Logging cleanup, linter.

Fix errors where permission scopes were still expected for indexing.
Large refactoring for better JSONL context. Switched back the urlsafe for session tokens that need to be passed in URLs. Other minor fixes.
2026-01-24 01:08:00 +00:00 · 2026-01-24 00:58:18 +00:00 · 2026-01-24 00:40:32 +00:00 · 2026-01-24 00:08:21 +00:00 · 2026-01-24 00:06:08 +00:00 · 2026-01-23 23:49:11 +00:00
44 changed files with 3809 additions and 2764 deletions
@@ -5,6 +5,7 @@ dist/
 *.lock
 package-lock.json
 paskia.sqlite
 paskia.jsonl
 /paskia/frontend-build
 /paskia/_version.py
 coverage-html/
@@ -1,105 +0,0 @@
 # Paskia API Documentation
 This document lists the HTTP and WebSocket endpoints exposed by the Paskia
 service and how they behave depending on whether a dedicated authentication host
 (`--auth-host` / environment `PASSKEY_AUTH_HOST`) is configured.
 ## Base Paths & Host Modes
 Two deployment modes:
 1. Multi‑host (default – no `--auth-host` provided)
   - All endpoints are reachable on any host under the `/auth/` prefix.
   - A convenience root (`/`) also serves the main app.
 2. Dedicated auth host (`--auth-host auth.example.com`)
   - The specified auth host serves the UI at the root (`/`, `/admin/`, reset tokens, etc.).
   - Other (non‑auth) hosts show a lightweight account summary at `/` or `/auth/`, while other UI routes still redirect to the auth host.
   - Restricted endpoints on non‑auth hosts return `404` instead of redirecting.
 ### Path Mapping When Auth Host Enabled
 | Purpose | On Auth Host | On Other Hosts (incoming) | Action |
 |---------|--------------|---------------------------|--------|
 | Main UI | `/` | `/auth/` or `/` | Serve account summary SPA (no redirect) |
 | Admin UI root | `/admin/` | `/auth/admin/` or `/admin/` | Redirect -> auth host `/admin/` (strip `/auth`) |
 | Reset / device addition token | `/{token}` | `/auth/{token}` | Redirect -> auth host `/{token}` (strip `/auth`) |
 | Static assets | `/auth/assets/*` | `/auth/assets/*` | Served directly (no redirect) |
 | Unrestricted API | `/auth/api/...` | `/auth/api/...` | Served directly |
 | Restricted API (admin,user,ws namespaces) | `/auth/api/{admin|user|ws}*` | same path | 404 on non‑auth hosts |
 | WebSocket (register/auth) | `/auth/ws/*` | `/auth/ws/*` | 404 on non‑auth hosts |
 Notes:
 - “Strip `/auth`” means only when the path starts with that exact segment.
 - A reset token is a single path segment validated by server logic; malformed tokens 404.
 - Method and body are preserved for UI redirects (307 Temporary Redirect).
 ## HTTP UI Endpoints
 | Method | Path (multi‑host) | Path (auth host) | Description |
 |--------|-------------------|------------------|-------------|
 | GET | `/auth/` | `/` | Main authentication SPA (non-auth hosts show an account summary view) |
 | GET | `/auth/admin/` | `/admin/` | Admin SPA root |
 | GET | `/auth/{reset_token}` | `/{reset_token}` | Reset / device addition SPA (token validated) |
 ## Core API (Unrestricted – available on all hosts)
 Always under `/auth/api/` (even on auth host):
 | Method | Path | Description |
 |--------|------|-------------|
 | GET | `/auth/restricted/` | Authentication UI for iframe embedding (supports `?mode=login` or `?mode=reauth`) |
 |--------|------|-------------|
 | POST | `/auth/api/validate` | Validate & (conditionally) renew session |
 | GET | `/auth/api/forward` | Auth proxy endpoint for reverse proxies (204 or 4xx) |
 | POST | `/auth/api/set-session` | Set cookie from Bearer token |
 | POST | `/auth/api/logout` | Logout current session |
 | POST | `/auth/api/user-info` | Authenticated user + context info (also handles reset tokens) |
 | POST | `/auth/api/create-link` | Create a device addition link (reset token) |
 | DELETE | `/auth/api/credential/{uuid}` | Delete user credential |
 | DELETE | `/auth/api/session/{session_id}` | Terminate a specific session |
 | POST | `/auth/api/user/logout-all` | Terminate all sessions for the user |
 | PUT | `/auth/api/user/display-name` | Update display name |
 ## Restricted API Namespaces
 When `--auth-host` is set, requests to these paths on non‑auth hosts return 404:
 | Namespace | Examples |
 |-----------|----------|
 | `/auth/api/admin` | `/auth/api/admin/orgs`, `/auth/api/admin/orgs/{uuid}` ... |
 | `/auth/api/user` | Segment prefix – includes `/auth/api/user/...` endpoints (logout-all, display-name, session, credential) |
 | `/auth/api/ws` | (Reserved / future) |
 ## WebSockets (Passkey)
 | Path | Description | Host Mode Behavior |
 |------|-------------|--------------------|
 | `/auth/ws/register` | Register new credential (new or existing user) | 404 on non‑auth hosts when auth host configured |
 | `/auth/ws/authenticate` | Authenticate user & issue session | 404 on non‑auth hosts when auth host configured |
 ## Redirection & Status Codes
 | Scenario | Response |
 |----------|----------|
 | UI path on non‑auth host (auth host configured) | 307 redirect to auth host; `/auth` prefix stripped |
 | Reset token UI path on non‑auth host | 307 redirect (token preserved) |
 | Restricted API on non‑auth host | 404 |
 | Unrestricted API on any host | Normal response |
 | No auth host configured | All hosts behave like multi-host mode (no redirects; everything accessible) |
 ## Headers for /auth/api/forward
 See `Headers.md` for details of headers returned on success (204).
 ## Notes for Integrators
 1. Always use absolute `/auth/api/...` paths for programmatic requests (they do not move when an auth host is introduced).
 2. Bookmark / deep links to UI should resolve correctly after redirection if users access via a non-auth application host.
 3. Treat 404 from restricted namespaces on non-auth hosts as a signal to direct users to the central auth site.
 ## Environment & CLI Summary
 | Option | Effect |
 |--------|--------|
 | `--auth-host` / `PASSKEY_AUTH_HOST` | Enables dedicated host mode, root-mounts UI there, restricts certain namespaces elsewhere |
 ---
 This document reflects current behavior of the middleware-based host routing logic.
@@ -1,64 +0,0 @@
 ## Caddy configuration
 We provide a few Caddy snippets that make the configuration easier, although the `forward_auth` directive of Caddy can be used directly as well. Place the auth folder with the snippets where your Caddyfile is.
 What these snippets do
 - Mount the auth UI at `/auth/` proxying to `:4401` (auth backend)
 - Use the forward-auth interface `/auth/api/forward` to verify the required credentials
 - Render a login page or a permission denied page if needed (without changing URL)
 Your backend may not use authentication at all, or it can make use of the user information passed via `Remote-*` headers by the authentication system, see [Headers.md](Headers.md) for details.
 ### 1) Protect the full site (auth/all)
 Use this when you want “login required everywhere” which is useful to protect some service that doesn't have any authentication of its own:
 ```caddyfile
 localhost {
    import auth/all "" {
        reverse_proxy :3000  # your app
    }
 }
 ```
 The auth/all protects the entire site with a simple directive. Put your normal setup inside the block. In this example we don't require any permissions, only that the user is logged in. Instead of `""` you may specify `perm=myapp:login` or other permissions.
 It is possible to add your own `handle @matcher` blocks prior importing `auth/all` for endpoints that don't require authentication, e.g. to exclude `/favicon.ico`.
 ### 2) Different areas, different permissions (auth/setup, auth/require)
 When you need a more fine-grained control, use the auth/setup and auth/require snippets:
 ```caddyfile
 localhost {
    import auth/setup
    @public path /.well-known/* /favicon.ico
    handle @public {
        root * /var/www/
        file_server
    }
    @reports path /reports
    handle @reports {
        import auth/require perm=myapp:reports
        reverse_proxy :3000
    }
    # Anywhere else, require login only
    handle {
        import auth/require ""
        reverse_proxy :3000
    }
 }
 ```
 Note: We use the `handle @name` approach rather than `handle_path` to prevent the matched path being removed out of upstream URL. Unlike bare directives, these blocks will be tried in sequence and each can contain what you'd typically put in your site definition.
 ---
 ## Override the auth backend URL (AUTH_UPSTREAM)
 By default, the auth service is contacted at localhost port 4401 ("for authentication required"). You can point Caddy to a different by setting the `AUTH_UPSTREAM` environment variable for Caddy.
 If unset, the snippets use `:4401` by default.
@@ -1,17 +0,0 @@
 ## Headers your app receives
 When a request is allowed, the auth service adds these headers before proxying to your app (e.g., the service at `:3000`). Your app can use them for user context and authorization.
 | Header | Meaning | Example |
 |---|---|---|
 | `Remote-User` | Authenticated user UUID | `3f1a2b3c-4d5e-6789-abcd-ef0123456789` |
 | `Remote-Name` | User display name | `Jane Doe` |
 | `Remote-Org` | Organization UUID | `a1b2c3d4-1111-2222-3333-444455556666` |
 | `Remote-Org-Name` | Organization display name | `Acme Inc` |
 | `Remote-Role` | Role UUID | `b2c3d4e5-2222-3333-4444-555566667777` |
 | `Remote-Role-Name` | Role display name | `Administrators` |
 | `Remote-Groups` | Comma‑separated permissions the user has | `myapp:reports,auth:admin` |
 | `Remote-Session-Expires` | Session expiry timestamp (ISO 8601) | `2025-09-25T14:30:00Z` |
 | `Remote-Credential` | Credential UUID backing the session | `c3d4e5f6-3333-4444-5555-666677778888` |
 Note: Any incoming `Remote-*` headers from clients are stripped by our [Caddy configuration](Caddy.md), so that apps can trust these values.
@@ -30,16 +30,9 @@ Install [UV](https://docs.astral.sh/uv/getting-started/installation/) and run:
 uvx paskia serve --rp-id example.com
 ```
-On the first run it downloads the software and prints a registration link for the Admin. If you are going to be connecting `localhost` directly, for testing, leave out the rp-id.
+On the first run it downloads the software and prints a registration link for the Admin.  The server will start up on [localhost:4401](http://localhost:4401) *for authentication required*, serving for `*.example.com`. If you are going to be connecting `localhost` directly, for testing, leave out the rp-id.
-The server will start up on [localhost:4401](http://localhost:4401) "for authentication required", serving for `*.example.com`.
+Otherwise you will need a web server such as [Caddy](https://caddyserver.com/) to serve HTTPS on your actual domain names and proxy requests to Paskia and your backend apps (see documentation below).
 Otherwise you will need a web server such as [Caddy](https://caddyserver.com/) to serve HTTPS on your actual domain names and proxy requests to Paskia and your backend apps.
 A quick example without any config file:
 ```fish
 sudo caddy reverse-proxy --from example.com --to :4401
 ```
 For a permanent install of `paskia` CLI command, not needing `uvx`:
@@ -55,18 +48,17 @@ There is no config file. Pass only the options on CLI:
 paskia serve [options]
 ```
-Optional options:
+| Option | Description | Default |
 |--------|-------------|---------|
 | Listen address | One of *host***:***port* (default all hosts, port 4401) or **unix:***path***/paskia.socket** (Unix socket) | **localhost:4401** |
 | --rp-id *domain* | Main/top domain | **localhost** |
 | --rp-name *"text"* | Name of your company or site | Same as rp-id |
 | --origin *url* | Explicitly list the domain names served | **https://**_rp-id_ |
 | --auth-host *domain* | Dedicated authentication site (e.g., **auth.example.com**) | **Unspecified:** we use **/auth/** on **every** site under rp-id.|
- Listen address (one of):
+## Further Documentation
    * `[host]:port`: Address and port (default: `localhost:4401`)
    * `unix:/path.sock`: Unix socket
 - `--rp-id <domain>`: Main domain (required for production)
 - `--rp-name "<text>"`: Name of your company or site (default: same as rp-id)
 - `--origin <url>`: Explicit single site (default: `https://<rp-id>`)
 - `--auth-host <domain>`: Dedicated authentication site (e.g., `auth.example.com`)
-## Documentation
+- [Caddy configuration](https://git.zi.fi/LeoVasanko/paskia/src/branch/main/docs/Caddy.md)
-
+- [Trusted Headers for Backend Apps](https://git.zi.fi/LeoVasanko/paskia/src/branch/main/docs/Headers.md)
- `API.md`: Complete HTTP and WebSocket API reference
+- [Frontend integration](https://git.zi.fi/LeoVasanko/paskia/src/branch/main/docs/Integration.md)
- `Caddy.md`: Caddy configuration examples
+- [Paskia API](https://git.zi.fi/LeoVasanko/paskia/src/branch/main/docs/API.md)
 - `Headers.md`: HTTP headers passed to protected applications
@@ -0,0 +1,64 @@
 # Paskia API
 For integrating Paskia with your app frontend, see [integration](Integration.md).
 ## Web Interface
 | Method | Path | What it is for | Notes |
 |---:|---|---|---|
 | GET | `/auth/` | User profile page | |
 | GET | `/auth/admin/` | Admin panel | Requires auth:admin (master) or org admin permissions. |
 | GET | `/auth/{token}` | Reset / add credential URL (QR code link) | E.g. `/auth/fun.cotton.fresh.xray.lava` |
 ### Public JSON API: `/auth/api/*`
 | Method | Path | Used for | Notes |
 |---:|---|---|---|
 | GET | `/auth/api/settings` | Paskia configuration | Returns RP info + base paths + session cookie name |
 | POST | `/auth/api/user-info` | Full user profile | Basic information, credentials, sessions, permissions |
 | POST | `/auth/api/logout` | Terminate session and delete session cookie | Signs out of the current site |
 | POST | `/auth/api/validate` | Validate and renew session cookie | Optional query: `perm=` (repeatable), `max_age=` |
 | GET | `/auth/api/forward` | Validate access (Caddy/Nginx) | 204 on success; 401/403 otherwise (HTML if requested) |
 The `validate` and `forward` endpoints take query arguments `perm=` and `max_age=` for specific requirements on the validation of the current session.
 ### User JSON API: `/auth/api/user/*`
 | Method | Path | Used for | Notes |
 |---:|---|---|---|
 | PUT | `/auth/api/user/display-name` | Update the user’s display name | Body: JSON `{ "display_name": "..." }` |
 | POST | `/auth/api/user/logout-all` | Terminate all user sessions | Clears current host cookie |
 | DELETE | `/auth/api/user/session/{session_id}` | Terminate one session | Session IDs are server-issued |
 | DELETE | `/auth/api/user/credential/{uuid}` | Delete a credential | Requires recent authentication |
 | POST | `/auth/api/user/create-link` | Create a device-add link | Requires recent authentication |
 These are used mostly from the user profile panel and modify the current user.
 ### Admin API: `/auth/api/admin/*`
 Normally only used via admin panel, requires auth admin permissions and can modify any users, orgs and permissions the session has access to.
 E.g. Org admin cannot see anything of the other orgs that he has no admin access to. Master admin `auth:admin` can see everything and create and manage orgs.
 ### WebSockets: `/auth/ws/*`
 | Path | Used for | Notes |
 |---|---|---|
 | `WS /auth/ws/authenticate` | Passkey authentication | Returns a session token |
 | `WS /auth/ws/register` | Register a new credential | Adding another passkey to current user or via reset token |
 | `WS /auth/ws/remote-auth/request` | Start a cross-device login/registration request | Used from unauthenticated client |
 | `WS /auth/ws/remote-auth/permit` | Approve/deny a pairing code | Used to accept the request, if same words are entered |
 These are for internal use only, but are documented here because they are the core piece in all passkey operations.
 ### Auth host mode (`--auth-host`)
 #### On the auth host:
 - The Web UI is served at site root (e.g. admin UI at `/admin/`), and the `/auth/...` equivalents (e.g. `/auth/admin/`) redirect to the root paths.
 - All of the API stays under `/auth/api/*`
 - Auth WebSockets remain at `/auth/ws/*` but take connections from other hosts to issue sessions for each of those.
 #### On non-auth hosts:
 - `/auth/` shows only minimal profile and allows logging out of the current site
 - `/auth/api/*` is served normally.
 - `/auth/api/user/*`, `/auth/api/admin/*`, and `/auth/ws/*` don't exist.
@@ -0,0 +1,79 @@
 # Paskia Caddy Configuration
 [Caddy](https://caddyserver.com/) is a modern web server that makes setting up web services easy. We provide a few Caddy snippets that make the configuration even easier, although the `forward_auth` directive of Caddy can be used directly as well. Place the [auth folder](../caddy/auth) with the snippets `require` and `setup` where your config file is (e.g. `/etc/caddy/auth`)
 What these snippets do
 - `setup`: Mount the auth UI at `/auth/` proxying to `:4401`
 - `require`: Use `/auth/api/forward` for access control
 - Render a login page or a permission denied page if needed (without changing URL)
 Your backend may not use authentication at all, or it can make use of the user information passed via `Remote-*` headers by the authentication system, see [trusted headers](Headers.md) for details.
 We assume the normal unprotected **Caddyfile** for your site looks like this:
 ```caddyfile
 app.example.com {
    @public path /.well-known/* /favicon.ico
    handle @public {
        root * /var/www/
        file_server
    }
    handle {
        reverse_proxy :3000  # Your app backend
    }
 }
 ```
 Note: We use the `handle @name` approach rather than `handle_path` to keep the path unaltered. Unlike bare directives, these blocks will be tried in sequence and each can contain what you'd typically put in your site definition (by default `reverse_proxy` takes precedence and nothing reaches the static files).
 We will adapt from this to protect your app.
 ### Protect your site (auth/setup, auth/require)
 ```caddyfile
 app.example.com {
    import auth/setup
    @public path /.well-known/* /favicon.ico
    handle @public {
        root * /var/www/
        file_server
    }
    @reports path /reports
    handle @reports {
        import auth/require perm=myapp:reports
        reverse_proxy :3000
    }
    handle {
        import auth/require max-age=12h
        reverse_proxy :3000
    }
 }
 ```
 The above setup allows unauthenticated access to certain files, then implements two different access controls for your backend app depending on which path is accessed. Note that the perm and max-age options may be combined, e.g. `perm=myapp:admin&max-age=5min` on a very sensitive endpoint. This will require additional authentication if the passkey hasn't been used in the last 5 minutes (automatic session renewals don't affect this). Use `""` if you only want the user to be authenticated with no time or perm requirements.
 ### Dedicated Authentication Site
 When you setup a separate subdomain for the authentication site, just add to your config another section for the auth host:
 ```caddyfile
 auth.example.com {
    reverse_proxy :4401
 }
 ```
 Remember to specify `paskia serve --auth-host auth.example.com` to restrict the authentication services to this domain.
 Note that we still reserve `/auth/` on each site for logout page and any APIs your application may require, while full user profile and global options are only available on the auth host.
 Paskia does not require CORS configuration, but it can access the authentication and registration of auth host WS API from the other sites as WebSockets don't require any CORS.
 ### Override the paskia backend address (AUTH_UPSTREAM)
 By default, the auth service is contacted at localhost port 4401. You can point Caddy to a different address by setting the `AUTH_UPSTREAM` environment variable for Caddy.
 If unset, the snippets use `:4401` by default.
@@ -0,0 +1,23 @@
 # Paskia Trusted Headers for Backend Apps
 | HTTP Header | Meaning | Example |
 |---|---|---|
 | `Remote-User` | Authenticated user UUID | **01c03276-b8f0-**… (string) |
 | `Remote-Name` | User display name | **John Doe** |
 | `Remote-Org` | Organization UUID | Identifier for user's org (string) |
 | `Remote-Org-Name` | Organization display name | **The Company Ltd.** |
 | `Remote-Role` | Role UUID | Identifier for user's role (string) |
 | `Remote-Role-Name` | Role display name | **Employee** |
 | `Remote-Groups` | Permissions the user has, comma separated | **auth:admin,yourapp:reports** |
 | `Remote-Session-Expires` | Session expiry timestamp (ISO 8601 UTC) | **2030-12-31T23:59:59Z** |
 | `Remote-Credential` | Credential UUID | Identifier for the sign-in passkey (string) |
 Similar headers are also used by other authentication systems like [Authelia](https://www.authelia.com/integration/trusted-header-sso/introduction/) to signal the backend application information about the signed in user.
 When a request is allowed, the auth service adds these headers by the forward-auth mechanism before proxying to your app as **request headers**. Your app can use them for user context to show on UI, or for its own authentication needs (e.g. prevent different orgs messing up with each other's data, logging which user performed an action).
 Only the UUID values should be used for identification needs, because they never change, even when things are renamed (display names change), and are never reused (created on authentication server). They are UUIDv7 so you can also extract the creation timestamp from them.
 Any `Remote-*` headers from clients are stripped by our [Caddy configuration](Caddy.md) to avoid dealing with any fake headers.
 Note: the headers are intended primarily for the backend, while either frontend or backend (passing the session cookie) can request `/auth/api/user-info` for more complete information, and that is the recommended way to do it in the frontend. See [integration](Integration.md) for more.
@@ -0,0 +1,43 @@
 # Integrating Paskia with your App
 Protect API routes with forward-auth (see [Caddy configuration](Caddy.md)). Optionally protect your app assets and not just the API.
 Catch response status 401/403 in fetch calls to protected endpoints and implement authentication flow in this case. The response is JSON and contains `detail` (an error message describing what is needed) and `auth.iframe` (a URL). Render that URL in an iframe and retry the request after authentication (see below).
 While the app is in (active) use, call `/auth/api/validate` occasionally to keep the session alive (session lifetime is 24h), otherwise the user will have to login every day. Max-age limits are unaffected by this and can be used on endpoints needing to reauthenticate with passkey more frequently.
 Fetch `/auth/api/user-info` to display user/session details, or link to `/auth/` if you prefer using the built-in profile UI and not having to do anything more.
 ## Authentication Flow (iframe)
 ```js
 // Show an authentication dialog
 const iframe = document.createElement('iframe')
 iframe.src = auth.url   // from 401/403 response JSON
 iframe.style.cssText = `
  position: fixed;
  inset: 0;
  width: 100%;
  height: 100%;
  border: 0;
  z-index: 9999;
  background: transparent;
  backdrop-filter: blur(0.1rem) brightness(0.7);
 `
 document.body.appendChild(iframe)
 // Wait until user is finished with the dialog
 const handler = ev => {
  if (ev.origin !== location.origin) return
  iframe.remove()
  removeEventListener('message', handler)
  if (ev.data?.type === 'auth-success') retry_original_fetch()
 }
 addEventListener('message', handler)
 ```
 This describes the frontend flow for handling 401/403 responses from endpoints protected by Paskia forward-auth, without ever exiting your app.
 When a protected request fails, the backend returns 401 (needs auth / reauth) or 403 (missing permission). For API requests, the response is JSON that includes an iframe URL. Your app should render that URL in a full-screen iframe overlay, and retry the request after the iframe reports success. If it reports `auth-cancel`, don't try again. The backdrop for the dialog is a stylistic choice, and you can style the background shown with the dialog any way you wish, and consider using CSS file with the iframe rather than inline styles as used in the example.
 Following this flow the user gets authenticated properly and after that your app keeps running as if nothing ever happened.
@@ -11,9 +11,10 @@ import AdminOrgDetail from '@/admin/AdminOrgDetail.vue'
 import AdminUserDetail from '@/admin/AdminUserDetail.vue'
 import AdminDialogs from '@/admin/AdminDialogs.vue'
 import { useAuthStore } from '@/stores/auth'
-import { getSettings, adminUiPath, makeUiHref } from '@/utils/settings'
+import { adminUiPath, makeUiHref } from '@/utils/settings'
 import { apiJson } from '@/utils/api'
 import { getDirection } from '@/utils/keynav'
 import { goBack } from '@/utils/helpers'
 const info = ref(null)
 const loading = ref(true)
@@ -46,6 +47,10 @@ const adminUserDetailRef = ref(null)
 // Check if any modal/dialog is open (blocks arrow key navigation)
 const hasActiveModal = computed(() => dialog.value.type !== null || showRegModal.value)
 // Derive admin status from permissions
 const isGlobalAdmin = computed(() => info.value?.permissions?.includes('auth:admin') ?? false)
 const isOrgAdmin = computed(() => info.value?.permissions?.includes('auth:org:admin') ?? false)
 function sanitizeRenameId() { if (renameIdValue.value) renameIdValue.value = renameIdValue.value.replace(safeIdRegex, '') }
 function handleGlobalClick(e) {
@@ -60,8 +65,8 @@ function handleGlobalClick(e) {
 onMounted(async () => {
  document.addEventListener('click', handleGlobalClick)
  window.addEventListener('hashchange', parseHash)
-  const settings = await getSettings()
+  await authStore.loadSettings()
-  if (settings?.rp_name) document.title = settings.rp_name + ' Admin'
+  if (authStore.settings?.rp_name) document.title = authStore.settings.rp_name + ' Admin'
  await load()
 })
@@ -108,7 +113,7 @@ const permissionSummary = computed(() => {
  return display
 })
-function renamePermissionDisplay(p) { openDialog('perm-display', { permission: p, id: p.id, display_name: p.display_name }) }
+function renamePermissionDisplay(p) { openDialog('perm-display', { permission: p, scope: p.scope, display_name: p.display_name, domain: p.domain || '' }) }
 function parseHash() {
@@ -153,7 +158,7 @@ async function load() {
    // If we get here, user has admin access - now fetch user info for display
    await loadUserInfo()
-    if (!info.value.is_global_admin && info.value.is_org_admin && orgs.value.length === 1) {
+    if (!isGlobalAdmin.value && isOrgAdmin.value && orgs.value.length === 1) {
      if (!window.location.hash || window.location.hash === '#overview') {
        currentOrgId.value = orgs.value[0].uuid
        window.location.hash = `#org/${currentOrgId.value}`
@@ -186,7 +191,7 @@ async function performOrgDeletion(orgUuid) {
 }
 function deleteOrg(org) {
-  if (!info.value?.is_global_admin) { authStore.showMessage('Global admin only'); return }
+  if (!isGlobalAdmin.value) { authStore.showMessage('Global admin only'); return }
  const userCount = org.roles.reduce((acc, r) => acc + r.users.length, 0)
@@ -220,7 +225,7 @@ async function moveUserToRole(org, user, targetRoleDisplayName) {
  if (user.role === targetRoleDisplayName) return
  try {
    await apiJson(`/auth/api/admin/orgs/${org.uuid}/users/${user.uuid}/role`, {
-      method: 'PUT',
+      method: 'PATCH',
      body: { role: targetRoleDisplayName }
    })
    await loadOrgs()
@@ -267,19 +272,17 @@ function deleteRole(role) {
 }
 async function toggleRolePermission(role, pid, checked) {
-  // Calculate new permissions array
+  // Optimistic update
  const prevPermissions = [...role.permissions]
  const newPermissions = checked
    ? [...role.permissions, pid]
    : role.permissions.filter(p => p !== pid)
  // Optimistic update
  const prevPermissions = [...role.permissions]
  role.permissions = newPermissions
  try {
-    await apiJson(`/auth/api/admin/orgs/${role.org_uuid}/roles/${role.uuid}`, {
+    const method = checked ? 'POST' : 'DELETE'
-      method: 'PUT',
+    await apiJson(`/auth/api/admin/orgs/${role.org_uuid}/roles/${role.uuid}/permissions/${pid}`, {
-      body: { display_name: role.display_name, permissions: newPermissions }
+      method
    })
    await loadOrgs()
  } catch (e) {
@@ -289,20 +292,20 @@ async function toggleRolePermission(role, pid, checked) {
 }
 // Permission actions
-async function performPermissionDeletion(permissionId) {
+async function performPermissionDeletion(permissionScope) {
-  const params = new URLSearchParams({ permission_id: permissionId })
+  const params = new URLSearchParams({ permission_id: permissionScope })
  await apiJson(`/auth/api/admin/permission?${params.toString()}`, { method: 'DELETE' })
  await loadPermissions()
 }
 function deletePermission(p) {
-  const userCount = permissionSummary.value[p.id]?.userCount || 0
+  const userCount = permissionSummary.value[p.uuid]?.userCount || 0
  // Count roles that have this permission
  let roleCount = 0
  for (const org of orgs.value) {
    for (const role of org.roles) {
-      if (role.permissions.includes(p.id)) {
+      if (role.permissions.includes(p.uuid)) {
        roleCount++
      }
    }
@@ -310,7 +313,7 @@ function deletePermission(p) {
  if (roleCount === 0) {
    // No roles have this permission, safe to delete directly
-    performPermissionDeletion(p.id)
+    performPermissionDeletion(p.scope)
      .then(() => {
        authStore.showMessage(`Permission "${p.display_name}" deleted.`, 'success', 2500)
      })
@@ -326,7 +329,7 @@ function deletePermission(p) {
  const affects = parts.join(', ')
  openDialog('confirm', { message: `Delete permission "${p.display_name}" (${affects})?`, action: async () => {
-    await performPermissionDeletion(p.id)
+    await performPermissionDeletion(p.scope)
  } })
 }
@@ -414,7 +417,7 @@ async function toggleOrgPermission(org, permId, checked) {
    await apiJson(`/auth/api/admin/orgs/${org.uuid}/permission?${params.toString()}`, { method: checked ? 'POST' : 'DELETE' })
    await loadOrgs()
  } catch (e) {
-    authStore.showMessage(e.message || 'Failed to update organization permission')
+    authStore.showMessage(e.message || 'Failed to update organization permission', 'error')
    org.permissions = prev // revert
  }
 }
@@ -559,7 +562,7 @@ async function submitDialog() {
      // Close dialog immediately, then perform async operation
      closeDialog()
-      apiJson(`/auth/api/admin/orgs/${org.uuid}`, { method: 'PUT', body: { display_name: name, permissions: org.permissions } })
+      apiJson(`/auth/api/admin/orgs/${org.uuid}`, { method: 'PATCH', body: { display_name: name } })
        .then(() => {
          authStore.showMessage(`Organization renamed to "${name}".`, 'success', 2500)
          loadOrgs()
@@ -587,7 +590,7 @@ async function submitDialog() {
      // Close dialog immediately, then perform async operation
      closeDialog()
-      apiJson(`/auth/api/admin/orgs/${role.org_uuid}/roles/${role.uuid}`, { method: 'PUT', body: { display_name: name, permissions: role.permissions } })
+      apiJson(`/auth/api/admin/orgs/${role.org_uuid}/roles/${role.uuid}`, { method: 'PATCH', body: { display_name: name } })
        .then(() => {
          authStore.showMessage(`Role renamed to "${name}".`, 'success', 2500)
          loadOrgs()
@@ -615,7 +618,7 @@ async function submitDialog() {
      // Close dialog immediately, then perform async operation
      closeDialog()
-      apiJson(`/auth/api/admin/orgs/${user.org_uuid}/users/${user.uuid}/display-name`, { method: 'PUT', body: { display_name: name } })
+      apiJson(`/auth/api/admin/orgs/${user.org_uuid}/users/${user.uuid}/display-name`, { method: 'PATCH', body: { display_name: name } })
        .then(() => {
          authStore.showMessage(`User renamed to "${name}".`, 'success', 2500)
          onUserNameSaved()
@@ -626,22 +629,25 @@ async function submitDialog() {
      return // Don't call closeDialog() again
    } else if (t === 'perm-display') {
      const { permission } = dialog.value.data
-      const newId = dialog.value.data.id?.trim()
+      const newId = dialog.value.data.scope?.trim()
      const newDisplay = dialog.value.data.display_name?.trim()
      const newDomain = dialog.value.data.domain?.trim() || ''
      if (!newDisplay) throw new Error('Display name required')
-      if (!newId) throw new Error('ID required')
+      if (!newId) throw new Error('Scope required')
      // Close dialog immediately, then perform async operation
      closeDialog()
      const oldDomain = permission.domain || ''
      let apiCall;
-      if (newId !== permission.id) {
+      if (newId !== permission.scope) {
-        // ID changed, use rename endpoint
+        // Scope changed, use rename endpoint (also update domain)
-        apiCall = apiJson('/auth/api/admin/permission/rename', { method: 'POST', body: { old_id: permission.id, new_id: newId, display_name: newDisplay } })
+        apiCall = apiJson('/auth/api/admin/permission/rename', { method: 'POST', body: { old_scope: permission.scope, new_scope: newId, display_name: newDisplay, domain: newDomain } })
-      } else if (newDisplay !== permission.display_name) {
+      } else if (newDisplay !== permission.display_name || newDomain !== oldDomain) {
-        // Only display name changed
+        // Display name or domain changed
-        const params = new URLSearchParams({ permission_id: permission.id, display_name: newDisplay })
+        const params = new URLSearchParams({ permission_id: permission.scope, display_name: newDisplay })
-        apiCall = apiJson(`/auth/api/admin/permission?${params.toString()}`, { method: 'PUT' })
+        if (newDomain) params.set('domain', newDomain)
        apiCall = apiJson(`/auth/api/admin/permission?${params.toString()}`, { method: 'PATCH' })
      } else {
        // No changes
        return
@@ -655,13 +661,15 @@ async function submitDialog() {
        .catch(e => {
          authStore.showMessage(e.message || 'Failed to update permission', 'error')
        })
-      return // Don't call closeDialog() again else if (t === 'perm-create') {
+      return // Don't call closeDialog() again
-      const id = dialog.value.data.id?.trim(); if (!id) throw new Error('ID required')
+    } else if (t === 'perm-create') {
      const scope = dialog.value.data.scope?.trim(); if (!scope) throw new Error('Scope required')
      const display_name = dialog.value.data.display_name?.trim(); if (!display_name) throw new Error('Display name required')
      const domain = dialog.value.data.domain?.trim() || ''
      // Close dialog immediately, then perform async operation
      closeDialog()
-      apiJson('/auth/api/admin/permissions', { method: 'POST', body: { id, display_name } })
+      apiJson('/auth/api/admin/permissions', { method: 'POST', body: { scope, display_name, domain: domain || undefined } })
        .then(() => {
          authStore.showMessage(`Permission "${display_name}" created.`, 'success', 2500)
          loadPermissions()
@@ -671,7 +679,17 @@ async function submitDialog() {
        })
      return // Don't call closeDialog() again
    } else if (t === 'confirm') {
-      const action = dialog.value.data.action; if (action) await action()
+      const action = dialog.value.data.action
      // Close dialog first, then perform action (errors shown via showMessage)
      closeDialog()
      if (action) {
        try {
          await action()
        } catch (e) {
          authStore.showMessage(e.message || 'Action failed', 'error')
        }
      }
      return // Already closed
    }
    closeDialog()
  } catch (e) {
@@ -689,7 +707,19 @@ async function submitDialog() {
        v-else-if="showBackMessage"
        @reload="reloadPage"
      />
-      <section v-else-if="authenticated && (info?.is_global_admin || info?.is_org_admin)" class="view-root view-root--wide view-admin">
+      <!-- Access denied: authenticated but not admin, or error occurred -->
      <div v-else-if="error || (authenticated && !isGlobalAdmin && !isOrgAdmin)" class="access-denied-container">
        <div class="access-denied-content">
          <h2>⛔ Access Denied</h2>
          <p v-if="error" class="error-detail">{{ error }}</p>
          <p v-else class="error-detail">You do not have admin permissions for this application.</p>
          <div class="button-row">
            <button class="btn-secondary" @click="goBack">Back</button>
            <button class="btn-primary" @click="reloadPage">Reload Page</button>
          </div>
        </div>
      </div>
      <section v-else-if="authenticated && (isGlobalAdmin || isOrgAdmin)" class="view-root view-root--wide view-admin">
        <header class="view-header">
          <h1>{{ pageHeading }}</h1>
          <Breadcrumbs ref="breadcrumbsRef" :entries="breadcrumbEntries" @keydown="handleBreadcrumbKeydown" />
@@ -697,10 +727,9 @@ async function submitDialog() {
        <section class="section-block admin-section">
          <div class="section-body admin-section-body">
-            <div v-if="error" class="surface surface--tight error">{{ error }}</div>
+            <div class="admin-panels">
            <div v-else class="admin-panels">
                                  <AdminOverview
-                  v-if="!selectedUser && !selectedOrg && (info.is_global_admin || info.is_org_admin)"
+                  v-if="!selectedUser && !selectedOrg && (isGlobalAdmin || isOrgAdmin)"
                  ref="adminOverviewRef"
                  :info="info"
                  :orgs="orgs"
@@ -763,6 +792,7 @@ async function submitDialog() {
    <AdminDialogs
      :dialog="dialog"
      :permission-id-pattern="PERMISSION_ID_PATTERN"
      :settings="authStore.settings"
      @submit-dialog="submitDialog"
      @close-dialog="closeDialog"
    />
@@ -775,4 +805,9 @@ async function submitDialog() {
 .admin-section { margin-top: var(--space-xl); }
 .admin-section-body { display: flex; flex-direction: column; gap: var(--space-xl); }
 .admin-panels { display: flex; flex-direction: column; gap: var(--space-xl); }
 .access-denied-container { display: flex; flex-direction: column; align-items: center; justify-content: center; min-height: 60vh; padding: 2rem; }
 .access-denied-content { text-align: center; max-width: 480px; }
 .access-denied-content h2 { margin: 0 0 1rem; color: var(--color-heading); font-size: 1.5rem; }
 .access-denied-content .error-detail { margin: 0 0 1.5rem; color: var(--color-text-muted); }
 .access-denied-content .button-row { display: flex; gap: 0.75rem; justify-content: center; }
 </style>
@@ -1,15 +1,18 @@
 <script setup>
 import { computed } from 'vue'
 import Modal from '@/components/Modal.vue'
 import NameEditForm from '@/components/NameEditForm.vue'
 const props = defineProps({
  dialog: Object,
-  PERMISSION_ID_PATTERN: String
+  PERMISSION_ID_PATTERN: String,
  settings: Object
 })
 const emit = defineEmits(['submitDialog', 'closeDialog'])
 const NAME_EDIT_TYPES = new Set(['org-update', 'role-update', 'user-update-name'])
 const rpId = computed(() => props.settings?.rp_id || 'the configured domain')
 </script>
 <template>
@@ -72,10 +75,14 @@ const NAME_EDIT_TYPES = new Set(['org-update', 'role-update', 'user-update-name'
          <label>Display Name
            <input ref="displayNameInput" v-model="dialog.data.display_name" required />
          </label>
-          <label>Permission ID
+          <label>Permission Scope
-            <input v-model="dialog.data.id" :placeholder="dialog.type === 'perm-create' ? 'yourapp:permission' : dialog.data.permission.id" required :pattern="PERMISSION_ID_PATTERN" title="Allowed: A-Za-z0-9:._~-" data-form-type="other" />
+            <input v-model="dialog.data.scope" :placeholder="dialog.type === 'perm-create' ? 'yourapp:permission' : dialog.data.permission.scope" required :pattern="PERMISSION_ID_PATTERN" title="Allowed: A-Za-z0-9:._~-" data-form-type="other" />
          </label>
-          <p class="small muted">The permission ID is used for permission checks in the application. Changing it may break deployed applications that reference this permission.</p>
+          <p class="small muted">E.g. yourapp:reports. Changing the scope name may break deployed applications.</p>
          <label>Domain Scope
            <input v-model="dialog.data.domain" placeholder="e.g. app.example.com" data-form-type="other" />
          </label>
          <p class="small muted">If set, this permission is effective only on the specified domain, which can be {{ rpId }} or its subdomain.</p>
        </template>
        <template v-else-if="dialog.type==='confirm'">
          <p>{{ dialog.data.message }}</p>
@@ -106,4 +113,5 @@ const NAME_EDIT_TYPES = new Set(['org-update', 'role-update', 'user-update-name'
 .error { color: var(--color-danger-text); }
 .small { font-size: 0.9rem; }
 .muted { color: var(--color-text-muted); }
 .optional { font-weight: normal; color: var(--color-text-muted); font-size: 0.85em; }
 </style>
@@ -26,8 +26,14 @@ const sortedRoles = computed(() => {
  })
 })
-function permissionDisplayName(id) {
+// Get org's grantable permissions as full permission objects (with UUIDs)
-  return props.permissions.find(p => p.id === id)?.display_name || id
+const orgPermissions = computed(() => {
  const uuidSet = new Set(props.selectedOrg.permissions || [])
  return props.permissions.filter(p => uuidSet.has(p.uuid))
 })
 function permissionDisplayName(scope) {
  return props.permissions.find(p => p.scope === scope)?.display_name || scope
 }
 function toggleRolePermission(role, pid, checked) {
@@ -302,17 +308,17 @@ defineExpose({ focusFirstElement })
          </div>
          <div class="grid-head role-head add-role-head" title="Add role" @click="$emit('createRole', selectedOrg)" role="button" tabindex="0" @keydown.enter="$emit('createRole', selectedOrg)">➕</div>
-          <template v-for="pid in selectedOrg.permissions" :key="pid">
+          <template v-for="p in orgPermissions" :key="p.uuid">
-            <div class="perm-name" :title="pid">{{ permissionDisplayName(pid) }}</div>
+            <div class="perm-name" :title="p.scope">{{ p.display_name }}</div>
            <div
              v-for="r in sortedRoles"
-              :key="r.uuid + '-' + pid"
+              :key="r.uuid + '-' + p.uuid"
              class="matrix-cell"
            >
              <input
                type="checkbox"
-                :checked="r.permissions.includes(pid)"
+                :checked="r.permissions.includes(p.uuid)"
-                @change="e => toggleRolePermission(r, pid, e.target.checked)"
+                @change="e => toggleRolePermission(r, p.uuid, e.target.checked)"
              />
            </div>
            <div class="matrix-cell add-role-cell" />
@@ -24,10 +24,14 @@ const sortedOrgs = computed(() => [...props.orgs].sort((a,b)=> {
  const nameCompare = a.display_name.localeCompare(b.display_name)
  return nameCompare !== 0 ? nameCompare : a.uuid.localeCompare(b.uuid)
 }))
-const sortedPermissions = computed(() => [...props.permissions].sort((a,b)=> a.id.localeCompare(b.id)))
+const sortedPermissions = computed(() => [...props.permissions].sort((a,b)=> a.scope.localeCompare(b.scope)))
-function permissionDisplayName(id) {
+// Derive admin status from permissions
-  return props.permissions.find(p => p.id === id)?.display_name || id
+const isGlobalAdmin = computed(() => props.info?.permissions?.includes('auth:admin') ?? false)
 const isOrgAdmin = computed(() => props.info?.permissions?.includes('auth:org:admin') ?? false)
 function permissionDisplayName(scope) {
  return props.permissions.find(p => p.scope === scope)?.display_name || scope
 }
 function getRoleNames(org) {
@@ -89,7 +93,7 @@ function handleTableKeydown(event, tableType) {
  } else if (direction === 'down' && currentIndex === rows.length - 1) {
    // At bottom of org table, navigate to permissions section
    event.preventDefault()
-    if (tableType === 'org' && props.info.is_global_admin) {
+    if (tableType === 'org' && isGlobalAdmin.value) {
      // Navigate to permissions matrix or actions
      if (permMatrixRef.value) {
        const firstCheckbox = permMatrixRef.value.querySelector('input[type="checkbox"]')
@@ -232,7 +236,7 @@ function handlePermActionsKeydown(event) {
 // Focus helper for external navigation
 function focusFirstElement() {
-  if (props.info.is_global_admin) {
+  if (isGlobalAdmin.value) {
    focusPreferred(orgActionsRef.value, { itemSelector: 'button' })
  } else {
    const firstFocusable = orgTableRef.value?.querySelector('tbody tr a, tbody tr button:not([disabled])')
@@ -245,9 +249,9 @@ defineExpose({ focusFirstElement })
 <template>
  <div class="permissions-section" ref="orgSection">
-    <h2>{{ info.is_global_admin ? 'Organizations' : 'Your Organizations' }}</h2>
+    <h2>{{ isGlobalAdmin ? 'Organizations' : 'Your Organizations' }}</h2>
    <div class="actions" ref="orgActionsRef" @keydown="handleOrgActionsKeydown">
-      <button v-if="info.is_global_admin" @click="$emit('createOrg')">+ Create Org</button>
+      <button v-if="isGlobalAdmin" @click="$emit('createOrg')">+ Create Org</button>
    </div>
    <table class="org-table" ref="orgTableRef" @keydown="e => handleTableKeydown(e, 'org')">
      <thead>
@@ -255,18 +259,18 @@ defineExpose({ focusFirstElement })
          <th>Name</th>
          <th>Roles</th>
          <th>Members</th>
-          <th v-if="info.is_global_admin">Actions</th>
+          <th v-if="isGlobalAdmin">Actions</th>
        </tr>
      </thead>
      <tbody>
        <tr v-for="o in sortedOrgs" :key="o.uuid">
          <td>
            <a href="#org/{{o.uuid}}" @click.prevent="$emit('openOrg', o)">{{ o.display_name }}</a>
-            <button v-if="info.is_global_admin || info.is_org_admin" @click="$emit('updateOrg', o)" class="icon-btn edit-org-btn" aria-label="Rename organization" title="Rename organization">✏️</button>
+            <button v-if="isGlobalAdmin || isOrgAdmin" @click="$emit('updateOrg', o)" class="icon-btn edit-org-btn" aria-label="Rename organization" title="Rename organization">✏️</button>
          </td>
          <td class="role-names">{{ getRoleNames(o) }}</td>
          <td class="center">{{ o.roles.reduce((acc,r)=>acc + r.users.length,0) }}</td>
-          <td v-if="info.is_global_admin" class="center">
+          <td v-if="isGlobalAdmin" class="center">
            <button @click="$emit('deleteOrg', o)" class="icon-btn delete-icon" aria-label="Delete organization" title="Delete organization">❌</button>
          </td>
        </tr>
@@ -274,7 +278,7 @@ defineExpose({ focusFirstElement })
    </table>
  </div>
-  <div v-if="info.is_global_admin" class="permissions-section">
+  <div v-if="isGlobalAdmin" class="permissions-section">
    <h2>Permissions</h2>
    <div class="matrix-wrapper" ref="permMatrixRef" @keydown="handleMatrixKeydown">
      <div class="matrix-scroll">
@@ -292,19 +296,19 @@ defineExpose({ focusFirstElement })
            <span>{{ o.display_name }}</span>
          </div>
-          <template v-for="p in sortedPermissions" :key="p.id">
+          <template v-for="p in sortedPermissions" :key="p.uuid">
-            <div class="perm-name" :title="p.id">
+            <div class="perm-name" :title="p.scope">
              <span class="display-text">{{ p.display_name }}</span>
            </div>
            <div
              v-for="o in sortedOrgs"
-              :key="o.uuid + '-' + p.id"
+              :key="o.uuid + '-' + p.uuid"
              class="matrix-cell"
            >
              <input
                type="checkbox"
-                :checked="o.permissions.includes(p.id)"
+                :checked="o.permissions.includes(p.uuid)"
-                @change="e => $emit('toggleOrgPermission', o, p.id, e.target.checked)"
+                @change="e => $emit('toggleOrgPermission', o, p.uuid, e.target.checked)"
              />
            </div>
          </template>
@@ -313,28 +317,30 @@ defineExpose({ focusFirstElement })
      <p class="matrix-hint muted">Toggle which permissions each organization can grant to its members.</p>
    </div>
    <div class="actions" ref="permActionsRef" @keydown="handlePermActionsKeydown">
-      <button v-if="info.is_global_admin" @click="$emit('openDialog', 'perm-create', { display_name: '', id: '' })">+ Create Permission</button>
+      <button v-if="isGlobalAdmin" @click="$emit('openDialog', 'perm-create', { display_name: '', scope: '', domain: '' })">+ Create Permission</button>
    </div>
    <table class="org-table" ref="permTableRef" @keydown="e => handleTableKeydown(e, 'perm')">
        <thead>
          <tr>
            <th scope="col">Permission</th>
            <th scope="col">Domain</th>
            <th scope="col" class="center">Members</th>
            <th scope="col" class="center">Actions</th>
          </tr>
        </thead>
        <tbody>
-          <tr v-for="p in sortedPermissions" :key="p.id">
+          <tr v-for="p in sortedPermissions" :key="p.uuid">
            <td class="perm-name-cell">
              <div class="perm-title">
                <span class="display-text">{{ p.display_name }}</span>
-                <button @click="$emit('renamePermissionDisplay', p)" class="icon-btn edit-display-btn" aria-label="Edit display name" title="Edit display name">✏️</button>
+                <button @click="$emit('renamePermissionDisplay', p)" class="icon-btn edit-display-btn" aria-label="Edit permission" title="Edit permission">✏️</button>
              </div>
              <div class="perm-id-info">
-                <span class="id-text">{{ p.id }}</span>
+                <span class="id-text">{{ p.scope }}</span>
              </div>
            </td>
-            <td class="perm-members center">{{ permissionSummary[p.id]?.userCount || 0 }}</td>
+            <td class="perm-domain">{{ p.domain || '—' }}</td>
            <td class="perm-members center">{{ permissionSummary[p.uuid]?.userCount || 0 }}</td>
            <td class="perm-actions center">
              <button @click="$emit('deletePermission', p)" class="icon-btn delete-icon" aria-label="Delete permission" title="Delete permission">❌</button>
            </td>
@@ -355,7 +361,8 @@ defineExpose({ focusFirstElement })
 .org-table .role-names { max-width: 200px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
 .perm-name-cell { display: flex; flex-direction: column; gap: 0.3rem; }
 .perm-title { font-weight: 600; color: var(--color-heading); }
-.perm-id-info { font-size: 0.8rem; color: var(--color-text-muted); }
+.perm-id-info { font-size: 0.8rem; color: var(--color-text-muted); display: flex; align-items: center; gap: 0.5rem; flex-wrap: wrap; }
 .perm-domain { color: var(--color-text-muted); font-size: 0.9rem; }
 .icon-btn { background: none; border: none; color: var(--color-text-muted); padding: 0.2rem; border-radius: var(--radius-sm); cursor: pointer; transition: background 0.2s ease, color 0.2s ease; }
 .icon-btn:hover { color: var(--color-heading); background: var(--color-surface-muted); }
 .delete-icon { color: var(--color-danger); }
@@ -324,7 +324,10 @@ const terminateSession = async (session) => {
 const logoutEverywhere = async () => { await authStore.logoutEverywhere() }
 const logout = async () => { await authStore.logout() }
 const openNameDialog = () => { newName.value = authStore.userInfo?.user?.user_name || ''; showNameDialog.value = true }
-const isAdmin = computed(() => !!(authStore.userInfo?.is_global_admin || authStore.userInfo?.is_org_admin))
+const isAdmin = computed(() => {
  const perms = authStore.userInfo?.permissions ?? []
  return perms.includes('auth:admin') || perms.includes('auth:org:admin')
 })
 const hasMultipleSessions = computed(() => sessions.value.length > 1)
 const breadcrumbEntries = computed(() => { const entries = [{ label: 'Auth', href: makeUiHref() }]; if (isAdmin.value) entries.push({ label: 'Admin', href: adminUiPath() }); return entries })
@@ -333,7 +336,7 @@ const saveName = async () => {
  if (!name) { authStore.showMessage('Name cannot be empty', 'error'); return }
  try {
    saving.value = true
-    await apiJson('/auth/api/user/display-name', { method: 'PUT', body: { display_name: name } })
+    await apiJson('/auth/api/user/display-name', { method: 'PATCH', body: { display_name: name } })
    showNameDialog.value = false
    await authStore.loadUserInfo()
    authStore.showMessage('Name updated successfully!', 'success', 3000)
@@ -26,16 +26,18 @@ export const useAuthStore = defineStore('auth', {
    setLoading(flag) {
      this.isLoading = !!flag
    },
-    showMessage(message, type = 'info', duration = 3000) {
+    showMessage(message, type = 'info', duration = null) {
      // Default duration: 5 seconds for errors, 3 seconds for others
      const effectiveDuration = duration ?? (type === 'error' ? 5000 : 3000)
      this.status = {
        message,
        type,
        show: true
      }
-      if (duration > 0) {
+      if (effectiveDuration > 0) {
        setTimeout(() => {
          this.status.show = false
-        }, duration)
+        }, effectiveDuration)
      }
    },
    async setSessionCookie(result) {
@@ -11,11 +11,10 @@ independent of any web framework:
 from datetime import datetime, timezone
 from uuid import UUID
 from paskia import db
 from paskia.config import SESSION_LIFETIME
 from paskia.db import ResetToken, Session
 from paskia.globals import db, passkey
 from paskia.util import hostutil
 from paskia.util.tokens import create_token, reset_key, session_key
 EXPIRES = SESSION_LIFETIME
@@ -30,46 +29,10 @@ def reset_expires() -> datetime:
    return datetime.now(timezone.utc) + RESET_LIFETIME
 def session_expiry(session: Session) -> datetime:
    """Calculate the expiration timestamp for a session (UTC aware)."""
    # After migration all renewed timestamps are timezone-aware UTC
    return session.renewed + EXPIRES
 async def create_session(
    user_uuid: UUID,
    credential_uuid: UUID,
    *,
    host: str,
    ip: str,
    user_agent: str,
 ) -> str:
    """Create a new session and return a session token."""
    normalized_host = hostutil.normalize_host(host)
    if not normalized_host:
        raise ValueError("Host required for session creation")
    hostname = normalized_host.split(":")[0]  # Domain names only, IPs aren't supported
    rp_id = passkey.instance.rp_id
    if not (hostname == rp_id or hostname.endswith(f".{rp_id}")):
        raise ValueError(f"Host must be the same as or a subdomain of {rp_id}")
    token = create_token()
    now = datetime.now(timezone.utc)
    await db.instance.create_session(
        user_uuid=user_uuid,
        credential_uuid=credential_uuid,
        key=session_key(token),
        host=normalized_host,
        ip=ip,
        user_agent=user_agent,
        renewed=now,
    )
    return token
 async def get_reset(token: str) -> ResetToken:
-    """Validate a credential reset token. Returns None if the token is not well formed (i.e. it is another type of token)."""
+    """Validate a credential reset token."""
-    record = await db.instance.get_reset_token(reset_key(token))
+    record = db.get_reset_token(token)
-    if record and record.expiry >= datetime.now(timezone.utc):
+    if record:
        return record
    raise ValueError("This authentication link is no longer valid.")
@@ -79,11 +42,11 @@ async def get_session(token: str, host: str | None = None) -> Session:
    host = hostutil.normalize_host(host)
    if not host:
        raise ValueError("Invalid host")
-    session = await db.instance.get_session(session_key(token))
+    session = db.get_session(token)
-    if session and session_expiry(session) >= datetime.now(timezone.utc):
+    if session:
        if session.host is None:
            # First time binding: store exact host:port (or IPv6 form) now.
-            await db.instance.set_session_host(session.key, host)
+            db.set_session_host(session.key, host)
            session.host = host
        elif session.host != host:
            raise ValueError("Session host mismatch")
@@ -93,14 +56,14 @@ async def get_session(token: str, host: str | None = None) -> Session:
 async def refresh_session_token(token: str, *, ip: str, user_agent: str):
    """Refresh a session extending its expiry."""
-    session_record = await db.instance.get_session(session_key(token))
+    session_record = db.get_session(token)
    if not session_record:
        raise ValueError("Session not found or expired")
-    updated = await db.instance.update_session(
+    updated = db.update_session(
-        session_key(token),
+        token,
        ip=ip,
        user_agent=user_agent,
-        renewed=datetime.now(timezone.utc),
+        expiry=expires(),
    )
    if not updated:
        raise ValueError("Session not found or expired")
@@ -109,4 +72,4 @@ async def refresh_session_token(token: str, *, ip: str, user_agent: str):
 async def delete_credential(credential_uuid: UUID, auth: str, host: str | None = None):
    """Delete a specific credential for the current user."""
    s = await get_session(auth, host=host)
-    await db.instance.delete_credential(credential_uuid, s.user_uuid)
+    db.delete_credential(credential_uuid, s.user_uuid)
@@ -12,9 +12,9 @@ from datetime import datetime, timezone
 import uuid7
-from paskia import authsession, globals
+from paskia import authsession, db
 from paskia.db import Org, Permission, Role, User
-from paskia.util import hostutil, passphrase, tokens
+from paskia.util import hostutil, passphrase
 def _init_logger() -> logging.Logger:
@@ -42,9 +42,9 @@ async def _create_and_log_admin_reset_link(user_uuid, message, session_type) ->
    """Create an admin reset link and log it with the provided message."""
    token = passphrase.generate()
    expiry = authsession.reset_expires()
-    await globals.db.instance.create_reset_token(
+    db.create_reset_token(
        user_uuid=user_uuid,
-        key=tokens.reset_key(token),
+        passphrase=token,
        expiry=expiry,
        token_type=session_type,
    )
@@ -61,25 +61,32 @@ async def bootstrap_system() -> dict:
        dict: Contains information about created entities and reset link
    """
    # Create permission first - will fail if already exists
-    perm0 = Permission(id="auth:admin", display_name="Master Admin")
+    perm0 = Permission(
-    await globals.db.instance.create_permission(perm0)
+        uuid=uuid7.create(), scope="auth:admin", display_name="Master Admin"
    )
    db.create_permission(perm0)
    # Create org admin permission - allows managing users within an org
    perm_org_admin = Permission(
        uuid=uuid7.create(), scope="auth:org:admin", display_name="Org Admin"
    )
    db.create_permission(perm_org_admin)
    org = Org(uuid7.create(), "Organization")
-    await globals.db.instance.create_organization(org)
+    db.create_organization(org)
-    # After creation, org.permissions now includes the auto-created org admin permission
+    # Allow this org to grant global admin and org admin permissions
-    # Allow this org to grant global admin explicitly
+    db.add_permission_to_organization(str(org.uuid), perm0.scope)
-    await globals.db.instance.add_permission_to_organization(str(org.uuid), perm0.id)
+    db.add_permission_to_organization(str(org.uuid), perm_org_admin.scope)
    # Create an Administration role granting both org and global admin
    # Compose permissions for Administration role: global admin + org admin auto-perm
    role = Role(
        uuid7.create(),
        org.uuid,
        "Administration",
-        permissions=[perm0.id, *org.permissions],
+        permissions=[perm0.scope, perm_org_admin.scope],
    )
-    await globals.db.instance.create_role(role)
+    db.create_role(role)
    user = User(
        uuid=uuid7.create(),
@@ -88,7 +95,7 @@ async def bootstrap_system() -> dict:
        created_at=datetime.now(timezone.utc),
        visits=0,
    )
-    await globals.db.instance.create_user(user)
+    db.create_user(user)
    # Generate reset link and log it
    reset_link = await _create_and_log_admin_reset_link(
@@ -101,7 +108,11 @@ async def bootstrap_system() -> dict:
        "role": role,
        "permissions": [
            perm0,
-            *[Permission(id=p, display_name="") for p in org.permissions],
+            *[
                db.get_permission_by_scope(p)
                for p in org.permissions
                if db.get_permission_by_scope(p)
            ],
        ],
        "reset_link": reset_link,
    }
@@ -116,17 +127,13 @@ async def check_admin_credentials() -> bool:
    """
    try:
        # Get permission organizations to find admin users
-        permission_orgs = await globals.db.instance.get_permission_organizations(
+        permission_orgs = db.get_permission_organizations("auth:admin")
            "auth:admin"
        )
        if not permission_orgs:
            return False
        # Get users from the first organization with admin permission
-        org_users = await globals.db.instance.get_organization_users(
+        org_users = db.get_organization_users(str(permission_orgs[0].uuid))
            str(permission_orgs[0].uuid)
        )
        admin_users = [user for user, role in org_users if role == "Administration"]
        if not admin_users:
@@ -134,9 +141,7 @@ async def check_admin_credentials() -> bool:
        # Check first admin user for credentials
        admin_user = admin_users[0]
-        credentials = await globals.db.instance.get_credentials_by_user_uuid(
+        credentials = db.get_credentials_by_user_uuid(admin_user.uuid)
            admin_user.uuid
        )
        if not credentials:
            # Admin exists but has no credentials, create reset link
@@ -162,7 +167,7 @@ async def bootstrap_if_needed() -> bool:
    """
    try:
        # Check if the admin permission exists - if it does, system is already bootstrapped
-        await globals.db.instance.get_permission("auth:admin")
+        db.get_permission("auth:admin")
        # Permission exists, system is already bootstrapped
        # Check if admin needs credentials (only for already-bootstrapped systems)
        await check_admin_credentials()
@@ -1,415 +1,177 @@
 """
 Database module for WebAuthn passkey authentication.
-This module provides dataclasses and database abstractions for managing
+Read: Access _db._data directly, use build_* to convert to public structs.
-users, credentials, and sessions in a WebAuthn authentication system.
+CTX: get_session_context(key) returns SessionContext with effective permissions.
 Write: Functions validate and commit, or raise ValueError.
 Usage:
    from paskia import db
    # Read (after init)
    user_data = db._db._data.users[user_uuid]
    user = db.build_user(user_uuid)
    # Context
    ctx = db.get_session_context(session_key)
    # Write
    db.create_user(user)
 """
-from abc import ABC, abstractmethod
+from paskia.db.background import (
-from dataclasses import dataclass, field
+    start_background,
-from datetime import datetime
+    start_cleanup,
-from uuid import UUID
+    stop_background,
-
+    stop_cleanup,
-
+)
-@dataclass
+from paskia.db.operations import (
-class Permission:
+    DB,
-    id: str  # String primary key (max 128 chars)
+    _db,
-    display_name: str
+    add_permission_to_organization,
-
+    add_permission_to_role,
-
+    build_credential,
-@dataclass
+    build_org,
-class Role:
+    build_permission,
-    uuid: UUID
+    build_reset_token,
-    org_uuid: UUID
+    build_role,
-    display_name: str
+    build_session,
-    # List of permission IDs this role grants to its members
+    build_user,
-    permissions: list[str] = field(default_factory=list)  # permission IDs
+    cleanup_expired,
-
+    create_credential,
-
+    create_credential_session,
-@dataclass
+    create_organization,
-class Org:
+    create_permission,
-    uuid: UUID
+    create_reset_token,
-    display_name: str
+    create_role,
-    # All permission IDs that the Org is allowed to grant to its roles
+    create_session,
-    permissions: list[str] = field(default_factory=list)  # permission IDs
+    create_user,
-    # Roles belonging to this org
+    delete_credential,
-    roles: list[Role] = field(default_factory=list)
+    delete_organization,
-
+    delete_permission,
-
+    delete_reset_token,
-@dataclass
+    delete_role,
-class User:
+    delete_session,
-    uuid: UUID
+    delete_sessions_for_user,
-    display_name: str
+    delete_user,
-    role_uuid: UUID
+    get_credential_by_id,
-    created_at: datetime | None = None
+    get_credentials_by_user_uuid,
-    last_seen: datetime | None = None
+    get_organization,
-    visits: int = 0
+    get_organization_users,
-
+    get_permission,
-
+    get_permission_by_scope,
-@dataclass
+    get_permission_organizations,
-class Credential:
+    get_reset_token,
-    uuid: UUID
+    get_role,
-    credential_id: bytes  # Long binary ID passed from the authenticator
+    get_roles_by_organization,
-    user_uuid: UUID
+    get_session,
-    aaguid: UUID
+    get_session_context,
-    public_key: bytes
+    get_user_by_uuid,
-    sign_count: int
+    get_user_organization,
-    created_at: datetime
+    init,
-    last_used: datetime | None = None
+    list_organizations,
-    last_verified: datetime | None = None
+    list_permissions,
-
+    list_sessions_for_user,
-
+    login,
-@dataclass
+    remove_permission_from_organization,
-class Session:
+    remove_permission_from_role,
-    key: bytes
+    rename_permission,
-    user_uuid: UUID
+    set_session_host,
-    credential_uuid: UUID
+    update_credential_sign_count,
-    host: str
+    update_organization_name,
-    ip: str
+    update_permission,
-    user_agent: str
+    update_role_name,
-    renewed: datetime
+    update_session,
-
+    update_user_display_name,
-    def metadata(self) -> dict:
+    update_user_role,
-        """Return session metadata for backwards compatibility."""
+    update_user_role_in_organization,
-        return {
+)
-            "ip": self.ip,
+from paskia.db.structs import (
-            "user_agent": self.user_agent,
+    Credential,
-            "renewed": self.renewed.isoformat(),
+    Org,
-        }
+    Permission,
-
+    ResetToken,
-
+    Role,
-@dataclass
+    Session,
-class ResetToken:
+    SessionContext,
-    key: bytes
+    User,
-    user_uuid: UUID
+)
    expiry: datetime
    token_type: str
@dataclass
 class SessionContext:
    session: Session
    user: User
    org: Org
    role: Role
    credential: Credential | None = None
    permissions: list[Permission] | None = None
 class DatabaseInterface(ABC):
    """Abstract base class defining the database interface.
    This class defines the public API that database implementations should provide.
    Implementations may use decorators like @with_session that modify method signatures
    at runtime, so this interface focuses on the logical operations rather than
    exact parameter matching.
    """
    @abstractmethod
    async def init_db(self) -> None:
        """Initialize database tables."""
        pass
    # User operations
    @abstractmethod
    async def get_user_by_uuid(self, user_uuid: UUID) -> User:
        """Get user record by WebAuthn user UUID."""
    @abstractmethod
    async def create_user(self, user: User) -> None:
        """Create a new user."""
    @abstractmethod
    async def update_user_display_name(
        self, user_uuid: UUID, display_name: str
    ) -> None:
        """Update a user's display name."""
    # Role operations
    @abstractmethod
    async def create_role(self, role: Role) -> None:
        """Create new role."""
    @abstractmethod
    async def update_role(self, role: Role) -> None:
        """Update a role's display name and synchronize its permissions."""
    @abstractmethod
    async def delete_role(self, role_uuid: UUID) -> None:
        """Delete a role by UUID. Implementations may prevent deletion if users exist."""
    # Credential operations
    @abstractmethod
    async def create_credential(self, credential: Credential) -> None:
        """Store a credential for a user."""
    @abstractmethod
    async def get_credential_by_id(self, credential_id: bytes) -> Credential:
        """Get credential by credential ID."""
    @abstractmethod
    async def get_credentials_by_user_uuid(self, user_uuid: UUID) -> list[bytes]:
        """Get all credential IDs for a user."""
    @abstractmethod
    async def update_credential(self, credential: Credential) -> None:
        """Update the sign count, created_at, last_used, and last_verified for a credential."""
    @abstractmethod
    async def delete_credential(self, uuid: UUID, user_uuid: UUID) -> None:
        """Delete a specific credential for a user."""
    # Session operations
    @abstractmethod
    async def create_session(
        self,
        user_uuid: UUID,
        key: bytes,
        credential_uuid: UUID,
        host: str,
        ip: str,
        user_agent: str,
        renewed: datetime,
    ) -> None:
        """Create a new session."""
    @abstractmethod
    async def get_session(self, key: bytes) -> Session | None:
        """Get session by key."""
    @abstractmethod
    async def delete_session(self, key: bytes) -> None:
        """Delete session by key."""
    @abstractmethod
    async def update_session(
        self,
        key: bytes,
        *,
        ip: str,
        user_agent: str,
        renewed: datetime,
    ) -> Session | None:
        """Update session metadata and touch renewed timestamp."""
    @abstractmethod
    async def set_session_host(self, key: bytes, host: str) -> None:
        """Bind a session to a specific host if not already set."""
    @abstractmethod
    async def list_sessions_for_user(self, user_uuid: UUID) -> list[Session]:
        """Return all sessions for a user (including other hosts)."""
    @abstractmethod
    async def cleanup(self) -> None:
        """Called periodically to clean up expired records."""
    @abstractmethod
    async def delete_sessions_for_user(self, user_uuid: UUID) -> None:
        """Delete all sessions belonging to the provided user."""
    # Reset token operations
    @abstractmethod
    async def create_reset_token(
        self,
        user_uuid: UUID,
        key: bytes,
        expiry: datetime,
        token_type: str,
    ) -> None:
        """Create a reset token for a user."""
    @abstractmethod
    async def get_reset_token(self, key: bytes) -> ResetToken | None:
        """Retrieve a reset token by key."""
    @abstractmethod
    async def delete_reset_token(self, key: bytes) -> None:
        """Delete a reset token by key."""
    # Organization operations
    @abstractmethod
    async def create_organization(self, org: Org) -> None:
        """Add a new organization."""
    @abstractmethod
    async def get_organization(self, org_id: str) -> Org:
        """Get organization by ID, including its permission IDs and roles (with their permission IDs)."""
    @abstractmethod
    async def list_organizations(self) -> list[Org]:
        """List all organizations with their roles and permission IDs."""
    @abstractmethod
    async def update_organization(self, org: Org) -> None:
        """Update organization options."""
    @abstractmethod
    async def delete_organization(self, org_uuid: UUID) -> None:
        """Delete organization by ID."""
    @abstractmethod
    async def add_user_to_organization(
        self, user_uuid: UUID, org_id: str, role: str
    ) -> None:
        """Set a user's organization and role."""
    @abstractmethod
    async def transfer_user_to_organization(
        self, user_uuid: UUID, new_org_id: str, new_role: str | None = None
    ) -> None:
        """Transfer a user to another organization with an optional role."""
    @abstractmethod
    async def get_user_organization(self, user_uuid: UUID) -> tuple[Org, str]:
        """Get the organization and role for a user."""
    @abstractmethod
    async def get_organization_users(self, org_id: str) -> list[tuple[User, str]]:
        """Get all users in an organization with their roles."""
    @abstractmethod
    async def get_roles_by_organization(self, org_id: str) -> list[Role]:
        """List roles belonging to an organization."""
    @abstractmethod
    async def get_user_role_in_organization(
        self, user_uuid: UUID, org_id: str
    ) -> str | None:
        """Get a user's role in a specific organization."""
    @abstractmethod
    async def update_user_role_in_organization(
        self, user_uuid: UUID, new_role: str
    ) -> None:
        """Update a user's role in their organization."""
    # Permission operations
    @abstractmethod
    async def create_permission(self, permission: Permission) -> None:
        """Create a new permission."""
    @abstractmethod
    async def get_permission(self, permission_id: str) -> Permission:
        """Get permission by ID."""
    @abstractmethod
    async def list_permissions(self) -> list[Permission]:
        """List all permissions."""
    @abstractmethod
    async def update_permission(self, permission: Permission) -> None:
        """Update permission details."""
    @abstractmethod
    async def delete_permission(self, permission_id: str) -> None:
        """Delete permission by ID."""
    @abstractmethod
    async def rename_permission(
        self, old_id: str, new_id: str, display_name: str
    ) -> None:
        """Rename a permission's ID (and display name) updating all references.
        This must update:
            - permissions.id (primary key)
            - org_permissions.permission_id
            - role_permissions.permission_id
        """
    @abstractmethod
    async def add_permission_to_organization(
        self, org_id: str, permission_id: str
    ) -> None:
        """Add a permission to an organization."""
    @abstractmethod
    async def remove_permission_from_organization(
        self, org_id: str, permission_id: str
    ) -> None:
        """Remove a permission from an organization."""
    @abstractmethod
    async def get_organization_permissions(self, org_id: str) -> list[Permission]:
        """Get all permissions assigned to an organization."""
    @abstractmethod
    async def get_permission_organizations(self, permission_id: str) -> list[Org]:
        """Get all organizations that have a specific permission."""
    # Role-permission operations
    @abstractmethod
    async def add_permission_to_role(self, role_uuid: UUID, permission_id: str) -> None:
        """Add a permission to a role."""
    @abstractmethod
    async def remove_permission_from_role(
        self, role_uuid: UUID, permission_id: str
    ) -> None:
        """Remove a permission from a role."""
    @abstractmethod
    async def get_role_permissions(self, role_uuid: UUID) -> list[Permission]:
        """List all permissions granted to a role."""
    @abstractmethod
    async def get_permission_roles(self, permission_id: str) -> list[Role]:
        """List all roles that grant a permission."""
    @abstractmethod
    async def get_role(self, role_uuid: UUID) -> Role:
        """Get a role by UUID, including its permission IDs."""
    # Combined operations
    @abstractmethod
    async def login(self, user_uuid: UUID, credential: Credential) -> None:
        """Update user and credential timestamps after successful login."""
    @abstractmethod
    async def create_user_and_credential(
        self, user: User, credential: Credential
    ) -> None:
        """Create a new user and their first credential in a transaction."""
    @abstractmethod
    async def get_session_context(
        self, session_key: bytes, host: str | None = None
    ) -> SessionContext | None:
        """Get complete session context including user, organization, role, and permissions."""
    # Combined atomic operations
    @abstractmethod
    async def create_credential_session(
        self,
        user_uuid: UUID,
        credential: Credential,
        reset_key: bytes | None,
        session_key: bytes,
        *,
        display_name: str | None = None,
        host: str | None = None,
        ip: str | None = None,
        user_agent: str | None = None,
    ) -> None:
        """Atomically add a credential and create a session.
        Steps (single transaction):
            1. Insert credential
            2. Optionally delete old reset token if provided
            3. Optionally update user's display name
            4. Insert new session referencing the credential
            5. Update user's last_seen and increment visits (treat as a login)
        """
 __all__ = [
-    "User",
+    # Types
    "Credential",
-    "Session",
+    "DB",
    "ResetToken",
    "SessionContext",
    "Org",
    "Role",
    "Permission",
-    "DatabaseInterface",
+    "ResetToken",
    "Role",
    "Session",
    "SessionContext",
    "User",
    # Instance
    "_db",
    "init",
    # Background
    "start_background",
    "stop_background",
    "start_cleanup",
    "stop_cleanup",
    # Builders
    "build_credential",
    "build_org",
    "build_permission",
    "build_reset_token",
    "build_role",
    "build_session",
    "build_user",
    # Read ops
    "get_credential_by_id",
    "get_credentials_by_user_uuid",
    "get_organization",
    "get_organization_users",
    "get_permission",
    "get_permission_by_scope",
    "get_permission_organizations",
    "get_reset_token",
    "get_role",
    "get_roles_by_organization",
    "get_session",
    "get_session_context",
    "get_user_by_uuid",
    "get_user_organization",
    "list_organizations",
    "list_permissions",
    "list_sessions_for_user",
    # Write ops
    "add_permission_to_organization",
    "add_permission_to_role",
    "cleanup_expired",
    "create_credential",
    "create_credential_session",
    "create_organization",
    "create_permission",
    "create_reset_token",
    "create_role",
    "create_session",
    "create_user",
    "delete_credential",
    "delete_organization",
    "delete_permission",
    "delete_reset_token",
    "delete_role",
    "delete_session",
    "delete_sessions_for_user",
    "delete_user",
    "login",
    "remove_permission_from_organization",
    "remove_permission_from_role",
    "rename_permission",
    "update_credential_sign_count",
    "update_organization_name",
    "update_permission",
    "update_role_name",
    "update_session",
    "update_user_display_name",
    "update_user_role",
    "update_user_role_in_organization",
 ]
@@ -0,0 +1,128 @@
 """
 Background task for database maintenance.
 Periodically flushes pending changes to disk and cleans up expired items.
 """
 import asyncio
 import logging
 from datetime import datetime, timezone
 from paskia.db.jsonl import flush_changes
 # Flush changes to disk every N seconds
 FLUSH_INTERVAL = 1
 # Cleanup expired items every N seconds (cheap when nothing to remove)
 CLEANUP_INTERVAL = 1
 _logger = logging.getLogger(__name__)
 _background_task: asyncio.Task | None = None
 def cleanup() -> None:
    """Remove expired sessions and reset tokens from the database."""
    from paskia.db.operations import _db
    if _db is None or _db._data is None:
        return
    with _db.transaction("expiry"):
        current_time = datetime.now(timezone.utc)
        # Clean expired sessions
        to_delete_sessions = [
            k for k, s in _db._data.sessions.items() if s.expiry < current_time
        ]
        for k in to_delete_sessions:
            del _db._data.sessions[k]
        # Clean expired reset tokens
        to_delete_tokens = [
            k for k, t in _db._data.reset_tokens.items() if t.expiry < current_time
        ]
        for k in to_delete_tokens:
            del _db._data.reset_tokens[k]
 async def flush() -> None:
    """Write all pending database changes to disk."""
    from paskia.db.operations import _db
    if _db is None:
        _logger.warning("flush() called but _db is None")
        return
    await flush_changes(_db.db_path, _db._pending_changes)
 async def _background_loop():
    """Background task that periodically flushes changes and cleans up."""
    # Run cleanup immediately on startup to clear old expired items
    cleanup()
    await flush()
    last_cleanup = datetime.now(timezone.utc)
    while True:
        try:
            await asyncio.sleep(FLUSH_INTERVAL)
            # Flush pending changes to disk
            await flush()
            # Run cleanup less frequently
            now = datetime.now(timezone.utc)
            if (now - last_cleanup).total_seconds() >= CLEANUP_INTERVAL:
                cleanup()
                await flush()  # Flush cleanup changes
                last_cleanup = now
        except asyncio.CancelledError:
            # Final flush before exit
            await flush()
            break
        except Exception:
            _logger.debug("Error in database background loop", exc_info=True)
 async def start_background():
    """Start the background flush/cleanup task."""
    global _background_task
    # Check if task exists but is no longer running (e.g., after uvicorn reload)
    if _background_task is not None:
        if _background_task.done():
            _logger.debug("Previous background task was done, restarting")
            _background_task = None
        else:
            # Task exists and is running - but might be in a dead event loop
            try:
                # Check if task is in current event loop
                loop = asyncio.get_running_loop()
                task_loop = _background_task.get_loop()
                if loop is not task_loop:
                    _logger.debug("Background task in different event loop, restarting")
                    _background_task = None
            except Exception as e:
                _logger.debug("Error checking background task loop: %s, restarting", e)
                _background_task = None
    if _background_task is None:
        _background_task = asyncio.create_task(_background_loop())
    else:
        _logger.debug("Background task already running: %s", _background_task)
 async def stop_background():
    """Stop the background task and flush any pending changes."""
    global _background_task
    if _background_task:
        _background_task.cancel()
        try:
            await _background_task
        except asyncio.CancelledError:
            pass
        _background_task = None
 # Aliases for backwards compatibility
 start_cleanup = start_background
 stop_cleanup = stop_background
@@ -0,0 +1,132 @@
 """
 JSONL persistence layer for the database.
 Handles file I/O, JSON diffs, and persistence. Works with plain JSON/dict data.
 Uses aiofiles for async I/O operations.
 """
 import logging
 from collections import deque
 from datetime import datetime, timezone
 from pathlib import Path
 import aiofiles
 import jsondiff
 import msgspec
 _logger = logging.getLogger(__name__)
 # Default database path
 DB_PATH_DEFAULT = "paskia.jsonl"
 class _ChangeRecord(msgspec.Struct, omit_defaults=True):
    """A single change record in the JSONL file."""
    ts: datetime
    a: str  # action - describes the operation (e.g., "migrate", "login", "create_user")
    u: str | None = None  # user UUID who performed the action (None for system)
    diff: dict = {}
 # msgspec encoder for change records
 _change_encoder = msgspec.json.Encoder()
 async def load_jsonl(db_path: Path) -> dict:
    """Load data from disk by applying change log.
    Replays all changes from JSONL file using plain dicts (to handle
    schema evolution).
    Args:
        db_path: Path to the JSONL database file
    Returns:
        The final state after applying all changes
    Raises:
        ValueError: If file doesn't exist or cannot be loaded
    """
    if not db_path.exists():
        raise ValueError(f"Database file not found: {db_path}")
    data_dict: dict = {}
    try:
        # Read entire file at once and split into lines
        async with aiofiles.open(db_path, "rb") as f:
            content = await f.read()
        for line_num, line in enumerate(content.split(b"\n"), 1):
            line = line.strip()
            if not line:
                continue
            try:
                change = msgspec.json.decode(line)
                # Apply the diff to current state (marshal=True for $-prefixed keys)
                data_dict = jsondiff.patch(data_dict, change["diff"], marshal=True)
            except Exception as e:
                raise ValueError(f"Error parsing line {line_num}: {e}")
    except (OSError, ValueError, msgspec.DecodeError) as e:
        raise ValueError(f"Failed to load database: {e}")
    return data_dict
 def compute_diff(previous: dict, current: dict) -> dict | None:
    """Compute JSON diff between two states.
    Args:
        previous: Previous state (JSON-compatible dict)
        current: Current state (JSON-compatible dict)
    Returns:
        The diff, or None if no changes
    """
    diff = jsondiff.diff(previous, current, marshal=True)
    return diff if diff else None
 def create_change_record(
    action: str, diff: dict, user: str | None = None
 ) -> _ChangeRecord:
    """Create a change record for persistence."""
    return _ChangeRecord(
        ts=datetime.now(timezone.utc),
        a=action,
        u=user,
        diff=diff,
    )
 async def flush_changes(
    db_path: Path,
    pending_changes: deque[_ChangeRecord],
 ) -> bool:
    """Write all pending changes to disk.
    Args:
        db_path: Path to the JSONL database file
        pending_changes: Queue of pending change records (will be cleared on success)
    Returns:
        True if flush succeeded, False otherwise
    """
    if not pending_changes:
        return True
    # Collect all pending changes
    changes_to_write = list(pending_changes)
    pending_changes.clear()
    try:
        # Build lines to append (keep as bytes, join with \n)
        lines = [_change_encoder.encode(change) for change in changes_to_write]
        # Append all lines in a single write (binary mode for Windows compatibility)
        async with aiofiles.open(db_path, "ab") as f:
            await f.write(b"\n".join(lines) + b"\n")
        return True
    except OSError:
        _logger.exception("Failed to flush database changes")
        # Re-queue the changes on failure
        for change in reversed(changes_to_write):
            pending_changes.appendleft(change)
        return False
@@ -0,0 +1,148 @@
 from datetime import datetime
 from uuid import UUID
 import msgspec
 class Permission(msgspec.Struct, omit_defaults=True):
    uuid: UUID  # UUID primary key
    scope: str  # Permission scope identifier (e.g. "auth:admin", "myapp:write")
    display_name: str
    domain: str | None = None  # If set, scopes permission to this domain
 class Role(msgspec.Struct):
    uuid: UUID
    org_uuid: UUID
    display_name: str
    permissions: list[str] = []  # permission UUIDs this role grants
 class Org(msgspec.Struct):
    uuid: UUID
    display_name: str
    permissions: list[str] = []  # permission UUIDs this org can grant
    roles: list[Role] = []  # roles belonging to this org
 class User(msgspec.Struct):
    uuid: UUID
    display_name: str
    role_uuid: UUID
    created_at: datetime | None = None
    last_seen: datetime | None = None
    visits: int = 0
 class Credential(msgspec.Struct):
    uuid: UUID
    credential_id: bytes  # Long binary ID from the authenticator
    user_uuid: UUID
    aaguid: UUID
    public_key: bytes
    sign_count: int
    created_at: datetime
    last_used: datetime | None = None
    last_verified: datetime | None = None
 class Session(msgspec.Struct):
    key: str
    user_uuid: UUID
    credential_uuid: UUID
    host: str | None
    ip: str | None
    user_agent: str | None
    expiry: datetime
    def metadata(self) -> dict:
        """Return session metadata for backwards compatibility."""
        return {
            "ip": self.ip,
            "user_agent": self.user_agent,
            "expiry": self.expiry.isoformat(),
        }
 class ResetToken(msgspec.Struct):
    key: bytes
    user_uuid: UUID
    expiry: datetime
    token_type: str
 class SessionContext(msgspec.Struct):
    session: Session
    user: User
    org: Org
    role: Role
    credential: Credential | None = None
    permissions: list[Permission] | None = None
 # -------------------------------------------------------------------------
 # Internal storage types (different structure for efficient storage)
 # -------------------------------------------------------------------------
 class _PermissionData(msgspec.Struct, omit_defaults=True):
    scope: str  # Permission scope identifier
    display_name: str
    domain: str | None = None
    orgs: dict[UUID, bool] = {}  # org_uuid -> True (which orgs can grant this)
 class _OrgData(msgspec.Struct):
    display_name: str
    created_at: datetime | None = None
 class _RoleData(msgspec.Struct):
    org: UUID
    display_name: str
    permissions: dict[UUID, bool] = {}  # permission_uuid -> True
 class _UserData(msgspec.Struct):
    display_name: str
    role: UUID
    created_at: datetime
    last_seen: datetime | None
    visits: int
 class _CredentialData(msgspec.Struct):
    credential_id: bytes
    user: UUID
    aaguid: UUID
    public_key: bytes
    sign_count: int
    created_at: datetime
    last_used: datetime | None
    last_verified: datetime | None
 class _SessionData(msgspec.Struct):
    user: UUID
    credential: UUID
    host: str | None
    ip: str | None
    user_agent: str | None
    expiry: datetime
 class _ResetTokenData(msgspec.Struct):
    user: UUID
    expiry: datetime
    token_type: str
 class _DatabaseData(msgspec.Struct, omit_defaults=True):
    permissions: dict[UUID, _PermissionData]
    orgs: dict[UUID, _OrgData]
    roles: dict[UUID, _RoleData]
    users: dict[UUID, _UserData]
    credentials: dict[UUID, _CredentialData]
    sessions: dict[str, _SessionData]
    reset_tokens: dict[bytes, _ResetTokenData]
    v: int = 0
@@ -13,19 +13,17 @@ from fastapi import (
 from fastapi.responses import JSONResponse
 from fastapi.security import HTTPBearer
 from paskia import db
 from paskia.authsession import (
    EXPIRES,
    get_reset,
    get_session,
    refresh_session_token,
    session_expiry,
 )
 from paskia.fastapi import authz, session, user
 from paskia.fastapi.session import AUTH_COOKIE, AUTH_COOKIE_NAME
 from paskia.globals import db
 from paskia.globals import passkey as global_passkey
 from paskia.util import frontend, hostutil, htmlutil, passphrase, userinfo
 from paskia.util.tokens import session_key
 bearer_auth = HTTPBearer(auto_error=True)
@@ -77,6 +75,7 @@ async def validate_token(
    request: Request,
    response: Response,
    perm: list[str] = Query([]),
    max_age: str | None = Query(None),
    auth=AUTH_COOKIE,
 ):
    """Validate the current session and extend its expiry.
@@ -86,14 +85,18 @@ async def validate_token(
    refresh endpoint.
    """
    try:
-        ctx = await authz.verify(auth, perm, host=request.headers.get("host"))
+        ctx = await authz.verify(
            auth,
            perm,
            host=request.headers.get("host"),
            max_age=max_age,
        )
    except HTTPException:
        # Global handler will clear cookie if 401
        raise
    renewed = False
    if auth:
-        current_expiry = session_expiry(ctx.session)
+        consumed = EXPIRES - (ctx.session.expiry - datetime.now(timezone.utc))
        consumed = EXPIRES - (current_expiry - datetime.now(timezone.utc))
        if not timedelta(0) < consumed < _REFRESH_INTERVAL:
            try:
                await refresh_session_token(
@@ -143,7 +146,7 @@ async def forward_authentication(
        )
        role_permissions = set(ctx.role.permissions or [])
        if ctx.permissions:
-            role_permissions.update(permission.id for permission in ctx.permissions)
+            role_permissions.update(permission.scope for permission in ctx.permissions)
        remote_headers: dict[str, str] = {
            "Remote-User": str(ctx.user.uuid),
@@ -154,13 +157,11 @@ async def forward_authentication(
            "Remote-Role": str(ctx.role.uuid),
            "Remote-Role-Name": ctx.role.display_name,
            "Remote-Session-Expires": (
-                session_expiry(ctx.session)
+                ctx.session.expiry.astimezone(timezone.utc)
                .astimezone(timezone.utc)
                .isoformat()
                .replace("+00:00", "Z")
-                if session_expiry(ctx.session).tzinfo
+                if ctx.session.expiry.tzinfo
-                else session_expiry(ctx.session)
+                else ctx.session.expiry.replace(tzinfo=timezone.utc)
                .replace(tzinfo=timezone.utc)
                .isoformat()
                .replace("+00:00", "Z")
            ),
@@ -221,7 +222,7 @@ async def api_token_info(token: str):
    # Check if this is a reset token
    try:
        reset_token = await get_reset(token)
-        user = await db.instance.get_user_by_uuid(reset_token.user_uuid)
+        user = db.get_user_by_uuid(reset_token.user_uuid)
        return {
            "type": "reset",
            "user_name": user.display_name,
@@ -287,11 +288,11 @@ async def api_logout(request: Request, response: Response, auth=AUTH_COOKIE):
    if not auth:
        return {"message": "Already logged out"}
    try:
-        await get_session(auth, host=request.headers.get("host"))
+        _s = await get_session(auth, host=request.headers.get("host"))
    except ValueError:
        return {"message": "Already logged out"}
    with suppress(Exception):
-        await db.instance.delete_session(session_key(auth))
+        db.delete_session(auth)
    session.clear_session_cookie(response)
    return {"message": "Logged out successfully"}
@@ -94,14 +94,19 @@ async def verify(
    if not match(ctx, perm):
        # Determine which permissions are missing for clearer diagnostics
-        missing = sorted(set(perm) - set(ctx.role.permissions))
+        effective_scopes = (
            {p.scope for p in (ctx.permissions or [])}
            if ctx.permissions
            else set(ctx.role.permissions or [])
        )
        missing = sorted(set(perm) - effective_scopes)
        logger.warning(
            "Permission denied: user=%s role=%s missing=%s required=%s granted=%s",  # noqa: E501
            getattr(ctx.user, "uuid", "?"),
            getattr(ctx.role, "display_name", "?"),
            missing,
            perm,
-            ctx.role.permissions,
+            list(effective_scopes),
        )
        raise AuthException(
            status_code=403, mode="forbidden", detail="Permission required"
@@ -50,7 +50,7 @@ async def lifespan(app: FastAPI):  # pragma: no cover - startup path
    yield
-app = FastAPI(lifespan=lifespan)
+app = FastAPI(lifespan=lifespan, redirect_slashes=False)
 # Apply redirections to auth-host if configured (deny access to restricted endpoints, remove /auth/)
 app.middleware("http")(auth_host.redirect_middleware)
@@ -96,6 +96,7 @@ async def admin_root_redirect():
@app.get("/admin/", include_in_schema=False)
@app.get("/auth/admin/", include_in_schema=False)
 async def admin_root(request: Request, auth=AUTH_COOKIE):
    return await admin.adminapp(request, auth)  # Delegated to admin app
@@ -15,11 +15,10 @@ from uuid import UUID
 import base64url
 from fastapi import FastAPI, WebSocket, WebSocketDisconnect
-from paskia import remoteauth
+from paskia import db, remoteauth
 from paskia.authsession import create_session
 from paskia.fastapi.session import infodict
 from paskia.fastapi.wsutil import validate_origin, websocket_error_handler
-from paskia.globals import db, passkey
+from paskia.globals import passkey
 from paskia.util import passphrase, pow
 # Create a FastAPI subapp for remote auth WebSocket endpoints
@@ -323,9 +322,7 @@ async def websocket_remote_auth_permit(ws: WebSocket):
                # Fetch and verify credential
                try:
-                    stored_cred = await db.instance.get_credential_by_id(
+                    stored_cred = db.get_credential_by_id(credential.raw_id)
                        credential.raw_id
                    )
                except ValueError:
                    raise ValueError(
                        f"This passkey is no longer registered with {passkey.instance.rp_name}"
@@ -336,9 +333,6 @@ async def websocket_remote_auth_permit(ws: WebSocket):
                    credential, webauthn_challenge, stored_cred, origin
                )
                # Update credential last_used
                await db.instance.login(stored_cred.user_uuid, stored_cred)
                # Create a session for the REQUESTING device
                assert stored_cred.uuid is not None
@@ -348,34 +342,40 @@ async def websocket_remote_auth_permit(ws: WebSocket):
                if request.action == "register":
                    # For registration, create a reset token for device addition
                    from paskia.authsession import expires
-                    from paskia.util import tokens
+                    from paskia.util import hostutil
                    token_str = passphrase.generate()
                    expiry = expires()
-                    await db.instance.create_reset_token(
+                    db.create_reset_token(
                        user_uuid=stored_cred.user_uuid,
-                        key=tokens.reset_key(token_str),
+                        passphrase=token_str,
                        expiry=expiry,
                        token_type="device addition",
                    )
                    reset_token = token_str
-                    # Also create a session so the device is logged in?
+                    # Also create a session so the device is logged in
-                    # User requested: "We can make the flow always create a new session, but make additional tokens for other possibilities."
+                    normalized_host = hostutil.normalize_host(request.host)
-                    session_token = await create_session(
+                    session_token = db.login(
                        user_uuid=stored_cred.user_uuid,
-                        credential_uuid=stored_cred.uuid,
+                        credential=stored_cred,
-                        host=request.host,
+                        host=normalized_host,
                        ip=request.ip,
                        user_agent=request.user_agent,
                        expiry=expires(),
                    )
                else:
                    # Default login action
-                    session_token = await create_session(
+                    from paskia.authsession import expires
                    from paskia.util import hostutil
                    normalized_host = hostutil.normalize_host(request.host)
                    session_token = db.login(
                        user_uuid=stored_cred.user_uuid,
-                        credential_uuid=stored_cred.uuid,
+                        credential=stored_cred,
-                        host=request.host,
+                        host=normalized_host,
                        ip=request.ip,
                        user_agent=request.user_agent,
                        expiry=expires(),
                    )
                # Complete the remote auth request (notifies the waiting device)
@@ -16,9 +16,8 @@ import asyncio
 from uuid import UUID
 from paskia import authsession as _authsession
-from paskia import globals as _g
+from paskia import db as _db
 from paskia.util import hostutil, passphrase
 from paskia.util import tokens as _tokens
 async def _resolve_targets(query: str | None):
@@ -27,9 +26,9 @@ async def _resolve_targets(query: str | None):
        targets: list[tuple] = []
        try:
            q_uuid = UUID(query)
-            perm_orgs = await _g.db.instance.get_permission_organizations("auth:admin")
+            perm_orgs = _db.get_permission_organizations("auth:admin")
            for o in perm_orgs:
-                users = await _g.db.instance.get_organization_users(str(o.uuid))
+                users = _db.get_organization_users(str(o.uuid))
                for u, role_name in users:
                    if u.uuid == q_uuid:
                        return [(u, role_name)]
@@ -38,9 +37,9 @@ async def _resolve_targets(query: str | None):
            pass
        # Substring search
        needle = query.lower()
-        perm_orgs = await _g.db.instance.get_permission_organizations("auth:admin")
+        perm_orgs = _db.get_permission_organizations("auth:admin")
        for o in perm_orgs:
-            users = await _g.db.instance.get_organization_users(str(o.uuid))
+            users = _db.get_organization_users(str(o.uuid))
            for u, role_name in users:
                if needle in (u.display_name or "").lower():
                    targets.append((u, role_name))
@@ -53,10 +52,10 @@ async def _resolve_targets(query: str | None):
                deduped.append((u, role_name))
        return deduped
    # No query -> master admin
-    perm_orgs = await _g.db.instance.get_permission_organizations("auth:admin")
+    perm_orgs = _db.get_permission_organizations("auth:admin")
    if not perm_orgs:
        return []
-    users = await _g.db.instance.get_organization_users(str(perm_orgs[0].uuid))
+    users = _db.get_organization_users(str(perm_orgs[0].uuid))
    admin_users = [pair for pair in users if pair[1] == "Administration"]
    return admin_users[:1]
@@ -64,9 +63,9 @@ async def _resolve_targets(query: str | None):
 async def _create_reset(user, role_name: str):
    token = passphrase.generate()
    expiry = _authsession.reset_expires()
-    await _g.db.instance.create_reset_token(
+    _db.create_reset_token(
        passphrase=token,
        user_uuid=user.uuid,
        key=_tokens.reset_key(token),
        expiry=expiry,
        token_type="manual reset",
    )
@@ -10,6 +10,7 @@ from fastapi import (
 )
 from fastapi.responses import JSONResponse
 from paskia import db
 from paskia.authsession import (
    delete_credential,
    expires,
@@ -17,9 +18,7 @@ from paskia.authsession import (
 )
 from paskia.fastapi import authz, session
 from paskia.fastapi.session import AUTH_COOKIE
-from paskia.globals import db
+from paskia.util import hostutil, passphrase
 from paskia.util import hostutil, passphrase, tokens
 from paskia.util.tokens import decode_session_key, session_key
 app = FastAPI()
@@ -33,7 +32,7 @@ async def auth_exception_handler(_request, exc: authz.AuthException):
    )
-@app.put("/display-name")
+@app.patch("/display-name")
 async def user_update_display_name(
    request: Request,
    response: Response,
@@ -55,7 +54,7 @@ async def user_update_display_name(
        raise HTTPException(status_code=400, detail="display_name required")
    if len(new_name) > 64:
        raise HTTPException(status_code=400, detail="display_name too long")
-    await db.instance.update_user_display_name(s.user_uuid, new_name)
+    db.update_user_display_name(s.user_uuid, new_name)
    return {"status": "ok"}
@@ -69,7 +68,7 @@ async def api_logout_all(request: Request, response: Response, auth=AUTH_COOKIE)
        raise authz.AuthException(
            status_code=401, detail="Session expired", mode="login"
        )
-    await db.instance.delete_sessions_for_user(s.user_uuid)
+    db.delete_sessions_for_user(s.user_uuid)
    session.clear_session_cookie(response)
    return {"message": "Logged out from all hosts"}
@@ -92,19 +91,12 @@ async def api_delete_session(
            status_code=401, detail="Session expired", mode="login"
        ) from exc
-    try:
+    target_session = db.get_session(session_id)
        target_key = decode_session_key(session_id)
    except ValueError as exc:
        raise HTTPException(
            status_code=400, detail="Invalid session identifier"
        ) from exc
    target_session = await db.instance.get_session(target_key)
    if not target_session or target_session.user_uuid != current_session.user_uuid:
        raise HTTPException(status_code=404, detail="Session not found")
-    await db.instance.delete_session(target_key)
+    db.delete_session(session_id)
-    current_terminated = target_key == session_key(auth)
+    current_terminated = session_id == auth
    if current_terminated:
        session.clear_session_cookie(response)  # explicit because 200
    return {"status": "ok", "current_session_terminated": current_terminated}
@@ -144,9 +136,9 @@ async def api_create_link(
        ) from e
    token = passphrase.generate()
    expiry = expires()
-    await db.instance.create_reset_token(
+    db.create_reset_token(
        user_uuid=s.user_uuid,
-        key=tokens.reset_key(token),
+        passphrase=token,
        expiry=expiry,
        token_type="device addition",
    )
@@ -2,13 +2,13 @@ from uuid import UUID
 from fastapi import FastAPI, WebSocket
-from paskia.authsession import create_session, get_reset, get_session
+from paskia import db
 from paskia.authsession import expires, get_reset, get_session
 from paskia.fastapi import authz, remote
 from paskia.fastapi.session import AUTH_COOKIE, infodict
 from paskia.fastapi.wsutil import validate_origin, websocket_error_handler
-from paskia.globals import db, passkey
+from paskia.globals import passkey
-from paskia.util import passphrase
+from paskia.util import hostutil, passphrase
 from paskia.util.tokens import create_token, session_key
 # Create a FastAPI subapp for WebSocket endpoints
 app = FastAPI()
@@ -65,25 +65,23 @@ async def websocket_register_add(
        s = ctx.session
    # Get user information and determine effective user_name for this registration
-    user = await db.instance.get_user_by_uuid(user_uuid)
+    user = db.get_user_by_uuid(user_uuid)
    user_name = user.display_name
    if name is not None:
        stripped = name.strip()
        if stripped:
            user_name = stripped
-    challenge_ids = await db.instance.get_credentials_by_user_uuid(user_uuid)
+    challenge_ids = db.get_credentials_by_user_uuid(user_uuid)
    # WebAuthn registration
    credential = await register_chat(ws, user_uuid, user_name, origin, challenge_ids)
    # Create a new session and store everything in database
    token = create_token()
    metadata = infodict(ws, "authenticated")
-    await db.instance.create_credential_session(  # type: ignore[attr-defined]
+    token = db.create_credential_session(  # type: ignore[attr-defined]
        user_uuid=user_uuid,
        credential=credential,
        reset_key=(s.key if reset is not None else None),
        session_key=session_key(token),
        display_name=user_name,
        host=host,
        ip=metadata.get("ip"),
@@ -115,9 +113,7 @@ async def websocket_authenticate(ws: WebSocket, auth=AUTH_COOKIE):
        try:
            session = await get_session(auth, host=host)
            session_user_uuid = session.user_uuid
-            credential_ids = await db.instance.get_credentials_by_user_uuid(
+            credential_ids = db.get_credentials_by_user_uuid(session_user_uuid)
                session_user_uuid
            )
        except ValueError:
            pass  # Invalid/expired session - allow normal authentication
@@ -129,7 +125,7 @@ async def websocket_authenticate(ws: WebSocket, auth=AUTH_COOKIE):
    credential = passkey.instance.auth_parse(await ws.receive_json())
    # Fetch from the database by credential ID
    try:
-        stored_cred = await db.instance.get_credential_by_id(credential.raw_id)
+        stored_cred = db.get_credential_by_id(credential.raw_id)
    except ValueError:
        raise ValueError(
            f"This passkey is no longer registered with {passkey.instance.rp_name}"
@@ -141,18 +137,25 @@ async def websocket_authenticate(ws: WebSocket, auth=AUTH_COOKIE):
    # Verify the credential matches the stored data
    passkey.instance.auth_verify(credential, challenge, stored_cred, origin)
    # Update both credential and user's last_seen timestamp
    await db.instance.login(stored_cred.user_uuid, stored_cred)
-    # Create a session token for the authenticated user
+    # Create session and update user/credential in a single transaction
    assert stored_cred.uuid is not None
    metadata = infodict(ws, "auth")
-    token = await create_session(
+    normalized_host = hostutil.normalize_host(host)
    if not normalized_host:
        raise ValueError("Host required for session creation")
    hostname = normalized_host.split(":")[0]
    rp_id = passkey.instance.rp_id
    if not (hostname == rp_id or hostname.endswith(f".{rp_id}")):
        raise ValueError(f"Host must be the same as or a subdomain of {rp_id}")
    token = db.login(
        user_uuid=stored_cred.user_uuid,
-        credential_uuid=stored_cred.uuid,
+        credential=stored_cred,
-        host=host,
+        host=normalized_host,
        ip=metadata.get("ip") or "",
        user_agent=metadata.get("user_agent") or "",
        expiry=expires(),
    )
    await ws.send_json(
@@ -1,6 +1,5 @@
 from typing import Generic, TypeVar
 from paskia.db import DatabaseInterface
 from paskia.sansio import Passkey
 T = TypeVar("T")
@@ -38,8 +37,12 @@ async def init(
    If bootstrap=True (default) the system bootstrap_if_needed() will be invoked.
    In FastAPI lifespan we call with bootstrap=False to avoid duplicate bootstrapping
    since the CLI performs it once before servers start.
    Database configuration:
        Set PASKIA_DB environment variable to specify the JSONL database file path.
        Default: paskia.jsonl
    """
-    from . import remoteauth
+    from . import db, remoteauth
    # Initialize passkey instance with provided parameters
    passkey.instance = Passkey(
@@ -48,13 +51,8 @@ async def init(
        origins=origins,
    )
-    # Test if we have a database already initialized, otherwise use SQL
+    # Initialize database
-    try:
+    await db.init()
        db.instance
    except RuntimeError:
        from .db import sql
        await sql.init()
    # Initialize remote auth manager
    await remoteauth.init()
@@ -68,4 +66,3 @@ async def init(
 # Global instances
 passkey = Manager[Passkey]("Passkey")
 db = Manager[DatabaseInterface]("Database")
@@ -0,0 +1,274 @@
 """
 SQL to JSON migration module for Paskia.
 This module contains the legacy SQL database implementation and migration tools
 for converting from the old SQLite database to the new JSONL format.
 Usage:
    python -m paskia.migrate --sql sqlite+aiosqlite:///paskia.sqlite --json paskia.jsonl
 Or via the CLI entry point (if installed):
    paskia-migrate --sql sqlite+aiosqlite:///paskia.sqlite --json paskia.jsonl
 """
 import asyncio
 from datetime import datetime, timezone
 from uuid import UUID
 import base64url
 from paskia.authsession import EXPIRES
 from .sql import (
    DB as SQLDB,
 )
 from .sql import (
    CredentialModel,
    ResetTokenModel,
    SessionModel,
    UserModel,
 )
 # Re-export for convenience
 __all__ = ["migrate_from_sql", "main", "SQLDB"]
 # Default paths
 SQL_DB_DEFAULT = "sqlite+aiosqlite:///paskia.sqlite"
 JSON_DB_DEFAULT = "paskia.jsonl"
 async def migrate_from_sql(
    sql_db_path: str = SQL_DB_DEFAULT,
    json_db_path: str = JSON_DB_DEFAULT,
 ) -> None:
    """Migrate data from SQL database to JSON format.
    Args:
        sql_db_path: SQLAlchemy connection string for the source SQL database
        json_db_path: Path for the destination JSONL file
    """
    # Import here to avoid circular imports and to not require JSON db at import time
    import re
    import uuid7
    from sqlalchemy import select
    from paskia.db.operations import DB as JSONDB
    from paskia.db.structs import (
        _CredentialData,
        _OrgData,
        _PermissionData,
        _ResetTokenData,
        _RoleData,
        _SessionData,
        _UserData,
    )
    # Initialize source SQL database
    sql_db = SQLDB(sql_db_path)
    await sql_db.init_db()
    # Initialize destination JSON database (fresh, don't load existing)
    json_db = JSONDB(json_db_path)
    # Don't call json_db.load() - we want a fresh database, not to load existing
    print(f"Migrating from {sql_db_path} to {json_db_path}...")
    # Build all data directly without saving (we'll save once at the end)
    # Track old permission ID -> new scope mapping for migration
    # Also track org-specific admin permissions to consolidate
    old_org_admin_pattern = re.compile(r"^auth:org:([0-9a-f-]+)$", re.IGNORECASE)
    org_admin_uuids = set()  # org UUIDs that had org-specific admin permissions
    # First pass: identify org-specific admin permissions
    permissions = await sql_db.list_permissions()
    for perm in permissions:
        match = old_org_admin_pattern.match(perm.id)
        if match:
            org_admin_uuids.add(match.group(1).lower())
    # Migrate permissions with UUID keys and scope field
    # Always create exactly one common auth:org:admin permission for all org admin needs
    org_admin_perm_uuid: UUID = uuid7.create()
    json_db._data.permissions[org_admin_perm_uuid] = _PermissionData(
        scope="auth:org:admin",
        display_name="Org Admin",
        orgs={},
    )
    # Mapping from old permission ID to new permission UUID
    perm_id_to_uuid: dict[str, UUID] = {}
    for perm in permissions:
        # Skip old org-specific admin permissions (auth:org:{uuid}) - they map to auth:org:admin
        match = old_org_admin_pattern.match(perm.id)
        if match:
            perm_id_to_uuid[perm.id] = org_admin_perm_uuid
            continue
        # Skip if this is already auth:org:admin - we created one above
        if perm.id == "auth:org:admin":
            perm_id_to_uuid[perm.id] = org_admin_perm_uuid
            continue
        # Regular permission - create with UUID key
        perm_uuid: UUID = uuid7.create()
        json_db._data.permissions[perm_uuid] = _PermissionData(
            scope=perm.id,  # Old ID becomes the scope
            display_name=perm.display_name,
            orgs={},
        )
        perm_id_to_uuid[perm.id] = perm_uuid
    print(
        f"  Migrated {len(permissions)} permissions (with {len(org_admin_uuids)} org-specific admins consolidated to auth:org:admin)"
    )
    # Migrate organizations
    orgs = await sql_db.list_organizations()
    for org in orgs:
        org_key: UUID = org.uuid
        json_db._data.orgs[org_key] = _OrgData(
            display_name=org.display_name,
        )
        # Update permissions to allow this org to grant them (by UUID)
        for old_perm_id in org.permissions:
            perm_uuid = perm_id_to_uuid.get(old_perm_id)
            if perm_uuid and perm_uuid in json_db._data.permissions:
                json_db._data.permissions[perm_uuid].orgs[org_key] = True
        # Ensure every org can grant auth:org:admin
        json_db._data.permissions[org_admin_perm_uuid].orgs[org_key] = True
    print(f"  Migrated {len(orgs)} organizations")
    # Migrate roles - convert old permission IDs to UUIDs
    role_count = 0
    for org in orgs:
        for role in org.roles:
            role_key: UUID = role.uuid
            # Convert old permission IDs to UUIDs
            new_permissions: dict[UUID, bool] = {}
            for old_perm_id in role.permissions or []:
                perm_uuid = perm_id_to_uuid.get(old_perm_id)
                if perm_uuid:
                    new_permissions[perm_uuid] = True
            json_db._data.roles[role_key] = _RoleData(
                org=role.org_uuid,
                display_name=role.display_name,
                permissions=new_permissions,
            )
            role_count += 1
    print(f"  Migrated {role_count} roles")
    # Migrate users
    async with sql_db.session() as session:
        result = await session.execute(select(UserModel))
        user_models = result.scalars().all()
        for um in user_models:
            user = um.as_dataclass()
            user_key: UUID = user.uuid
            json_db._data.users[user_key] = _UserData(
                display_name=user.display_name,
                role=user.role_uuid,
                created_at=user.created_at or datetime.now(timezone.utc),
                last_seen=user.last_seen,
                visits=user.visits,
            )
        print(f"  Migrated {len(user_models)} users")
    # Migrate credentials
    async with sql_db.session() as session:
        result = await session.execute(select(CredentialModel))
        cred_models = result.scalars().all()
        for cm in cred_models:
            cred = cm.as_dataclass()
            cred_key: UUID = cred.uuid
            json_db._data.credentials[cred_key] = _CredentialData(
                credential_id=cred.credential_id,
                user=cred.user_uuid,
                aaguid=cred.aaguid,
                public_key=cred.public_key,
                sign_count=cred.sign_count,
                created_at=cred.created_at,
                last_used=cred.last_used,
                last_verified=cred.last_verified,
            )
        print(f"  Migrated {len(cred_models)} credentials")
    # Migrate sessions
    # Old format: b"sess" + 12 bytes -> New format: base64url string (16 chars)
    async with sql_db.session() as session:
        result = await session.execute(select(SessionModel))
        session_models = result.scalars().all()
        for sm in session_models:
            sess = sm.as_dataclass()
            old_key: bytes = sess.key
            # Strip b"sess" prefix and encode remaining 12 bytes as base64url
            if old_key.startswith(b"sess"):
                session_key = base64url.enc(old_key[4:])
            else:
                # Already in new format or unknown - try to use as-is
                session_key = base64url.enc(old_key[:12])
            json_db._data.sessions[session_key] = _SessionData(
                user=sess.user_uuid,
                credential=sess.credential_uuid,
                host=sess.host,
                ip=sess.ip,
                user_agent=sess.user_agent,
                expiry=sess.renewed + EXPIRES,  # Convert renewed to expiry
            )
        print(f"  Migrated {len(session_models)} sessions")
    # Migrate reset tokens
    # Old format: b"rset" + 16 bytes hash -> New format: 9 bytes (truncated hash)
    async with sql_db.session() as session:
        result = await session.execute(select(ResetTokenModel))
        token_models = result.scalars().all()
        for tm in token_models:
            token = tm.as_dataclass()
            old_key: bytes = token.key
            # Strip b"rset" prefix and take first 9 bytes of hash
            if old_key.startswith(b"rset"):
                token_key = old_key[4:13]  # 9 bytes after prefix
            else:
                # Already in new format or unknown - truncate to 9 bytes
                token_key = old_key[:9]
            json_db._data.reset_tokens[token_key] = _ResetTokenData(
                user=token.user_uuid,
                expiry=token.expiry,
                token_type=token.token_type,
            )
        print(f"  Migrated {len(token_models)} reset tokens")
    # Queue and flush all changes with actor "migrate"
    json_db._current_actor = "migrate"
    json_db._queue_change()
    from paskia.db.jsonl import flush_changes
    await flush_changes(json_db.db_path, json_db._pending_changes)
    print("Migration complete!")
 def main():
    """CLI entry point for migration."""
    import argparse
    parser = argparse.ArgumentParser(
        description="Migrate Paskia database from SQL to JSON"
    )
    parser.add_argument(
        "--sql",
        default=SQL_DB_DEFAULT,
        help=f"Source SQL database connection string (default: {SQL_DB_DEFAULT})",
    )
    parser.add_argument(
        "--json",
        default=JSON_DB_DEFAULT,
        help=f"Destination JSONL file path (default: {JSON_DB_DEFAULT})",
    )
    args = parser.parse_args()
    asyncio.run(migrate_from_sql(args.sql, args.json))
 if __name__ == "__main__":
    main()
@@ -0,0 +1,381 @@
 """
 Legacy SQL database implementation for migration purposes.
 This module provides the async SQLAlchemy database layer that was used
 before the JSONL format. It is kept here for migration purposes only.
 DO NOT use this module for new code. Use paskia.db instead.
 """
 from contextlib import asynccontextmanager
 from dataclasses import dataclass
 from datetime import datetime, timezone
 from uuid import UUID
 from sqlalchemy import (
    DateTime,
    ForeignKey,
    Integer,
    LargeBinary,
    String,
    event,
    select,
 )
 from sqlalchemy.dialects.sqlite import BLOB
 from sqlalchemy.ext.asyncio import async_sessionmaker, create_async_engine
 from sqlalchemy.orm import DeclarativeBase, Mapped, mapped_column
 from paskia.db import (
    Credential,
    Org,
    ResetToken,
    Role,
    User,
 )
 # Local Permission class for SQL schema (uses 'id' not 'uuid' + 'scope')
@dataclass
 class SqlPermission:
    """Permission as stored in the old SQL schema with id field."""
    id: str
    display_name: str
 DB_PATH_DEFAULT = "sqlite+aiosqlite:///paskia.sqlite"
 # Local Session class for SQL schema (uses 'renewed' not 'expiry')
@dataclass
 class _SqlSession:
    """Session as stored in the old SQL schema with renewed timestamp."""
    key: bytes
    user_uuid: UUID
    credential_uuid: UUID
    host: str
    ip: str
    user_agent: str
    renewed: datetime
 def _normalize_dt(value: datetime | None) -> datetime | None:
    if value is None:
        return None
    if value.tzinfo is None:
        return value.replace(tzinfo=timezone.utc)
    return value.astimezone(timezone.utc)
 class Base(DeclarativeBase):
    pass
 class OrgModel(Base):
    __tablename__ = "orgs"
    uuid: Mapped[bytes] = mapped_column(LargeBinary(16), primary_key=True)
    display_name: Mapped[str] = mapped_column(String, nullable=False)
    def as_dataclass(self):
        # Base Org without permissions/roles (filled by data accessors)
        return Org(UUID(bytes=self.uuid), self.display_name)
    @staticmethod
    def from_dataclass(org: Org):
        return OrgModel(uuid=org.uuid.bytes, display_name=org.display_name)
 class RoleModel(Base):
    __tablename__ = "roles"
    uuid: Mapped[bytes] = mapped_column(LargeBinary(16), primary_key=True)
    org_uuid: Mapped[bytes] = mapped_column(
        LargeBinary(16), ForeignKey("orgs.uuid", ondelete="CASCADE"), nullable=False
    )
    display_name: Mapped[str] = mapped_column(String, nullable=False)
    def as_dataclass(self):
        # Base Role without permissions (filled by data accessors)
        return Role(
            uuid=UUID(bytes=self.uuid),
            org_uuid=UUID(bytes=self.org_uuid),
            display_name=self.display_name,
        )
    @staticmethod
    def from_dataclass(role: Role):
        return RoleModel(
            uuid=role.uuid.bytes,
            org_uuid=role.org_uuid.bytes,
            display_name=role.display_name,
        )
 class UserModel(Base):
    __tablename__ = "users"
    uuid: Mapped[bytes] = mapped_column(LargeBinary(16), primary_key=True)
    display_name: Mapped[str] = mapped_column(String, nullable=False)
    role_uuid: Mapped[bytes] = mapped_column(
        LargeBinary(16), ForeignKey("roles.uuid", ondelete="CASCADE"), nullable=False
    )
    created_at: Mapped[datetime] = mapped_column(
        DateTime(timezone=True), default=lambda: datetime.now(timezone.utc)
    )
    last_seen: Mapped[datetime | None] = mapped_column(
        DateTime(timezone=True), nullable=True
    )
    visits: Mapped[int] = mapped_column(Integer, nullable=False, default=0)
    def as_dataclass(self) -> User:
        return User(
            uuid=UUID(bytes=self.uuid),
            display_name=self.display_name,
            role_uuid=UUID(bytes=self.role_uuid),
            created_at=_normalize_dt(self.created_at) or self.created_at,
            last_seen=_normalize_dt(self.last_seen) or self.last_seen,
            visits=self.visits,
        )
    @staticmethod
    def from_dataclass(user: User):
        return UserModel(
            uuid=user.uuid.bytes,
            display_name=user.display_name,
            role_uuid=user.role_uuid.bytes,
            created_at=user.created_at or datetime.now(timezone.utc),
            last_seen=user.last_seen,
            visits=user.visits,
        )
 class CredentialModel(Base):
    __tablename__ = "credentials"
    uuid: Mapped[bytes] = mapped_column(LargeBinary(16), primary_key=True)
    credential_id: Mapped[bytes] = mapped_column(
        LargeBinary(64), unique=True, index=True
    )
    user_uuid: Mapped[bytes] = mapped_column(
        LargeBinary(16), ForeignKey("users.uuid", ondelete="CASCADE")
    )
    aaguid: Mapped[bytes] = mapped_column(LargeBinary(16), nullable=False)
    public_key: Mapped[bytes] = mapped_column(BLOB, nullable=False)
    sign_count: Mapped[int] = mapped_column(Integer, nullable=False)
    created_at: Mapped[datetime] = mapped_column(
        DateTime(timezone=True), default=lambda: datetime.now(timezone.utc)
    )
    last_used: Mapped[datetime | None] = mapped_column(
        DateTime(timezone=True), nullable=True
    )
    last_verified: Mapped[datetime | None] = mapped_column(
        DateTime(timezone=True), nullable=True
    )
    def as_dataclass(self):
        return Credential(
            uuid=UUID(bytes=self.uuid),
            credential_id=self.credential_id,
            user_uuid=UUID(bytes=self.user_uuid),
            aaguid=UUID(bytes=self.aaguid),
            public_key=self.public_key,
            sign_count=self.sign_count,
            created_at=_normalize_dt(self.created_at) or self.created_at,
            last_used=_normalize_dt(self.last_used) or self.last_used,
            last_verified=_normalize_dt(self.last_verified) or self.last_verified,
        )
 class SessionModel(Base):
    __tablename__ = "sessions"
    key: Mapped[bytes] = mapped_column(LargeBinary(16), primary_key=True)
    user_uuid: Mapped[bytes] = mapped_column(
        LargeBinary(16), ForeignKey("users.uuid", ondelete="CASCADE"), nullable=False
    )
    credential_uuid: Mapped[bytes] = mapped_column(
        LargeBinary(16),
        ForeignKey("credentials.uuid", ondelete="CASCADE"),
        nullable=False,
    )
    host: Mapped[str] = mapped_column(String, nullable=False)
    ip: Mapped[str] = mapped_column(String(64), nullable=False)
    user_agent: Mapped[str] = mapped_column(String(512), nullable=False)
    renewed: Mapped[datetime] = mapped_column(
        DateTime(timezone=True),
        default=lambda: datetime.now(timezone.utc),
        nullable=False,
    )
    def as_dataclass(self):
        return _SqlSession(
            key=self.key,
            user_uuid=UUID(bytes=self.user_uuid),
            credential_uuid=UUID(bytes=self.credential_uuid),
            host=self.host,
            ip=self.ip,
            user_agent=self.user_agent,
            renewed=_normalize_dt(self.renewed) or self.renewed,
        )
    @staticmethod
    def from_dataclass(session: _SqlSession):
        return SessionModel(
            key=session.key,
            user_uuid=session.user_uuid.bytes,
            credential_uuid=session.credential_uuid.bytes,
            host=session.host,
            ip=session.ip,
            user_agent=session.user_agent,
            renewed=session.renewed,
        )
 class ResetTokenModel(Base):
    __tablename__ = "reset_tokens"
    key: Mapped[bytes] = mapped_column(LargeBinary(16), primary_key=True)
    user_uuid: Mapped[bytes] = mapped_column(
        LargeBinary(16), ForeignKey("users.uuid", ondelete="CASCADE"), nullable=False
    )
    token_type: Mapped[str] = mapped_column(String, nullable=False)
    expiry: Mapped[datetime] = mapped_column(DateTime(timezone=True), nullable=False)
    def as_dataclass(self) -> ResetToken:
        return ResetToken(
            key=self.key,
            user_uuid=UUID(bytes=self.user_uuid),
            token_type=self.token_type,
            expiry=_normalize_dt(self.expiry) or self.expiry,
        )
 class PermissionModel(Base):
    __tablename__ = "permissions"
    id: Mapped[str] = mapped_column(String(64), primary_key=True)
    display_name: Mapped[str] = mapped_column(String, nullable=False)
    def as_dataclass(self):
        return SqlPermission(self.id, self.display_name)
    @staticmethod
    def from_dataclass(permission: SqlPermission):
        return PermissionModel(
            id=permission.id,
            display_name=permission.display_name,
        )
 class OrgPermission(Base):
    """Permissions each organization is allowed to grant to its roles."""
    __tablename__ = "org_permissions"
    id: Mapped[int] = mapped_column(Integer, primary_key=True)
    org_uuid: Mapped[bytes] = mapped_column(
        LargeBinary(16), ForeignKey("orgs.uuid", ondelete="CASCADE")
    )
    permission_id: Mapped[str] = mapped_column(
        String(64), ForeignKey("permissions.id", ondelete="CASCADE")
    )
 class RolePermission(Base):
    """Permissions that each role grants to its members."""
    __tablename__ = "role_permissions"
    id: Mapped[int] = mapped_column(Integer, primary_key=True)
    role_uuid: Mapped[bytes] = mapped_column(
        LargeBinary(16), ForeignKey("roles.uuid", ondelete="CASCADE")
    )
    permission_id: Mapped[str] = mapped_column(
        String(64), ForeignKey("permissions.id", ondelete="CASCADE")
    )
 class DB:
    """Legacy SQL database class for migration purposes only."""
    def __init__(self, db_path: str = DB_PATH_DEFAULT):
        """Initialize with database path."""
        self.engine = create_async_engine(db_path, echo=False)
        # Ensure SQLite foreign key enforcement is ON for every new connection
        if db_path.startswith("sqlite"):
            @event.listens_for(self.engine.sync_engine, "connect")
            def _fk_on(dbapi_connection, connection_record):
                try:
                    cursor = dbapi_connection.cursor()
                    cursor.execute("PRAGMA foreign_keys=ON;")
                    cursor.close()
                except Exception:
                    pass
        self.async_session_factory = async_sessionmaker(
            self.engine, expire_on_commit=False
        )
    @asynccontextmanager
    async def session(self):
        """Async context manager that provides a database session with transaction."""
        async with self.async_session_factory() as session:
            async with session.begin():
                yield session
                await session.flush()
            await session.commit()
    async def init_db(self) -> None:
        """Initialize database tables."""
        async with self.engine.begin() as conn:
            await conn.run_sync(Base.metadata.create_all)
    async def list_permissions(self) -> list[SqlPermission]:
        async with self.session() as session:
            result = await session.execute(select(PermissionModel))
            return [p.as_dataclass() for p in result.scalars().all()]
    async def list_organizations(self) -> list[Org]:
        async with self.session() as session:
            # Load all orgs
            orgs_result = await session.execute(select(OrgModel))
            org_models = orgs_result.scalars().all()
            if not org_models:
                return []
            # Preload org permissions mapping
            org_perms_result = await session.execute(select(OrgPermission))
            org_perms = org_perms_result.scalars().all()
            perms_by_org: dict[bytes, list[str]] = {}
            for op in org_perms:
                perms_by_org.setdefault(op.org_uuid, []).append(op.permission_id)
            # Preload roles
            roles_result = await session.execute(select(RoleModel))
            role_models = roles_result.scalars().all()
            # Preload role permissions mapping
            rp_result = await session.execute(select(RolePermission))
            rps = rp_result.scalars().all()
            perms_by_role: dict[bytes, list[str]] = {}
            for rp in rps:
                perms_by_role.setdefault(rp.role_uuid, []).append(rp.permission_id)
            # Build org dataclasses with roles and permission IDs
            roles_by_org: dict[bytes, list[Role]] = {}
            for rm in role_models:
                r_dc = rm.as_dataclass()
                r_dc.permissions = perms_by_role.get(rm.uuid, [])
                roles_by_org.setdefault(rm.org_uuid, []).append(r_dc)
            orgs: list[Org] = []
            for om in org_models:
                o_dc = om.as_dataclass()
                o_dc.permissions = perms_by_org.get(om.uuid, [])
                o_dc.roles = roles_by_org.get(om.uuid, [])
                orgs.append(o_dc)
            return orgs
@@ -3,9 +3,8 @@
 from collections.abc import Sequence
 from fnmatch import fnmatchcase
-from paskia.globals import db
+from paskia import db
 from paskia.util.hostutil import normalize_host
 from paskia.util.tokens import session_key
 __all__ = ["has_any", "has_all", "session_context"]
@@ -17,16 +16,28 @@ def _match(perms: set[str], patterns: Sequence[str]):
    )
 def _get_effective_scopes(ctx) -> set[str]:
    """Get effective permission scopes from context.
    Returns scopes from ctx.permissions (filtered by org) if available,
    otherwise falls back to ctx.role.permissions for backwards compatibility.
    """
    if ctx.permissions:
        return {p.scope for p in ctx.permissions}
    # Fallback for contexts without effective permissions computed
    return set(ctx.role.permissions or [])
 def has_any(ctx, patterns: Sequence[str]) -> bool:
-    return any(_match(ctx.role.permissions, patterns)) if ctx else False
+    return any(_match(_get_effective_scopes(ctx), patterns)) if ctx else False
 def has_all(ctx, patterns: Sequence[str]) -> bool:
-    return all(_match(ctx.role.permissions, patterns)) if ctx else False
+    return all(_match(_get_effective_scopes(ctx), patterns)) if ctx else False
 async def session_context(auth: str | None, host: str | None = None):
    if not auth:
        return None
    normalized_host = normalize_host(host) if host else None
-    return await db.instance.get_session_context(session_key(auth), normalized_host)
+    return db.get_session_context(auth, normalized_host)
@@ -2,6 +2,7 @@
 from datetime import datetime, timezone
 from paskia.authsession import EXPIRES
 from paskia.db import SessionContext
 from paskia.util.timeutil import parse_duration
@@ -27,11 +28,11 @@ def check_session_age(ctx: SessionContext, max_age: str | None) -> bool:
    max_age_delta = parse_duration(max_age)
-    # Use credential's last_used time if available, fall back to session renewed
+    # Use credential's last_used time if available, fall back to session renewed time
    if ctx.credential and ctx.credential.last_used:
        auth_time = ctx.credential.last_used
    else:
-        auth_time = ctx.session.renewed
+        auth_time = ctx.session.expiry - EXPIRES
    time_since_auth = datetime.now(timezone.utc) - auth_time
    return time_since_auth <= max_age_delta
@@ -1,44 +0,0 @@
 import hashlib
 import secrets
 import base64url
 from paskia.util.passphrase import is_well_formed
 def create_token() -> str:
    return secrets.token_urlsafe(12)  # 16 characters Base64
 def session_key(token: str) -> bytes:
    if len(token) != 16:
        raise ValueError("Session token must be exactly 16 characters long")
    return b"sess" + base64url.dec(token)
 def encode_session_key(key: bytes) -> str:
    """Encode an opaque session key for external representation."""
    return base64url.enc(key)
 def decode_session_key(encoded: str) -> bytes:
    """Decode an opaque session key from its public representation."""
    if not encoded:
        raise ValueError("Invalid session identifier")
    try:
        raw = base64url.dec(encoded)
    except Exception as exc:  # pragma: no cover - defensive
        raise ValueError("Invalid session identifier") from exc
    if not raw.startswith(b"sess"):
        raise ValueError("Invalid session identifier")
    return raw
 def reset_key(passphrase: str) -> bytes:
    if not is_well_formed(passphrase):
        raise ValueError(
            "Trying to reset with a session token in place of a passphrase"
            if len(passphrase) == 16
            else "Invalid passphrase format"
        )
    return b"rset" + hashlib.sha512(passphrase.encode()).digest()[:12]
@@ -2,10 +2,9 @@
 from datetime import timezone
-from paskia import aaguid
+from paskia import aaguid, db
-from paskia.authsession import session_key
+from paskia.authsession import EXPIRES
-from paskia.globals import db
+from paskia.util import hostutil, permutil, useragent
 from paskia.util import hostutil, permutil, tokens, useragent
 def _format_datetime(dt):
@@ -41,20 +40,15 @@ async def format_user_info(
        - Sessions list
        - Permissions
    """
-    u = await db.instance.get_user_by_uuid(user_uuid)
+    u = db.get_user_by_uuid(user_uuid)
    ctx = await permutil.session_context(auth, request_host)
    # Fetch and format credentials
-    credential_ids = await db.instance.get_credentials_by_user_uuid(user_uuid)
+    user_credentials = db.get_credentials_by_user_uuid(user_uuid)
    credentials: list[dict] = []
    user_aaguids: set[str] = set()
-    for cred_id in credential_ids:
+    for c in user_credentials:
        try:
            c = await db.instance.get_credential_by_id(cred_id)
        except ValueError:
            continue
        aaguid_str = str(c.aaguid)
        user_aaguids.add(aaguid_str)
        credentials.append(
@@ -76,8 +70,6 @@ async def format_user_info(
    role_info = None
    org_info = None
    effective_permissions: list[str] = []
    is_global_admin = False
    is_org_admin = False
    if ctx:
        role_info = {
@@ -90,27 +82,23 @@ async def format_user_info(
            "display_name": ctx.org.display_name,
            "permissions": ctx.org.permissions,
        }
-        effective_permissions = [p.id for p in (ctx.permissions or [])]
+        effective_permissions = [p.scope for p in (ctx.permissions or [])]
        is_global_admin = "auth:admin" in (role_info["permissions"] or [])
        is_org_admin = any(
            p.startswith("auth:org:") for p in (role_info["permissions"] or [])
        )
    # Format sessions
    normalized_request_host = hostutil.normalize_host(request_host)
-    session_records = await db.instance.list_sessions_for_user(user_uuid)
+    session_records = db.list_sessions_for_user(user_uuid)
-    current_session_key = session_key(auth)
+    current_session_key = auth
    sessions_payload: list[dict] = []
    for entry in session_records:
        sessions_payload.append(
            {
-                "id": tokens.encode_session_key(entry.key),
+                "id": entry.key,
                "credential_uuid": str(entry.credential_uuid),
                "host": entry.host,
                "ip": entry.ip,
                "user_agent": useragent.compact_user_agent(entry.user_agent),
-                "last_renewed": _format_datetime(entry.renewed),
+                "last_renewed": _format_datetime(entry.expiry - EXPIRES),
                "is_current": entry.key == current_session_key,
                "is_current_host": bool(
                    normalized_request_host
@@ -132,8 +120,6 @@ async def format_user_info(
        "org": org_info,
        "role": role_info,
        "permissions": effective_permissions,
        "is_global_admin": is_global_admin,
        "is_org_admin": is_org_admin,
        "credentials": credentials,
        "aaguid_info": aaguid_info,
        "sessions": sessions_payload,
@@ -150,7 +136,7 @@ async def format_reset_user_info(user_uuid, reset_token) -> dict:
    Returns:
        Dictionary with minimal user info for password reset flow
    """
-    u = await db.instance.get_user_by_uuid(user_uuid)
+    u = db.get_user_by_uuid(user_uuid)
    return {
        "authenticated": False,
@@ -16,11 +16,12 @@ dependencies = [
    "websockets>=12.0",
    "webauthn>=1.11.1",
    "base64url>=1.0.0",
    "sqlalchemy[asyncio]>=2.0.0",
    "aiosqlite>=0.19.0",
    "uuid7-standard>=1.0.0",
    "pyjwt>=2.8.0",
    "user-agents>=2.2.0",
    "jsondiff>=2.2.1",
    "msgspec>=0.20.0",
    "aiofiles>=25.1.0",
 ]
 requires-python = ">=3.10"
@@ -42,6 +43,10 @@ dev = [
    "pytest-asyncio>=0.24.0",
    "httpx>=0.27.0",
 ]
 migrate = [
    "sqlalchemy[asyncio]>=2.0.0",
    "aiosqlite>=0.19.0",
 ]
 [tool.coverage.run]
 source = ["paskia"]
@@ -89,6 +94,7 @@ dev = [
 [project.scripts]
 paskia = "paskia.fastapi.__main__:main"
 paskia-migrate = "paskia.migrate:main"
 [tool.hatch.build]
 artifacts = ["paskia/frontend-build"]
@@ -118,7 +118,9 @@ def parse_endpoint(
    return host, port, None, False
-def run_vite(vite_url: str, vite_host: str | None, vite_port: int, auth_host: str | None = None):
+def run_vite(
    vite_url: str, vite_host: str | None, vite_port: int, auth_host: str | None = None
 ):
    """Spawn the frontend dev server (deno, npm, or bunx) as a background process."""
    devpath = Path(__file__).parent.parent / "frontend"
    if not (devpath / "package.json").exists():
@@ -163,7 +165,9 @@ def run_vite(vite_url: str, vite_host: str | None, vite_port: int, auth_host: st
            vite_env = os.environ.copy()
            if auth_host:
                vite_env["PASKIA_AUTH_HOST"] = auth_host
-            vite_process = subprocess.Popen(full_cmd, cwd=str(devpath), shell=False, env=vite_env)
+            vite_process = subprocess.Popen(
                full_cmd, cwd=str(devpath), shell=False, env=vite_env
            )
        except Exception as e:
            stderr.write(
                f"┃ ⚠️  Vite couldn't start: {e}\n"
@@ -11,6 +11,7 @@ in the database to test authenticated endpoints.
 import asyncio
 import os
 import tempfile
 from collections.abc import AsyncGenerator
 from datetime import datetime, timezone
 from uuid import UUID
@@ -20,15 +21,26 @@ import pytest
 import pytest_asyncio
 import uuid7
-from paskia import globals
+from paskia import globals as paskia_globals
-from paskia.db import Credential, Org, Permission, Role, User
+from paskia.authsession import expires
-from paskia.db.sql import DB
+from paskia.db import (
    Credential,
    Org,
    Permission,
    Role,
    User,
    add_permission_to_organization,
    create_credential,
    create_organization,
    create_permission,
    create_reset_token,
    create_role,
    create_session,
    create_user,
 )
 from paskia.db.operations import DB, _create_token
 from paskia.fastapi.session import AUTH_COOKIE_NAME
 from paskia.sansio import Passkey
 from paskia.util.tokens import create_token, session_key
 # Use in-memory SQLite for tests
 os.environ["PASKIA_DB"] = "sqlite+aiosqlite:///:memory:"
@pytest.fixture(scope="session")
@@ -41,16 +53,19 @@ def event_loop():
@pytest_asyncio.fixture(scope="function")
 async def test_db() -> AsyncGenerator[DB, None]:
-    """Create an in-memory SQLite database for testing.
+    """Create an in-memory JSON database for testing.
-    We use :memory: for speed - each test gets a fresh database.
+    Uses a temp file that gets cleaned up after each test.
    """
-    db = DB("sqlite+aiosqlite:///:memory:")
+    import paskia.db.operations as ops_db
-    await db.init_db()
+
-    globals.db._instance = db
+    with tempfile.NamedTemporaryFile(suffix=".jsonl", delete=True) as f:
-    yield db
+        db = DB(f.name)
-    # Clean up
+        await db.load()
-    globals.db._instance = None
+        ops_db._db = db
        yield db
        # Clean up
        ops_db._db = None
@pytest_asyncio.fixture(scope="function")
@@ -61,9 +76,9 @@ async def passkey_instance() -> Passkey:
        rp_name="Test RP",
        origins=["http://localhost:4401"],
    )
-    globals.passkey._instance = pk
+    paskia_globals.passkey._instance = pk
    yield pk
-    globals.passkey._instance = None
+    paskia_globals.passkey._instance = None
@pytest_asyncio.fixture(scope="function")
@@ -72,30 +87,53 @@ async def test_org(test_db: DB, admin_permission: Permission) -> Org:
    org = Org(
        uuid=uuid7.create(),
        display_name="Test Organization",
-        permissions=["auth:admin"],  # Org can grant this permission
+        permissions=[str(admin_permission.uuid)],  # Org can grant this permission
    )
-    await test_db.create_organization(org)
+    create_organization(org)
    return org
@pytest_asyncio.fixture(scope="function")
 async def admin_permission(test_db: DB) -> Permission:
    """Create the auth:admin permission."""
-    perm = Permission(id="auth:admin", display_name="Master Admin")
+    import uuid7
-    await test_db.create_permission(perm)
+
    perm = Permission(
        uuid=uuid7.create(), scope="auth:admin", display_name="Master Admin"
    )
    create_permission(perm)
    return perm
@pytest_asyncio.fixture(scope="function")
-async def test_role(test_db: DB, test_org: Org, admin_permission: Permission) -> Role:
+async def org_admin_permission(test_db: DB, test_org: Org) -> Permission:
    """Create the auth:org:admin permission."""
    import uuid7
    perm = Permission(
        uuid=uuid7.create(), scope="auth:org:admin", display_name="Organization Admin"
    )
    create_permission(perm)
    # Make it grantable by the org
    add_permission_to_organization(str(test_org.uuid), "auth:org:admin")
    return perm
@pytest_asyncio.fixture(scope="function")
 async def test_role(
    test_db: DB,
    test_org: Org,
    admin_permission: Permission,
    org_admin_permission: Permission,
 ) -> Role:
    """Create a test role with admin permission."""
    role = Role(
        uuid=uuid7.create(),
        org_uuid=test_org.uuid,
        display_name="Test Admin Role",
-        permissions=["auth:admin", f"auth:org:{test_org.uuid}"],
+        permissions=[str(admin_permission.uuid), str(org_admin_permission.uuid)],
    )
-    await test_db.create_role(role)
+    create_role(role)
    return role
@@ -108,7 +146,7 @@ async def user_role(test_db: DB, test_org: Org) -> Role:
        display_name="User Role",
        permissions=[],
    )
-    await test_db.create_role(role)
+    create_role(role)
    return role
@@ -122,7 +160,7 @@ async def test_user(test_db: DB, test_role: Role) -> User:
        created_at=datetime.now(timezone.utc),
        visits=0,
    )
-    await test_db.create_user(user)
+    create_user(user)
    return user
@@ -136,7 +174,7 @@ async def regular_user(test_db: DB, user_role: Role) -> User:
        created_at=datetime.now(timezone.utc),
        visits=0,
    )
-    await test_db.create_user(user)
+    create_user(user)
    return user
@@ -154,7 +192,7 @@ async def test_credential(test_db: DB, test_user: User) -> Credential:
        last_used=None,
        last_verified=None,
    )
-    await test_db.create_credential(credential)
+    create_credential(credential)
    return credential
@@ -172,7 +210,7 @@ async def regular_credential(test_db: DB, regular_user: User) -> Credential:
        last_used=None,
        last_verified=None,
    )
-    await test_db.create_credential(credential)
+    create_credential(credential)
    return credential
@@ -181,15 +219,15 @@ async def session_token(
    test_db: DB, test_user: User, test_credential: Credential
 ) -> str:
    """Create a session for the admin user and return the token."""
-    token = create_token()
+    token = _create_token()
-    await test_db.create_session(
+    create_session(
        user_uuid=test_user.uuid,
        credential_uuid=test_credential.uuid,
-        key=session_key(token),
+        key=token,
        host="localhost:4401",
        ip="127.0.0.1",
        user_agent="pytest",
-        renewed=datetime.now(timezone.utc),
+        expiry=expires(),
    )
    return token
@@ -199,15 +237,15 @@ async def regular_session_token(
    test_db: DB, regular_user: User, regular_credential: Credential
 ) -> str:
    """Create a session for a regular user and return the token."""
-    token = create_token()
+    token = _create_token()
-    await test_db.create_session(
+    create_session(
        user_uuid=regular_user.uuid,
        credential_uuid=regular_credential.uuid,
-        key=session_key(token),
+        key=token,
        host="localhost:4401",
        ip="127.0.0.1",
        user_agent="pytest",
-        renewed=datetime.now(timezone.utc),
+        expiry=expires(),
    )
    return token
@@ -217,12 +255,11 @@ async def reset_token(test_db: DB, test_user: User, test_credential: Credential)
    """Create a reset token for the test user."""
    from paskia.authsession import reset_expires
    from paskia.util.passphrase import generate
    from paskia.util.tokens import reset_key
    token = generate()
-    await test_db.create_reset_token(
+    create_reset_token(
        user_uuid=test_user.uuid,
-        key=reset_key(token),
+        passphrase=token,
        expiry=reset_expires(),
        token_type="reset",
    )
@@ -19,9 +19,22 @@ import pytest
 import pytest_asyncio
 import uuid7
-from paskia.db import Credential, Org, Permission, Role, User
+from paskia.authsession import expires
-from paskia.db.sql import DB
+from paskia.db import (
-from paskia.util.tokens import create_token, encode_session_key, session_key
+    Credential,
    Org,
    Permission,
    Role,
    User,
    add_permission_to_organization,
    create_credential,
    create_organization,
    create_permission,
    create_role,
    create_session,
    create_user,
 )
 from paskia.db.operations import DB, _create_token
 from tests.conftest import auth_headers
 # -------------------- Additional Fixtures --------------------
@@ -35,7 +48,7 @@ async def second_org(test_db: DB) -> Org:
        display_name="Second Organization",
        permissions=[],
    )
-    await test_db.create_organization(org)
+    create_organization(org)
    return org
@@ -48,9 +61,9 @@ async def second_org_role(
        uuid=uuid7.create(),
        org_uuid=second_org.uuid,
        display_name="Second Org Admin Role",
-        permissions=["auth:admin"],
+        permissions=[str(admin_permission.uuid)],
    )
-    await test_db.create_role(role)
+    create_role(role)
    return role
@@ -64,7 +77,7 @@ async def second_org_user(test_db: DB, second_org_role: Role) -> User:
        created_at=datetime.now(timezone.utc),
        visits=0,
    )
-    await test_db.create_user(user)
+    create_user(user)
    return user
@@ -84,7 +97,7 @@ async def second_org_credential(test_db: DB, second_org_user: User) -> Credentia
        last_used=datetime.now(timezone.utc),
        last_verified=datetime.now(timezone.utc),
    )
-    await test_db.create_credential(credential)
+    create_credential(credential)
    return credential
@@ -93,29 +106,31 @@ async def second_org_session_token(
    test_db: DB, second_org_user: User, second_org_credential: Credential
 ) -> str:
    """Create a session for the second org admin user."""
-    token = create_token()
+    token = _create_token()
-    await test_db.create_session(
+    create_session(
        user_uuid=second_org_user.uuid,
        credential_uuid=second_org_credential.uuid,
-        key=session_key(token),
+        key=token,
        host="localhost:4401",
        ip="127.0.0.1",
        user_agent="pytest",
-        renewed=datetime.now(timezone.utc),
+        expiry=expires(),
    )
    return token
@pytest_asyncio.fixture(scope="function")
-async def org_admin_role(test_db: DB, test_org: Org) -> Role:
+async def org_admin_role(
    test_db: DB, test_org: Org, org_admin_permission: Permission
 ) -> Role:
    """Create a role with org admin permission only (no global admin)."""
    role = Role(
        uuid=uuid7.create(),
        org_uuid=test_org.uuid,
        display_name="Org Admin Role",
-        permissions=[f"auth:org:{test_org.uuid}"],
+        permissions=[str(org_admin_permission.uuid)],
    )
-    await test_db.create_role(role)
+    create_role(role)
    return role
@@ -130,7 +145,7 @@ async def org_admin_user(test_db: DB, org_admin_role: Role) -> User:
        visits=5,
        last_seen=datetime.now(timezone.utc),
    )
-    await test_db.create_user(user)
+    create_user(user)
    return user
@@ -150,7 +165,7 @@ async def org_admin_credential(test_db: DB, org_admin_user: User) -> Credential:
        last_used=datetime.now(timezone.utc),
        last_verified=None,
    )
-    await test_db.create_credential(credential)
+    create_credential(credential)
    return credential
@@ -159,15 +174,15 @@ async def org_admin_session_token(
    test_db: DB, org_admin_user: User, org_admin_credential: Credential
 ) -> str:
    """Create a session for the org admin user."""
-    token = create_token()
+    token = _create_token()
-    await test_db.create_session(
+    create_session(
        user_uuid=org_admin_user.uuid,
        credential_uuid=org_admin_credential.uuid,
-        key=session_key(token),
+        key=token,
        host="localhost:4401",
        ip="127.0.0.1",
        user_agent="pytest",
-        renewed=datetime.now(timezone.utc),
+        expiry=expires(),
    )
    return token
@@ -175,10 +190,14 @@ async def org_admin_session_token(
@pytest_asyncio.fixture(scope="function")
 async def grantable_permission(test_db: DB, test_org: Org) -> Permission:
    """Create a permission and add it to org's grantable permissions."""
-    perm = Permission(id="test:grantable:perm", display_name="Grantable Perm")
+    import uuid7
-    await test_db.create_permission(perm)
+
    perm = Permission(
        uuid=uuid7.create(), scope="test:grantable:perm", display_name="Grantable Perm"
    )
    create_permission(perm)
    # Add to org's grantable permissions
-    await test_db.add_permission_to_organization(str(test_org.uuid), perm.id)
+    add_permission_to_organization(str(test_org.uuid), perm.scope)
    return perm
@@ -333,7 +352,7 @@ class TestAdminOrganizations:
        self, client: httpx.AsyncClient, session_token: str, test_org
    ):
        """Admin should be able to update an organization."""
-        response = await client.put(
+        response = await client.patch(
            f"/auth/api/admin/orgs/{test_org.uuid}",
            json={"display_name": "Updated Org Name"},
            headers={**auth_headers(session_token), "Host": "localhost:4401"},
@@ -350,11 +369,10 @@ class TestAdminOrganizations:
        test_org,
    ):
        """Org admin should be able to update their organization."""
-        response = await client.put(
+        response = await client.patch(
            f"/auth/api/admin/orgs/{test_org.uuid}",
            json={
                "display_name": "Org Admin Updated Name",
                "permissions": [f"auth:org:{test_org.uuid}"],  # Keep org admin perm
            },
            headers={**auth_headers(org_admin_session_token), "Host": "localhost:4401"},
        )
@@ -371,31 +389,15 @@ class TestAdminOrganizations:
        test_db: DB,
    ):
        """Org admin cannot remove their org admin permission from org's permissions."""
-        # First create and add the org admin perm to the org's grantable perms
+        # The auth:org:admin perm is already created and added by org_admin_permission fixture
        org_admin_perm_id = f"auth:org:{test_org.uuid}"
        perm = Permission(id=org_admin_perm_id, display_name="Org Admin")
        try:
            await test_db.create_permission(perm)
        except Exception:
            pass  # Permission may already exist
-        # Add it to the org's permissions
+        # Try to remove org admin perm (this is validated server-side in the remove endpoint)
-        await test_db.add_permission_to_organization(
+        response = await client.delete(
-            str(test_org.uuid), org_admin_perm_id
+            f"/auth/api/admin/orgs/{test_org.uuid}/permission?permission_id=auth:org:admin",
        )
        # Try to remove all permissions including org admin perm
        response = await client.put(
            f"/auth/api/admin/orgs/{test_org.uuid}",
            json={
                "display_name": "Try Remove Own Perm",
                "permissions": [],  # Remove org admin perm from org's permissions
            },
            headers={**auth_headers(org_admin_session_token), "Host": "localhost:4401"},
        )
-        assert response.status_code == 400
+        # This should fail because only global admin can remove perms from org
-        data = response.json()
+        assert response.status_code == 403
        assert "Cannot remove organization admin permission" in data["detail"]
    @pytest.mark.asyncio
    async def test_delete_org_own_org_fails(
@@ -418,19 +420,23 @@ class TestAdminOrganizations:
        test_db: DB,
    ):
        """Admin should be able to delete another organization."""
        import uuid7
        # Create org to delete
        org_to_delete = Org(
            uuid=uuid7.create(),
            display_name="Org To Delete",
            permissions=[],
        )
-        await test_db.create_organization(org_to_delete)
+        create_organization(org_to_delete)
        # Create some org-specific permissions to test cleanup
        org_perm = Permission(
-            id=f"test:org:{org_to_delete.uuid}:feature", display_name="Org Feature"
+            uuid=uuid7.create(),
            scope=f"test:org:{org_to_delete.uuid}:feature",
            display_name="Org Feature",
        )
-        await test_db.create_permission(org_perm)
+        create_permission(org_perm)
        response = await client.delete(
            f"/auth/api/admin/orgs/{org_to_delete.uuid}",
@@ -455,7 +461,7 @@ class TestAdminOrgPermissions:
        # First create a permission
        await client.post(
            "/auth/api/admin/permissions",
-            json={"id": "test:org:addable", "display_name": "Addable"},
+            json={"scope": "test:org:addable", "display_name": "Addable"},
            headers={**auth_headers(session_token), "Host": "localhost:4401"},
        )
@@ -490,7 +496,7 @@ class TestAdminOrgPermissions:
        # First create and add a permission
        await client.post(
            "/auth/api/admin/permissions",
-            json={"id": "test:org:removable", "display_name": "Removable"},
+            json={"scope": "test:org:removable", "display_name": "Removable"},
            headers={**auth_headers(session_token), "Host": "localhost:4401"},
        )
        await client.post(
@@ -584,7 +590,7 @@ class TestAdminRoles:
            f"/auth/api/admin/orgs/{test_org.uuid}/roles",
            json={
                "display_name": "Role With Perms",
-                "permissions": [grantable_permission.id],
+                "permissions": [grantable_permission.scope],
            },
            headers={**auth_headers(session_token), "Host": "localhost:4401"},
        )
@@ -602,8 +608,14 @@ class TestAdminRoles:
    ):
        """Creating role with non-grantable permission should fail."""
        # Create permission but don't add to org
-        perm = Permission(id="test:not:grantable", display_name="Not Grantable")
+        import uuid7
-        await test_db.create_permission(perm)
+
        perm = Permission(
            uuid=uuid7.create(),
            scope="test:not:grantable",
            display_name="Not Grantable",
        )
        create_permission(perm)
        response = await client.post(
            f"/auth/api/admin/orgs/{test_org.uuid}/roles",
@@ -622,7 +634,7 @@ class TestAdminRoles:
        self, client: httpx.AsyncClient, session_token: str, test_org, test_role
    ):
        """Admin should be able to update a role."""
-        response = await client.put(
+        response = await client.patch(
            f"/auth/api/admin/orgs/{test_org.uuid}/roles/{test_role.uuid}",
            json={"display_name": "Updated Role Name"},
            headers={**auth_headers(session_token), "Host": "localhost:4401"},
@@ -636,7 +648,7 @@ class TestAdminRoles:
        self, client: httpx.AsyncClient, session_token: str, test_org, second_org_role
    ):
        """Cannot update role from another org."""
-        response = await client.put(
+        response = await client.patch(
            f"/auth/api/admin/orgs/{test_org.uuid}/roles/{second_org_role.uuid}",
            json={"display_name": "Try Update Wrong Org"},
            headers={**auth_headers(session_token), "Host": "localhost:4401"},
@@ -655,9 +667,8 @@ class TestAdminRoles:
        grantable_permission,
    ):
        """Admin should be able to add grantable permissions to role."""
-        response = await client.put(
+        response = await client.post(
-            f"/auth/api/admin/orgs/{test_org.uuid}/roles/{user_role.uuid}",
+            f"/auth/api/admin/orgs/{test_org.uuid}/roles/{user_role.uuid}/permissions/{grantable_permission.uuid}",
            json={"permissions": [grantable_permission.id]},
            headers={**auth_headers(session_token), "Host": "localhost:4401"},
        )
        assert response.status_code == 200
@@ -672,12 +683,17 @@ class TestAdminRoles:
        test_db: DB,
    ):
        """Adding non-grantable permission to role should fail."""
-        perm = Permission(id="test:not:grantable:update", display_name="Not Grantable")
+        import uuid7
        await test_db.create_permission(perm)
-        response = await client.put(
+        perm = Permission(
-            f"/auth/api/admin/orgs/{test_org.uuid}/roles/{user_role.uuid}",
+            uuid=uuid7.create(),
-            json={"permissions": ["test:not:grantable:update"]},
+            scope="test:not:grantable:update",
            display_name="Not Grantable",
        )
        create_permission(perm)
        response = await client.post(
            f"/auth/api/admin/orgs/{test_org.uuid}/roles/{user_role.uuid}/permissions/{perm.uuid}",
            headers={**auth_headers(session_token), "Host": "localhost:4401"},
        )
        assert response.status_code == 400
@@ -686,17 +702,31 @@ class TestAdminRoles:
    @pytest.mark.asyncio
    async def test_update_own_role_cannot_remove_admin(
-        self, client: httpx.AsyncClient, session_token: str, test_org, test_role
+        self,
        client: httpx.AsyncClient,
        session_token: str,
        test_org,
        test_role,
        admin_permission,
        org_admin_permission,
    ):
        """Admin cannot remove their own admin permissions."""
-        response = await client.put(
+        # test_role has both auth:admin and auth:org:admin
-            f"/auth/api/admin/orgs/{test_org.uuid}/roles/{test_role.uuid}",
+        # Remove auth:admin first (should succeed since org:admin remains)
-            json={"permissions": []},  # Remove all permissions
+        response = await client.delete(
            f"/auth/api/admin/orgs/{test_org.uuid}/roles/{test_role.uuid}/permissions/{admin_permission.uuid}",
            headers={**auth_headers(session_token), "Host": "localhost:4401"},
        )
        assert response.status_code == 200
        # Now try to remove auth:org:admin (should fail - would leave no admin access)
        response = await client.delete(
            f"/auth/api/admin/orgs/{test_org.uuid}/roles/{test_role.uuid}/permissions/{org_admin_permission.uuid}",
            headers={**auth_headers(session_token), "Host": "localhost:4401"},
        )
        assert response.status_code == 400
        data = response.json()
-        assert "Cannot update your own role" in data["detail"]
+        assert "Cannot remove your own admin permissions" in data["detail"]
    @pytest.mark.asyncio
    async def test_delete_role(
@@ -853,7 +883,7 @@ class TestAdminUsersInOrg:
        self, client: httpx.AsyncClient, session_token: str, test_org, test_user
    ):
        """Admin should be able to update user display name."""
-        response = await client.put(
+        response = await client.patch(
            f"/auth/api/admin/orgs/{test_org.uuid}/users/{test_user.uuid}/display-name",
            json={"display_name": "Updated Admin Name"},
            headers={**auth_headers(session_token), "Host": "localhost:4401"},
@@ -866,7 +896,7 @@ class TestAdminUsersInOrg:
    ):
        """Updating non-existent user should return 404."""
        fake_uuid = uuid7.create()
-        response = await client.put(
+        response = await client.patch(
            f"/auth/api/admin/orgs/{test_org.uuid}/users/{fake_uuid}/display-name",
            json={"display_name": "New Name"},
            headers={**auth_headers(session_token), "Host": "localhost:4401"},
@@ -880,7 +910,7 @@ class TestAdminUsersInOrg:
        self, client: httpx.AsyncClient, session_token: str, test_org, second_org_user
    ):
        """Updating user from another org should return 404."""
-        response = await client.put(
+        response = await client.patch(
            f"/auth/api/admin/orgs/{test_org.uuid}/users/{second_org_user.uuid}/display-name",
            json={"display_name": "New Name"},
            headers={**auth_headers(session_token), "Host": "localhost:4401"},
@@ -892,7 +922,7 @@ class TestAdminUsersInOrg:
        self, client: httpx.AsyncClient, session_token: str, test_org, test_user
    ):
        """Updating user with empty display name should fail."""
-        response = await client.put(
+        response = await client.patch(
            f"/auth/api/admin/orgs/{test_org.uuid}/users/{test_user.uuid}/display-name",
            json={"display_name": "   "},
            headers={**auth_headers(session_token), "Host": "localhost:4401"},
@@ -906,7 +936,7 @@ class TestAdminUsersInOrg:
        self, client: httpx.AsyncClient, session_token: str, test_org, test_user
    ):
        """Updating user with too long display name should fail."""
-        response = await client.put(
+        response = await client.patch(
            f"/auth/api/admin/orgs/{test_org.uuid}/users/{test_user.uuid}/display-name",
            json={"display_name": "x" * 100},
            headers={**auth_headers(session_token), "Host": "localhost:4401"},
@@ -926,7 +956,7 @@ class TestAdminUsersInOrg:
    ):
        """Admin should be able to change user's role within org."""
        # Use regular_user who is in the same org but not the session owner
-        response = await client.put(
+        response = await client.patch(
            f"/auth/api/admin/orgs/{test_org.uuid}/users/{regular_user.uuid}/role",
            json={"role": user_role.display_name},
            headers={**auth_headers(session_token), "Host": "localhost:4401"},
@@ -938,7 +968,7 @@ class TestAdminUsersInOrg:
        self, client: httpx.AsyncClient, session_token: str, test_org, test_user
    ):
        """Updating user role without specifying role should fail."""
-        response = await client.put(
+        response = await client.patch(
            f"/auth/api/admin/orgs/{test_org.uuid}/users/{test_user.uuid}/role",
            json={},
            headers={**auth_headers(session_token), "Host": "localhost:4401"},
@@ -953,7 +983,7 @@ class TestAdminUsersInOrg:
    ):
        """Updating role for non-existent user should fail."""
        fake_uuid = uuid7.create()
-        response = await client.put(
+        response = await client.patch(
            f"/auth/api/admin/orgs/{test_org.uuid}/users/{fake_uuid}/role",
            json={"role": "User Role"},
            headers={**auth_headers(session_token), "Host": "localhost:4401"},
@@ -967,7 +997,7 @@ class TestAdminUsersInOrg:
        self, client: httpx.AsyncClient, session_token: str, test_org, second_org_user
    ):
        """Updating role for user in another org should fail."""
-        response = await client.put(
+        response = await client.patch(
            f"/auth/api/admin/orgs/{test_org.uuid}/users/{second_org_user.uuid}/role",
            json={"role": "User Role"},
            headers={**auth_headers(session_token), "Host": "localhost:4401"},
@@ -981,7 +1011,7 @@ class TestAdminUsersInOrg:
        self, client: httpx.AsyncClient, session_token: str, test_org, test_user
    ):
        """Updating user to non-existent role should fail."""
-        response = await client.put(
+        response = await client.patch(
            f"/auth/api/admin/orgs/{test_org.uuid}/users/{test_user.uuid}/role",
            json={"role": "Nonexistent Role"},
            headers={**auth_headers(session_token), "Host": "localhost:4401"},
@@ -1000,7 +1030,7 @@ class TestAdminUsersInOrg:
        user_role,
    ):
        """Admin cannot change their own role to non-admin role."""
-        response = await client.put(
+        response = await client.patch(
            f"/auth/api/admin/orgs/{test_org.uuid}/users/{org_admin_user.uuid}/role",
            json={"role": user_role.display_name},
            headers={**auth_headers(org_admin_session_token), "Host": "localhost:4401"},
@@ -1021,7 +1051,7 @@ class TestAdminUsersInOrg:
        """Admin can change their own role to another admin role."""
        # test_user is already on test_role which has auth:admin
        # Changing to the same role should succeed (no permission loss)
-        response = await client.put(
+        response = await client.patch(
            f"/auth/api/admin/orgs/{test_org.uuid}/users/{test_user.uuid}/role",
            json={"role": test_role.display_name},
            headers={**auth_headers(session_token), "Host": "localhost:4401"},
@@ -1087,7 +1117,7 @@ class TestAdminUsersInOrg:
            created_at=datetime.now(timezone.utc),
            visits=0,
        )
-        await test_db.create_user(user_no_cred)
+        create_user(user_no_cred)
        response = await client.post(
            f"/auth/api/admin/orgs/{test_org.uuid}/users/{user_no_cred.uuid}/create-link",
@@ -1172,21 +1202,19 @@ class TestAdminSessions:
    ):
        """Admin should be able to delete a user's session."""
        # Create an additional session to delete
-        extra_token = create_token()
+        extra_token = _create_token()
-        extra_key = session_key(extra_token)
+        create_session(
        await test_db.create_session(
            user_uuid=test_user.uuid,
            credential_uuid=test_credential.uuid,
-            key=extra_key,
+            key=extra_token,
            host="other.host:4401",
            ip="192.168.1.1",
            user_agent="other-agent",
-            renewed=datetime.now(timezone.utc),
+            expiry=expires(),
        )
        encoded_key = encode_session_key(extra_key)
        response = await client.delete(
-            f"/auth/api/admin/orgs/{test_org.uuid}/users/{test_user.uuid}/sessions/{encoded_key}",
+            f"/auth/api/admin/orgs/{test_org.uuid}/users/{test_user.uuid}/sessions/{extra_token}",
            headers={**auth_headers(session_token), "Host": "localhost:4401"},
        )
        assert response.status_code == 200
@@ -1203,9 +1231,8 @@ class TestAdminSessions:
        test_user,
    ):
        """Admin can delete their own current session."""
        encoded_key = encode_session_key(session_key(session_token))
        response = await client.delete(
-            f"/auth/api/admin/orgs/{test_org.uuid}/users/{test_user.uuid}/sessions/{encoded_key}",
+            f"/auth/api/admin/orgs/{test_org.uuid}/users/{test_user.uuid}/sessions/{session_token}",
            headers={**auth_headers(session_token), "Host": "localhost:4401"},
        )
        assert response.status_code == 200
@@ -1245,14 +1272,14 @@ class TestAdminSessions:
    async def test_delete_session_invalid_id(
        self, client: httpx.AsyncClient, session_token: str, test_org, test_user
    ):
-        """Deleting session with invalid ID format should fail."""
+        """Deleting session with invalid/non-existent ID should fail."""
        response = await client.delete(
            f"/auth/api/admin/orgs/{test_org.uuid}/users/{test_user.uuid}/sessions/invalid!!id",
            headers={**auth_headers(session_token), "Host": "localhost:4401"},
        )
-        assert response.status_code == 400
+        assert response.status_code == 404
        data = response.json()
-        assert "Invalid session identifier" in data["detail"]
+        assert "Session not found" in data["detail"]
    @pytest.mark.asyncio
    async def test_delete_session_not_found(
@@ -1260,10 +1287,9 @@ class TestAdminSessions:
    ):
        """Deleting non-existent session should fail."""
        # Use a valid format but non-existent key
-        fake_key = session_key(create_token())
+        fake_token = _create_token()
        encoded_key = encode_session_key(fake_key)
        response = await client.delete(
-            f"/auth/api/admin/orgs/{test_org.uuid}/users/{test_user.uuid}/sessions/{encoded_key}",
+            f"/auth/api/admin/orgs/{test_org.uuid}/users/{test_user.uuid}/sessions/{fake_token}",
            headers={**auth_headers(session_token), "Host": "localhost:4401"},
        )
        assert response.status_code == 404
@@ -1290,8 +1316,8 @@ class TestAdminPermissions:
        data = response.json()
        assert isinstance(data, list)
        # Should include at least auth:admin
-        perm_ids = [p["id"] for p in data]
+        perm_scopes = [p["scope"] for p in data]
-        assert "auth:admin" in perm_ids
+        assert "auth:admin" in perm_scopes
    @pytest.mark.asyncio
    async def test_list_permissions_org_admin(
@@ -1301,7 +1327,7 @@ class TestAdminPermissions:
        test_org,
        grantable_permission,
    ):
-        """Org admin should only see grantable permissions."""
+        """Org admin should only see permissions their org can grant."""
        response = await client.get(
            "/auth/api/admin/permissions",
            headers={**auth_headers(org_admin_session_token), "Host": "localhost:4401"},
@@ -1309,10 +1335,12 @@ class TestAdminPermissions:
        assert response.status_code == 200
        data = response.json()
        # Should only see permissions the org can grant
-        perm_ids = [p["id"] for p in data]
+        perm_scopes = [p["scope"] for p in data]
-        assert grantable_permission.id in perm_ids
+        assert grantable_permission.scope in perm_scopes
-        # Should NOT see auth:admin (not grantable by org)
+        # test_org CAN grant auth:admin (it's in org.permissions), so org admin sees it
-        assert "auth:admin" not in perm_ids
+        assert "auth:admin" in perm_scopes
        # Should also see auto-created org admin permission
        assert "auth:org:admin" in perm_scopes
    @pytest.mark.asyncio
    async def test_create_permission(
@@ -1321,7 +1349,7 @@ class TestAdminPermissions:
        """Admin should be able to create new permissions."""
        response = await client.post(
            "/auth/api/admin/permissions",
-            json={"id": "test:create:permission", "display_name": "Test Permission"},
+            json={"scope": "test:create:permission", "display_name": "Test Permission"},
            headers={**auth_headers(session_token), "Host": "localhost:4401"},
        )
        assert response.status_code == 200
@@ -1349,7 +1377,7 @@ class TestAdminPermissions:
        """Creating permission without admin should fail."""
        response = await client.post(
            "/auth/api/admin/permissions",
-            json={"id": "test:forbidden", "display_name": "Forbidden"},
+            json={"scope": "test:forbidden", "display_name": "Forbidden"},
            headers={
                **auth_headers(regular_session_token),
                "Host": "localhost:4401",
@@ -1363,10 +1391,14 @@ class TestAdminPermissions:
    ):
        """Admin should be able to update a permission."""
        # Create permission first
-        perm = Permission(id="test:updateable", display_name="Updateable")
+        import uuid7
        await test_db.create_permission(perm)
-        response = await client.put(
+        perm = Permission(
            uuid=uuid7.create(), scope="test:updateable", display_name="Updateable"
        )
        create_permission(perm)
        response = await client.patch(
            "/auth/api/admin/permission?permission_id=test:updateable&display_name=Updated%20Name",
            headers={**auth_headers(session_token), "Host": "localhost:4401"},
        )
@@ -1376,10 +1408,18 @@ class TestAdminPermissions:
    @pytest.mark.asyncio
    async def test_update_permission_empty_name(
-        self, client: httpx.AsyncClient, session_token: str
+        self, client: httpx.AsyncClient, session_token: str, test_db: DB
    ):
        """Updating permission with empty name should fail."""
-        response = await client.put(
+        # Create permission first
        import uuid7
        perm = Permission(
            uuid=uuid7.create(), scope="test:perm", display_name="Test Perm"
        )
        create_permission(perm)
        response = await client.patch(
            "/auth/api/admin/permission?permission_id=test:perm&display_name=",
            headers={**auth_headers(session_token), "Host": "localhost:4401"},
        )
@@ -1393,12 +1433,16 @@ class TestAdminPermissions:
    ):
        """Admin should be able to rename a permission."""
        # Create permission first
-        perm = Permission(id="test:renameable2", display_name="Renameable")
+        import uuid7
-        await test_db.create_permission(perm)
+
        perm = Permission(
            uuid=uuid7.create(), scope="test:renameable2", display_name="Renameable"
        )
        create_permission(perm)
        response = await client.post(
            "/auth/api/admin/permission/rename",
-            json={"old_id": "test:renameable2", "new_id": "test:renamed2"},
+            json={"old_scope": "test:renameable2", "new_scope": "test:renamed2"},
            headers={**auth_headers(session_token), "Host": "localhost:4401"},
        )
        assert response.status_code == 200
@@ -1436,14 +1480,18 @@ class TestAdminPermissions:
        self, client: httpx.AsyncClient, session_token: str, test_db: DB
    ):
        """Renaming permission can also update display name."""
-        perm = Permission(id="test:rename:withname", display_name="Old Name")
+        import uuid7
-        await test_db.create_permission(perm)
+
        perm = Permission(
            uuid=uuid7.create(), scope="test:rename:withname", display_name="Old Name"
        )
        create_permission(perm)
        response = await client.post(
            "/auth/api/admin/permission/rename",
            json={
-                "old_id": "test:rename:withname",
+                "old_scope": "test:rename:withname",
-                "new_id": "test:renamed:withname",
+                "new_scope": "test:renamed:withname",
                "display_name": "New Display Name",
            },
            headers={**auth_headers(session_token), "Host": "localhost:4401"},
@@ -1456,8 +1504,12 @@ class TestAdminPermissions:
    ):
        """Admin should be able to delete a permission."""
        # Create permission first
-        perm = Permission(id="test:deleteable", display_name="Deleteable")
+        import uuid7
-        await test_db.create_permission(perm)
+
        perm = Permission(
            uuid=uuid7.create(), scope="test:deleteable", display_name="Deleteable"
        )
        create_permission(perm)
        response = await client.delete(
            "/auth/api/admin/permission?permission_id=test:deleteable",
@@ -1468,17 +1520,81 @@ class TestAdminPermissions:
        assert data["status"] == "ok"
    @pytest.mark.asyncio
-    async def test_delete_permission_auth_admin_fails(
+    async def test_delete_permission_auth_admin_last_one_fails(
        self, client: httpx.AsyncClient, session_token: str
    ):
-        """Cannot delete the auth:admin permission."""
+        """Cannot delete the only auth:admin permission (would lock out admin)."""
        response = await client.delete(
            "/auth/api/admin/permission?permission_id=auth:admin",
            headers={**auth_headers(session_token), "Host": "localhost:4401"},
        )
        assert response.status_code == 400
        data = response.json()
-        assert "Cannot delete the master admin" in data["detail"]
+        assert "lock you out of admin access" in data["detail"]
    @pytest.mark.asyncio
    async def test_delete_permission_auth_admin_with_another_succeeds(
        self, client: httpx.AsyncClient, session_token: str, test_db: DB
    ):
        """Can delete an auth:admin permission if another accessible one exists."""
        import uuid7
        from paskia.db import Permission
        # Create a second auth:admin permission (no domain restriction)
        perm2 = Permission(
            uuid=uuid7.create(), scope="auth:admin", display_name="Secondary Admin"
        )
        create_permission(perm2)
        # Now we can delete the original one
        response = await client.delete(
            "/auth/api/admin/permission?permission_id=auth:admin",
            headers={**auth_headers(session_token), "Host": "localhost:4401"},
        )
        assert response.status_code == 200
        data = response.json()
        assert data["status"] == "ok"
    @pytest.mark.asyncio
    async def test_delete_permission_auth_admin_domain_mismatch_fails(
        self, client: httpx.AsyncClient, session_token: str, test_db: DB
    ):
        """Cannot delete auth:admin if remaining one has mismatched domain."""
        import uuid7
        from paskia.db import Permission
        # Create a second auth:admin permission with a different domain
        perm2 = Permission(
            uuid=uuid7.create(),
            scope="auth:admin",
            display_name="Other Domain Admin",
            domain="other.example.com",
        )
        create_permission(perm2)
        # Cannot delete the original one because the remaining one is not accessible
        response = await client.delete(
            "/auth/api/admin/permission?permission_id=auth:admin",
            headers={**auth_headers(session_token), "Host": "localhost:4401"},
        )
        assert response.status_code == 400
        data = response.json()
        assert "lock you out of admin access" in data["detail"]
    @pytest.mark.asyncio
    async def test_remove_auth_admin_from_own_org_fails(
        self, client: httpx.AsyncClient, session_token: str, test_org
    ):
        """Cannot remove auth:admin permission from your own organization."""
        response = await client.delete(
            f"/auth/api/admin/orgs/{test_org.uuid}/permission?permission_id=auth:admin",
            headers={**auth_headers(session_token), "Host": "localhost:4401"},
        )
        assert response.status_code == 400
        data = response.json()
        assert "lock you out of admin access" in data["detail"]
 # -------------------- Edge Cases for AuthException in Org-Admin Checks --------------------
@@ -1526,7 +1642,7 @@ class TestOrgAdminAuthExceptions:
        test_user,
    ):
        """Regular user trying to update display name should get 403."""
-        response = await client.put(
+        response = await client.patch(
            f"/auth/api/admin/orgs/{test_org.uuid}/users/{test_user.uuid}/display-name",
            json={"display_name": "New Name"},
            headers={**auth_headers(regular_session_token), "Host": "localhost:4401"},
@@ -15,6 +15,7 @@ from datetime import datetime, timezone
 import httpx
 import pytest
 from paskia.db import create_session, delete_session
 from tests.conftest import auth_headers
@@ -498,10 +499,10 @@ class TestValidateSessionRefresh:
        self, client: httpx.AsyncClient, test_db
    ):
        """Validate should handle session expiry during refresh attempt."""
-        from paskia.util.tokens import create_token
+        from paskia.db.operations import _create_token
        # Create a token but don't create a session for it
-        token = create_token()
+        token = _create_token()
        response = await client.post(
            "/auth/api/validate",
            headers={**auth_headers(token), "Host": "localhost:4401"},
@@ -520,23 +521,24 @@ class TestValidateSessionRefresh:
        """Validate should return 401 if session disappears during refresh."""
        from datetime import timedelta
-        from paskia.util.tokens import create_token, session_key
+        from paskia.authsession import EXPIRES
        from paskia.db.operations import _create_token
-        # Create a session with an old renewed time to trigger refresh
+        # Create a session with an old expiry time to trigger refresh
-        token = create_token()
+        token = _create_token()
-        old_time = datetime.now(timezone.utc) - timedelta(minutes=10)
+        old_expiry = datetime.now(timezone.utc) + EXPIRES - timedelta(minutes=10)
-        await test_db.create_session(
+        create_session(
            user_uuid=test_user.uuid,
            credential_uuid=test_credential.uuid,
-            key=session_key(token),
+            key=token,
            host="localhost:4401",
            ip="127.0.0.1",
            user_agent="pytest",
-            renewed=old_time,
+            expiry=old_expiry,
        )
        # Delete the session right before validate tries to refresh
-        await test_db.delete_session(session_key(token))
+        delete_session(token)
        response = await client.post(
            "/auth/api/validate",
@@ -16,12 +16,12 @@ from tests.conftest import auth_headers
 class TestUserDisplayName:
-    """Tests for PUT /auth/api/user/display-name"""
+    """Tests for PATCH /auth/api/user/display-name"""
    @pytest.mark.asyncio
    async def test_update_display_name_requires_auth(self, client: httpx.AsyncClient):
        """Update display name without auth should return 401."""
-        response = await client.put(
+        response = await client.patch(
            "/auth/api/user/display-name",
            json={"display_name": "New Name"},
        )
@@ -32,7 +32,7 @@ class TestUserDisplayName:
        self, client: httpx.AsyncClient, session_token: str
    ):
        """User should be able to update their display name."""
-        response = await client.put(
+        response = await client.patch(
            "/auth/api/user/display-name",
            json={"display_name": "Updated Name"},
            headers={**auth_headers(session_token), "Host": "localhost:4401"},
@@ -46,7 +46,7 @@ class TestUserDisplayName:
        self, client: httpx.AsyncClient, session_token: str
    ):
        """Empty display name should fail."""
-        response = await client.put(
+        response = await client.patch(
            "/auth/api/user/display-name",
            json={"display_name": ""},
            headers={**auth_headers(session_token), "Host": "localhost:4401"},
@@ -59,7 +59,7 @@ class TestUserDisplayName:
    ):
        """Display name over 64 chars should fail."""
        long_name = "x" * 100
-        response = await client.put(
+        response = await client.patch(
            "/auth/api/user/display-name",
            json={"display_name": long_name},
            headers={**auth_headers(session_token), "Host": "localhost:4401"},
@@ -117,7 +117,7 @@ class TestUserSessionManagement:
            "/auth/api/user/session/invalid-session-id",
            headers={**auth_headers(session_token), "Host": "localhost:4401"},
        )
-        assert response.status_code == 400
+        assert response.status_code == 404  # Not found (no format validation)
    @pytest.mark.asyncio
    async def test_delete_nonexistent_session_returns_404(
Author	SHA1	Message	Date
LeoVasanko	2100a7e14f	Logging cleanup, linter.	2026-01-24 01:08:00 +00:00
LeoVasanko	aae33e60ce	Fix errors where permission scopes were still expected for indexing.	2026-01-24 00:58:18 +00:00
LeoVasanko	cebef8adfc	Large refactoring for better JSONL context. Switched back the urlsafe for session tokens that need to be passed in URLs. Other minor fixes.	2026-01-24 00:40:32 +00:00
LeoVasanko	57a9c60557	Don't load existing JSONL on migrate.	2026-01-24 00:08:21 +00:00
LeoVasanko	a9ef20969e	Refer permissions by UUID rather than scope.	2026-01-24 00:06:08 +00:00
LeoVasanko	57748876cb	Debug JSONL updates.	2026-01-23 23:49:11 +00:00
LeoVasanko	ba552e24cd	Debug JSONL updates.	2026-01-23 23:41:47 +00:00
LeoVasanko	dbe4149b63	Debug JSONL updates.	2026-01-23 23:35:00 +00:00
LeoVasanko	3d5f82c3df	Debug JSONL updates.	2026-01-23 23:29:47 +00:00
LeoVasanko	2a005692ee	Fixes to JSONL management, starting from empty state rather than default DB.	2026-01-23 21:31:54 +00:00
LeoVasanko	2ec6314264	Simplify session and reset token formats; removes the token utility functions entirely.	2026-01-23 20:53:03 +00:00
LeoVasanko	ae4c982a30	Fix actor fields and transactions for API operations as they are recorded to DB.	2026-01-23 20:19:33 +00:00
LeoVasanko	c2933d60c2	Update migrate script with the latest database changes.	2026-01-23 19:56:44 +00:00
LeoVasanko	d4ebc1bf99	Record user UUID as actor for API access.	2026-01-23 19:55:54 +00:00
LeoVasanko	0f857ffb78	Cleanup, add database versioning.	2026-01-23 19:22:23 +00:00
LeoVasanko	b7ebe68665	Refactor to use UUID and bytes rather than str keys in msgspec structs because the module can automatically convert these.	2026-01-23 18:47:56 +00:00
LeoVasanko	f9d23a196c	Database refactor to separate modules.	2026-01-23 18:27:12 +00:00
LeoVasanko	2c6a5c72d9	Updated database to use async background worker, making changes lock-free synchronous ops.	2026-01-23 15:57:16 +00:00
LeoVasanko	c13044c085	Change PUT to PATCH for intent-based updates, avoiding override of fields not intended to change. This preserves role permissions matrix even if the permission is temporarily removed from the org.	2026-01-23 15:41:23 +00:00
LeoVasanko	2c783498a4	Better handling of Org Admin permission. More guardrails for Master Admin not locking himself out by changes. Admin app UI improvements.	2026-01-23 15:11:01 +00:00
LeoVasanko	3430c7f0cf	Permissions refactor. Permissions have UUID and scope (previously id) and the latter no longer needs to be unique. Org admin uses a single global permission now. Domain scoped permissions. Removed from user info the admin fields, use effective_permission checks instead.	2026-01-23 13:54:31 +00:00
LeoVasanko	236d52aa55	Replace session.renewed with .expiry for consistency with other expiring items. Fix migration script.	2026-01-23 01:39:59 +00:00
LeoVasanko	02e04da2c4	Database cleanup: make it synchronous because we work with in-memory data. Defer writes to disk and cleanup to background task. Tests passing.	2026-01-23 01:22:47 +00:00
LeoVasanko	7f3763b46d	Replace SQL database with JSONL based solution that keeps history.	2026-01-23 00:54:37 +00:00
LeoVasanko	0fe55b2b62	Update docs/Caddy.md	2025-12-19 22:53:10 +00:00
LeoVasanko	ccf71bf0a3	Docs updates.	2025-12-19 21:09:56 +00:00
LeoVasanko	cdaeecb179	Docs updates.	2025-12-19 21:08:40 +00:00
LeoVasanko	82cdee51e4	Docs updates.	2025-12-19 21:07:20 +00:00
LeoVasanko	851e0793a6	Docs updates.	2025-12-19 21:06:27 +00:00
LeoVasanko	cd681a0599	Docs updates.	2025-12-19 21:01:05 +00:00
LeoVasanko	71cb01cfda	Docs updates.	2025-12-19 21:00:16 +00:00
LeoVasanko	535ac8558d	Docs updates.	2025-12-19 20:59:16 +00:00
LeoVasanko	c64554aeda	Docs updates.	2025-12-19 20:56:47 +00:00
LeoVasanko	0bc1bae26c	Docs updates.	2025-12-19 20:54:44 +00:00
LeoVasanko	156231b142	Docs updates.	2025-12-19 20:52:38 +00:00
LeoVasanko	daf397b3b5	Docs updates.	2025-12-19 20:38:49 +00:00
LeoVasanko	a1a5ad8520	Docs updates.	2025-12-19 20:37:25 +00:00
LeoVasanko	d25124d30b	Docs updates.	2025-12-19 20:23:49 +00:00
LeoVasanko	0bfb035f76	Docs updates.	2025-12-19 18:34:12 +00:00
LeoVasanko	000501b718	Add missing max-age argument to validate endpoint.	2025-12-19 18:34:01 +00:00
LeoVasanko	5a57e78814	Docs updates.	2025-12-19 18:17:28 +00:00
LeoVasanko	e5b84dd28c	Docs updates.	2025-12-19 17:34:09 +00:00
LeoVasanko	4b01fd9e7a	Docs updates.	2025-12-19 17:28:54 +00:00
LeoVasanko	431c48f1dd	Docs updates.	2025-12-19 16:06:51 +00:00
LeoVasanko	03c966919f	README formatting and links.	2025-12-19 14:59:22 +00:00