch("/users/{user_uuid}/role")
@@ -538,11 +529,13 @@ async def admin_create_user_registration_link(
         ctx=ctx,
     )
     url = hostutil.reset_link_url(token)
-    return {
-        "url": url,
-        "expires": format_datetime(expiry),
-        "token_type": token_type,
-    }
+    return MsgspecResponse(
+        ApiCreateLinkResponse(
+            url=url,
+            expires=format_datetime(expiry),
+            token_type=token_type,
+        )
+    )
 
 
 @app.get("/users/{user_uuid}")
@@ -553,7 +546,6 @@ async def admin_get_user_detail(
 ):
     try:
         user = db.data().users[user_uuid]
-        role_name = user.role.display_name
     except KeyError:
         raise HTTPException(status_code=404, detail="User not found")
     ctx = await authz.verify(
@@ -568,36 +560,28 @@ async def admin_get_user_detail(
         )
     normalized_host = hostutil.normalize_host(request.headers.get("host"))
 
+    sessions = [
+        ApiUserSession.from_db(
+            s,
+            current_key=auth,
+            normalized_host=normalized_host,
+            expires_delta=EXPIRES,
+        )
+        for s in user.sessions
+    ]
+
     return MsgspecResponse(
-        {
-            "display_name": user.display_name,
-            "org": {"display_name": user.org.display_name},
-            "role": role_name,
-            "visits": user.visits,
-            "created_at": user.created_at,
-            "last_seen": user.last_seen,
-            "credentials": [
-                {
-                    "credential": c.uuid,
-                    "aaguid": c.aaguid,
-                    "created_at": c.created_at,
-                    "last_used": c.last_used,
-                    "last_verified": c.last_verified,
-                    "sign_count": c.sign_count,
-                }
-                for c in user.credentials
-            ],
-            "aaguid_info": aaguid_mod.filter(c.aaguid for c in user.credentials),
-            "sessions": [
-                ApiSession.from_db(
-                    s,
-                    current_key=auth,
-                    normalized_host=normalized_host,
-                    expires_delta=EXPIRES,
-                )
-                for s in user.sessions
-            ],
-        }
+        ApiUserDetail(
+            user=ApiUser.from_db(user),
+            credentials={c.uuid: c for c in user.credentials},
+            aaguid_info={
+                k: ApiAaguidInfo(**v)
+                for k, v in aaguid_mod.filter(
+                    c.aaguid for c in user.credentials
+                ).items()
+            },
+            sessions=sessions,
+        )
     )
 
 
@@ -813,7 +797,7 @@ async def admin_list_permissions(request: Request, auth=AUTH_COOKIE):
         host=request.headers.get("host"),
     )
     perms = db.data().permissions.values() if master_admin(ctx) else ctx.org.permissions
-    return MsgspecResponse([ApiPermission.from_db(p) for p in perms])
+    return MsgspecResponse({p.uuid: ApiPermission.from_db(p) for p in perms})
 
 
 @app.post("/permissions")
diff --git a/paskia/fastapi/api.py b/paskia/fastapi/api.py
index 76f9d36..9eb1805 100644
--- a/paskia/fastapi/api.py
+++ b/paskia/fastapi/api.py
@@ -21,6 +21,7 @@ from paskia.fastapi.response import MsgspecResponse
 from paskia.fastapi.session import AUTH_COOKIE, AUTH_COOKIE_NAME, get_client_ip
 from paskia.globals import passkey as global_passkey
 from paskia.util import hostutil, htmlutil, passphrase, userinfo, vitedev
+from paskia.util.apistructs import ApiSettings, ApiTokenInfo, ApiValidateResponse
 
 bearer_auth = HTTPBearer(auto_error=True)
 
@@ -100,11 +101,11 @@ async def validate_token(
             session.set_session_cookie(response, auth)
             renewed = True
     return MsgspecResponse(
-        {
-            "valid": True,
-            "renewed": renewed,
-            "ctx": userinfo.build_session_context(ctx),
-        }
+        ApiValidateResponse(
+            valid=True,
+            renewed=renewed,
+            ctx=userinfo.build_session_context(ctx),
+        )
     )
 
 
@@ -189,15 +190,17 @@ async def forward_authentication(
 async def get_settings():
     pk = global_passkey.instance
     base_path = hostutil.ui_base_path()
-    return {
-        "rp_id": pk.rp_id,
-        "rp_name": pk.rp_name,
-        "ui_base_path": base_path,
-        "auth_host": hostutil.dedicated_auth_host(),
-        "auth_site_url": hostutil.auth_site_url(),
-        "session_cookie": AUTH_COOKIE_NAME,
-        "version": __version__,
-    }
+    return MsgspecResponse(
+        ApiSettings(
+            rp_id=pk.rp_id,
+            rp_name=pk.rp_name,
+            ui_base_path=base_path,
+            auth_host=hostutil.dedicated_auth_host(),
+            auth_site_url=hostutil.auth_site_url(),
+            session_cookie=AUTH_COOKIE_NAME,
+            version=__version__,
+        )
+    )
 
 
 @app.post("/user-info")
@@ -223,6 +226,7 @@ async def api_user_info(
             auth=auth,
             session_record=ctx.session,
             request_host=request.headers.get("host"),
+            ctx=ctx,
         )
     )
 
@@ -239,10 +243,12 @@ async def token_info(credentials=Depends(bearer_auth)):
         raise HTTPException(401, str(e))
 
     u = reset_token.user
-    return {
-        "token_type": reset_token.token_type,
-        "display_name": u.display_name,
-    }
+    return MsgspecResponse(
+        ApiTokenInfo(
+            token_type=reset_token.token_type,
+            display_name=u.display_name,
+        )
+    )
 
 
 @app.post("/logout")
diff --git a/paskia/fastapi/mainapp.py b/paskia/fastapi/mainapp.py
index c36051a..31f5a05 100644
--- a/paskia/fastapi/mainapp.py
+++ b/paskia/fastapi/mainapp.py
@@ -9,10 +9,10 @@ from fastapi.responses import FileResponse, RedirectResponse
 from fastapi_vue import Frontend
 
 from paskia import globals
+from paskia.__main__ import DEVMODE
 from paskia.db import start_background, stop_background
 from paskia.db.logging import configure_db_logging
 from paskia.fastapi import admin, api, auth_host, ws
-from paskia.__main__ import DEVMODE
 from paskia.fastapi.logging import AccessLogMiddleware, configure_access_logging
 from paskia.fastapi.session import AUTH_COOKIE
 from paskia.util import hostutil, passphrase, vitedev
diff --git a/paskia/fastapi/user.py b/paskia/fastapi/user.py
index 3b93505..0bd3bae 100644
--- a/paskia/fastapi/user.py
+++ b/paskia/fastapi/user.py
@@ -16,8 +16,10 @@ from paskia.authsession import (
     expires,
 )
 from paskia.fastapi import authz, session
+from paskia.fastapi.response import MsgspecResponse
 from paskia.fastapi.session import AUTH_COOKIE
 from paskia.util import hostutil
+from paskia.util.apistructs import ApiCreateLinkResponse
 
 app = FastAPI(docs_url=None, redoc_url=None, openapi_url=None)
 
@@ -157,13 +159,15 @@ async def api_create_link(
         ctx=ctx,
     )
     url = hostutil.reset_link_url(token)
-    return {
-        "message": "Registration link generated successfully",
-        "url": url,
-        "expires": (
-            expiry.astimezone(UTC).isoformat().replace("+00:00", "Z")
-            if expiry.tzinfo
-            else expiry.replace(tzinfo=UTC).isoformat().replace("+00:00", "Z")
-        ),
-        "token_type": "device addition",
-    }
+    return MsgspecResponse(
+        ApiCreateLinkResponse(
+            message="Registration link generated successfully",
+            url=url,
+            expires=(
+                expiry.astimezone(UTC).isoformat().replace("+00:00", "Z")
+                if expiry.tzinfo
+                else expiry.replace(tzinfo=UTC).isoformat().replace("+00:00", "Z")
+            ),
+            token_type="device addition",
+        )
+    )
diff --git a/paskia/util/apistructs.py b/paskia/util/apistructs.py
index 5cc31d6..b29efac 100644
--- a/paskia/util/apistructs.py
+++ b/paskia/util/apistructs.py
@@ -1,3 +1,5 @@
+from __future__ import annotations
+
 """API response utilities using msgspec for JSON serialization.
 
 msgspec handles UUID and datetime conversion automatically.
@@ -9,7 +11,7 @@ from uuid import UUID
 
 import msgspec
 
-from paskia.db.structs import Org, Permission, Role, User
+from paskia.db.structs import Credential, Org, Permission, Role, User
 from paskia.util import useragent
 
 
@@ -41,7 +43,7 @@ class ApiUser(User, kw_only=True):
     uuid: UUID
 
     @classmethod
-    def from_db(cls, u: User) -> "ApiUser":
+    def from_db(cls, u: User) -> ApiUser:
         return cls(uuid=u.uuid, **msgspec.structs.asdict(u))
 
 
@@ -51,7 +53,7 @@ class ApiOrg(Org, kw_only=True):
     uuid: UUID
 
     @classmethod
-    def from_db(cls, o: Org) -> "ApiOrg":
+    def from_db(cls, o: Org) -> ApiOrg:
         return cls(uuid=o.uuid, **msgspec.structs.asdict(o))
 
 
@@ -61,28 +63,42 @@ class ApiRole(Role, kw_only=True):
     uuid: UUID
 
     @classmethod
-    def from_db(cls, r: Role) -> "ApiRole":
+    def from_db(cls, r: Role) -> ApiRole:
         return cls(uuid=r.uuid, **msgspec.structs.asdict(r))
 
 
-class ApiPermission(Permission, kw_only=True):
-    """Permission with uuid serialized."""
+class ApiPermission(msgspec.Struct, kw_only=True):
+    """Permission for API responses, without org details."""
 
-    uuid: UUID
+    scope: str
+    display_name: str
+    domain: str | None = None
 
     @classmethod
-    def from_db(cls, p: Permission) -> "ApiPermission":
-        return cls(uuid=p.uuid, **msgspec.structs.asdict(p))
+    def from_db(cls, p: Permission) -> ApiPermission:
+        return cls(
+            scope=p.scope,
+            display_name=p.display_name,
+            domain=p.domain,
+        )
 
 
-class ApiSession(msgspec.Struct):
-    """Session for API responses with computed fields."""
+class ApiAaguidInfo(msgspec.Struct, kw_only=True, omit_defaults=True):
+    """AAGUID information for authenticators."""
+
+    name: str
+    icon: str | None = None
+    icon_dark: str | None = None
+
+
+class ApiUserSession(msgspec.Struct):
+    """Session for user info responses with computed fields."""
 
-    id: str
     credential_uuid: UUID = msgspec.field(name="credential")
     host: str
     ip: str
     user_agent: str
+    expiry: datetime
     last_renewed: datetime
     is_current: bool = False
     is_current_host: bool = False
@@ -95,16 +111,113 @@ class ApiSession(msgspec.Struct):
         current_key: str,
         normalized_host: str | None,
         expires_delta,  # timedelta
-    ) -> "ApiSession":
+    ) -> ApiUserSession:
         return cls(
-            id=s.key,
             credential_uuid=s.credential_uuid,
             host=s.host,
             ip=s.ip,
             user_agent=useragent.compact_user_agent(s.user_agent),
+            expiry=s.expiry,
             last_renewed=s.expiry - expires_delta,
             is_current=s.key == current_key,
             is_current_host=bool(
                 normalized_host and s.host and s.host == normalized_host
             ),
         )
+
+
+class ApiUserDetail(msgspec.Struct, kw_only=True):
+    """User detail response with credentials and sessions."""
+
+    user: ApiUser
+    credentials: dict[UUID, Credential]
+    aaguid_info: dict[str, ApiAaguidInfo]
+    sessions: list[ApiUserSession]
+    permissions: dict[UUID, ApiPermission] = {}
+
+
+# -------------------------------------------------------------------------
+# Nested API structs for org response - without uuid
+# -------------------------------------------------------------------------
+
+
+class ApiOrgResponse(msgspec.Struct, kw_only=True):
+    """Org response containing Org with roles and users as UUID-keyed dicts."""
+
+    org: Org
+    permissions: dict[UUID, Permission]
+    roles: dict[UUID, Role]
+    users: dict[UUID, User]
+
+
+class ApiSettings(msgspec.Struct):
+    """Settings response struct."""
+
+    rp_id: str
+    rp_name: str
+    ui_base_path: str
+    auth_host: str | None
+    auth_site_url: str
+    session_cookie: str
+    version: str
+
+
+class ApiTokenInfo(msgspec.Struct):
+    """Token info response struct."""
+
+    token_type: str
+    display_name: str
+
+
+class ApiUuidResponse(msgspec.Struct):
+    """Response struct for creation endpoints returning a UUID."""
+
+    uuid: str
+
+
+class ApiCreateLinkResponse(msgspec.Struct):
+    """Response struct for create-link endpoints."""
+
+    url: str
+    expires: str
+    token_type: str
+    message: str | None = None
+
+
+class ApiUserContext(msgspec.Struct, omit_defaults=True):
+    """User context for session validation."""
+
+    uuid: str
+    display_name: str
+    theme: str = ""
+
+
+class ApiOrgContext(msgspec.Struct):
+    """Org context for session validation."""
+
+    uuid: str
+    display_name: str
+
+
+class ApiRoleContext(msgspec.Struct):
+    """Role context for session validation."""
+
+    uuid: str
+    display_name: str
+
+
+class ApiSessionContext(msgspec.Struct):
+    """Session context struct."""
+
+    user: ApiUserContext
+    org: ApiOrgContext
+    role: ApiRoleContext
+    permissions: list[str]
+
+
+class ApiValidateResponse(msgspec.Struct):
+    """Response struct for validate endpoint."""
+
+    valid: bool
+    renewed: bool
+    ctx: ApiSessionContext
diff --git a/paskia/util/userinfo.py b/paskia/util/userinfo.py
index 39fe2db..11fa986 100644
--- a/paskia/util/userinfo.py
+++ b/paskia/util/userinfo.py
@@ -3,21 +3,35 @@
 from paskia import aaguid, db
 from paskia.authsession import EXPIRES
 from paskia.db import SessionContext
-from paskia.util import hostutil, permutil
-from paskia.util.apistructs import ApiSession
+from paskia.util import hostutil
+from paskia.util.apistructs import (
+    ApiAaguidInfo,
+    ApiOrgContext,
+    ApiPermission,
+    ApiRoleContext,
+    ApiSessionContext,
+    ApiUser,
+    ApiUserContext,
+    ApiUserDetail,
+    ApiUserSession,
+)
 
 
-def build_session_context(ctx: SessionContext) -> dict:
-    """Build session context dict from SessionContext."""
-    result = {
-        "user": {"uuid": ctx.user.uuid, "display_name": ctx.user.display_name},
-        "org": {"uuid": ctx.org.uuid, "display_name": ctx.org.display_name},
-        "role": {"uuid": ctx.role.uuid, "display_name": ctx.role.display_name},
-        "permissions": [p.scope for p in ctx.permissions],
-    }
-    if ctx.user.theme:
-        result["user"]["theme"] = ctx.user.theme
-    return result
+def build_session_context(ctx: SessionContext) -> ApiSessionContext:
+    """Build session context struct from SessionContext."""
+    user = ApiUserContext(
+        uuid=ctx.user.uuid,
+        display_name=ctx.user.display_name,
+        theme=ctx.user.theme,
+    )
+    org = ApiOrgContext(uuid=ctx.org.uuid, display_name=ctx.org.display_name)
+    role = ApiRoleContext(uuid=ctx.role.uuid, display_name=ctx.role.display_name)
+    return ApiSessionContext(
+        user=user,
+        org=org,
+        role=role,
+        permissions=[p.scope for p in ctx.permissions],
+    )
 
 
 async def build_user_info(
@@ -26,38 +40,31 @@ async def build_user_info(
     auth: str,
     session_record,
     request_host: str | None,
-) -> dict:
-    """Build user info dict for authenticated users."""
-    ctx = await permutil.session_context(auth, request_host)
+    ctx: SessionContext | None = None,
+) -> ApiUserDetail:
+    """Build user info struct for authenticated users."""
     user = db.data().users[user_uuid]
     normalized_host = hostutil.normalize_host(request_host)
 
-    credentials = sorted(user.credentials, key=lambda c: c.created_at)
-    return {
-        "ctx": build_session_context(ctx),
-        "created_at": ctx.user.created_at,
-        "last_seen": ctx.user.last_seen,
-        "visits": ctx.user.visits,
-        "credentials": [
-            {
-                "credential": c.uuid,
-                "aaguid": c.aaguid,
-                "created_at": c.created_at,
-                "last_used": c.last_used,
-                "last_verified": c.last_verified,
-                "sign_count": c.sign_count,
-                "is_current_session": session_record.credential == c.uuid,
-            }
-            for c in credentials
-        ],
-        "aaguid_info": aaguid.filter(c.aaguid for c in credentials),
-        "sessions": [
-            ApiSession.from_db(
-                s,
-                current_key=auth,
-                normalized_host=normalized_host,
-                expires_delta=EXPIRES,
-            )
-            for s in user.sessions
-        ],
-    }
+    sessions = [
+        ApiUserSession.from_db(
+            s,
+            current_key=auth,
+            normalized_host=normalized_host,
+            expires_delta=EXPIRES,
+        )
+        for s in user.sessions
+    ]
+
+    return ApiUserDetail(
+        user=ApiUser.from_db(user),
+        credentials={c.uuid: c for c in user.credentials},
+        aaguid_info={
+            k: ApiAaguidInfo(**v)
+            for k, v in aaguid.filter(c.aaguid for c in user.credentials).items()
+        },
+        sessions=sessions,
+        permissions={p.uuid: ApiPermission.from_db(p) for p in ctx.permissions}
+        if ctx
+        else {},
+    )