Change CLI to use --listen rather than positional hostport argument. Fix listening on all interfaces (runs lifespan twice, which needs to be OK). Update README with various CLI changes and more.

Add missing __init__ that was causing ModuleFoundError trying to import paskia.util.
Console startup box themed as well.
2026-02-05 02:54:07 +00:00 · 2026-02-05 02:33:05 +00:00 · 2026-01-31 00:30:14 +00:00 · 2026-01-31 00:25:38 +00:00 · 2026-01-30 23:31:06 +00:00 · 2026-01-30 22:59:52 +00:00
92 changed files with 4645 additions and 3445 deletions
@@ -1,5 +1,7 @@
 # Paskia

+![Screenshot](https://git.zi.fi/leovasanko/paskia/raw/main/docs/screenshots/forbidden-light.webp)
+
 An easy to install passkey-based authentication service that protects any web application with strong passwordless login.

 ## What is Paskia?
@@ -27,12 +29,12 @@ Single Sign-On (SSO): Users register once and authenticate across all applicatio
 Install [UV](https://docs.astral.sh/uv/getting-started/installation/) and run:

 ```fish
-uvx paskia serve --rp-id example.com
+uvx paskia --rp-id example.com
 ```

-On the first run it downloads the software and prints a registration link for the Admin.  The server will start up on [localhost:4401](http://localhost:4401) *for authentication required*, serving for `*.example.com`. If you are going to be connecting `localhost` directly, for testing, leave out the rp-id.
+On the first run it downloads the software and prints a registration link for the Admin. The server starts on [localhost:4401](http://localhost:4401), serving authentication for `*.example.com`. For local testing, leave out `--rp-id`.

-Otherwise you will need a web server such as [Caddy](https://caddyserver.com/) to serve HTTPS on your actual domain names and proxy requests to Paskia and your backend apps (see documentation below).
+For production you need a web server such as [Caddy](https://caddyserver.com/) to serve HTTPS on your actual domain names and proxy requests to Paskia and your backend apps (see documentation below).

 For a permanent install of `paskia` CLI command, not needing `uvx`:

@@ -42,19 +44,20 @@ uv tool install paskia

 ## Configuration

-There is no config file. Pass only the options on CLI:
+There is no config file. All settings are passed as CLI options:

 ```text
-paskia serve [options]
+paskia [options]
+paskia reset [user]     # Generate passkey reset link
 ```

 | Option | Description | Default |
 |--------|-------------|---------|
-| Listen address | One of *host***:***port* (default all hosts, port 4401) or **unix:***path***/paskia.socket** (Unix socket) | **localhost:4401** |
-| --rp-id *domain* | Main/top domain | **localhost** |
-| --rp-name *"text"* | Name of your company or site | Same as rp-id |
-| --origin *url* | Explicitly list the domain names served | **https://**_rp-id_ |
-| --auth-host *domain* | Dedicated authentication site (e.g., **auth.example.com**) | **Unspecified:** we use **/auth/** on **every** site under rp-id.|
+| -l, --listen *endpoint* | Listen address: *host*:*port*, :*port* (all interfaces), or */path.sock* | **localhost:4401** |
+| --rp-id *domain* | Main/top domain for passkeys | **localhost** |
+| --rp-name *"text"* | Name shown during passkey registration | Same as rp-id |
+| --origin *url* | Restrict allowed origins for WebSocket auth (repeatable) | All under rp-id |
+| --auth-host *url* | Dedicated authentication site, e.g. **auth.example.com** | Use **/auth/** path on each site |

 ## Further Documentation

@@ -97,14 +97,14 @@ test.describe('Passkey Authentication E2E', () => {
    // Verify registration result
    expect(result.session_token).toBeDefined()
    expect(result.session_token).toHaveLength(16)
-    expect(result.user_uuid).toBeDefined()
-    expect(result.credential_uuid).toBeDefined()
+    expect(result.user).toBeDefined()
+    expect(result.credential).toBeDefined()
    expect(result.message).toContain('successfully')

    // Store for subsequent tests
    sessionToken = result.session_token
-    userUuid = result.user_uuid
-    credentialUuid = result.credential_uuid
+    userUuid = result.user
+    credentialUuid = result.credential

    // Save session token for other test groups to use
    saveSessionToken(sessionToken)
@@ -138,9 +138,9 @@ test.describe('Passkey Authentication E2E', () => {
    const validation = await validateSession(page, baseUrl, sessionToken)

    expect(validation.valid).toBe(true)
-    expect(validation.user_uuid).toBe(userUuid)
+    expect(validation.ctx.user.uuid).toBe(userUuid)

-    console.log(`✓ Session validated for user: ${validation.user_uuid}`)
+    console.log(`✓ Session validated for user: ${validation.ctx.user.uuid}`)
  })

  test('should retrieve user info', async ({ page }) => {
@@ -148,8 +148,8 @@ test.describe('Passkey Authentication E2E', () => {

    const userInfo = await getUserInfo(page, baseUrl, sessionToken)

-    expect(userInfo.user.user_uuid).toBe(userUuid)
-    expect(userInfo.user.user_name).toBe('Admin User')
+    expect(userInfo.ctx.user.uuid).toBe(userUuid)
+    expect(userInfo.ctx.user.display_name).toBe('Admin User')
    expect(userInfo.credentials).toBeDefined()
    expect(userInfo.credentials.length).toBeGreaterThanOrEqual(1)

@@ -169,7 +169,7 @@ test.describe('Passkey Authentication E2E', () => {
    await page.screenshot({ path: 'test-results/profile-view.png' })
    console.log('✓ Screenshot saved: test-results/profile-view.png')

-    console.log(`✓ User info retrieved: ${userInfo.user.user_name}`)
+    console.log(`✓ User info retrieved: ${userInfo.ctx.user.display_name}`)
    console.log(`✓ Credentials count: ${userInfo.credentials.length}`)
  })

@@ -190,7 +190,7 @@ test.describe('Passkey Authentication E2E', () => {
      displayName: 'Admin User (test device)'
    })

-    console.log(`✓ Added test credential: ${regResult.credential_uuid}`)
+    console.log(`✓ Added test credential: ${regResult.credential}`)

    // Now logout and authenticate with the fresh credential
    await logout(page, baseUrl, regResult.session_token)
@@ -201,7 +201,7 @@ test.describe('Passkey Authentication E2E', () => {

    expect(result.session_token).toBeDefined()
    expect(result.session_token).toHaveLength(16)
-    expect(result.user_uuid).toBe(userUuid)
+    expect(result.user).toBe(userUuid)

    // Update session token for subsequent tests
    sessionToken = result.session_token
@@ -209,7 +209,7 @@ test.describe('Passkey Authentication E2E', () => {
    // Save session token for other test groups to use
    saveSessionToken(sessionToken)

-    console.log(`✓ Authenticated as user: ${result.user_uuid}`)
+    console.log(`✓ Authenticated as user: ${result.user}`)
    console.log(`✓ New session token: ${sessionToken.substring(0, 4)}...`)
  })

@@ -219,7 +219,7 @@ test.describe('Passkey Authentication E2E', () => {
    const validation = await validateSession(page, baseUrl, sessionToken)

    expect(validation.valid).toBe(true)
-    expect(validation.user_uuid).toBe(userUuid)
+    expect(validation.ctx.user.uuid).toBe(userUuid)

    console.log(`✓ New session validated`)
  })
@@ -291,8 +291,8 @@ test.describe('Device Addition Dialog', () => {
    // Wait for the profile view to load
    await page.waitForSelector('[data-view="profile"]', { timeout: 5000 })

-    // Click the "Add Another Device" button
-    const addDeviceButton = page.getByRole('button', { name: 'Add Another Device' })
+    // Click the "Another Device" button
+    const addDeviceButton = page.getByRole('button', { name: 'Another Device' })
    await expect(addDeviceButton).toBeVisible()
    await addDeviceButton.click()

@@ -301,7 +301,7 @@ test.describe('Device Addition Dialog', () => {
    await expect(dialog).toBeVisible({ timeout: 5000 })

    // Verify dialog contains expected elements
-    await expect(dialog.locator('h2')).toContainText('Device Registration Link')
+    await expect(dialog.locator('h2')).toContainText('Add Another Device')

    // Wait for QR code to be generated (canvas should have content)
    const qrCanvas = dialog.locator('.qr-code')
@@ -318,16 +318,16 @@ test.describe('Device Addition Dialog', () => {
    expect(linkHref).toContain('http://localhost:4404/auth/')
    console.log(`✓ Device link displayed: ${linkText} (href: ${linkHref})`)

-    // Verify expiration warning is shown
-    await expect(dialog.locator('.reg-help')).toContainText('Expires')
+    // Verify help text is shown
+    await expect(dialog.locator('.reg-help')).toContainText('Scan this QR code')

    // Take screenshot of the dialog
    await dialog.screenshot({ path: 'test-results/device-addition-dialog.png' })
    console.log(`✓ Screenshot saved: test-results/device-addition-dialog.png`)

-    // Verify Copy Link button exists
-    const copyButton = dialog.getByRole('button', { name: 'Copy Link' })
-    await expect(copyButton).toBeVisible()
+    // Verify the QR link element is clickable (copy functionality is built into clicking it)
+    const qrLink = dialog.locator('a.qr-link')
+    await expect(qrLink).toBeVisible()

    // Close the dialog (use the text button, not the icon button)
    const closeButton = dialog.locator('button.btn-secondary', { hasText: 'Close' })
@@ -357,12 +357,12 @@ test.describe('Device Addition Dialog', () => {
    await page.waitForSelector('[data-view="profile"]', { timeout: 5000 })

    // Open the dialog
-    await page.getByRole('button', { name: 'Add Another Device' }).click()
+    await page.getByRole('button', { name: 'Another Device' }).click()
    const dialog = page.locator('.device-dialog')
    await expect(dialog).toBeVisible({ timeout: 5000 })

    // Extract the reset token from the displayed URL
-    const linkText = dialog.locator('.qr-link p')
+    const linkText = dialog.locator('.qr-link .link-text')
    const linkContent = await linkText.textContent()

    // URL format: localhost/auth/word1.word2.word3.word4.word5
@@ -405,7 +405,7 @@ test.describe('Device Addition Dialog', () => {
  })
 })

-test.describe('ProfileView - Add New Passkey', () => {
+test.describe('ProfileView - Register New', () => {
  const baseUrl = process.env.BASE_URL || 'http://localhost:4404'

  test('should show credentials list in profile', async ({ page }) => {
@@ -427,7 +427,7 @@ test.describe('ProfileView - Add New Passkey', () => {
    console.log(`✓ Profile shows ${credentialItems} credential(s) in list`)
  })

-  test('should add a new passkey using Add New Passkey button', async ({ page }) => {
+  test('should add a new passkey using Register New button', async ({ page }) => {
    const sessionToken = getSavedSessionToken()
    test.skip(!sessionToken, 'Requires saved session token')

@@ -444,8 +444,8 @@ test.describe('ProfileView - Add New Passkey', () => {
    const initialCredentialCount = await page.locator('.credential-item').count()
    console.log(`Initial credential count: ${initialCredentialCount}`)

-    // Click "Add New Passkey" button
-    const addPasskeyBtn = page.locator('button:has-text("Add New Passkey")')
+    // Click "Register New" button
+    const addPasskeyBtn = page.locator('button:has-text("Register New")')
    await expect(addPasskeyBtn).toBeVisible()
    await addPasskeyBtn.click()

@@ -490,7 +490,7 @@ test.describe('ProfileView - Add New Passkey', () => {

    // Try to add a passkey - with excludeCredentials the authenticator should
    // prevent re-registration of the same credential
-    const addPasskeyBtn = page.locator('button:has-text("Add New Passkey")')
+    const addPasskeyBtn = page.locator('button:has-text("Register New")')
    await expect(addPasskeyBtn).toBeVisible()
    await addPasskeyBtn.click()

@@ -541,8 +541,8 @@ test.describe('ProfileView - Multi-Authenticator', () => {
    await page.waitForSelector('.credential-list', { timeout: 10000 })
    const initialCredentialCount = await page.locator('.credential-item').count()

-    // Click "Add New Passkey" button
-    const addPasskeyBtn = page.locator('button:has-text("Add New Passkey")')
+    // Click "Register New" button
+    const addPasskeyBtn = page.locator('button:has-text("Register New")')
    await expect(addPasskeyBtn).toBeVisible()
    await addPasskeyBtn.click()

@@ -84,7 +84,7 @@ async function makeApiCall(page: Page, url: string, method = 'GET'): Promise<{ s
          // Wait a tick for the page's handler to retry, then make our own call
          setTimeout(async () => {
            try {
-              const response = await fetch(url, { method, credentials: 'include' });
+              const response = await fetch(url, { method });
              if (response.status === 204) {
                resolve({ status: 204 });
              } else if (response.ok) {
@@ -111,7 +111,7 @@ async function makeApiCall(page: Page, url: string, method = 'GET'): Promise<{ s
      setTimeout(async () => {
        if (resolved) return;
        try {
-          const response = await fetch(url, { method, credentials: 'include' });
+          const response = await fetch(url, { method });
          // Only resolve if this is a success or non-auth error
          if (response.status !== 401 && response.status !== 403) {
            if (resolved) return;
@@ -242,7 +242,7 @@ test.describe('API Mode - 401 Login Flow', () => {
      resetToken: deviceToken,
      displayName: 'API Test Device',
    })
-    console.log(`✓ Registered credential: ${regResult.credential_uuid}`)
+    console.log(`✓ Registered credential: ${regResult.credential}`)

    // Logout to clear session (but keep the passkey in virtual authenticator)
    await logout(page, baseUrl, regResult.session_token)
@@ -268,7 +268,7 @@ test.describe('API Mode - 401 Login Flow', () => {
    // Wait for API call to complete and verify result
    const result = await apiCallPromise
    expect(result.status).toBe(200)
-    expect(result.data.user).toBeDefined()
+    expect(result.data.ctx).toBeDefined()
    console.log('✓ API call succeeded after authentication')

    // Save the session for other tests
@@ -12,17 +12,51 @@ const stateFile = join(__dirname, '..', '..', 'test-data', 'test-state.json')
 */

 export interface RegistrationResult {
-  user_uuid: string
-  credential_uuid: string
+  user: string
+  credential: string
  session_token: string
  message: string
 }

 export interface AuthenticationResult {
-  user_uuid: string
+  user: string
  session_token: string
 }

+export interface SessionContext {
+  user: { uuid: string; display_name: string }
+  org: { uuid: string; display_name: string }
+  role: { uuid: string; display_name: string }
+  permissions: string[]
+}
+
+export interface UserInfo {
+  ctx: SessionContext
+  created_at: string
+  last_seen: string
+  visits: number
+  credentials: Array<{
+    credential: string
+    aaguid: string
+    created_at: string
+    last_used: string | null
+    last_verified: string | null
+    sign_count: number
+    is_current_session: boolean
+  }>
+  aaguid_info: Record<string, { name: string; icon_light?: string; icon_dark?: string }>
+  sessions: Array<{
+    id: string
+    credential: string
+    host: string
+    ip: string
+    user_agent: string
+    last_renewed: string
+    is_current: boolean
+    is_current_host: boolean
+  }>
+}
+
 /**
 * Get the bootstrap reset token from the test state file.
 */
@@ -376,7 +410,7 @@ export async function validateSession(
  page: Page,
  baseUrl: string,
  sessionToken: string
-): Promise<{ valid: boolean; user_uuid: string; renewed: boolean }> {
+): Promise<{ valid: boolean; ctx: SessionContext; renewed: boolean }> {
  const cookieName = getSessionCookieName()
  const response = await page.request.post(`${baseUrl}/auth/api/validate`, {
    headers: {
@@ -393,7 +427,7 @@ export async function getUserInfo(
  page: Page,
  baseUrl: string,
  sessionToken: string
-): Promise<any> {
+): Promise<UserInfo> {
  const cookieName = getSessionCookieName()
  const response = await page.request.post(`${baseUrl}/auth/api/user-info`, {
    headers: {
@@ -42,21 +42,23 @@ export default async function globalSetup() {
  const serverArgs = COLLECT_COVERAGE
    ? [
        'run', 'coverage', 'run', '--parallel-mode',
-        '-m', 'paskia.fastapi', 'serve', 'localhost:4404',
+        '-m', 'paskia.fastapi', 'localhost:4404',
        '--rp-id', 'localhost'
      ]
    : [
-        'run', 'paskia', 'serve', 'localhost:4404',
+        'run', 'paskia', 'localhost:4404',
        '--rp-id', 'localhost'
      ]

+  // Use a temporary jsonl file for test database
+  const testDbFile = join(testDataDir, 'test-db.jsonl')
+
  // Start the server using Node's spawn
-  // Use in-memory SQLite for faster tests
  const serverProcess = spawn('uv', serverArgs, {
    cwd: projectRoot,
    env: {
      ...process.env,
-      PASKIA_DB: 'sqlite+aiosqlite:///:memory:',
+      PASKIA_DB: testDbFile,
      COVERAGE_FILE: join(projectRoot, '.coverage'),
    },
    stdio: ['ignore', 'pipe', 'pipe'],
@@ -59,18 +59,11 @@ export default async function globalTeardown() {
    rmSync(stateFile, { force: true })
  }

-  // Optionally clean up test database (keep it for debugging by default)
-  if (process.env.CLEANUP_TEST_DB === 'true') {
-    const dbPath = join(testDataDir, 'test.sqlite')
-    if (existsSync(dbPath)) {
-      console.log('  Removing test database...')
-      rmSync(dbPath)
-    }
-    // Remove wal/shm files too
-    for (const ext of ['-wal', '-shm']) {
-      const file = dbPath + ext
-      if (existsSync(file)) rmSync(file)
-    }
+  // Clean up test database
+  const testDbFile = join(testDataDir, 'test-db.jsonl')
+  if (existsSync(testDbFile)) {
+    console.log('  Removing test database...')
+    rmSync(testDbFile)
  }

  // Generate Python coverage report if coverage was collected
@@ -96,7 +96,7 @@
        async function apiCall(url, method = 'GET') {
            log(`${method} ${url}...`);

-            const response = await fetch(url, { method, credentials: 'include' });
+            const response = await fetch(url, { method });

            // Server returns 401 (login/reauth) or 403 (missing permissions)
            // with a JSON body containing the iframe URL for authentication
@@ -131,7 +131,7 @@
        }

        async function logout() {
-            await fetch('/auth/api/logout', { method: 'POST', credentials: 'include' });
+            await fetch('/auth/api/logout', { method: 'POST' });
            log('Logged out');
        }

@@ -2,10 +2,10 @@
  <div class="app-shell">
    <StatusMessage />
    <main class="app-main">
-      <HostProfileView v-if="authenticated && isHostMode" :initializing="loading" />
-      <ProfileView v-else-if="authenticated" />
-      <LoadingView v-else-if="loading" :message="loadingMessage" />
-      <AuthRequiredMessage v-else-if="showBackMessage" @reload="reloadPage" />
+      <HostProfileView v-if="viewState === 'profile' && isHostMode" />
+      <ProfileView v-else-if="viewState === 'profile'" />
+      <LoadingView v-else-if="viewState === 'loading'" :message="loadingMessage" />
+      <AccessDenied v-else-if="viewState === 'terminal'" />
    </main>
  </div>
 </template>
@@ -13,18 +13,17 @@
 <script setup>
 import { computed, onMounted, onUnmounted, ref } from 'vue'
 import { useAuthStore } from '@/stores/auth'
-import { apiJson, getAuthIframeUrl } from '@/utils/api'
+import { apiJson, SessionValidator, createAuthIframe, removeAuthIframe } from 'paskia'
+import { getAuthIframeUrl } from '@/utils/api'
 import StatusMessage from '@/components/StatusMessage.vue'
 import ProfileView from '@/components/ProfileView.vue'
 import HostProfileView from '@/components/HostProfileView.vue'
 import LoadingView from '@/components/LoadingView.vue'
-import AuthRequiredMessage from '@/components/AccessDenied.vue'
+import AccessDenied from '@/components/AccessDenied.vue'

 const store = useAuthStore()
-const loading = ref(true)
+const viewState = ref('loading')  // 'loading' | 'profile' | 'terminal'
 const loadingMessage = ref('Loading...')
-const authenticated = ref(false)
-const showBackMessage = ref(false)

 /**
 * Normalize a host string for comparison (lowercase, strip default ports).
@@ -48,47 +47,36 @@ const isHostMode = computed(() => {
  const configuredHost = normalizeHost(authHost)
  return currentHost !== configuredHost
 })
-let validationTimer = null
-let authIframe = null
+const userUuid = computed(() => store.userInfo?.ctx.user.uuid)
+
+function terminateSession() {
+  store.userInfo = null
+  viewState.value = 'terminal'
+}
+
+const userUuidGetter = () => store.userInfo?.ctx.user.uuid
+const sessionValidator = new SessionValidator(userUuidGetter, terminateSession)
+
+onMounted(() => sessionValidator.start())
+onUnmounted(() => sessionValidator.stop())

 async function loadUserInfo() {
  try {
    store.userInfo = await apiJson('/auth/api/user-info', { method: 'POST' })
-    authenticated.value = true
-    loading.value = false
-    startSessionValidation()
+    viewState.value = 'profile'
    return true
-  } catch (e) {
+  } catch {
+    store.userInfo = null
    return false
  }
 }

 async function showAuthIframe() {
-  // Remove existing iframe if any
-  hideAuthIframe()
-
-  // Create new iframe for authentication using src URL
  const url = await getAuthIframeUrl('login')
-  authIframe = document.createElement('iframe')
-  authIframe.id = 'auth-iframe'
-  authIframe.title = 'Authentication'
-  authIframe.allow = 'publickey-credentials-get; publickey-credentials-create'
-  authIframe.src = url
-  document.body.appendChild(authIframe)
+  createAuthIframe(url)
  loadingMessage.value = 'Authentication required...'
 }

-function hideAuthIframe() {
-  if (authIframe) {
-    authIframe.remove()
-    authIframe = null
-  }
-}
-
-function reloadPage() {
-  window.location.reload()
-}
-
 function handleAuthMessage(event) {
  const data = event.data
  if (!data?.type) return
@@ -96,8 +84,8 @@ function handleAuthMessage(event) {
  switch (data.type) {
    case 'auth-success':
      // Authentication successful - reload user info
-      hideAuthIframe()
-      loading.value = true
+      removeAuthIframe()
+      viewState.value = 'loading'
      loadingMessage.value = 'Loading user profile...'
      loadUserInfo()
      break
@@ -117,55 +105,18 @@ function handleAuthMessage(event) {
      break

    case 'auth-back':
-      // User clicked Back - show message with reload option
-      hideAuthIframe()
-      loading.value = false
-      showBackMessage.value = true
-      store.showMessage('Authentication cancelled', 'info', 3000)
+      // User clicked Back - show terminal state
+      removeAuthIframe()
+      terminateSession()
      break

    case 'auth-close-request':
      // Legacy support - treat as back
-      hideAuthIframe()
+      removeAuthIframe()
      break
  }
 }

-async function validateSession() {
-  try {
-    await apiJson('/auth/api/validate', {
-      method: 'POST',
-      credentials: 'include'
-    })
-    // If successful, session was renewed automatically
-  } catch (error) {
-    if (error.status === 401) {
-      // Session expired - need to re-authenticate
-      console.log('Session expired, requiring re-authentication')
-      authenticated.value = false
-      loading.value = true
-      stopSessionValidation()
-      showAuthIframe()
-    } else {
-      console.error('Session validation error:', error)
-      // Don't treat network errors as session expiry
-    }
-  }
-}
-
-function startSessionValidation() {
-  // Validate session every 2 minutes
-  stopSessionValidation()
-  validationTimer = setInterval(validateSession, 2 * 60 * 1000)
-}
-
-function stopSessionValidation() {
-  if (validationTimer) {
-    clearInterval(validationTimer)
-    validationTimer = null
-  }
-}
-
 onMounted(async () => {
  // Listen for postMessage from auth iframe
  window.addEventListener('message', handleAuthMessage)
@@ -194,8 +145,7 @@ onMounted(async () => {

 onUnmounted(() => {
  window.removeEventListener('message', handleAuthMessage)
-  stopSessionValidation()
-  hideAuthIframe()
+  removeAuthIframe()
 })
 </script>

@@ -5,14 +5,14 @@ import CredentialList from '@/components/CredentialList.vue'
 import UserBasicInfo from '@/components/UserBasicInfo.vue'
 import StatusMessage from '@/components/StatusMessage.vue'
 import LoadingView from '@/components/LoadingView.vue'
-import AuthRequiredMessage from '@/components/AccessDenied.vue'
+import AccessDenied from '@/components/AccessDenied.vue'
 import AdminOverview from '@/admin/AdminOverview.vue'
 import AdminOrgDetail from '@/admin/AdminOrgDetail.vue'
 import AdminUserDetail from '@/admin/AdminUserDetail.vue'
 import AdminDialogs from '@/admin/AdminDialogs.vue'
 import { useAuthStore } from '@/stores/auth'
 import { adminUiPath, makeUiHref } from '@/utils/settings'
-import { apiJson } from '@/utils/api'
+import { apiJson, SessionValidator } from 'paskia'
 import { getDirection } from '@/utils/keynav'
 import { goBack } from '@/utils/helpers'

@@ -48,8 +48,8 @@ const adminUserDetailRef = ref(null)
 const hasActiveModal = computed(() => dialog.value.type !== null || showRegModal.value)

 // Derive admin status from permissions
-const isGlobalAdmin = computed(() => info.value?.permissions?.includes('auth:admin') ?? false)
-const isOrgAdmin = computed(() => info.value?.permissions?.includes('auth:org:admin') ?? false)
+const isMasterAdmin = computed(() => info.value?.ctx.permissions.includes('auth:admin'))
+const isOrgAdmin = computed(() => info.value?.ctx.permissions.includes('auth:org:admin'))

 function sanitizeRenameId() { if (renameIdValue.value) renameIdValue.value = renameIdValue.value.replace(safeIdRegex, '') }

@@ -130,7 +130,7 @@ function parseHash() {
 async function loadOrgs() {
  const data = await apiJson('/auth/api/admin/orgs')
  orgs.value = data.map(o => {
-    const roles = o.roles.map(r => ({ ...r, org_uuid: o.uuid, users: [] }))
+    const roles = o.roles.map(r => ({ ...r, org: o.uuid, users: [] }))
    const roleMap = Object.fromEntries(roles.map(r => [r.display_name, r]))
    for (const u of o.users || []) {
      if (roleMap[u.role]) roleMap[u.role].users.push(u)
@@ -144,10 +144,34 @@ async function loadPermissions() {
 }

 async function loadUserInfo() {
-  info.value = await apiJson('/auth/api/user-info', { method: 'POST' })
+  const data = await apiJson('/auth/api/validate', { method: 'POST' })
+  info.value = data
  authenticated.value = true
 }

+function clearSensitiveState() {
+  info.value = null
+  orgs.value = []
+  permissions.value = []
+  userDetail.value = null
+  authenticated.value = false
+}
+
+function onSessionLost(e) {
+  clearSensitiveState()
+  if (e.name === 'AuthCancelledError') {
+    showBackMessage.value = true
+  } else {
+    error.value = e.message
+  }
+}
+
+const userUuidGetter = () => info.value?.ctx.user.uuid
+const sessionValidator = new SessionValidator(userUuidGetter, onSessionLost)
+
+onMounted(() => sessionValidator.start())
+onUnmounted(() => sessionValidator.stop())
+
 async function load() {
  loading.value = true
  loadingMessage.value = 'Loading...'
@@ -158,7 +182,7 @@ async function load() {
    // If we get here, user has admin access - now fetch user info for display
    await loadUserInfo()

-    if (!isGlobalAdmin.value && isOrgAdmin.value && orgs.value.length === 1) {
+    if (!isMasterAdmin.value && isOrgAdmin.value && orgs.value.length === 1) {
      if (!window.location.hash || window.location.hash === '#overview') {
        currentOrgId.value = orgs.value[0].uuid
        window.location.hash = `#org/${currentOrgId.value}`
@@ -168,11 +192,7 @@ async function load() {
      }
    } else parseHash()
  } catch (e) {
-    if (e.name === 'AuthCancelledError') {
-      showBackMessage.value = true
-    } else {
-      error.value = e.message
-    }
+    onSessionLost(e)
  } finally {
    loading.value = false
  }
@@ -191,8 +211,6 @@ async function performOrgDeletion(orgUuid) {
 }

 function deleteOrg(org) {
-  if (!isGlobalAdmin.value) { authStore.showMessage('Global admin only'); return }
-
  const userCount = org.roles.reduce((acc, r) => acc + r.users.length, 0)

  if (userCount === 0) {
@@ -234,9 +252,9 @@ async function moveUserToRole(org, user, targetRoleDisplayName) {
  }
 }

-function onUserDragStart(e, user, org_uuid) {
+function onUserDragStart(e, user, org) {
  e.dataTransfer.effectAllowed = 'move'
-  e.dataTransfer.setData('text/plain', JSON.stringify({ user_uuid: user.uuid, org_uuid }))
+  e.dataTransfer.setData('text/plain', JSON.stringify({ user_uuid: user.uuid, org }))
 }

 function onRoleDragOver(e) {
@@ -248,7 +266,7 @@ function onRoleDrop(e, org, role) {
  e.preventDefault()
  try {
    const data = JSON.parse(e.dataTransfer.getData('text/plain'))
-    if (data.org_uuid !== org.uuid) return // only within same org
+    if (data.org !== org.uuid) return // only within same org
    const user = org.roles.flatMap(r => r.users).find(u => u.uuid === data.user_uuid)
    if (user) moveUserToRole(org, user, role.display_name)
  } catch (_) { /* ignore */ }
@@ -261,7 +279,7 @@ function updateRole(role) { openDialog('role-update', { role, name: role.display

 function deleteRole(role) {
  // UI only allows deleting empty roles, so no confirmation needed
-  apiJson(`/auth/api/admin/orgs/${role.org_uuid}/roles/${role.uuid}`, { method: 'DELETE' })
+  apiJson(`/auth/api/admin/orgs/${role.org}/roles/${role.uuid}`, { method: 'DELETE' })
    .then(() => {
      authStore.showMessage(`Role "${role.display_name}" deleted.`, 'success', 2500)
      loadOrgs()
@@ -281,7 +299,7 @@ async function toggleRolePermission(role, pid, checked) {

  try {
    const method = checked ? 'POST' : 'DELETE'
-    await apiJson(`/auth/api/admin/orgs/${role.org_uuid}/roles/${role.uuid}/permissions/${pid}`, {
+    await apiJson(`/auth/api/admin/orgs/${role.org}/roles/${role.uuid}/permissions/${pid}`, {
      method
    })
    await loadOrgs()
@@ -292,8 +310,8 @@ async function toggleRolePermission(role, pid, checked) {
 }

 // Permission actions
-async function performPermissionDeletion(permissionScope) {
-  const params = new URLSearchParams({ permission_id: permissionScope })
+async function performPermissionDeletion(permissionUuid) {
+  const params = new URLSearchParams({ permission_uuid: permissionUuid })
  await apiJson(`/auth/api/admin/permission?${params.toString()}`, { method: 'DELETE' })
  await loadPermissions()
 }
@@ -313,7 +331,7 @@ function deletePermission(p) {

  if (roleCount === 0) {
    // No roles have this permission, safe to delete directly
-    performPermissionDeletion(p.scope)
+    performPermissionDeletion(p.uuid)
      .then(() => {
        authStore.showMessage(`Permission "${p.display_name}" deleted.`, 'success', 2500)
      })
@@ -329,14 +347,10 @@ function deletePermission(p) {
  const affects = parts.join(', ')

  openDialog('confirm', { message: `Delete permission "${p.display_name}" (${affects})?`, action: async () => {
-    await performPermissionDeletion(p.scope)
+    await performPermissionDeletion(p.uuid)
  } })
 }

-function reloadPage() {
-  window.location.reload()
-}
-
 const selectedOrg = computed(() => orgs.value.find(o => o.uuid === currentOrgId.value) || null)

 function openOrg(o) {
@@ -356,7 +370,7 @@ const selectedUser = computed(() => {
  for (const o of orgs.value) {
    for (const r of o.roles) {
      const u = r.users.find(x => x.uuid === currentUserId.value)
-      if (u) return { ...u, org_uuid: o.uuid, role_display_name: r.display_name }
+      if (u) return { ...u, org: o.uuid, role_display_name: r.display_name }
    }
  }
  return null
@@ -377,14 +391,14 @@ const breadcrumbEntries = computed(() => {
  // Determine organization for user view if selectedOrg not explicitly chosen.
  let orgForUser = null
  if (selectedUser.value) {
-    orgForUser = orgs.value.find(o => o.uuid === selectedUser.value.org_uuid) || null
+    orgForUser = orgs.value.find(o => o.uuid === selectedUser.value.org) || null
  }
  const orgToShow = selectedOrg.value || orgForUser
  if (orgToShow) {
    entries.push({ label: orgToShow.display_name, href: `#org/${orgToShow.uuid}` })
  }
  if (selectedUser.value) {
-    entries.push({ label: selectedUser.value.display_name || 'User', href: `#user/${selectedUser.value.uuid}` })
+    entries.push({ label: selectedUser.value.display_name, href: `#user/${selectedUser.value.uuid}` })
  }
  return entries
 })
@@ -392,7 +406,7 @@ const breadcrumbEntries = computed(() => {
 watch(selectedUser, async (u) => {
  if (!u) { userDetail.value = null; return }
  try {
-    userDetail.value = await apiJson(`/auth/api/admin/orgs/${u.org_uuid}/users/${u.uuid}`)
+    userDetail.value = await apiJson(`/auth/api/admin/orgs/${u.org}/users/${u.uuid}`)
  } catch (e) {
    userDetail.value = { error: e.message }
  }
@@ -413,7 +427,7 @@ async function toggleOrgPermission(org, permId, checked) {
  const prev = [...org.permissions]
  org.permissions = next
  try {
-    const params = new URLSearchParams({ permission_id: permId })
+    const params = new URLSearchParams({ permission_uuid: permId })
    await apiJson(`/auth/api/admin/orgs/${org.uuid}/permission?${params.toString()}`, { method: checked ? 'POST' : 'DELETE' })
    await loadOrgs()
  } catch (e) {
@@ -528,7 +542,7 @@ async function refreshUserDetail() {
  await loadOrgs()
  if (selectedUser.value) {
    try {
-      userDetail.value = await apiJson(`/auth/api/admin/orgs/${selectedUser.value.org_uuid}/users/${selectedUser.value.uuid}`)
+      userDetail.value = await apiJson(`/auth/api/admin/orgs/${selectedUser.value.org}/users/${selectedUser.value.uuid}`)
    } catch (e) { authStore.showMessage(e.message || 'Failed to reload user', 'error') }
  }
 }
@@ -590,7 +604,7 @@ async function submitDialog() {

      // Close dialog immediately, then perform async operation
      closeDialog()
-      apiJson(`/auth/api/admin/orgs/${role.org_uuid}/roles/${role.uuid}`, { method: 'PATCH', body: { display_name: name } })
+      apiJson(`/auth/api/admin/orgs/${role.org}/roles/${role.uuid}`, { method: 'PATCH', body: { display_name: name } })
        .then(() => {
          authStore.showMessage(`Role renamed to "${name}".`, 'success', 2500)
          loadOrgs()
@@ -618,7 +632,7 @@ async function submitDialog() {

      // Close dialog immediately, then perform async operation
      closeDialog()
-      apiJson(`/auth/api/admin/orgs/${user.org_uuid}/users/${user.uuid}/display-name`, { method: 'PATCH', body: { display_name: name } })
+      apiJson(`/auth/api/admin/orgs/${user.org}/users/${user.uuid}/display-name`, { method: 'PATCH', body: { display_name: name } })
        .then(() => {
          authStore.showMessage(`User renamed to "${name}".`, 'success', 2500)
          onUserNameSaved()
@@ -629,31 +643,28 @@ async function submitDialog() {
      return // Don't call closeDialog() again
    } else if (t === 'perm-display') {
      const { permission } = dialog.value.data
-      const newId = dialog.value.data.scope?.trim()
+      const newScope = dialog.value.data.scope?.trim()
      const newDisplay = dialog.value.data.display_name?.trim()
      const newDomain = dialog.value.data.domain?.trim() || ''
      if (!newDisplay) throw new Error('Display name required')
-      if (!newId) throw new Error('Scope required')
+      if (!newScope) throw new Error('Scope required')

      // Close dialog immediately, then perform async operation
      closeDialog()

      const oldDomain = permission.domain || ''
-      let apiCall;
-      if (newId !== permission.scope) {
-        // Scope changed, use rename endpoint (also update domain)
-        apiCall = apiJson('/auth/api/admin/permission/rename', { method: 'POST', body: { old_scope: permission.scope, new_scope: newId, display_name: newDisplay, domain: newDomain } })
-      } else if (newDisplay !== permission.display_name || newDomain !== oldDomain) {
-        // Display name or domain changed
-        const params = new URLSearchParams({ permission_id: permission.scope, display_name: newDisplay })
-        if (newDomain) params.set('domain', newDomain)
-        apiCall = apiJson(`/auth/api/admin/permission?${params.toString()}`, { method: 'PATCH' })
-      } else {
-        // No changes
-        return
+      // Check if anything changed
+      if (newScope === permission.scope && newDisplay === permission.display_name && newDomain === oldDomain) {
+        return // No changes
      }

-      apiCall
+      // Always use PATCH with permission_uuid
+      const params = new URLSearchParams({ permission_uuid: permission.uuid })
+      if (newScope !== permission.scope) params.set('scope', newScope)
+      if (newDisplay !== permission.display_name) params.set('display_name', newDisplay)
+      if (newDomain !== oldDomain) params.set('domain', newDomain || '')
+
+      apiJson(`/auth/api/admin/permission?${params.toString()}`, { method: 'PATCH' })
        .then(() => {
          authStore.showMessage(`Permission "${newDisplay}" updated.`, 'success', 2500)
          loadPermissions()
@@ -703,23 +714,19 @@ async function submitDialog() {
    <StatusMessage />
    <main class="app-main">
      <LoadingView v-if="loading" :message="loadingMessage" />
-      <AuthRequiredMessage
-        v-else-if="showBackMessage"
-        @reload="reloadPage"
+      <AccessDenied v-else-if="showBackMessage" />
+      <AccessDenied
+        v-else-if="error"
+        icon="⚠️"
+        title="Error"
+        :message="error"
      />
-      <!-- Access denied: authenticated but not admin, or error occurred -->
-      <div v-else-if="error || (authenticated && !isGlobalAdmin && !isOrgAdmin)" class="access-denied-container">
-        <div class="access-denied-content">
-          <h2>⛔ Access Denied</h2>
-          <p v-if="error" class="error-detail">{{ error }}</p>
-          <p v-else class="error-detail">You do not have admin permissions for this application.</p>
-          <div class="button-row">
-            <button class="btn-secondary" @click="goBack">Back</button>
-            <button class="btn-primary" @click="reloadPage">Reload Page</button>
-          </div>
-        </div>
-      </div>
-      <section v-else-if="authenticated && (isGlobalAdmin || isOrgAdmin)" class="view-root view-root--wide view-admin">
+      <AccessDenied
+        v-else-if="authenticated && !isMasterAdmin && !isOrgAdmin"
+        icon="⛔"
+        message="You do not have admin permissions for this application."
+      />
+      <section v-else-if="authenticated && (isMasterAdmin || isOrgAdmin)" class="view-root view-root--wide view-admin">
        <header class="view-header">
          <h1>{{ pageHeading }}</h1>
          <Breadcrumbs ref="breadcrumbsRef" :entries="breadcrumbEntries" @keydown="handleBreadcrumbKeydown" />
@@ -729,7 +736,7 @@ async function submitDialog() {
          <div class="section-body admin-section-body">
            <div class="admin-panels">
                                  <AdminOverview
-                  v-if="!selectedUser && !selectedOrg && (isGlobalAdmin || isOrgAdmin)"
+                  v-if="!selectedUser && !selectedOrg && (isMasterAdmin || isOrgAdmin)"
                  ref="adminOverviewRef"
                  :info="info"
                  :orgs="orgs"
@@ -805,9 +812,4 @@ async function submitDialog() {
 .admin-section { margin-top: var(--space-xl); }
 .admin-section-body { display: flex; flex-direction: column; gap: var(--space-xl); }
 .admin-panels { display: flex; flex-direction: column; gap: var(--space-xl); }
-.access-denied-container { display: flex; flex-direction: column; align-items: center; justify-content: center; min-height: 60vh; padding: 2rem; }
-.access-denied-content { text-align: center; max-width: 480px; }
-.access-denied-content h2 { margin: 0 0 1rem; color: var(--color-heading); font-size: 1.5rem; }
-.access-denied-content .error-detail { margin: 0 0 1.5rem; color: var(--color-text-muted); }
-.access-denied-content .button-row { display: flex; gap: 0.75rem; justify-content: center; }
 </style>
@@ -1,3 +1,6 @@
+import { initThemeFromCache } from '@/utils/theme'
+initThemeFromCache()
+
 import '@/assets/style.css'

 import { createApp } from 'vue'
@@ -1,3 +1,6 @@
+import { initThemeFromCache } from '@/utils/theme'
+initThemeFromCache()
+
 import '@/assets/style.css'

 import { createApp } from 'vue'
@@ -8,7 +8,7 @@
 </template>

 <script setup>
-import { computed, onMounted, ref } from 'vue'
+import { onMounted, ref } from 'vue'
 import RestrictedAuth from '@/components/RestrictedAuth.vue'

 // Check if this is a remote auth URL: /auth/{token}
@@ -30,14 +30,9 @@ function extractRemoteToken() {
  return null
 }

-// Detect mode from URL hash fragment
-const authMode = computed(() => {
-  const params = new URLSearchParams(window.location.hash.slice(1))
-  const mode = params.get('mode')
-  if (mode === 'reauth') return 'reauth'
-  if (mode === 'forbidden') return 'forbidden'
-  return 'login'
-})
+// Parse URL hash fragment
+const hashParams = new URLSearchParams(window.location.hash.slice(1))
+const authMode = ['reauth', 'forbidden'].includes(hashParams.get('mode')) ? hashParams.get('mode') : 'login'

 function postToParent(message) {
  if (window.parent && window.parent !== window) {
@@ -1,3 +1,4 @@
+import './theme.js'
 import { createApp } from 'vue'
 import RestrictedApi from './RestrictedApi.vue'
 import '@/assets/style.css'
@@ -0,0 +1,11 @@
+// Early theme for restricted app - first URL param wins, then localStorage
+import { themeColors, applyTheme, getCachedTheme } from '@/utils/theme.js'
+
+function getTheme() {
+  const params = new URLSearchParams(location.hash.slice(1))
+  return params.get('theme') || getCachedTheme() || ''
+}
+
+// Use .surface selector to preserve transparent background
+applyTheme(getTheme(), '.surface')
+addEventListener('hashchange', () => applyTheme(getTheme(), '.surface'))
@@ -59,7 +59,7 @@
 import { computed, onMounted, reactive, ref } from 'vue'
 import passkey from '@/utils/passkey'
 import { getSettings, uiBasePath } from '@/utils/settings'
-import { apiJson, ApiError, getUserFriendlyErrorMessage } from '@/utils/api'
+import { apiJson, ApiError, getUserFriendlyErrorMessage } from 'paskia'

 const status = reactive({
  show: false,
@@ -71,12 +71,12 @@ const initializing = ref(true)
 const loading = ref(false)
 const token = ref('')
 const settings = ref(null)
-const userInfo = ref(null)
+const tokenInfo = ref(null)
 const displayName = ref('')
 const errorMessage = ref('')
 let statusTimer = null

-const sessionDescriptor = computed(() => userInfo.value?.session_type || 'your enrollment')
+const sessionDescriptor = computed(() => tokenInfo.value?.token_type || 'your enrollment')
 const subtitleMessage = computed(() => {
  if (initializing.value) return 'Preparing your secure enrollment…'
  if (!canRegister.value) return 'This authentication link is no longer valid.'
@@ -85,7 +85,7 @@ const subtitleMessage = computed(() => {

 const basePath = computed(() => uiBasePath())

-const canRegister = computed(() => !!(token.value && userInfo.value))
+const canRegister = computed(() => !!(token.value && tokenInfo.value))

 function showMessage(message, type = 'info', duration = 3000) {
  status.show = true
@@ -109,15 +109,16 @@ async function fetchSettings() {
  }
 }

-async function fetchUserInfo() {
+async function fetchTokenInfo() {
  if (!token.value) return
  try {
-    userInfo.value = await apiJson(`/auth/api/user-info?reset=${encodeURIComponent(token.value)}`, {
-      method: 'POST'
+    tokenInfo.value = await apiJson('/auth/api/token-info', {
+      method: 'GET',
+      headers: { 'Authorization': `Bearer ${token.value}` },
    })
-    displayName.value = userInfo.value?.user?.user_name || ''
+    displayName.value = tokenInfo.value.display_name
  } catch (error) {
-    console.error('Failed to load user info', error)
+    console.error('Failed to load token info', error)
    const message = error instanceof ApiError
      ? (error.data?.detail || 'The authentication link is invalid or expired.')
      : getUserFriendlyErrorMessage(error)
@@ -196,7 +197,7 @@ onMounted(async () => {
    initializing.value = false
    return
  }
-  await fetchUserInfo()
+  await fetchTokenInfo()
  initializing.value = false
 })
 </script>
@@ -10,6 +10,7 @@
  },
  "dependencies": {
    "@simplewebauthn/browser": "^13.1.2",
+    "paskia": "file:../paskia-js",
    "pinia": "^3.0.3",
    "qrcode": "^1.5.4",
    "sirv": "^3.0.2",
@@ -24,7 +24,7 @@ const rpId = computed(() => props.settings?.rp_id || 'the configured domain')
        <template v-else-if="dialog.type==='role-update'">Edit Role</template>
        <template v-else-if="dialog.type==='user-create'">Add User To Role</template>
        <template v-else-if="dialog.type==='user-update-name'">Edit User Name</template>
-        <template v-else-if="dialog.type==='perm-create' || dialog.type==='perm-display'">{{ dialog.type === 'perm-create' ? 'Create Permission' : 'Edit Permission Display' }}</template>
+        <template v-else-if="dialog.type==='perm-create' || dialog.type==='perm-display'">{{ dialog.type === 'perm-create' ? 'Create Permission' : 'Edit Permission' }}</template>
        <template v-else-if="dialog.type==='confirm'">Confirm</template>
      </h3>
      <form @submit.prevent="$emit('submitDialog')" class="modal-form">
@@ -26,9 +26,9 @@ const sortedOrgs = computed(() => [...props.orgs].sort((a,b)=> {
 }))
 const sortedPermissions = computed(() => [...props.permissions].sort((a,b)=> a.scope.localeCompare(b.scope)))

-// Derive admin status from permissions
-const isGlobalAdmin = computed(() => props.info?.permissions?.includes('auth:admin') ?? false)
-const isOrgAdmin = computed(() => props.info?.permissions?.includes('auth:org:admin') ?? false)
+// Derive admin status from permissions (info contains ctx from validate response)
+const isMasterAdmin = computed(() => props.info?.ctx.permissions.includes('auth:admin'))
+const isOrgAdmin = computed(() => props.info?.ctx.permissions.includes('auth:org:admin'))

 function permissionDisplayName(scope) {
  return props.permissions.find(p => p.scope === scope)?.display_name || scope
@@ -93,7 +93,7 @@ function handleTableKeydown(event, tableType) {
  } else if (direction === 'down' && currentIndex === rows.length - 1) {
    // At bottom of org table, navigate to permissions section
    event.preventDefault()
-    if (tableType === 'org' && isGlobalAdmin.value) {
+    if (tableType === 'org' && isMasterAdmin.value) {
      // Navigate to permissions matrix or actions
      if (permMatrixRef.value) {
        const firstCheckbox = permMatrixRef.value.querySelector('input[type="checkbox"]')
@@ -236,7 +236,7 @@ function handlePermActionsKeydown(event) {

 // Focus helper for external navigation
 function focusFirstElement() {
-  if (isGlobalAdmin.value) {
+  if (isMasterAdmin.value) {
    focusPreferred(orgActionsRef.value, { itemSelector: 'button' })
  } else {
    const firstFocusable = orgTableRef.value?.querySelector('tbody tr a, tbody tr button:not([disabled])')
@@ -249,9 +249,9 @@ defineExpose({ focusFirstElement })

 <template>
  <div class="permissions-section" ref="orgSection">
-    <h2>{{ isGlobalAdmin ? 'Organizations' : 'Your Organizations' }}</h2>
+    <h2>{{ isMasterAdmin ? 'Organizations' : 'Your Organizations' }}</h2>
    <div class="actions" ref="orgActionsRef" @keydown="handleOrgActionsKeydown">
-      <button v-if="isGlobalAdmin" @click="$emit('createOrg')">+ Create Org</button>
+      <button v-if="isMasterAdmin" @click="$emit('createOrg')">+ Create Org</button>
    </div>
    <table class="org-table" ref="orgTableRef" @keydown="e => handleTableKeydown(e, 'org')">
      <thead>
@@ -259,18 +259,18 @@ defineExpose({ focusFirstElement })
          <th>Name</th>
          <th>Roles</th>
          <th>Members</th>
-          <th v-if="isGlobalAdmin">Actions</th>
+          <th v-if="isMasterAdmin">Actions</th>
        </tr>
      </thead>
      <tbody>
        <tr v-for="o in sortedOrgs" :key="o.uuid">
          <td>
            <a href="#org/{{o.uuid}}" @click.prevent="$emit('openOrg', o)">{{ o.display_name }}</a>
-            <button v-if="isGlobalAdmin || isOrgAdmin" @click="$emit('updateOrg', o)" class="icon-btn edit-org-btn" aria-label="Rename organization" title="Rename organization">✏️</button>
+            <button v-if="isMasterAdmin || isOrgAdmin" @click="$emit('updateOrg', o)" class="icon-btn edit-org-btn" aria-label="Rename organization" title="Rename organization">✏️</button>
          </td>
          <td class="role-names">{{ getRoleNames(o) }}</td>
          <td class="center">{{ o.roles.reduce((acc,r)=>acc + r.users.length,0) }}</td>
-          <td v-if="isGlobalAdmin" class="center">
+          <td v-if="isMasterAdmin" class="center">
            <button @click="$emit('deleteOrg', o)" class="icon-btn delete-icon" aria-label="Delete organization" title="Delete organization">❌</button>
          </td>
        </tr>
@@ -278,7 +278,7 @@ defineExpose({ focusFirstElement })
    </table>
  </div>

-  <div v-if="isGlobalAdmin" class="permissions-section">
+  <div v-if="isMasterAdmin" class="permissions-section">
    <h2>Permissions</h2>
    <div class="matrix-wrapper" ref="permMatrixRef" @keydown="handleMatrixKeydown">
      <div class="matrix-scroll">
@@ -317,7 +317,7 @@ defineExpose({ focusFirstElement })
      <p class="matrix-hint muted">Toggle which permissions each organization can grant to its members.</p>
    </div>
    <div class="actions" ref="permActionsRef" @keydown="handlePermActionsKeydown">
-      <button v-if="isGlobalAdmin" @click="$emit('openDialog', 'perm-create', { display_name: '', scope: '', domain: '' })">+ Create Permission</button>
+      <button v-if="isMasterAdmin" @click="$emit('openDialog', 'perm-create', { display_name: '', scope: '', domain: '' })">+ Create Permission</button>
    </div>
    <table class="org-table" ref="permTableRef" @keydown="e => handleTableKeydown(e, 'perm')">
        <thead>
@@ -5,7 +5,7 @@ import CredentialList from '@/components/CredentialList.vue'
 import RegistrationLinkModal from '@/components/RegistrationLinkModal.vue'
 import SessionList from '@/components/SessionList.vue'
 import { useAuthStore } from '@/stores/auth'
-import { apiJson } from '@/utils/api'
+import { apiJson } from 'paskia'
 import { getDirection, navigateButtonRow, focusPreferred, focusAtIndex } from '@/utils/keynav'

 const props = defineProps({
@@ -45,7 +45,7 @@ function handleEditName() {

 async function handleDelete(credential) {
  try {
-    const data = await apiJson(`/auth/api/admin/orgs/${props.selectedUser.org_uuid}/users/${props.selectedUser.uuid}/credentials/${credential.credential_uuid}`, { method: 'DELETE' })
+    const data = await apiJson(`/auth/api/admin/orgs/${props.selectedUser.org}/users/${props.selectedUser.uuid}/credentials/${credential.credential}`, { method: 'DELETE' })
    if (data.status === 'ok') {
      emit('onUserNameSaved') // Reuse to refresh user detail
    } else {
@@ -61,7 +61,7 @@ async function handleTerminateSession(session) {
  if (!sessionId) return
  terminatingSessions.value = { ...terminatingSessions.value, [sessionId]: true }
  try {
-    const data = await apiJson(`/auth/api/admin/orgs/${props.selectedUser.org_uuid}/users/${props.selectedUser.uuid}/sessions/${sessionId}`, { method: 'DELETE' })
+    const data = await apiJson(`/auth/api/admin/orgs/${props.selectedUser.org}/users/${props.selectedUser.uuid}/sessions/${sessionId}`, { method: 'DELETE' })
    if (data.status === 'ok') {
      if (data.current_session_terminated) {
        sessionStorage.clear()
@@ -183,7 +183,7 @@ defineExpose({ focusFirstElement })
        :loading="loading"
        :org-display-name="userDetail.org.display_name"
        :role-name="userDetail.role"
-        :update-endpoint="`/auth/api/admin/orgs/${selectedUser.org_uuid}/users/${selectedUser.uuid}/display-name`"
+        :update-endpoint="`/auth/api/admin/orgs/${selectedUser.org}/users/${selectedUser.uuid}/display-name`"
        @saved="$emit('onUserNameSaved')"
        @edit-name="handleEditName"
      />
@@ -212,7 +212,7 @@ defineExpose({ focusFirstElement })
            :aaguid-info="userDetail.aaguid_info"
            :allow-delete="true"
            :hovered-credential-uuid="hoveredCredentialUuid"
-            :hovered-session-credential-uuid="hoveredSession?.credential_uuid"
+            :hovered-session-credential-uuid="hoveredSession?.credential"
            :navigation-disabled="hasActiveModal"
            @delete="handleDelete"
            @credential-hover="hoveredCredentialUuid = $event"
@@ -238,7 +238,7 @@ defineExpose({ focusFirstElement })
    </div>
    <RegistrationLinkModal
      v-if="showRegModal"
-      :endpoint="`/auth/api/admin/orgs/${selectedUser.org_uuid}/users/${selectedUser.uuid}/create-link`"
+      :endpoint="`/auth/api/admin/orgs/${selectedUser.org}/users/${selectedUser.uuid}/create-link`"
      :user-name="userDetail?.display_name || selectedUser.display_name"
      @close="$emit('closeRegModal')"
      @copied="onLinkCopied"
@@ -78,7 +78,6 @@ html {
 }

 body {
-  color-scheme: light dark;
  overflow: auto;
  scrollbar-gutter: stable;
  height: 100%;
@@ -132,6 +131,7 @@ a:focus-visible {
 }

 .view-root {
+  position: relative;
  flex: 1;
  width: 100%;
  display: flex;
@@ -731,42 +731,6 @@ th {
  }
 }

-/* Global backdrop controlled by api.js ref-counting */
-body::before {
-  content: '';
-  position: fixed;
-  inset: 0;
-  z-index: 1099;
-  background: transparent;
-  backdrop-filter: blur(0) brightness(1);
-  -webkit-backdrop-filter: blur(0) brightness(1);
-  pointer-events: none;
-  visibility: hidden;
-  transition: all 0.2s ease-out;
-}
-
-body.has-backdrop::before {
-  -webkit-backdrop-filter: blur(.2rem) brightness(0.5);
-  backdrop-filter: blur(.2rem) brightness(0.5);
-  visibility: visible;
-}
-
-body.has-backdrop {
-  overflow: auto;
-}
-
-#auth-iframe {
-  border: none;
-  position: fixed;
-  top: 0;
-  left: 0;
-  width: 100%;
-  height: 100%;
-  z-index: 9999;
-  color-scheme: auto;
-  background: transparent;
-}
-
 .slot-machine {
  padding: 0.875rem 1rem;
  background: var(--color-surface-hover, rgba(0, 0, 0, 0.03));
@@ -1,10 +1,11 @@
 <template>
  <div class="message-container">
    <div class="message-content">
-      <h2>🔒 Access Denied</h2>
+      <h2>{{ icon }} {{ title }}</h2>
+      <p v-if="message" class="error-detail">{{ message }}</p>
      <div class="button-row">
        <button class="btn-secondary" @click="goBack">Back</button>
-        <button class="btn-primary" @click="$emit('reload')">Reload Page</button>
+        <button class="btn-primary" @click="reload">Reload Page</button>
      </div>
    </div>
  </div>
@@ -13,7 +14,15 @@
 <script setup>
 import { goBack } from '@/utils/helpers'

-defineEmits(['reload'])
+const props = defineProps({
+  title: { type: String, default: 'Access Denied' },
+  icon: { type: String, default: '🔒' },
+  message: { type: String, default: null },
+})
+
+function reload() {
+  window.location.reload()
+}
 </script>

 <style scoped>
@@ -32,10 +41,15 @@ defineEmits(['reload'])
 }

 .message-content h2 {
-  margin: 0 0 1.5rem;
+  margin: 0 0 1rem;
  color: var(--color-heading);
 }

+.message-content .error-detail {
+  margin: 0 0 1.5rem;
+  color: var(--color-text-muted);
+}
+
 .message-content .button-row {
  display: flex;
  gap: 0.75rem;
@@ -5,16 +5,16 @@
    <template v-else>
      <div
        v-for="credential in credentials"
-        :key="credential.credential_uuid"
+        :key="credential.credential"
        :class="['credential-item', {
          'current-session': credential.is_current_session && !hoveredCredentialUuid && !hoveredSessionCredentialUuid,
-          'is-hovered': hoveredCredentialUuid === credential.credential_uuid,
-          'is-linked-session': hoveredSessionCredentialUuid === credential.credential_uuid
+          'is-hovered': hoveredCredentialUuid === credential.credential,
+          'is-linked-session': hoveredSessionCredentialUuid === credential.credential
        }]"
        tabindex="-1"
        @mousedown.prevent
        @click.capture="handleCardClick"
-        @focusin="handleCredentialFocus(credential.credential_uuid)"
+        @focusin="handleCredentialFocus(credential.credential)"
        @focusout="handleCredentialBlur($event)"
        @keydown="handleItemKeydown($event, credential)"
      >
@@ -33,8 +33,8 @@
          <h4 class="item-title">{{ getCredentialAuthName(credential) }}</h4>
          <div class="item-actions">
            <span v-if="credential.is_current_session && !hoveredCredentialUuid && !hoveredSessionCredentialUuid" class="badge badge-current">Current</span>
-            <span v-else-if="hoveredCredentialUuid === credential.credential_uuid" class="badge badge-current">Selected</span>
-            <span v-else-if="hoveredSessionCredentialUuid === credential.credential_uuid" class="badge badge-current">Linked</span>
+            <span v-else-if="hoveredCredentialUuid === credential.credential" class="badge badge-current">Selected</span>
+            <span v-else-if="hoveredSessionCredentialUuid === credential.credential" class="badge badge-current">Linked</span>
            <button
              v-if="allowDelete"
              @click="$emit('delete', credential)"
@@ -8,11 +8,11 @@
    <section class="section-block" ref="userInfoSection">
      <div class="section-body">
        <UserBasicInfo
-          v-if="user"
-          :name="user.user_name"
-          :visits="user.visits || 0"
-          :created-at="user.created_at"
-          :last-seen="user.last_seen"
+          v-if="ctx"
+          :name="ctx.user.display_name"
+          :visits="authStore.userInfo?.visits || 0"
+          :created-at="authStore.userInfo?.created_at"
+          :last-seen="authStore.userInfo?.last_seen"
          :org-display-name="orgDisplayName"
          :role-name="roleDisplayName"
          :can-edit="false"
@@ -78,9 +78,9 @@ const currentHost = window.location.host
 const userInfoSection = ref(null)
 const buttonRow = ref(null)

-const user = computed(() => authStore.userInfo?.user || null)
-const orgDisplayName = computed(() => authStore.userInfo?.org?.display_name || '')
-const roleDisplayName = computed(() => authStore.userInfo?.role?.display_name || '')
+const ctx = computed(() => authStore.userInfo?.ctx || null)
+const orgDisplayName = computed(() => ctx.value?.org.display_name ?? '')
+const roleDisplayName = computed(() => ctx.value?.role.display_name ?? '')

 const headingTitle = computed(() => {
  const service = authStore.settings?.rp_name
@@ -1,5 +1,15 @@
 <template>
  <section class="view-root" data-view="profile">
+    <div class="theme-toggle">
+      <button class="theme-btn" @click="themeMenuOpen = !themeMenuOpen" :title="themeTitle">
+        {{ themeEmoji }}
+      </button>
+      <div v-if="themeMenuOpen" class="theme-menu" @click="themeMenuOpen = false">
+        <button class="theme-option top" :class="{ active: selectedTheme === '' }" @click.stop="setTheme('')" title="Auto">🌓</button>
+        <button class="theme-option left" :class="{ active: selectedTheme === 'light' }" @click.stop="setTheme('light')" title="Light">☀️</button>
+        <button class="theme-option right" :class="{ active: selectedTheme === 'dark' }" @click.stop="setTheme('dark')" title="Dark">🌙</button>
+      </div>
+    </div>
    <header class="view-header">
      <h1>User Profile</h1>
      <Breadcrumbs ref="breadcrumbs" :entries="breadcrumbEntries" @keydown="handleBreadcrumbKeydown" />
@@ -8,12 +18,12 @@

    <section class="section-block" ref="userInfoSection">
      <UserBasicInfo
-        v-if="authStore.userInfo?.user"
+        v-if="authStore.userInfo?.ctx"
        ref="userBasicInfo"
-        :name="authStore.userInfo.user.user_name"
-        :visits="authStore.userInfo.user.visits || 0"
-        :created-at="authStore.userInfo.user.created_at"
-        :last-seen="authStore.userInfo.user.last_seen"
+        :name="authStore.userInfo.ctx.user.display_name"
+        :visits="authStore.userInfo.visits"
+        :created-at="authStore.userInfo.created_at"
+        :last-seen="authStore.userInfo.last_seen"
        :loading="authStore.isLoading"
        update-endpoint="/auth/api/user/display-name"
        @saved="authStore.loadUserInfo()"
@@ -47,7 +57,7 @@
          :aaguid-info="authStore.userInfo?.aaguid_info || {}"
          :loading="authStore.isLoading"
          :hovered-credential-uuid="hoveredCredentialUuid"
-          :hovered-session-credential-uuid="hoveredSession?.credential_uuid"
+          :hovered-session-credential-uuid="hoveredSession?.credential"
          :navigation-disabled="hasActiveModal"
          allow-delete
          @delete="handleDelete"
@@ -127,8 +137,9 @@ import { useAuthStore } from '@/stores/auth'
 import { adminUiPath, makeUiHref } from '@/utils/settings'
 import passkey from '@/utils/passkey'
 import { goBack } from '@/utils/helpers'
-import { apiJson } from '@/utils/api'
+import { apiJson } from 'paskia'
 import { navigateButtonRow, focusPreferred, focusAtIndex, getDirection } from '@/utils/keynav'
+import { updateThemeFromSession } from '@/utils/theme'

 const authStore = useAuthStore()
 const updateInterval = ref(null)
@@ -148,10 +159,26 @@ const breadcrumbs = ref(null)
 const userBasicInfo = ref(null)
 const userInfoSection = ref(null)

+// Theme preference
+const selectedTheme = ref('')
+const themeMenuOpen = ref(false)
+const themeEmoji = computed(() => ({ '': '🌓', light: '☀️', dark: '🌙' })[selectedTheme.value] || '🌓')
+const themeTitle = computed(() => ({ '': 'Auto (system)', light: 'Light mode', dark: 'Dark mode' })[selectedTheme.value] || 'Theme')
+watch(() => authStore.userInfo?.ctx?.user?.theme, (t) => { selectedTheme.value = t || '' }, { immediate: true })
+function setTheme(theme) {
+  selectedTheme.value = theme
+  themeMenuOpen.value = false
+  // Apply immediately for instant feedback
+  updateThemeFromSession({ user: { theme } }, true)
+  // Save to server in background
+  apiJson('/auth/api/user/theme', { method: 'PATCH', body: { theme } })
+    .catch(e => authStore.showMessage(e.message, 'error'))
+}
+
 // Check if any modal/dialog is open (blocks arrow key navigation)
 const hasActiveModal = computed(() => showNameDialog.value || showRegLink.value)

-watch(showNameDialog, (newVal) => { if (newVal) newName.value = authStore.userInfo?.user?.user_name || '' })
+watch(showNameDialog, (newVal) => { if (newVal) newName.value = authStore.userInfo?.ctx.user.display_name ?? '' })

 onMounted(() => {
  updateInterval.value = setInterval(() => { if (authStore.userInfo) authStore.userInfo = { ...authStore.userInfo } }, 60000)
@@ -292,7 +319,7 @@ const handleLogoutButtonKeydown = (event) => {
 }

 const handleDelete = async (credential) => {
-  const credentialId = credential?.credential_uuid
+  const credentialId = credential?.credential
  if (!credentialId) return
  try {
    await authStore.deleteCredential(credentialId)
@@ -323,9 +350,9 @@ const terminateSession = async (session) => {

 const logoutEverywhere = async () => { await authStore.logoutEverywhere() }
 const logout = async () => { await authStore.logout() }
-const openNameDialog = () => { newName.value = authStore.userInfo?.user?.user_name || ''; showNameDialog.value = true }
+const openNameDialog = () => { newName.value = authStore.userInfo?.ctx.user.display_name ?? ''; showNameDialog.value = true }
 const isAdmin = computed(() => {
-  const perms = authStore.userInfo?.permissions ?? []
+  const perms = authStore.userInfo?.ctx.permissions
  return perms.includes('auth:admin') || perms.includes('auth:org:admin')
 })
 const hasMultipleSessions = computed(() => sessions.value.length > 1)
@@ -352,8 +379,16 @@ const saveName = async () => {
 .logout-note { margin: 0.75rem 0 0; color: var(--color-text-muted); font-size: 0.875rem; }
 .remote-auth-inline { display: flex; flex-direction: column; gap: 0.5rem; }
 .remote-auth-label { display: block; margin: 0; font-size: 0.875rem; color: var(--color-text-muted); font-weight: 500; }
-.remote-auth-description {
-  font-size: 0.75rem;
-  color: var(--color-text-muted);
-}
+.remote-auth-description { font-size: 0.75rem; color: var(--color-text-muted); }
+.theme-toggle { position: absolute; top: var(--layout-padding); right: var(--layout-padding); }
+.theme-btn { background: none; border: none; padding: 0.25rem; font-size: 1.25rem; cursor: pointer; opacity: 0.5; transition: opacity 0.15s; }
+.theme-btn:hover { opacity: 0.8; }
+.theme-menu { position: absolute; top: 100%; right: 0; width: 5rem; height: 4rem; margin-top: 0.25rem; }
+.theme-option { position: absolute; background: none; border: none; font-size: 1.25rem; cursor: pointer; opacity: 0.5; padding: 0.25rem; border-radius: var(--radius-sm); transition: opacity 0.15s, transform 0.15s; }
+.theme-option:hover { opacity: 1; transform: scale(1.2); }
+.theme-option.active { opacity: 1; }
+.theme-option.top { top: 0; left: 50%; transform: translateX(-50%); }
+.theme-option.top:hover { transform: translateX(-50%) scale(1.2); }
+.theme-option.left { bottom: 0; left: 0; }
+.theme-option.right { bottom: 0; right: 0; }
 </style>
@@ -35,9 +35,10 @@
 <script setup>
 import { ref, onMounted, onUnmounted, nextTick } from 'vue'
 import QRCodeDisplay from '@/components/QRCodeDisplay.vue'
-import { apiJson } from '@/utils/api'
+import { apiJson } from 'paskia'
 import { formatDate } from '@/utils/helpers'
 import { getDirection } from '@/utils/keynav'
+import { useAuthStore } from '@/stores/auth'

 const props = defineProps({
  endpoint: { type: String, required: true },
@@ -46,6 +47,7 @@ const props = defineProps({

 const emit = defineEmits(['close', 'copied'])

+const authStore = useAuthStore()
 const dialog = ref(null)
 const linkUrl = ref(null)
 const expiresAt = ref(null)
@@ -73,7 +75,8 @@ async function generateLink() {
    } else {
      emit('close')
    }
-  } catch {
+  } catch (e) {
+    authStore.showMessage(e.message || 'Failed to generate link', 'error')
    emit('close')
  }
 }
@@ -58,7 +58,7 @@
 import { computed, nextTick, onMounted, onUnmounted, reactive, ref, watch } from 'vue'
 import passkey from '@/utils/passkey'
 import { getSettings, uiBasePath } from '@/utils/settings'
-import { fetchJson, getUserFriendlyErrorMessage } from '@/utils/api'
+import { fetchJson, getUserFriendlyErrorMessage } from 'paskia'
 import RemoteAuthRequest from '@/components/RemoteAuthRequest.vue'
 import { focusDialogButton } from '@/utils/keynav'

@@ -76,13 +76,13 @@ const status = reactive({ show: false, message: '', type: 'info' })
 const initializing = ref(true)
 const loading = ref(false)
 const settings = ref(null)
-const userInfo = ref(null)
+const session = ref(null)
 const currentView = ref('initial') // 'initial', 'login', 'forbidden'
 const authView = ref('local') // 'local' or 'remote'
 const buttonRow = ref(null)
 let statusTimer = null

-const isAuthenticated = computed(() => !!userInfo.value?.authenticated)
+const isAuthenticated = computed(() => !!session.value)

 const canAuthenticate = computed(() => {
  if (initializing.value) return false
@@ -115,7 +115,7 @@ const headerMessage = computed(() => {
  return 'Please sign in with your passkey.'
 })

-const userDisplayName = computed(() => userInfo.value?.user?.user_name || 'User')
+const userDisplayName = computed(() => session.value?.ctx.user.display_name || 'User')

 function showMessage(message, type = 'info', duration = 3000) {
  status.show = true
@@ -140,22 +140,21 @@ async function fetchSettings() {
  }
 }

-async function fetchUserInfo() {
+async function validateSession() {
  try {
-    userInfo.value = await fetchJson('/auth/api/user-info', { method: 'POST' })
+    session.value = await fetchJson('/auth/api/validate', { method: 'POST' })
    if (isAuthenticated.value && props.mode !== 'reauth') {
      currentView.value = 'forbidden'
-      emit('forbidden', userInfo.value)
+      emit('forbidden', session.value)
    } else {
      currentView.value = 'login'
    }
  } catch (error) {
-    console.error('Failed to load user info', error)
+    session.value = null
+    currentView.value = 'login'
    if (error.status !== 401 && error.status !== 403) {
      showMessage(getUserFriendlyErrorMessage(error), 'error', 4000)
    }
-    userInfo.value = null
-    currentView.value = 'login'
  }
 }

@@ -188,7 +187,7 @@ async function logoutUser() {
  loading.value = true
  try {
    await fetchJson('/auth/api/logout', { method: 'POST' })
-    userInfo.value = null
+    session.value = null
    currentView.value = 'login'
    showMessage('Logged out. You can sign in with a different account.', 'info', 3000)
  } catch (error) {
@@ -266,7 +265,7 @@ watch(initializing, (newVal) => {

 onMounted(async () => {
  await fetchSettings()
-  await fetchUserInfo()
+  await validateSession()
  initializing.value = false

  // Add click handler for inline links
@@ -280,7 +279,7 @@ onUnmounted(() => {
 defineExpose({
  showMessage,
  isAuthenticated,
-  userInfo
+  session
 })
 </script>

@@ -20,7 +20,7 @@
                :class="['session-item', {
                  'is-current': session.is_current && !hoveredIp && !hoveredCredentialUuid,
                  'is-hovered': hoveredSession?.id === session.id,
-                  'is-linked-credential': hoveredCredentialUuid === session.credential_uuid
+                  'is-linked-credential': hoveredCredentialUuid === session.credential
                }]"
                tabindex="-1"
                @mousedown.prevent
@@ -34,7 +34,7 @@
                  <div class="item-actions">
                    <span v-if="session.is_current && !hoveredIp && !hoveredCredentialUuid" class="badge badge-current">Current</span>
                    <span v-else-if="hoveredSession?.id === session.id" class="badge badge-current">Selected</span>
-                    <span v-else-if="hoveredCredentialUuid === session.credential_uuid" class="badge badge-current">Linked</span>
+                    <span v-else-if="hoveredCredentialUuid === session.credential" class="badge badge-current">Linked</span>
                    <span v-else-if="!hoveredCredentialUuid && isSameHost(session.ip)" class="badge">Same IP</span>
                    <button
                      @click="$emit('terminate', session)"
@@ -1,7 +1,8 @@
 import { defineStore } from 'pinia'
 import { register, authenticate } from '@/utils/passkey'
 import { getSettings } from '@/utils/settings'
-import { apiJson } from '@/utils/api'
+import { apiJson } from 'paskia'
+import { updateThemeFromSession } from '@/utils/theme'

 export const useAuthStore = defineStore('auth', {
  state: () => ({
@@ -86,6 +87,7 @@ export const useAuthStore = defineStore('auth', {
    async loadUserInfo() {
      try {
        this.userInfo = await apiJson('/auth/api/user-info', { method: 'POST' })
+        updateThemeFromSession(this.userInfo?.ctx)
        console.log('User info loaded:', this.userInfo)
      } catch (error) {
        // Suppress toast for 401/403 errors - the auth iframe will handle these
@@ -1,77 +1,3 @@
-/**
- * API fetch wrapper that handles authentication errors with iframe-based re-authentication.
- *
- * When a 401 or 403 response is received with an `auth` object containing `iframe` URL,
- * this wrapper shows an authentication iframe and retries the original request after
- * successful authentication.
- */
-
-/** Default timeout for API requests in milliseconds */
-const DEFAULT_TIMEOUT_MS = 1000
-
-/**
- * Custom error class for API errors with full response context.
- */
-export class ApiError extends Error {
-  constructor(url, response, data) {
-    super(data?.detail || `Request failed: ${response.status}`)
-    this.name = 'ApiError'
-    this.url = url
-    this.status = response.status
-    this.statusText = response.statusText
-    this.data = data
-  }
-}
-
-/**
- * Custom error class for network/timeout errors.
- */
-export class NetworkError extends Error {
-  constructor(message, originalError = null) {
-    super(message)
-    this.name = 'NetworkError'
-    this.originalError = originalError
-  }
-}
-
-/**
- * Error thrown when user cancels authentication.
- */
-export class AuthCancelledError extends Error {
-  constructor() {
-    super('Authentication cancelled')
-    this.name = 'AuthCancelledError'
-  }
-}
-
-let authIframe = null
-let authPromise = null
-let authResolve = null
-let authReject = null
-
-// Global backdrop ref-count (works independently of Pinia store)
-let backdropHolders = 0
-
-/**
- * Hold global backdrop (increment ref-count).
- * Multiple callers can hold the backdrop; it only hides when all release.
- */
-export function holdGlobalBackdrop() {
-  backdropHolders++
-  document.body.classList.add('has-backdrop')
-}
-
-/**
- * Release global backdrop (decrement ref-count).
- * Backdrop hides only when ref-count reaches zero.
- */
-export function releaseGlobalBackdrop() {
-  backdropHolders = Math.max(0, backdropHolders - 1)
-  if (backdropHolders === 0) {
-    document.body.classList.remove('has-backdrop')
-  }
-}
-
 // Cache for auth iframe URL by mode
 const authIframeUrlCache = {}

@@ -88,7 +14,7 @@ export async function getAuthIframeUrl(mode = 'login') {
  }

  // Fetch from forward endpoint - it returns URL in auth.iframe on 401/403
-  const response = await fetch('/auth/api/forward', { credentials: 'include' })
+  const response = await fetch('/auth/api/forward')
  if (response.status === 401 || response.status === 403) {
    const data = await response.json()
    if (data.auth?.iframe) {
@@ -104,303 +30,3 @@ export async function getAuthIframeUrl(mode = 'login') {
  }
  throw new Error('Unable to fetch auth iframe URL')
 }
-
-/**
- * Check if an auth iframe is already open (from any source).
- * @returns {boolean}
- */
-export function isAuthIframeOpen() {
-  return !!document.getElementById('auth-iframe')
-}
-
-/**
- * Show the authentication iframe and return a promise that resolves on success.
- * If an auth iframe is already open (from any source), hooks into its completion.
- * Uses global backdrop system to avoid flicker between auth and caller's UI.
- * @param {string} iframeUrl - The URL for the iframe src
- * @returns {Promise<void>}
- * @throws {AuthCancelledError} - If authentication is cancelled by user
- */
-export function showAuthIframe(iframeUrl) {
-  // If we already have a promise (from us), return it
-  if (authPromise) return authPromise
-
-  // If there's already an iframe in the DOM (from App.vue or elsewhere),
-  // create a promise that hooks into the message handler
-  if (document.getElementById('auth-iframe')) {
-    authPromise = new Promise((resolve, reject) => {
-      authResolve = resolve
-      authReject = reject
-    })
-    return authPromise
-  }
-
-  authPromise = new Promise((resolve, reject) => {
-    authResolve = resolve
-    authReject = reject
-  })
-
-  // Remove existing iframe if any
-  hideAuthIframe()
-
-  // Hold global backdrop for auth iframe
-  holdGlobalBackdrop()
-
-  // Create new iframe for authentication using src URL
-  authIframe = document.createElement('iframe')
-  authIframe.id = 'auth-iframe'
-  authIframe.title = 'Authentication'
-  authIframe.allow = 'publickey-credentials-get; publickey-credentials-create'
-  authIframe.src = iframeUrl
-  document.body.appendChild(authIframe)
-
-  return authPromise
-}
-
-function hideAuthIframe() {
-  if (authIframe) {
-    authIframe.remove()
-    authIframe = null
-    releaseGlobalBackdrop()
-  }
-}
-
-function handleAuthMessage(event) {
-  const data = event.data
-  if (!data?.type) return
-
-  switch (data.type) {
-    case 'auth-success':
-      hideAuthIframe()
-      if (authResolve) {
-        authResolve()
-        authPromise = null
-        authResolve = null
-        authReject = null
-      }
-      break
-
-    case 'auth-back':
-    case 'auth-close-request':
-      hideAuthIframe()
-      if (authReject) {
-        authReject(new AuthCancelledError())
-        authPromise = null
-        authResolve = null
-        authReject = null
-      }
-      break
-
-    case 'auth-error':
-      // Keep iframe open for retry, but if cancelled, treat as back
-      if (data.cancelled && authReject) {
-        hideAuthIframe()
-        authReject(new AuthCancelledError())
-        authPromise = null
-        authResolve = null
-        authReject = null
-      }
-      break
-  }
-}
-
-// Install global message listener
-if (typeof window !== 'undefined') {
-  window.addEventListener('message', handleAuthMessage)
-}
-
-/**
- * Fetch wrapper that handles auth errors with iframe-based re-authentication.
- * Loops until successful or user cancels authentication.
- *
- * @param {string|URL} url - The URL to fetch
- * @param {RequestInit} [options] - Fetch options
- * @param {number} [options.timeout] - Timeout in ms (default: 10000, use 0 to disable)
- * @returns {Promise<Response>} - The fetch response
- * @throws {AuthCancelledError} - If authentication is cancelled by user
- * @throws {NetworkError} - If network error or timeout occurs
- */
-export async function apiFetch(url, options = {}) {
-  const { timeout = DEFAULT_TIMEOUT_MS, ...fetchOptions } = options
-
-  // Ensure credentials are included for cookie-based auth
-  fetchOptions.credentials = fetchOptions.credentials || 'include'
-
-  while (true) {
-    let response
-    try {
-      response = await fetch(url, {...fetchOptions, signal: timeout && AbortSignal.timeout(timeout)})
-    } catch (error) {
-      // Handle network errors and timeouts
-      if (error.name === 'TimeoutError') {
-        throw new NetworkError('Request timed out', error)
-      }
-      if (error.name === 'AbortError') {
-        // Re-throw abort errors as-is (user-initiated cancellation)
-        throw error
-      }
-      if (error.name === 'TypeError' && error.message === 'Failed to fetch') {
-        throw new NetworkError('Unable to connect to server', error)
-      }
-      throw new NetworkError(error.message || 'Network error', error)
-    }
-
-    // Check for auth errors (401/403)
-    if (response.status === 401 || response.status === 403) {
-      // Try to parse the response to get the iframe URL
-      let authInfo = null
-      try {
-        const data = await response.clone().json()
-        authInfo = data.auth
-      } catch {
-        // If we can't parse JSON, no iframe available
-      }
-
-      // Authenticate via iframe (only in top-level window)
-      if (authInfo?.iframe && window === window.top) {
-        // Show auth iframe (or wait for existing one) and retry on success
-        // showAuthIframe returns existing promise if iframe is already open
-        await showAuthIframe(authInfo.iframe)
-        continue  // Retry the original request
-      }
-    }
-
-    return response
-  }
-}
-
-/**
- * Convenience method for JSON API calls.
- * Automatically sets Accept and Content-Type headers.
- * Returns parsed JSON directly if response is ok, throws ApiError otherwise.
- *
- * @param {string|URL} url - The URL to fetch
- * @param {RequestInit} [options] - Fetch options
- * @returns {Promise<any>} - Parsed JSON response
- * @throws {ApiError} - If response is not ok
- * @throws {NetworkError} - If network error or timeout occurs
- * @throws {AuthCancelledError} - If authentication is cancelled by user
- */
-export async function apiJson(url, options = {}) {
-  const fetchOptions = { ...options }
-
-  // Set default headers, allowing caller overrides
-  fetchOptions.headers = {
-    'Accept': 'application/json',
-    ...fetchOptions.headers,
-  }
-
-  // Set Content-Type for requests with JSON body
-  if (fetchOptions.body && typeof fetchOptions.body === 'object' && !(fetchOptions.body instanceof FormData)) {
-    fetchOptions.headers = {
-      'Content-Type': 'application/json',
-      ...fetchOptions.headers,
-    }
-    fetchOptions.body = JSON.stringify(fetchOptions.body)
-  }
-
-  const response = await apiFetch(url, fetchOptions)
-  const data = await response.json()
-
-  if (!response.ok) {
-    throw new ApiError(url, response, data)
-  }
-
-  return data
-}
-
-/**
- * Simple JSON fetch without auto-auth iframe handling.
- * Use this in contexts where showing an auth iframe would be inappropriate
- * (e.g., inside the auth iframe itself).
- *
- * @param {string|URL} url - The URL to fetch
- * @param {RequestInit} [options] - Fetch options
- * @returns {Promise<any>} - Parsed JSON response
- * @throws {ApiError} - If response is not ok
- */
-export async function fetchJson(url, options = {}) {
-  const fetchOptions = {
-    credentials: 'include',
-    ...options,
-    headers: {
-      'Accept': 'application/json',
-      ...options.headers,
-    },
-  }
-
-  const response = await fetch(url, fetchOptions)
-  const data = await response.json()
-
-  if (!response.ok) {
-    throw new ApiError(url, response, data)
-  }
-
-  return data
-}
-
-/**
- * Convert an error to a user-friendly message.
- * @param {Error} error - The error to convert
- * @returns {string} - User-friendly error message
- */
-export function getUserFriendlyErrorMessage(error) {
-  if (error instanceof NetworkError) {
-    return error.message
-  }
-  if (error instanceof ApiError) {
-    return error.message
-  }
-  if (error.name === 'TimeoutError') {
-    return 'Request timed out'
-  }
-  if (error.name === 'TypeError' && error.message === 'Failed to fetch') {
-    return 'Unable to connect to server'
-  }
-  return error.message || 'An error occurred'
-}
-
-/**
- * Check if an error should show a toast to the user.
- * @param {Error} error - The error to check
- * @returns {boolean} - Whether to show a toast
- */
-export function shouldShowErrorToast(error) {
-  // Don't show toast for user cancellations
-  if (error instanceof AuthCancelledError) return false
-  if (error.name === 'AbortError') return false
-  // Don't show toast for 401/403 errors - the auth iframe will handle these
-  if (error instanceof ApiError && (error.status === 401 || error.status === 403)) return false
-  return true
-}
-
-/**
- * Create an API caller with error handling (toast + console.error).
- * Wraps apiJson calls with consistent error handling for apps.
- *
- * @param {Function} showMessage - Function to show toast messages: (message, type, duration) => void
- * @returns {Function} - Wrapped apiJson that handles errors
- */
-export function createApiCaller(showMessage) {
-  /**
-   * @param {string|URL} url - The URL to fetch
-   * @param {RequestInit} [options] - Fetch options
-   * @returns {Promise<any>} - Parsed JSON response, or undefined on error
-   */
-  return async function apiCall(url, options = {}) {
-    try {
-      return await apiJson(url, options)
-    } catch (error) {
-      if (!shouldShowErrorToast(error)) {
-        throw error
-      }
-      // Log full error details
-      console.error(`API error for ${url}:`, error instanceof ApiError ? { status: error.status, statusText: error.statusText, data: error.data } : error)
-      // Show user-friendly toast
-      showMessage(getUserFriendlyErrorMessage(error), 'error', 4000)
-      throw error
-    }
-  }
-}
-
-export default apiFetch
@@ -1,7 +1,7 @@
 import { startRegistration, startAuthentication } from '@simplewebauthn/browser'
 import aWebSocket from '@/utils/awaitable-websocket'
 import { getSettings } from '@/utils/settings'
-import { showAuthIframe } from '@/utils/api'
+import { showAuthIframe } from 'paskia'

 // Generic path normalizer: if an auth_host is configured and differs from current
 // host, return absolute URL (scheme derived by aWebSocket). Otherwise, keep as-is.
@@ -0,0 +1,101 @@
+// Theme override utilities - shared across apps
+// User preference or URL hash can force light/dark mode
+
+export const themeColors = {
+  light: {
+    'color-canvas': '#ffffff',
+    'color-surface': '#eff6ff',
+    'color-surface-subtle': '#dbeafe',
+    'color-border': '#2563eb',
+    'color-border-strong': '#1e40af',
+    'color-heading': '#1e3a8a',
+    'color-text': '#1e293b',
+    'color-text-muted': '#475569',
+    'color-link': '#1d4ed8',
+    'color-link-hover': '#1e40af',
+    'color-accent': '#2563eb',
+    'color-accent-strong': '#1e40af',
+    'color-accent-contrast': '#ffffff',
+    'color-success-text': '#166534',
+    'color-success-bg': '#dcfce7',
+    'color-error-text': '#b91c1c',
+    'color-error-bg': '#fee2e2',
+    'color-info-text': '#1e40af',
+    'color-info-bg': '#dbeafe',
+    'color-danger': '#dc2626',
+    'shadow-soft': '0 10px 30px rgba(30, 64, 175, 0.15)',
+  },
+  dark: {
+    'color-canvas': '#0f172a',
+    'color-surface': '#141b2f',
+    'color-surface-subtle': '#1b243b',
+    'color-border': '#25304a',
+    'color-border-strong': '#3d4d6b',
+    'color-heading': '#fff',
+    'color-text': '#e2e8f0',
+    'color-text-muted': '#94a3b8',
+    'color-link': '#60a5fa',
+    'color-link-hover': '#93c5fd',
+    'color-accent': '#60a5fa',
+    'color-accent-strong': '#3b82f6',
+    'color-accent-contrast': '#0b1120',
+    'color-success-text': '#34d399',
+    'color-success-bg': '#1a4d2e',
+    'color-error-text': '#fca5a5',
+    'color-error-bg': '#4a1f1f',
+    'color-info-text': '#bae6fd',
+    'color-info-bg': '#1e3a5f',
+    'color-danger': '#f87171',
+    'shadow-soft': '0 0 0 #000000',
+  }
+}
+
+const STYLE_ID = 'theme-override'
+const TRANSITION_ID = 'theme-transition'
+const STORAGE_KEY = 'paskia-theme'
+
+/** Apply theme override CSS - selector targets .surface for restricted app, :root for main apps */
+export function applyTheme(theme, selector = ':root', animate = false) {
+  // Add temporary transition for smooth theme change
+  if (animate) {
+    let transitionStyle = document.getElementById(TRANSITION_ID)
+    if (!transitionStyle) {
+      transitionStyle = document.createElement('style')
+      transitionStyle.id = TRANSITION_ID
+      transitionStyle.textContent = '*, *::before, *::after { transition: background-color 0.3s, color 0.3s, border-color 0.3s, box-shadow 0.3s !important; }'
+      document.head.appendChild(transitionStyle)
+    }
+    setTimeout(() => document.getElementById(TRANSITION_ID)?.remove(), 350)
+  }
+  document.getElementById(STYLE_ID)?.remove()
+  if (theme && themeColors[theme]) {
+    const css = `${selector} { ${Object.entries(themeColors[theme]).map(([k, v]) => `--${k}: ${v}`).join('; ')}; }`
+    const style = document.createElement('style')
+    style.id = STYLE_ID
+    style.textContent = css
+    document.head.appendChild(style)
+  }
+}
+
+/** Get theme from localStorage cache */
+export function getCachedTheme() {
+  return localStorage.getItem(STORAGE_KEY) || ''
+}
+
+/** Cache theme in localStorage */
+export function setCachedTheme(theme) {
+  if (theme) localStorage.setItem(STORAGE_KEY, theme)
+  else localStorage.removeItem(STORAGE_KEY)
+}
+
+/** Initialize theme from user preference (with localStorage cache for fast load) */
+export function initThemeFromCache() {
+  applyTheme(getCachedTheme())
+}
+
+/** Update theme from session context (call after login/session load) */
+export function updateThemeFromSession(ctx, animate = false) {
+  const theme = ctx?.user?.theme || ''
+  setCachedTheme(theme)
+  applyTheme(theme, ':root', animate)
+}
@@ -0,0 +1,35 @@
+/**
+ * FastAPI-Vue Vite Plugin
+ *
+ * Configures Vite for FastAPI backend integration:
+ * - Proxies /api/* requests to the FastAPI backend
+ * - Builds to the Python module's frontend-build directory
+ *
+ * Environment variables (with defaults):
+ *   FASTAPI_VUE_BACKEND_URL=http://localhost:5180 - Backend API URL for proxying
+ */
+
+const backendUrl = process.env.FASTAPI_VUE_BACKEND_URL || "http://localhost:5180"
+
+export default function fastapiVue({ paths = ["/api"] } = {}) {
+  // Build proxy configuration for each path
+  const proxy = {}
+  for (const path of paths) {
+    proxy[path] = {
+      target: backendUrl,
+      changeOrigin: false,
+      ws: true,
+    }
+  }
+
+  return {
+    name: "fastapi-vite",
+    config: () => ({
+      server: { proxy },
+      build: {
+        outDir: "../paskia/frontend-build",
+        emptyOutDir: true,
+      },
+    }),
+  }
+}
@@ -4,6 +4,7 @@ import { resolve } from 'node:path'
 import vue from '@vitejs/plugin-vue'
 import { existsSync, renameSync, mkdirSync } from 'node:fs'
 import sirv from 'sirv'
+import fastapiVue from './vite-plugin-fastapi.js'

 // Auth host mode: when set, clients accessing the auth host get /auth/ at / and /auth/admin/ at /admin/
 const authHost = process.env.PASKIA_AUTH_HOST
@@ -12,6 +13,14 @@ export default defineConfig(({ command }) => ({
  appType: 'mpa',
  publicDir: 'public',
  plugins: [
+    fastapiVue({ paths: [
+      "/auth/api",
+      "/auth/ws",
+      // Passphrase links: /auth/word1.word2.word3.word4.word5
+      "^/auth/[a-z]+\\.[a-z]+\\.[a-z]+\\.[a-z]+\\.[a-z]+$",
+      // Passphrase links: /word1.word2.word3.word4.word5
+      "^/[a-z]+\\.[a-z]+\\.[a-z]+\\.[a-z]+\\.[a-z]+$",
+    ] }),
    vue(),
    // Auth host routing: rewrite paths when accessing dedicated auth host
    // Must run before serve-examples to handle / correctly
@@ -81,7 +90,9 @@ export default defineConfig(({ command }) => ({
    }
  ].filter(Boolean),
  resolve: {
-    alias: { '@': fileURLToPath(new URL('./src', import.meta.url)) }
+    alias: {
+      '@': fileURLToPath(new URL('./src', import.meta.url)),
+    }
  },
  base: '/',
  server: {
@@ -89,24 +100,6 @@ export default defineConfig(({ command }) => ({
    allowedHosts: true,
    fs: {
      allow: ['..']
-    },
-    proxy: {
-      // Only proxy these two specific backend API paths
-      '/auth/api': {
-        target: 'http://localhost:4402'
-      },
-      '/auth/ws': {
-        target: 'http://localhost:4402',
-        ws: true
-      },
-      // Passphrase links: /auth/word1.word2.word3.word4.word5
-      '^/auth/[a-z]+\\.[a-z]+\\.[a-z]+\\.[a-z]+\\.[a-z]+$': {
-        target: 'http://localhost:4402'
-      },
-      // Passphrase links: /word1.word2.word3.word4.word5
-      '^/[a-z]+\\.[a-z]+\\.[a-z]+\\.[a-z]+\\.[a-z]+$': {
-        target: 'http://localhost:4402'
-      }
    }
  },
  build: {
@@ -0,0 +1,30 @@
+# Logs
+logs
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+pnpm-debug.log*
+lerna-debug.log*
+
+node_modules
+.DS_Store
+dist
+dist-ssr
+coverage
+*.local
+
+/cypress/videos/
+/cypress/screenshots/
+
+# Editor directories and files
+.vscode/*
+!.vscode/extensions.json
+.idea
+*.suo
+*.ntvs*
+*.njsproj
+*.sln
+*.sw?
+
+*.tsbuildinfo
@@ -0,0 +1,131 @@
+# Paskia
+
+![Screenshot](https://git.zi.fi/leovasanko/paskia/raw/main/docs/screenshots/forbidden-light.webp)
+
+JavaScript utilities for [Paskia authentication system](https://git.zi.fi/leovasanko/paskia) integration into web apps.
+
+## Installation
+
+### NPM
+
+No framework dependencies. Works with any framework (Vue, React, Svelte, etc.) or vanilla JS. Typescript typing included.
+
+```sh
+npm install paskia
+```
+
+```js
+import { ... } from 'paskia'
+```
+
+### Plain JavaScript
+
+Fetch the module directly from a CDN, or [download](https://cdn.jsdelivr.net/npm/paskia@latest/dist/paskia.js) first and host yourself. No Node needed.
+
+```html
+<script type="module">
+  import { ... } from 'https://cdn.jsdelivr.net/npm/paskia@latest/dist/paskia.js'
+</script>
+```
+
+## Features
+
+### Session Validation
+
+Refresh session and track its validity with automatic polling. Pauses on lack of user activity to avoid useless traffic and to allow session expiry even when the page is left open but idle. This monitors that the same account stays logged in but doesn't do any permission checks.
+
+```js
+import { SessionValidator } from 'paskia'
+
+const validator = new SessionValidator(
+  () => currentUser?.uuid,  // getter for current user ID that we track
+  (error) => handleSessionLost(error)  // callback when session is lost
+)
+
+validator.start()  // call at your app startup/login
+validator.stop()   // stop the system (optional)
+```
+
+### API Fetch Utilities
+
+Enhanced fetch functions with automatic error handling and authentication retry:
+
+```js
+import { apiJson, apiFetch } from 'paskia'
+
+// JSON API calls with automatic auth handling
+const data = await apiJson('/api/endpoint', { method: 'POST', body: { key: 'value' } })
+
+// Raw fetch with auth handling
+const response = await apiFetch('/api/endpoint')
+```
+
+When a 401/403 response includes an auth iframe URL, the request automatically pauses, displays the authentication UI, and retries upon success. In case this is not needed, use standard `fetch` or our `fetchJson`.
+
+The JSON variants set headers automatically, with body and response in JSON.
+
+### Authentication Overlay
+
+Normally you use apiJson/apiFetch and they handle this automatically. If you need to wire it yourself, on a 401/403 response that includes `auth.iframe`, call `showAuthIframe(...)` and then retry the original request.
+
+The backend returns 401/403 responses with the correct URL for proper user feedback. Alternatively you may use `/auth/restricted/#mode=login`, `mode=reauth` or `mode=forbidden` to trigger the UX flow you need.
+
+```js
+import { showAuthIframe, AuthCancelledError } from 'paskia'
+
+const response = await fetch('/api/protected')
+if (response.status === 401 || response.status === 403) {
+  const data = await response.json()
+  if (data.auth?.iframe) {
+    await showAuthIframe(data.auth.iframe)  // Raises AuthCancelledError if the user cancels
+  }
+}
+```
+
+This resolves after the user authenticates (possibly with another account than previously), and you should usually retry the original API request. Note that successful authentication doesn't guarantee that the user still has rights to what originally failed.
+
+### Shared Blur Backdrop
+
+The authentication dialog displays with a blur backdrop (z-index 1099). The auth iframe uses z-index 9999. Your app dialogs should use z-index 1100–9998 to appear above the backdrop but below authentication.
+
+The backdrop is also reusable/refcounted, so you can keep consistent visuals for your own dialogs:
+
+```js
+import { holdGlobalBackdrop, releaseGlobalBackdrop } from 'paskia'
+
+holdGlobalBackdrop()
+try {
+  await your.own.dialog()
+} finally {
+  releaseGlobalBackdrop()
+}
+```
+
+The backdrop only disappears after all holders have released it.
+
+## Error Handling
+
+### AuthCancelledError (apiFetch, apiJson, showAuthIframe)
+
+If the user clicks Back in the authentication dialog, refusing to authenticate, `AuthCancelledError` is risen (as a response to postMessage from the iframe). The dialog closes as expected and it is up to the app how to continue from there.
+
+- Do nothing if the app can continue despite the failed operation (no UI notification needed)
+- Display a simple Access Denied page with suggestion/button to reload the page to try again
+
+Do not retry automatically.
+
+### UI feedback
+
+A set of small utilities are available for determining whether the user needs a notification and to format the error message.
+
+```js
+import { getUserFriendlyErrorMessage, shouldShowErrorToast } from 'paskia'
+
+try {
+  await apiJson('/api/action')
+} catch (e) {
+  if (shouldShowErrorToast(e)) {
+    your.message.display(getUserFriendlyErrorMessage(e))
+  }
+}
+```
@@ -0,0 +1,32 @@
+{
+  "name": "paskia",
+  "version": "0.1.2",
+  "description": "Paskia authentication utilities for JavaScript",
+  "type": "module",
+  "main": "./dist/paskia.js",
+  "types": "./dist/paskia.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/paskia.d.ts",
+      "import": "./dist/paskia.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "vite build",
+    "prepublishOnly": "npm run build"
+  },
+  "devDependencies": {
+    "typescript": "~5.8.0",
+    "vite": "^7.3.1",
+    "vite-plugin-dts": "^4.5.4"
+  },
+  "keywords": [
+    "auth",
+    "authentication",
+    "paskia"
+  ],
+  "license": "Unlicense"
+}
@@ -0,0 +1,146 @@
+import { showAuthIframe, AuthCancelledError } from './overlay'
+
+export { AuthCancelledError }
+
+const DEFAULT_TIMEOUT_MS = 1000
+
+export interface ApiFetchOptions extends RequestInit {
+  timeout?: number
+}
+
+export interface FetchJsonOptions extends Omit<RequestInit, 'body'> {
+  timeout?: number
+  body?: BodyInit | Record<string, unknown> | null
+}
+
+export class ApiError extends Error {
+  readonly url: string
+  readonly status: number
+  readonly statusText: string
+  readonly data: unknown
+
+  constructor(url: string, response: Response, data: unknown) {
+    super((data as { detail?: string })?.detail || `Request failed: ${response.status}`)
+    this.name = 'ApiError'
+    this.url = url
+    this.status = response.status
+    this.statusText = response.statusText
+    this.data = data
+  }
+}
+
+export class NetworkError extends Error {
+  readonly originalError: Error | null
+
+  constructor(message: string, originalError: Error | null = null) {
+    super(message)
+    this.name = 'NetworkError'
+    this.originalError = originalError
+  }
+}
+
+export async function apiFetch(url: string, options: ApiFetchOptions = {}): Promise<Response> {
+  const { timeout = DEFAULT_TIMEOUT_MS, ...fetchOptions } = options
+  fetchOptions.credentials = fetchOptions.credentials || 'include'
+
+  while (true) {
+    let response: Response
+    try {
+      response = await fetch(url, {...fetchOptions, signal: timeout ? AbortSignal.timeout(timeout) : undefined})
+    } catch (error) {
+      const err = error as Error
+      if (err.name === 'TimeoutError') {
+        throw new NetworkError('Request timed out', err)
+      }
+      if (err.name === 'AbortError') {
+        throw error
+      }
+      if (err.name === 'TypeError' && err.message === 'Failed to fetch') {
+        throw new NetworkError('Unable to connect to server', err)
+      }
+      throw new NetworkError(err.message || 'Network error', err)
+    }
+
+    if (response.status === 401 || response.status === 403) {
+      let data: { auth?: { iframe?: string } } | null = null
+      try {
+        data = await response.clone().json()
+      } catch {}
+      if (data?.auth?.iframe && window === window.top) {
+        await showAuthIframe(data.auth.iframe)
+        continue  // Retry the original request after successful auth
+      }
+    }
+
+    return response
+  }
+}
+
+type FetchFn = (url: string, options?: RequestInit) => Promise<Response>
+
+export async function apiJson<T = unknown>(url: string, options: FetchJsonOptions = {}): Promise<T> {
+  return fetchJson<T>(url, options, apiFetch)
+}
+
+export async function fetchJson<T = unknown>(url: string, options: FetchJsonOptions = {}, fetchFn: FetchFn = fetch): Promise<T> {
+  const headers: Record<string, string> = {
+    'Accept': 'application/json',
+    ...(options.headers as Record<string, string>),
+  }
+
+  let body: BodyInit | undefined
+  if (options.body && typeof options.body === 'object' && !(options.body instanceof FormData)) {
+    headers['Content-Type'] = 'application/json'
+    body = JSON.stringify(options.body)
+  } else {
+    body = options.body as BodyInit
+  }
+
+  const opt: RequestInit = { ...options, headers, body }
+
+  const response = await fetchFn(url, opt)
+  const data = await response.json() as T
+
+  if (!response.ok) {
+    throw new ApiError(url, response, data)
+  }
+
+  return data
+}
+
+export function getUserFriendlyErrorMessage(error: Error): string {
+  if (error instanceof NetworkError) return error.message
+  if (error instanceof ApiError) return error.message
+  if (error.name === 'TimeoutError') return 'Request timed out'
+  if (error.name === 'TypeError' && error.message === 'Failed to fetch') {
+    return 'Unable to connect to server'
+  }
+  return error.message || 'An error occurred'
+}
+
+export function shouldShowErrorToast(error: Error): boolean {
+  if (error instanceof AuthCancelledError) return false
+  if (error.name === 'AbortError') return false
+  if (error instanceof ApiError && (error.status === 401 || error.status === 403)) return false
+  return true
+}
+
+type ShowMessageFn = (message: string, type: string, duration: number) => void
+
+export function createApiCaller(showMessage: ShowMessageFn) {
+  return async function apiCall<T = unknown>(url: string, options: FetchJsonOptions = {}): Promise<T> {
+    try {
+      return await apiJson<T>(url, options)
+    } catch (error) {
+      if (!shouldShowErrorToast(error as Error)) {
+        throw error
+      }
+      const err = error as Error
+      console.error(`API error for ${url}:`, err instanceof ApiError ? { status: err.status, statusText: err.statusText, data: err.data } : err)
+      showMessage(getUserFriendlyErrorMessage(err), 'error', 4000)
+      throw error
+    }
+  }
+}
+
+export default apiFetch
@@ -0,0 +1,25 @@
+export {
+  ApiError,
+  NetworkError,
+  AuthCancelledError,
+  apiFetch,
+  apiJson,
+  fetchJson,
+  getUserFriendlyErrorMessage,
+  shouldShowErrorToast,
+  createApiCaller,
+} from './fetch'
+
+export type { ApiFetchOptions, FetchJsonOptions } from './fetch'
+
+export {
+  holdGlobalBackdrop,
+  releaseGlobalBackdrop,
+  isAuthIframeOpen,
+  hideAuthIframe,
+  showAuthIframe,
+  createAuthIframe,
+  removeAuthIframe,
+} from './overlay'
+
+export { SessionValidator } from './validate'
@@ -0,0 +1,166 @@
+const AUTH_IFRAME_ID = 'paskia-iframe'
+const STYLES_ID = 'paskia-dialog'
+const STYLES_TEXT = `\
+body::before {
+  content: '';
+  position: fixed;
+  inset: 0;
+  z-index: 1099;
+  background: transparent;
+  backdrop-filter: blur(0) brightness(1);
+  -webkit-backdrop-filter: blur(0) brightness(1);
+  pointer-events: none;
+  visibility: hidden;
+  transition: all 0.2s ease-out;
+}
+body.paskia-backdrop::before {
+  -webkit-backdrop-filter: blur(.2rem) brightness(0.5);
+  backdrop-filter: blur(.2rem) brightness(0.5);
+  visibility: visible;
+}
+body.paskia-backdrop {
+  overflow: auto;
+}
+#${AUTH_IFRAME_ID} {
+  border: none;
+  position: fixed;
+  top: 0;
+  left: 0;
+  width: 100%;
+  height: 100%;
+  z-index: 9999;
+  color-scheme: auto;
+  background: transparent;
+}
+`
+
+let authIframe: HTMLIFrameElement | null = null
+let authPromise: Promise<void> | null = null
+let authResolve: (() => void) | null = null
+let authReject: ((error: Error) => void) | null = null
+let messageListenerInstalled = false
+let backdropHolders = 0
+
+function injectStyles(): void {
+  if (document.getElementById(STYLES_ID)) return
+  const style = document.createElement('style')
+  style.id = STYLES_ID
+  style.textContent = STYLES_TEXT
+  document.head.insertBefore(style, document.head.firstChild)
+}
+
+export class AuthCancelledError extends Error {
+  constructor() {
+    super('Authentication cancelled')
+    this.name = 'AuthCancelledError'
+  }
+}
+
+export function holdGlobalBackdrop(): void {
+  backdropHolders++
+  document.body.classList.add('paskia-backdrop')
+}
+
+export function releaseGlobalBackdrop(): void {
+  backdropHolders = Math.max(0, backdropHolders - 1)
+  if (backdropHolders === 0) {
+    document.body.classList.remove('paskia-backdrop')
+  }
+}
+
+export function isAuthIframeOpen(): boolean {
+  return !!document.getElementById(AUTH_IFRAME_ID)
+}
+
+export function hideAuthIframe(): void {
+  if (authIframe) {
+    authIframe.remove()
+    authIframe = null
+    releaseGlobalBackdrop()
+  }
+}
+
+function handleAuthMessage(event: MessageEvent): void {
+  const data = event.data as { type?: string }
+  if (!data?.type) return
+
+  switch (data.type) {
+    case 'auth-success':
+      hideAuthIframe()
+      if (authResolve) {
+        authResolve()
+        authPromise = null
+        authResolve = null
+        authReject = null
+      }
+      break
+
+    case 'auth-back':
+      hideAuthIframe()
+      if (authReject) {
+        authReject(new AuthCancelledError())
+        authPromise = null
+        authResolve = null
+        authReject = null
+      }
+      break
+  }
+}
+
+function ensureMessageListener(): void {
+  if (messageListenerInstalled) return
+  if (typeof window !== 'undefined') {
+    window.addEventListener('message', handleAuthMessage)
+    messageListenerInstalled = true
+  }
+}
+
+export function showAuthIframe(iframeUrl: string, title = 'Authentication'): Promise<void> {
+  injectStyles()
+  ensureMessageListener()
+
+  if (authPromise) return authPromise
+
+  if (document.getElementById(AUTH_IFRAME_ID)) {
+    authPromise = new Promise((resolve, reject) => {
+      authResolve = resolve
+      authReject = reject
+    })
+    return authPromise
+  }
+
+  authPromise = new Promise((resolve, reject) => {
+    authResolve = resolve
+    authReject = reject
+  })
+
+  hideAuthIframe()
+  holdGlobalBackdrop()
+
+  authIframe = document.createElement('iframe')
+  authIframe.id = AUTH_IFRAME_ID
+  authIframe.title = title
+  authIframe.src = iframeUrl
+  document.body.appendChild(authIframe)
+
+  return authPromise
+}
+
+export function createAuthIframe(iframeUrl: string, title = 'Authentication'): HTMLIFrameElement {
+  injectStyles()
+  const existing = document.getElementById(AUTH_IFRAME_ID)
+  if (existing) existing.remove()
+
+  const iframe = document.createElement('iframe')
+  iframe.id = AUTH_IFRAME_ID
+  iframe.title = title
+  iframe.src = iframeUrl
+  document.body.appendChild(iframe)
+
+  return iframe
+}
+
+export function removeAuthIframe(): void {
+  const iframe = document.getElementById(AUTH_IFRAME_ID)
+  if (iframe) iframe.remove()
+}
@@ -0,0 +1,66 @@
+import { apiJson } from './fetch'
+
+const POLL_INTERVAL = 60 * 1000
+const IDLE_TIMEOUT = 5 * 60 * 1000
+
+export class SessionValidator {
+  private userUuidGetter: () => string | undefined
+  private onSessionLost: (error: Error) => void
+  private pollTimer: ReturnType<typeof setInterval> | null = null
+  private idleTimer: ReturnType<typeof setTimeout> | null = null
+  private active = false
+
+  constructor(userUuidGetter: () => string | undefined, onSessionLost: (error: Error) => void) {
+    this.userUuidGetter = userUuidGetter
+    this.onSessionLost = onSessionLost
+    this.resetIdleTimer = this.resetIdleTimer.bind(this)
+  }
+
+  resetIdleTimer(): void {
+    if (this.idleTimer) clearTimeout(this.idleTimer)
+    if (!this.active) this.startPolling()
+    this.idleTimer = setTimeout(() => this.stopPolling(), IDLE_TIMEOUT)
+  }
+
+  async validate(): Promise<void> {
+    try {
+      const data = await apiJson<{ ctx?: { user?: { uuid?: string } } }>('/auth/api/validate', { method: 'POST' })
+      const newUuid = data.ctx?.user?.uuid
+      if (newUuid !== this.userUuidGetter()) {
+        window.location.reload()
+      }
+    } catch (error) {
+      if ((error as Error).name !== 'NetworkError') {
+        this.stopPolling()
+        this.onSessionLost(error as Error)
+      }
+    }
+  }
+
+  startPolling(): void {
+    if (this.active) return
+    this.active = true
+    this.pollTimer = setInterval(() => this.validate(), POLL_INTERVAL)
+  }
+
+  stopPolling(): void {
+    this.active = false
+    if (this.pollTimer) {
+      clearInterval(this.pollTimer)
+      this.pollTimer = null
+    }
+  }
+
+  start(): void {
+    window.addEventListener('pointermove', this.resetIdleTimer)
+    window.addEventListener('pointerdown', this.resetIdleTimer)
+    this.resetIdleTimer()
+  }
+
+  stop(): void {
+    window.removeEventListener('pointermove', this.resetIdleTimer)
+    window.removeEventListener('pointerdown', this.resetIdleTimer)
+    if (this.idleTimer) clearTimeout(this.idleTimer)
+    this.stopPolling()
+  }
+}
@@ -0,0 +1,15 @@
+{
+  "compilerOptions": {
+    "target": "ES2020",
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "strict": true,
+    "declaration": true,
+    "declarationDir": "./dist",
+    "outDir": "./dist",
+    "rootDir": "./src",
+    "lib": ["ES2020", "DOM"],
+    "skipLibCheck": true
+  },
+  "include": ["src/**/*.ts"]
+}
@@ -0,0 +1,17 @@
+import { defineConfig } from 'vite'
+import { resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import dts from 'vite-plugin-dts'
+
+const __dirname = fileURLToPath(new URL('.', import.meta.url))
+
+export default defineConfig({
+  plugins: [dts({ rollupTypes: true })],
+  build: {
+    lib: {
+      entry: resolve(__dirname, 'src/index.ts'),
+      fileName: 'paskia',
+      formats: ['es'],
+    },
+  },
+})
@@ -10,6 +10,7 @@ This module provides functionality to:
 import json
 from collections.abc import Iterable
 from importlib.resources import files
+from uuid import UUID

 __ALL__ = ["AAGUID", "filter"]

@@ -18,15 +19,15 @@ AAGUID_FILE = files("paskia") / "aaguid" / "combined_aaguid.json"
 AAGUID: dict[str, dict] = json.loads(AAGUID_FILE.read_text(encoding="utf-8"))


-def filter(aaguids: Iterable[str]) -> dict[str, dict]:
+def filter(aaguids: Iterable[UUID]) -> dict[str, dict]:
    """
    Get AAGUID information only for the provided set of AAGUIDs.

    Args:
-        aaguids: Set of AAGUID strings that the user has credentials for
+        aaguids: Iterable of AAGUIDs (UUIDs) that the user has credentials for

    Returns:
-        Dictionary mapping AAGUID to authenticator information for only
+        Dictionary mapping AAGUID string to authenticator information for only
        the AAGUIDs that the user has and that we have data for
    """
-    return {aaguid: AAGUID[aaguid] for aaguid in aaguids if aaguid in AAGUID}
+    return {(s := str(a)): AAGUID[s] for a in aaguids if (s := str(a)) in AAGUID}
@@ -8,68 +8,40 @@ independent of any web framework:
 - Credential management
 """

-from datetime import datetime, timezone
+from datetime import UTC, datetime
+from typing import TYPE_CHECKING
 from uuid import UUID

 from paskia import db
-from paskia.config import SESSION_LIFETIME
-from paskia.db import ResetToken, Session
+from paskia.config import RESET_LIFETIME, SESSION_LIFETIME
 from paskia.util import hostutil

+if TYPE_CHECKING:
+    from paskia.db import ResetToken
+
 EXPIRES = SESSION_LIFETIME


 def expires() -> datetime:
-    return datetime.now(timezone.utc) + EXPIRES
+    return datetime.now(UTC) + EXPIRES


 def reset_expires() -> datetime:
-    from .config import RESET_LIFETIME
-
-    return datetime.now(timezone.utc) + RESET_LIFETIME
+    return datetime.now(UTC) + RESET_LIFETIME


-async def get_reset(token: str) -> ResetToken:
+def get_reset(token: str) -> "ResetToken":
    """Validate a credential reset token."""
+
    record = db.get_reset_token(token)
    if record:
        return record
    raise ValueError("This authentication link is no longer valid.")


-async def get_session(token: str, host: str | None = None) -> Session:
-    """Validate a session token and return session data if valid."""
-    host = hostutil.normalize_host(host)
-    if not host:
-        raise ValueError("Invalid host")
-    session = db.get_session(token)
-    if session:
-        if session.host is None:
-            # First time binding: store exact host:port (or IPv6 form) now.
-            db.set_session_host(session.key, host)
-            session.host = host
-        elif session.host != host:
-            raise ValueError("Session host mismatch")
-        return session
-    raise ValueError("Your session has expired. Please sign in again!")
-
-
-async def refresh_session_token(token: str, *, ip: str, user_agent: str):
-    """Refresh a session extending its expiry."""
-    session_record = db.get_session(token)
-    if not session_record:
-        raise ValueError("Session not found or expired")
-    updated = db.update_session(
-        token,
-        ip=ip,
-        user_agent=user_agent,
-        expiry=expires(),
-    )
-    if not updated:
-        raise ValueError("Session not found or expired")
-
-
-async def delete_credential(credential_uuid: UUID, auth: str, host: str | None = None):
+def delete_credential(credential_uuid: UUID, auth: str, host: str | None = None):
    """Delete a specific credential for the current user."""
-    s = await get_session(auth, host=host)
-    db.delete_credential(credential_uuid, s.user_uuid)
+    ctx = db.data().session_ctx(auth, hostutil.normalize_host(host))
+    if not ctx:
+        raise ValueError("Session expired")
+    db.delete_credential(credential_uuid, ctx.user.uuid)
@@ -8,114 +8,40 @@ generating a reset link for initial admin setup.

 import asyncio
 import logging
-from datetime import datetime, timezone

-import uuid7
-
-from paskia import authsession, db
-from paskia.db import Org, Permission, Role, User
+from paskia import authsession, db, globals
 from paskia.util import hostutil, passphrase

-
-def _init_logger() -> logging.Logger:
-    logger = logging.getLogger(__name__)
-    if not logger.handlers and not logging.getLogger().handlers:
-        h = logging.StreamHandler()
-        h.setFormatter(logging.Formatter("%(message)s"))
-        logger.addHandler(h)
-        logger.setLevel(logging.INFO)
-    return logger
-
-
-logger = _init_logger()
+logger = logging.getLogger(__name__)

 # Shared log message template for admin reset links
-ADMIN_RESET_MESSAGE = """\
-%s
-
+ADMIN_RESET_MESSAGE = """
 👤 Admin  %s
   - Use this link to register a Passkey for the admin user!
 """


-async def _create_and_log_admin_reset_link(user_uuid, message, session_type) -> str:
-    """Create an admin reset link and log it with the provided message."""
-    token = passphrase.generate()
-    expiry = authsession.reset_expires()
-    db.create_reset_token(
-        user_uuid=user_uuid,
-        passphrase=token,
-        expiry=expiry,
-        token_type=session_type,
-    )
-    reset_link = hostutil.reset_link_url(token)
-    logger.info(ADMIN_RESET_MESSAGE, message, reset_link)
+def _log_reset_link(passphrase: str, message: str | None = None) -> str:
+    """Log a reset link message and return the URL."""
+    reset_link = hostutil.reset_link_url(passphrase)
+    if message:
+        logger.info(message)
+    logger.info(ADMIN_RESET_MESSAGE, reset_link)
    return reset_link


-async def bootstrap_system() -> dict:
+async def bootstrap_system() -> None:
    """
    Bootstrap the entire system with default data.

-    Returns:
-        dict: Contains information about created entities and reset link
+    Uses db.bootstrap() which performs all operations in a single transaction.
+    The transaction log will show a single "bootstrap" action with all changes.
    """
-    # Create permission first - will fail if already exists
-    perm0 = Permission(
-        uuid=uuid7.create(), scope="auth:admin", display_name="Master Admin"
-    )
-    db.create_permission(perm0)
+    # Call the single-transaction bootstrap function
+    reset_passphrase = db.bootstrap()

-    # Create org admin permission - allows managing users within an org
-    perm_org_admin = Permission(
-        uuid=uuid7.create(), scope="auth:org:admin", display_name="Org Admin"
-    )
-    db.create_permission(perm_org_admin)
-
-    org = Org(uuid7.create(), "Organization")
-    db.create_organization(org)
-
-    # Allow this org to grant global admin and org admin permissions
-    db.add_permission_to_organization(str(org.uuid), perm0.scope)
-    db.add_permission_to_organization(str(org.uuid), perm_org_admin.scope)
-
-    # Create an Administration role granting both org and global admin
-    role = Role(
-        uuid7.create(),
-        org.uuid,
-        "Administration",
-        permissions=[perm0.scope, perm_org_admin.scope],
-    )
-    db.create_role(role)
-
-    user = User(
-        uuid=uuid7.create(),
-        display_name="Admin",
-        role_uuid=role.uuid,
-        created_at=datetime.now(timezone.utc),
-        visits=0,
-    )
-    db.create_user(user)
-
-    # Generate reset link and log it
-    reset_link = await _create_and_log_admin_reset_link(
-        user.uuid, "✅ Bootstrap completed!", "admin bootstrap"
-    )
-
-    return {
-        "user": user,
-        "org": org,
-        "role": role,
-        "permissions": [
-            perm0,
-            *[
-                db.get_permission_by_scope(p)
-                for p in org.permissions
-                if db.get_permission_by_scope(p)
-            ],
-        ],
-        "reset_link": reset_link,
-    }
+    # Log the reset link (this is separate from the transaction log)
+    _log_reset_link(reset_passphrase, "✅ Bootstrap completed!")


 async def check_admin_credentials() -> bool:
@@ -127,13 +53,15 @@ async def check_admin_credentials() -> bool:
    """
    try:
        # Get permission organizations to find admin users
-        permission_orgs = db.get_permission_organizations("auth:admin")
-
-        if not permission_orgs:
+        p = next(
+            (p for p in db.data().permissions.values() if p.scope == "auth:admin"), None
+        )
+        if not p or not p.orgs:
            return False

        # Get users from the first organization with admin permission
-        org_users = db.get_organization_users(str(permission_orgs[0].uuid))
+        first_org_uuid = next(iter(p.orgs))
+        org_users = db.get_organization_users(first_org_uuid)
        admin_users = [user for user, role in org_users if role == "Administration"]

        if not admin_users:
@@ -141,15 +69,20 @@ async def check_admin_credentials() -> bool:

        # Check first admin user for credentials
        admin_user = admin_users[0]
-        credentials = db.get_credentials_by_user_uuid(admin_user.uuid)

-        if not credentials:
+        if not db.get_user_credential_ids(admin_user.uuid):
            # Admin exists but has no credentials, create reset link
-            await _create_and_log_admin_reset_link(
-                admin_user.uuid,
-                "⚠️  Admin user has no credentials!",
-                "admin registration",
+            logger.info("⚠️  Admin user has no credentials!")
+
+            token = passphrase.generate()
+            expiry = authsession.reset_expires()
+            db.create_reset_token(
+                user_uuid=admin_user.uuid,
+                passphrase=token,
+                expiry=expiry,
+                token_type="admin registration",
            )
+            _log_reset_link(token)
            return True

        return False
@@ -165,16 +98,12 @@ async def bootstrap_if_needed() -> bool:
    Returns:
        bool: True if bootstrapping was performed, False if system was already set up
    """
-    try:
-        # Check if the admin permission exists - if it does, system is already bootstrapped
-        db.get_permission("auth:admin")
+    # Check if the admin permission exists - if it does, system is already bootstrapped
+    if any(p.scope == "auth:admin" for p in db.data().permissions.values()):
        # Permission exists, system is already bootstrapped
        # Check if admin needs credentials (only for already-bootstrapped systems)
        await check_admin_credentials()
        return False
-    except Exception:
-        # Permission doesn't exist, need to bootstrap
-        pass

    # No admin permission found, need to bootstrap
    # Bootstrap creates the admin user AND the reset link, so no need to check credentials after
@@ -22,4 +22,3 @@ class PaskiaConfig:
    host: str | None = None
    port: int | None = None
    uds: str | None = None
-    devmode: bool = False
@@ -1,24 +1,25 @@
 """
 Database module for WebAuthn passkey authentication.

-Read: Access _db._data directly, use build_* to convert to public structs.
-CTX: get_session_context(key) returns SessionContext with effective permissions.
+Read: Access data() directly, use build_* to convert to public structs.
+CTX: data().session_ctx(key) returns SessionContext with effective permissions.
 Write: Functions validate and commit, or raise ValueError.

 Usage:
    from paskia import db

    # Read (after init)
-    user_data = db._db._data.users[user_uuid]
+    user_data = db.data().users[user_uuid]
    user = db.build_user(user_uuid)

    # Context
-    ctx = db.get_session_context(session_key)
+    ctx = db.data().session_ctx(session_key)

    # Write
    db.create_user(user)
 """

+import paskia.db.operations as operations
 from paskia.db.background import (
    start_background,
    start_cleanup,
@@ -26,67 +27,47 @@ from paskia.db.background import (
    stop_cleanup,
 )
 from paskia.db.operations import (
-    DB,
-    _db,
-    add_permission_to_organization,
+    add_permission_to_org,
    add_permission_to_role,
-    build_credential,
-    build_org,
-    build_permission,
-    build_reset_token,
-    build_role,
-    build_session,
-    build_user,
+    bootstrap,
    cleanup_expired,
    create_credential,
    create_credential_session,
-    create_organization,
+    create_org,
    create_permission,
    create_reset_token,
    create_role,
    create_session,
    create_user,
    delete_credential,
-    delete_organization,
+    delete_org,
    delete_permission,
    delete_reset_token,
    delete_role,
    delete_session,
    delete_sessions_for_user,
    delete_user,
-    get_credential_by_id,
-    get_credentials_by_user_uuid,
-    get_organization,
    get_organization_users,
-    get_permission,
-    get_permission_by_scope,
-    get_permission_organizations,
    get_reset_token,
-    get_role,
-    get_roles_by_organization,
-    get_session,
-    get_session_context,
-    get_user_by_uuid,
+    get_user_credential_ids,
    get_user_organization,
    init,
-    list_organizations,
-    list_permissions,
-    list_sessions_for_user,
    login,
-    remove_permission_from_organization,
+    remove_permission_from_org,
    remove_permission_from_role,
-    rename_permission,
    set_session_host,
    update_credential_sign_count,
-    update_organization_name,
+    update_org_name,
    update_permission,
    update_role_name,
    update_session,
    update_user_display_name,
    update_user_role,
    update_user_role_in_organization,
+    update_user_theme,
 )
 from paskia.db.structs import (
+    DB,
    Credential,
    Org,
    Permission,
@@ -97,6 +78,12 @@ from paskia.db.structs import (
    User,
 )

+
+def data() -> DB:
+    """Get the database instance for direct read access."""
+    return operations._db
+
+
 __all__ = [
    # Types
    "Credential",
@@ -109,7 +96,7 @@ __all__ = [
    "SessionContext",
    "User",
    # Instance
-    "_db",
+    "data",
    "init",
    # Background
    "start_background",
@@ -118,44 +105,31 @@ __all__ = [
    "stop_cleanup",
    # Builders
    "build_credential",
-    "build_org",
    "build_permission",
    "build_reset_token",
    "build_role",
    "build_session",
    "build_user",
    # Read ops
-    "get_credential_by_id",
-    "get_credentials_by_user_uuid",
-    "get_organization",
    "get_organization_users",
-    "get_permission",
-    "get_permission_by_scope",
-    "get_permission_organizations",
    "get_reset_token",
-    "get_role",
-    "get_roles_by_organization",
-    "get_session",
-    "get_session_context",
-    "get_user_by_uuid",
+    "get_user_credential_ids",
    "get_user_organization",
-    "list_organizations",
-    "list_permissions",
-    "list_sessions_for_user",
    # Write ops
-    "add_permission_to_organization",
+    "add_permission_to_org",
    "add_permission_to_role",
+    "bootstrap",
    "cleanup_expired",
    "create_credential",
    "create_credential_session",
-    "create_organization",
+    "create_org",
    "create_permission",
    "create_reset_token",
    "create_role",
    "create_session",
    "create_user",
    "delete_credential",
-    "delete_organization",
+    "delete_org",
    "delete_permission",
    "delete_reset_token",
    "delete_role",
@@ -163,15 +137,16 @@ __all__ = [
    "delete_sessions_for_user",
    "delete_user",
    "login",
-    "remove_permission_from_organization",
+    "remove_permission_from_org",
    "remove_permission_from_role",
-    "rename_permission",
+    "set_session_host",
    "update_credential_sign_count",
-    "update_organization_name",
+    "update_org_name",
    "update_permission",
    "update_role_name",
    "update_session",
    "update_user_display_name",
    "update_user_role",
    "update_user_role_in_organization",
+    "update_user_theme",
 ]
@@ -6,62 +6,34 @@ Periodically flushes pending changes to disk and cleans up expired items.

 import asyncio
 import logging
-from datetime import datetime, timezone
+from datetime import UTC, datetime

-from paskia.db.jsonl import flush_changes
+from paskia.db.operations import _store, cleanup_expired

-# Flush changes to disk every N seconds
-FLUSH_INTERVAL = 1
-# Cleanup expired items every N seconds (cheap when nothing to remove)
-CLEANUP_INTERVAL = 1
+FLUSH_INTERVAL = 0.1  # Flush to disk
+CLEANUP_INTERVAL = 1  # Expired item cleanup


 _logger = logging.getLogger(__name__)
 _background_task: asyncio.Task | None = None


-def cleanup() -> None:
-    """Remove expired sessions and reset tokens from the database."""
-    from paskia.db.operations import _db
-
-    if _db is None or _db._data is None:
-        return
-
-    with _db.transaction("expiry"):
-        current_time = datetime.now(timezone.utc)
-
-        # Clean expired sessions
-        to_delete_sessions = [
-            k for k, s in _db._data.sessions.items() if s.expiry < current_time
-        ]
-        for k in to_delete_sessions:
-            del _db._data.sessions[k]
-
-        # Clean expired reset tokens
-        to_delete_tokens = [
-            k for k, t in _db._data.reset_tokens.items() if t.expiry < current_time
-        ]
-        for k in to_delete_tokens:
-            del _db._data.reset_tokens[k]
-
-
 async def flush() -> None:
    """Write all pending database changes to disk."""
-    from paskia.db.operations import _db

-    if _db is None:
-        _logger.warning("flush() called but _db is None")
+    if _store is None:
+        _logger.warning("flush() called but _store is None")
        return
-    await flush_changes(_db.db_path, _db._pending_changes)
+    await _store.flush()


 async def _background_loop():
    """Background task that periodically flushes changes and cleans up."""
    # Run cleanup immediately on startup to clear old expired items
-    cleanup()
+    cleanup_expired()
    await flush()

-    last_cleanup = datetime.now(timezone.utc)
+    last_cleanup = datetime.now(UTC)

    while True:
        try:
@@ -69,10 +41,10 @@ async def _background_loop():
            # Flush pending changes to disk
            await flush()

-            # Run cleanup less frequently
-            now = datetime.now(timezone.utc)
+            # Run cleanup periodically
+            now = datetime.now(UTC)
            if (now - last_cleanup).total_seconds() >= CLEANUP_INTERVAL:
-                cleanup()
+                cleanup_expired()
                await flush()  # Flush cleanup changes
                last_cleanup = now
        except asyncio.CancelledError:
@@ -101,14 +73,19 @@ async def start_background():
                if loop is not task_loop:
                    _logger.debug("Background task in different event loop, restarting")
                    _background_task = None
+                else:
+                    # Task is already running in same loop - idempotent, just return
+                    # This happens with dual IPv4+IPv6 endpoints sharing the same process
+                    _logger.debug(
+                        "Background task already running in same loop, skipping"
+                    )
+                    return
            except Exception as e:
                _logger.debug("Error checking background task loop: %s, restarting", e)
                _background_task = None

    if _background_task is None:
        _background_task = asyncio.create_task(_background_loop())
-    else:
-        _logger.debug("Background task already running: %s", _background_task)


 async def stop_background():
@@ -1,19 +1,24 @@
 """
 JSONL persistence layer for the database.
-
-Handles file I/O, JSON diffs, and persistence. Works with plain JSON/dict data.
-Uses aiofiles for async I/O operations.
 """

+import copy
 import logging
 from collections import deque
-from datetime import datetime, timezone
+from contextlib import contextmanager
+from datetime import UTC, datetime
 from pathlib import Path
+from typing import Any
+from uuid import UUID

 import aiofiles
 import jsondiff
 import msgspec

+from paskia.db.logging import log_change
+from paskia.db.migrations import DBVER, apply_all_migrations
+from paskia.db.structs import DB, SessionContext
+
 _logger = logging.getLogger(__name__)

 # Default database path
@@ -25,6 +30,7 @@ class _ChangeRecord(msgspec.Struct, omit_defaults=True):

    ts: datetime
    a: str  # action - describes the operation (e.g., "migrate", "login", "create_user")
+    v: int  # schema version after this change
    u: str | None = None  # user UUID who performed the action (None for system)
    diff: dict = {}

@@ -33,43 +39,6 @@ class _ChangeRecord(msgspec.Struct, omit_defaults=True):
 _change_encoder = msgspec.json.Encoder()


-async def load_jsonl(db_path: Path) -> dict:
-    """Load data from disk by applying change log.
-
-    Replays all changes from JSONL file using plain dicts (to handle
-    schema evolution).
-
-    Args:
-        db_path: Path to the JSONL database file
-
-    Returns:
-        The final state after applying all changes
-
-    Raises:
-        ValueError: If file doesn't exist or cannot be loaded
-    """
-    if not db_path.exists():
-        raise ValueError(f"Database file not found: {db_path}")
-    data_dict: dict = {}
-    try:
-        # Read entire file at once and split into lines
-        async with aiofiles.open(db_path, "rb") as f:
-            content = await f.read()
-        for line_num, line in enumerate(content.split(b"\n"), 1):
-            line = line.strip()
-            if not line:
-                continue
-            try:
-                change = msgspec.json.decode(line)
-                # Apply the diff to current state (marshal=True for $-prefixed keys)
-                data_dict = jsondiff.patch(data_dict, change["diff"], marshal=True)
-            except Exception as e:
-                raise ValueError(f"Error parsing line {line_num}: {e}")
-    except (OSError, ValueError, msgspec.DecodeError) as e:
-        raise ValueError(f"Failed to load database: {e}")
-    return data_dict
-
-
 def compute_diff(previous: dict, current: dict) -> dict | None:
    """Compute JSON diff between two states.

@@ -85,17 +54,22 @@ def compute_diff(previous: dict, current: dict) -> dict | None:


 def create_change_record(
-    action: str, diff: dict, user: str | None = None
+    action: str, version: int, diff: dict, user: str | None = None
 ) -> _ChangeRecord:
    """Create a change record for persistence."""
    return _ChangeRecord(
-        ts=datetime.now(timezone.utc),
+        ts=datetime.now(UTC),
        a=action,
+        v=version,
        u=user,
        diff=diff,
    )


+# Actions that are allowed to create a new database file
+_BOOTSTRAP_ACTIONS = frozenset({"bootstrap", "migrate:sql"})
+
+
 async def flush_changes(
    db_path: Path,
    pending_changes: deque[_ChangeRecord],
@@ -112,15 +86,25 @@ async def flush_changes(
    if not pending_changes:
        return True

-    # Collect all pending changes
+    if not db_path.exists():
+        first_action = pending_changes[0].a
+        if first_action not in _BOOTSTRAP_ACTIONS:
+            _logger.error(
+                "Refusing to create database file with action '%s' - "
+                "only bootstrap or migrate can create a new database",
+                first_action,
+            )
+            pending_changes.clear()
+            return False
+
    changes_to_write = list(pending_changes)
    pending_changes.clear()

    try:
-        # Build lines to append (keep as bytes, join with \n)
        lines = [_change_encoder.encode(change) for change in changes_to_write]
+        if not lines:
+            return True

-        # Append all lines in a single write (binary mode for Windows compatibility)
        async with aiofiles.open(db_path, "ab") as f:
            await f.write(b"\n".join(lines) + b"\n")
        return True
@@ -130,3 +114,169 @@ async def flush_changes(
        for change in reversed(changes_to_write):
            pending_changes.appendleft(change)
        return False
+
+
+class JsonlStore:
+    """JSONL persistence layer for a DB instance."""
+
+    def __init__(self, db: DB, db_path: str = DB_PATH_DEFAULT):
+        self.db: DB = db
+        self.db_path = Path(db_path)
+        self._previous_builtins: dict[str, Any] = {}
+        self._pending_changes: deque[_ChangeRecord] = deque()
+        self._current_action: str = "system"
+        self._current_user: str | None = None
+        self._in_transaction: bool = False
+        self._transaction_snapshot: dict[str, Any] | None = None
+        self._current_version: int = DBVER  # Schema version for new databases
+
+    async def load(self, db_path: str | None = None) -> None:
+        """Load data from JSONL change log."""
+        if db_path is not None:
+            self.db_path = Path(db_path)
+        if not self.db_path.exists():
+            return
+
+        # Replay change log to reconstruct state
+        data_dict: dict = {}
+        try:
+            async with aiofiles.open(self.db_path, "rb") as f:
+                content = await f.read()
+            for line_num, line in enumerate(content.split(b"\n"), 1):
+                line = line.strip()
+                if not line:
+                    continue
+                try:
+                    change = msgspec.json.decode(line)
+                    data_dict = jsondiff.patch(data_dict, change["diff"], marshal=True)
+                    self._current_version = change.get("v", 0)
+                except Exception as e:
+                    raise ValueError(f"Error parsing line {line_num}: {e}")
+        except (OSError, ValueError, msgspec.DecodeError) as e:
+            raise ValueError(f"Failed to load database: {e}")
+
+        if not data_dict:
+            return
+
+        # Set previous state for diffing (will be updated by _queue_change)
+        self._previous_builtins = copy.deepcopy(data_dict)
+
+        # Callback to persist each migration
+        async def persist_migration(
+            action: str, new_version: int, current: dict
+        ) -> None:
+            self._current_version = new_version
+            self._queue_change(action, new_version, current)
+
+        # Apply schema migrations one at a time
+        await apply_all_migrations(data_dict, self._current_version, persist_migration)
+
+        # Decode to msgspec struct
+        decoder = msgspec.json.Decoder(DB)
+        self.db = decoder.decode(msgspec.json.encode(data_dict))
+        self.db._store = self
+
+        # Normalize via msgspec round-trip (handles omit_defaults etc.)
+        # This ensures _previous_builtins matches what msgspec would produce
+        normalized_dict = msgspec.to_builtins(self.db)
+        await persist_migration(
+            "migrate:msgspec", self._current_version, normalized_dict
+        )
+
+    def _queue_change(
+        self, action: str, version: int, current: dict, user: str | None = None
+    ) -> None:
+        """Queue a change record and log it.
+
+        Args:
+            action: The action name for the change record
+            version: The schema version for the change record
+            current: The current state as a plain dict
+            user: Optional user UUID who performed the action
+        """
+        diff = compute_diff(self._previous_builtins, current)
+        if not diff:
+            return
+        self._pending_changes.append(create_change_record(action, version, diff, user))
+
+        # Log the change with user display name if available
+        user_display = None
+        if user:
+            try:
+                user_uuid = UUID(user)
+                if user_uuid in self.db.users:
+                    user_display = self.db.users[user_uuid].display_name
+            except (ValueError, KeyError):
+                user_display = user
+
+        log_change(action, diff, user_display, self._previous_builtins)
+        self._previous_builtins = copy.deepcopy(current)
+
+    @contextmanager
+    def transaction(
+        self,
+        action: str,
+        ctx: SessionContext | None = None,
+        *,
+        user: str | None = None,
+    ):
+        """Wrap writes in transaction. Queues change on successful exit.
+
+        Args:
+            action: Describes the operation (e.g., "Created user", "Login")
+            ctx: Session context of user performing the action (None for system operations)
+            user: User UUID string (alternative to ctx when full context unavailable)
+        """
+        if self._in_transaction:
+            raise RuntimeError("Nested transactions are not supported")
+
+        # Check for out-of-transaction modifications
+        current_state = msgspec.to_builtins(self.db)
+        if current_state != self._previous_builtins:
+            # Allow bootstrap/migrate to create a new database from empty state
+            is_bootstrap = action in _BOOTSTRAP_ACTIONS or action.startswith("migrate:")
+            if is_bootstrap and not self._previous_builtins:
+                pass  # Expected: creating database from scratch
+            else:
+                diff = compute_diff(self._previous_builtins, current_state)
+                diff_json = msgspec.json.encode(diff).decode()
+                _logger.critical(
+                    "Database state modified outside of transaction! "
+                    "This indicates a bug where DB changes occurred without a transaction wrapper.\n"
+                    f"Changes detected:\n{diff_json}"
+                )
+                raise SystemExit(1)
+
+        old_action = self._current_action
+        old_user = self._current_user
+        self._current_action = action
+        # Prefer ctx.user.uuid if ctx provided, otherwise use user param
+        self._current_user = str(ctx.user.uuid) if ctx else user
+        self._in_transaction = True
+        self._transaction_snapshot = current_state
+
+        try:
+            yield
+            current = msgspec.to_builtins(self.db)
+            self._queue_change(
+                self._current_action, self._current_version, current, self._current_user
+            )
+        except Exception:
+            # Rollback on error: restore from snapshot
+            _logger.warning("Transaction '%s' failed, rolling back changes", action)
+            if self._transaction_snapshot is not None:
+                decoder = msgspec.json.Decoder(DB)
+                self.db = decoder.decode(
+                    msgspec.json.encode(self._transaction_snapshot)
+                )
+                self.db._store = self
+            raise
+        finally:
+            self._current_action = old_action
+            self._current_user = old_user
+            self._in_transaction = False
+            self._transaction_snapshot = None
+
+    async def flush(self) -> bool:
+        """Write all pending changes to disk."""
+        return await flush_changes(self.db_path, self._pending_changes)
@@ -0,0 +1,318 @@
+"""
+Database change logging with pretty-printed diffs.
+
+Provides a logger for JSONL database changes that formats diffs
+in a human-readable path.notation style with color coding.
+"""
+
+import logging
+import re
+import sys
+from typing import Any
+
+logger = logging.getLogger("paskia.db")
+
+# Pattern to match control characters and bidirectional overrides
+_UNSAFE_CHARS = re.compile(
+    r"[\x00-\x1f\x7f-\x9f"  # C0 and C1 control characters
+    r"\u200e\u200f"  # LRM, RLM
+    r"\u202a-\u202e"  # LRE, RLE, PDF, LRO, RLO
+    r"\u2066-\u2069"  # LRI, RLI, FSI, PDI
+    r"]"
+)
+
+# ANSI color codes (matching FastAPI logging style)
+_RESET = "\033[0m"
+_DIM = "\033[2m"
+_PATH_PREFIX = "\033[1;30m"  # Dark grey for path prefix (like host in access log)
+_PATH_FINAL = "\033[0m"  # Default for final element (like path in access log)
+_DELETE = "\033[1;31m"  # Red for deletions
+_ADD = "\033[0;32m"  # Green for additions
+_ACTION = "\033[1;34m"  # Bold blue for action name
+_USER = "\033[0;34m"  # Blue for user display
+
+
+def _use_color() -> bool:
+    """Check if we should use color output."""
+    return sys.stderr.isatty()
+
+
+def _format_value(value: Any, use_color: bool, max_len: int = 60) -> str:
+    """Format a value for display, truncating if needed."""
+    if value is None:
+        return "null"
+
+    if isinstance(value, bool):
+        return "true" if value else "false"
+
+    if isinstance(value, (int, float)):
+        return str(value)
+
+    if isinstance(value, str):
+        # Filter out control characters and bidirectional overrides
+        value = _UNSAFE_CHARS.sub("", value)
+        # Truncate long strings
+        if len(value) > max_len:
+            return value[: max_len - 3] + "..."
+        return value
+
+    if isinstance(value, dict):
+        if not value:
+            return "{}"
+        # For small dicts, show inline
+        if len(value) == 1:
+            k, v = next(iter(value.items()))
+            return "{" + f"{k}: {_format_value(v, use_color, max_len=30)}" + "}"
+        return f"{{...{len(value)} keys}}"
+
+    if isinstance(value, list):
+        if not value:
+            return "[]"
+        if len(value) == 1:
+            return "[" + _format_value(value[0], use_color, max_len=30) + "]"
+        return f"[...{len(value)} items]"
+
+    # Fallback for other types
+    text = str(value)
+    if len(text) > max_len:
+        text = text[: max_len - 3] + "..."
+    return text
+
+
+def _format_path(path: list[str], use_color: bool) -> str:
+    """Format a path as dot notation with prefix in dark grey, final in default."""
+    if not path:
+        return ""
+    if not use_color:
+        return ".".join(path)
+    if len(path) == 1:
+        return f"{_PATH_FINAL}{path[0]}{_RESET}"
+    prefix = ".".join(path[:-1])
+    final = path[-1]
+    return f"{_PATH_PREFIX}{prefix}.{_RESET}{_PATH_FINAL}{final}{_RESET}"
+
+
+def _get_nested(data: dict | None, path: list[str]) -> Any:
+    """Get a nested value from a dict by path, or None if not found."""
+    if data is None:
+        return None
+    current = data
+    for key in path:
+        if not isinstance(current, dict) or key not in current:
+            return None
+        current = current[key]
+    return current
+
+
+def _collect_changes(
+    diff: dict,
+    path: list[str],
+    changes: list[tuple[str, list[str], Any]],
+    previous: dict | None,
+) -> None:
+    """
+    Recursively collect changes from a diff into a flat list.
+
+    Each change is a tuple of (change_type, path, new_value).
+    change_type is one of: 'add', 'update', 'delete'
+    """
+    if not isinstance(diff, dict):
+        # Leaf value - check if it existed before
+        existed = _get_nested(previous, path) is not None
+        changes.append(("update" if existed else "add", path, diff))
+        return
+
+    for key, value in diff.items():
+        if key == "$delete":
+            # $delete contains a list of keys to delete
+            if isinstance(value, list):
+                for deleted_key in value:
+                    changes.append(("delete", path + [str(deleted_key)], None))
+            else:
+                changes.append(("delete", path + [str(value)], None))
+
+        elif key == "$replace":
+            # $replace replaces the entire collection at this path
+            # We need to track what was added and what was deleted
+            old_collection = _get_nested(previous, path)
+            old_keys = (
+                set(old_collection.keys())
+                if isinstance(old_collection, dict)
+                else set()
+            )
+            new_keys = set(value.keys()) if isinstance(value, dict) else set()
+
+            # Items that existed before but not in new = deleted
+            for deleted_key in old_keys - new_keys:
+                changes.append(("delete", path + [str(deleted_key)], None))
+
+            # Items in new collection
+            if isinstance(value, dict):
+                for rkey, rval in value.items():
+                    existed = rkey in old_keys
+                    changes.append(
+                        ("update" if existed else "add", path + [str(rkey)], rval)
+                    )
+            elif value or not old_keys:
+                # Non-dict replacement or empty replacement with nothing before
+                changes.append(
+                    ("update" if old_collection is not None else "add", path, value)
+                )
+
+        elif key.startswith("$"):
+            # Other special operations (future-proofing)
+            changes.append(("add", path, {key: value}))
+
+        else:
+            # Regular nested key - check if this item existed before
+            new_path = path + [str(key)]
+            existed = _get_nested(previous, new_path) is not None
+            if existed:
+                # Item exists - recurse to show specific field changes
+                _collect_changes(value, new_path, changes, previous)
+            else:
+                # New item - record as add with full value, don't recurse
+                changes.append(("add", new_path, value))
+
+
+def _format_change_lines(
+    change_type: str, path: list[str], value: Any, use_color: bool
+) -> list[str]:
+    """Format a single change as one or more lines."""
+    if change_type == "delete":
+        if not use_color:
+            return [f"  {'.'.join(path)} ✗"]
+        if len(path) == 1:
+            return [f"  {_DELETE}{path[0]} ✗{_RESET}"]
+        prefix = ".".join(path[:-1])
+        final = path[-1]
+        return [f"  {_PATH_PREFIX}{prefix}.{_RESET}{_DELETE}{final} ✗{_RESET}"]
+
+    if change_type == "add":
+        # New item being created - only final element in green
+        # For dict values, show children on separate indented lines
+        if isinstance(value, dict) and value:
+            lines = []
+            # First line: path with green final element and grey =
+            if not use_color:
+                lines.append(f"  {'.'.join(path)} =")
+            elif len(path) == 1:
+                lines.append(f"  {_ADD}{path[0]}{_RESET} {_DIM}={_RESET}")
+            else:
+                prefix = ".".join(path[:-1])
+                final = path[-1]
+                lines.append(
+                    f"  {_PATH_PREFIX}{prefix}.{_RESET}{_ADD}{final}{_RESET} {_DIM}={_RESET}"
+                )
+            # Child lines: indented key: value, with aligned values
+            max_key_len = max(len(k) for k in value.keys())
+            field_width = max(max_key_len, 12)  # minimum 12 chars
+            for k, v in value.items():
+                v_str = _format_value(v, use_color)
+                padding = " " * (field_width - len(k))
+                if use_color:
+                    lines.append(f"    {k}{_DIM}:{_RESET}{padding} {v_str}")
+                else:
+                    lines.append(f"    {k}:{padding} {v_str}")
+            return lines
+        else:
+            value_str = _format_value(value, use_color)
+            if not use_color:
+                return [f"  {'.'.join(path)} = {value_str}"]
+            if len(path) == 1:
+                return [f"  {_ADD}{path[0]}{_RESET} {_DIM}={_RESET} {value_str}"]
+            prefix = ".".join(path[:-1])
+            final = path[-1]
+            return [
+                f"  {_PATH_PREFIX}{prefix}.{_RESET}{_ADD}{final}{_RESET} {_DIM}={_RESET} {value_str}"
+            ]
+
+    # update: Existing item being updated - normal path colors
+    value_str = _format_value(value, use_color)
+    path_str = _format_path(path, use_color)
+    if use_color:
+        return [f"  {path_str} {_DIM}={_RESET} {value_str}"]
+    return [f"  {path_str} = {value_str}"]
+
+
+def format_diff(diff: dict, previous: dict | None = None) -> list[str]:
+    """
+    Format a JSON diff as human-readable lines.
+
+    Args:
+        diff: The JSON diff dict
+        previous: The previous state dict (for determining add vs update)
+
+    Returns a list of formatted lines (without newlines).
+    Single changes return one line, multiple changes return multiple lines.
+    """
+    use_color = _use_color()
+    changes: list[tuple[str, list[str], Any]] = []
+    _collect_changes(diff, [], changes, previous)
+
+    if not changes:
+        return []
+
+    # Format each change
+    lines = []
+    for change_type, path, value in changes:
+        lines.extend(_format_change_lines(change_type, path, value, use_color))
+
+    return lines
+
+
+def format_action_header(action: str, user_display: str | None = None) -> str:
+    """Format the action header line."""
+    use_color = _use_color()
+
+    if use_color:
+        action_str = f"{_ACTION}{action}{_RESET}"
+        if user_display:
+            user_str = f"{_USER}{user_display}{_RESET}"
+            return f"{action_str} by {user_str}"
+        return action_str
+    else:
+        if user_display:
+            return f"{action} by {user_display}"
+        return action
+
+
+def log_change(
+    action: str,
+    diff: dict,
+    user_display: str | None = None,
+    previous: dict | None = None,
+) -> None:
+    """
+    Log a database change with pretty-printed diff.
+
+    Args:
+        action: The action name (e.g., "login", "admin:delete_user")
+        diff: The JSON diff dict
+        user_display: Optional display name of the user who performed the action
+        previous: The previous state dict (for determining add vs update)
+    """
+    header = format_action_header(action, user_display)
+    diff_lines = format_diff(diff, previous)
+
+    if not diff_lines:
+        logger.info(header)
+        return
+
+    if len(diff_lines) == 1:
+        # Single change - combine on one line
+        logger.info(f"{header}{diff_lines[0]}")
+    else:
+        # Multiple changes - header on its own line, then changes
+        logger.info(header)
+        for line in diff_lines:
+            logger.info(line)
+
+
+def configure_db_logging() -> None:
+    """Configure the database logger to output to stderr without prefix."""
+    handler = logging.StreamHandler(sys.stderr)
+    handler.setFormatter(logging.Formatter("%(message)s"))
+    logger.addHandler(handler)
+    logger.setLevel(logging.INFO)
+    logger.propagate = False
@@ -0,0 +1,33 @@
+"""
+Database schema migrations.
+
+Migrations are applied during database load based on the version field.
+Each migration should be idempotent and only run when needed.
+"""
+
+from collections.abc import Awaitable, Callable
+
+
+def migrate_v1(d: dict) -> None:
+    """Remove Org.created_at fields."""
+    for org_data in d["orgs"].values():
+        org_data.pop("created_at", None)
+
+
+migrations = sorted(
+    [f for n, f in globals().items() if n.startswith("migrate_v")],
+    key=lambda f: int(f.__name__.removeprefix("migrate_v")),
+)
+
+DBVER = len(migrations)  # Used by bootstrap and migrate:sql to set initial version
+
+
+async def apply_all_migrations(
+    data_dict: dict,
+    current_version: int,
+    persist: Callable[[str, int, dict], Awaitable[None]],
+) -> None:
+    while current_version < DBVER:
+        migrations[current_version](data_dict)
+        current_version += 1
+        await persist(f"migrate:v{current_version}", current_version, data_dict)
@@ -1,43 +1,224 @@
-from datetime import datetime
+from __future__ import annotations
+
+import secrets
+from datetime import UTC, datetime
 from uuid import UUID

 import msgspec
+import uuid7
+
+from paskia import db
+from paskia.util.hostutil import normalize_host
+
+# Sentinel for uuid fields before they are set by create() or DB post init
+_UUID_UNSET = UUID(int=0)


-class Permission(msgspec.Struct, omit_defaults=True):
-    uuid: UUID  # UUID primary key
+class Permission(msgspec.Struct, dict=True, omit_defaults=True):
+    """Permission data structure.
+
+    Mutable fields: scope, display_name, domain, orgs
+    Immutable fields: None (all fields can be updated via update_permission)
+    uuid is generated at creation.
+    """
+
    scope: str  # Permission scope identifier (e.g. "auth:admin", "myapp:write")
    display_name: str
    domain: str | None = None  # If set, scopes permission to this domain
+    orgs: dict[UUID, bool] = {}  # org_uuid -> True (which orgs can grant this)
+
+    def __post_init__(self):
+        if not hasattr(self, "uuid"):
+            self.uuid: UUID = _UUID_UNSET
+
+    @property
+    def org_set(self) -> set[UUID]:
+        """Get orgs that can grant this permission as a set."""
+        return set(self.orgs.keys())
+
+    @property
+    def orgs_list(self) -> list[Org]:
+        """Get list of Org objects that can grant this permission."""
+        return [
+            db.data().orgs[org_uuid]
+            for org_uuid in self.orgs.keys()
+            if org_uuid in db.data().orgs
+        ]
+
+    @classmethod
+    def create(
+        cls,
+        scope: str,
+        display_name: str,
+        domain: str | None = None,
+    ) -> Permission:
+        """Create a new Permission with auto-generated uuid7."""
+        perm = cls(
+            scope=scope,
+            display_name=display_name,
+            domain=domain,
+        )
+        perm.uuid = uuid7.create()
+        return perm


-class Role(msgspec.Struct):
-    uuid: UUID
-    org_uuid: UUID
+class Org(msgspec.Struct, dict=True):
+    """Organization data structure."""
+
    display_name: str
-    permissions: list[str] = []  # permission UUIDs this role grants
+
+    def __post_init__(self):
+        if not hasattr(self, "uuid"):
+            self.uuid: UUID = _UUID_UNSET
+
+    @property
+    def roles(self) -> list[Role]:
+        """Get all roles that belong to this organization."""
+        return [r for r in db.data().roles.values() if r.org_uuid == self.uuid]
+
+    @property
+    def permissions(self) -> list[Permission]:
+        """Get all permissions that this organization can grant."""
+        return [p for p in db.data().permissions.values() if self.uuid in p.orgs]
+
+    @classmethod
+    def create(cls, display_name: str) -> Org:
+        """Create a new Org with auto-generated uuid7."""
+        org = cls(display_name=display_name)
+        org.uuid = uuid7.create()
+        return org


-class Org(msgspec.Struct):
-    uuid: UUID
+class Role(msgspec.Struct, dict=True, omit_defaults=True):
+    """Role data structure.
+
+    Mutable fields: display_name, permissions
+    Immutable fields: org_uuid (set at creation, never modified)
+    uuid is generated at creation.
+    """
+
+    org_uuid: UUID = msgspec.field(name="org")
    display_name: str
-    permissions: list[str] = []  # permission UUIDs this org can grant
-    roles: list[Role] = []  # roles belonging to this org
+    permissions: dict[UUID, bool] = {}  # permission_uuid -> True
+
+    def __post_init__(self):
+        if not hasattr(self, "uuid"):
+            self.uuid: UUID = _UUID_UNSET
+
+    @property
+    def permission_set(self) -> set[UUID]:
+        """Get permissions as a set of UUIDs."""
+        return set(self.permissions.keys())
+
+    @property
+    def permissions_list(self) -> list[Permission]:
+        """Get list of Permission objects for this role."""
+        return [
+            db.data().permissions[perm_uuid]
+            for perm_uuid in self.permissions.keys()
+            if perm_uuid in db.data().permissions
+        ]
+
+    @property
+    def org(self) -> Org:
+        """Get the organization object this role belongs to."""
+        return db.data().orgs[self.org_uuid]
+
+    @property
+    def users(self) -> list[User]:
+        """Get all users that have this role."""
+        return [u for u in db.data().users.values() if u.role_uuid == self.uuid]
+
+    @classmethod
+    def create(
+        cls,
+        org: UUID | Org,
+        display_name: str,
+        permissions: set[UUID] | None = None,
+    ) -> Role:
+        """Create a new Role with auto-generated uuid7."""
+        org_uuid = org if isinstance(org, UUID) else org.uuid
+        role = cls(
+            org_uuid=org_uuid,
+            display_name=display_name,
+            permissions={p: True for p in (permissions or set())},
+        )
+        role.uuid = uuid7.create()
+        return role


-class User(msgspec.Struct):
-    uuid: UUID
+class User(msgspec.Struct, dict=True, omit_defaults=True):
+    """User data structure.
+
+    Mutable fields: display_name, role_uuid, last_seen, visits, theme
+    Immutable fields: created_at (set at creation, never modified)
+    uuid is derived from created_at using uuid7.
+    """
+
    display_name: str
-    role_uuid: UUID
-    created_at: datetime | None = None
+    role_uuid: UUID = msgspec.field(name="role")
+    created_at: datetime
    last_seen: datetime | None = None
    visits: int = 0
+    theme: str = ""  # "" or "auto" = OS default, "light", "dark"
+
+    def __post_init__(self):
+        if not hasattr(self, "uuid"):
+            self.uuid: UUID = _UUID_UNSET
+
+    @property
+    def role(self) -> Role:
+        """Get the role object this user has."""
+        return db.data().roles[self.role_uuid]
+
+    @property
+    def org(self) -> Org:
+        """Get the organization this user belongs to (via role)."""
+        return self.role.org
+
+    @property
+    def credentials(self) -> list[Credential]:
+        """Get all credentials for this user."""
+        return [c for c in db.data().credentials.values() if c.user_uuid == self.uuid]
+
+    @property
+    def sessions(self) -> list[Session]:
+        """Get all sessions for this user."""
+        return [s for s in db.data().sessions.values() if s.user_uuid == self.uuid]
+
+    @property
+    def reset_tokens(self) -> list[ResetToken]:
+        """Get all reset tokens for this user."""
+        return [t for t in db.data().reset_tokens.values() if t.user_uuid == self.uuid]
+
+    @classmethod
+    def create(
+        cls,
+        display_name: str,
+        role: UUID | Role,
+        created_at: datetime | None = None,
+    ) -> User:
+        """Create a new User with auto-generated uuid7."""
+        role_uuid = role if isinstance(role, UUID) else role.uuid
+        user = cls(
+            display_name=display_name,
+            role_uuid=role_uuid,
+            created_at=created_at or datetime.now(UTC),
+        )
+        user.uuid = uuid7.create(user.created_at)
+        return user


-class Credential(msgspec.Struct):
-    uuid: UUID
+class Credential(msgspec.Struct, dict=True):
+    """Credential (passkey) data structure.
+
+    Mutable fields: sign_count, last_used, last_verified
+    Immutable fields: credential_id, user, aaguid, public_key, created_at
+    uuid is derived from created_at using uuid7.
+    """
+
    credential_id: bytes  # Long binary ID from the authenticator
-    user_uuid: UUID
+    user_uuid: UUID = msgspec.field(name="user")
    aaguid: UUID
    public_key: bytes
    sign_count: int
@@ -45,16 +226,78 @@ class Credential(msgspec.Struct):
    last_used: datetime | None = None
    last_verified: datetime | None = None

+    def __post_init__(self):
+        if not hasattr(self, "uuid"):
+            self.uuid: UUID = _UUID_UNSET

-class Session(msgspec.Struct):
-    key: str
-    user_uuid: UUID
-    credential_uuid: UUID
-    host: str | None
-    ip: str | None
-    user_agent: str | None
+    @property
+    def user(self) -> User:
+        """Get the User object for this credential."""
+        return db.data().users[self.user_uuid]
+
+    @property
+    def sessions(self) -> list[Session]:
+        """Get all sessions using this credential."""
+        return [
+            s for s in db.data().sessions.values() if s.credential_uuid == self.uuid
+        ]
+
+    @classmethod
+    def create(
+        cls,
+        credential_id: bytes,
+        user: UUID | User,
+        aaguid: UUID,
+        public_key: bytes,
+        sign_count: int,
+        created_at: datetime | None = None,
+    ) -> Credential:
+        """Create a new Credential with auto-generated uuid7."""
+        user_uuid = user if isinstance(user, UUID) else user.uuid
+        now = created_at or datetime.now(UTC)
+        cred = cls(
+            credential_id=credential_id,
+            user_uuid=user_uuid,
+            aaguid=aaguid,
+            public_key=public_key,
+            sign_count=sign_count,
+            created_at=now,
+            last_used=now,
+            last_verified=now,
+        )
+        cred.uuid = uuid7.create(now)
+        return cred
+
+
+class Session(msgspec.Struct, dict=True):
+    """Session data structure.
+
+    Mutable fields: expiry (updated on session refresh)
+    Immutable fields: user_uuid, credential_uuid, host, ip, user_agent
+    key is stored in the dict key, not in the struct.
+    """
+
+    user_uuid: UUID = msgspec.field(name="user")
+    credential_uuid: UUID = msgspec.field(name="credential")
+    host: str
+    ip: str
+    user_agent: str
    expiry: datetime

+    def __post_init__(self):
+        if not hasattr(self, "key"):
+            self.key: str = ""
+
+    @property
+    def user(self) -> User:
+        """Get the User object for this session."""
+        return db.data().users[self.user_uuid]
+
+    @property
+    def credential(self) -> Credential:
+        """Get the Credential object for this session."""
+        return db.data().credentials[self.credential_uuid]
+
    def metadata(self) -> dict:
        """Return session metadata for backwards compatibility."""
        return {
@@ -63,86 +306,158 @@ class Session(msgspec.Struct):
            "expiry": self.expiry.isoformat(),
        }

+    @classmethod
+    def create(
+        cls,
+        user: UUID | User,
+        credential: UUID | Credential,
+        host: str,
+        ip: str,
+        user_agent: str,
+        expiry: datetime,
+    ) -> Session:
+        """Create a new Session with auto-generated key."""
+        user_uuid = user if isinstance(user, UUID) else user.uuid
+        credential_uuid = (
+            credential if isinstance(credential, UUID) else credential.uuid
+        )
+        session = cls(
+            user_uuid=user_uuid,
+            credential_uuid=credential_uuid,
+            host=host,
+            ip=ip,
+            user_agent=user_agent,
+            expiry=expiry,
+        )
+        session.key = secrets.token_urlsafe(12)
+        return session

-class ResetToken(msgspec.Struct):
-    key: bytes
-    user_uuid: UUID
+
+class ResetToken(msgspec.Struct, dict=True):
+    """Reset/device-addition token data structure.
+
+    Immutable fields: All fields (tokens are created and deleted, never modified)
+    key is stored in the dict key, not in the struct.
+    """
+
+    user_uuid: UUID = msgspec.field(name="user")
    expiry: datetime
    token_type: str

+    def __post_init__(self):
+        if not hasattr(self, "key"):
+            self.key: bytes = b""
+
+    @property
+    def user(self) -> User:
+        """Get the User object for this reset token."""
+        return db.data().users[self.user_uuid]
+

 class SessionContext(msgspec.Struct):
    session: Session
    user: User
    org: Org
    role: Role
-    credential: Credential | None = None
-    permissions: list[Permission] | None = None
+    credential: Credential
+    permissions: list[Permission] = []


 # -------------------------------------------------------------------------
-# Internal storage types (different structure for efficient storage)
+# Database storage structure
 # -------------------------------------------------------------------------


-class _PermissionData(msgspec.Struct, omit_defaults=True):
-    scope: str  # Permission scope identifier
-    display_name: str
-    domain: str | None = None
-    orgs: dict[UUID, bool] = {}  # org_uuid -> True (which orgs can grant this)
+class DB(msgspec.Struct, dict=True, omit_defaults=False):
+    """In-memory database. Access fields directly for reads."""

+    permissions: dict[UUID, Permission] = {}
+    orgs: dict[UUID, Org] = {}
+    roles: dict[UUID, Role] = {}
+    users: dict[UUID, User] = {}
+    credentials: dict[UUID, Credential] = {}
+    sessions: dict[str, Session] = {}
+    reset_tokens: dict[bytes, ResetToken] = {}

-class _OrgData(msgspec.Struct):
-    display_name: str
-    created_at: datetime | None = None
+    def __post_init__(self):
+        # Store reference for persistence (not serialized)
+        self._store = None
+        # Set the key fields on all stored objects
+        for uuid, perm in self.permissions.items():
+            perm.uuid = uuid
+        for uuid, org in self.orgs.items():
+            org.uuid = uuid
+        for uuid, role in self.roles.items():
+            role.uuid = uuid
+        for uuid, user in self.users.items():
+            user.uuid = uuid
+        for uuid, cred in self.credentials.items():
+            cred.uuid = uuid
+        for key, session in self.sessions.items():
+            session.key = key
+        for key, token in self.reset_tokens.items():
+            token.key = key

+    def transaction(self, action, ctx=None, *, user=None):
+        """Wrap writes in transaction. Delegates to JsonlStore."""
+        return self._store.transaction(action, ctx, user=user)

-class _RoleData(msgspec.Struct):
-    org: UUID
-    display_name: str
-    permissions: dict[UUID, bool] = {}  # permission_uuid -> True
+    def session_ctx(
+        self, session_key: str, host: str | None = None
+    ) -> SessionContext | None:
+        """Get full session context with effective permissions.

+        Args:
+            session_key: The session key string
+            host: Optional host for binding/validation and domain-scoped permissions

-class _UserData(msgspec.Struct):
-    display_name: str
-    role: UUID
-    created_at: datetime
-    last_seen: datetime | None
-    visits: int
+        Returns:
+            SessionContext if valid, None if session not found, expired, or host mismatch
+        """
+        try:
+            s = self.sessions[session_key]
+        except KeyError:
+            return None

+        # Validate host matches (sessions are always created with a host)
+        if s.host != host:
+            # Session bound to different host
+            return None

-class _CredentialData(msgspec.Struct):
-    credential_id: bytes
-    user: UUID
-    aaguid: UUID
-    public_key: bytes
-    sign_count: int
-    created_at: datetime
-    last_used: datetime | None
-    last_verified: datetime | None
+        try:
+            user = s.user
+            role = user.role
+            org = role.org
+            credential = s.credential
+        except KeyError:
+            return None

+        # Effective permissions: role's permissions that the org can grant
+        # Also filter by domain if host is provided
+        org_perm_uuids = {p.uuid for p in org.permissions}
+        normalized_host = normalize_host(host)
+        host_without_port = (
+            normalized_host.rsplit(":", 1)[0] if normalized_host else None
+        )

-class _SessionData(msgspec.Struct):
-    user: UUID
-    credential: UUID
-    host: str | None
-    ip: str | None
-    user_agent: str | None
-    expiry: datetime
+        effective_perms = []
+        for perm_uuid in role.permission_set:
+            if perm_uuid not in org_perm_uuids:
+                continue
+            try:
+                p = self.permissions[perm_uuid]
+            except KeyError:
+                continue
+            # Check domain restriction
+            if p.domain is not None and p.domain != host_without_port:
+                continue
+            effective_perms.append(p)

-
-class _ResetTokenData(msgspec.Struct):
-    user: UUID
-    expiry: datetime
-    token_type: str
-
-
-class _DatabaseData(msgspec.Struct, omit_defaults=True):
-    permissions: dict[UUID, _PermissionData]
-    orgs: dict[UUID, _OrgData]
-    roles: dict[UUID, _RoleData]
-    users: dict[UUID, _UserData]
-    credentials: dict[UUID, _CredentialData]
-    sessions: dict[str, _SessionData]
-    reset_tokens: dict[bytes, _ResetTokenData]
-    v: int = 0
+        return SessionContext(
+            session=s,
+            user=user,
+            org=org,
+            role=role,
+            credential=credential,
+            permissions=effective_perms,
+        )
@@ -1,16 +1,31 @@
 import argparse
 import asyncio
-import ipaddress
+import json
 import logging
 import os
 from urllib.parse import urlparse

-import uvicorn
+from fastapi_vue.hostutil import parse_endpoint
+from uvicorn import Config, Server
+from uvicorn import run as uvicorn_run

+from paskia import globals as _globals
+from paskia.bootstrap import bootstrap_if_needed
+from paskia.config import PaskiaConfig
+from paskia.db.background import flush
+from paskia.fastapi import reset as reset_cmd
+from paskia.util import startupbox
 from paskia.util.hostutil import normalize_origin

-DEFAULT_HOST = "localhost"
-DEFAULT_SERVE_PORT = 4401
+DEFAULT_PORT = 4401
+
+EPILOG = """\
+Examples:
+  paskia                           # localhost:4401
+  paskia -l :8080                  # All interfaces, port 8080
+  paskia -l /tmp/paskia.sock       # Unix socket
+  paskia reset [user]              # Generate passkey reset link
+"""


 def is_subdomain(sub: str, domain: str) -> bool:
@@ -34,80 +49,6 @@ def validate_auth_host(auth_host: str, rp_id: str) -> None:
        )


-def parse_endpoint(
-    value: str | None, default_port: int
-) -> tuple[str | None, int | None, str | None, bool]:
-    """Parse an endpoint using stdlib (urllib.parse, ipaddress).
-
-    Returns (host, port, uds_path). If uds_path is not None, host/port are None.
-
-    Supported forms:
-    - host[:port]
-    - :port (uses default host)
-    - [ipv6][:port] (bracketed for port usage)
-    - ipv6 (unbracketed, no port allowed -> default port)
-    - unix:/path/to/socket.sock
-    - None -> defaults (localhost:4401)
-
-    Notes:
-    - For IPv6 with an explicit port you MUST use brackets (e.g. [::1]:8080)
-    - Unbracketed IPv6 like ::1 implies the default port.
-    """
-    if not value:
-        return DEFAULT_HOST, default_port, None, False
-
-    # Port only (numeric) -> localhost:port
-    if value.isdigit():
-        try:
-            port_only = int(value)
-        except ValueError:  # pragma: no cover (isdigit guards)
-            raise SystemExit(f"Invalid port '{value}'")
-        return DEFAULT_HOST, port_only, None, False
-
-    # Leading colon :port -> bind all interfaces (0.0.0.0 + ::)
-    if value.startswith(":") and value != ":":
-        port_part = value[1:]
-        if not port_part.isdigit():
-            raise SystemExit(f"Invalid port in '{value}'")
-        return None, int(port_part), None, True
-
-    # UNIX domain socket
-    if value.startswith("unix:"):
-        uds_path = value[5:] or None
-        if uds_path is None:
-            raise SystemExit("unix: path must not be empty")
-        return None, None, uds_path, False
-
-    # Unbracketed IPv6 (cannot safely contain a port) -> detect by multiple colons
-    if value.count(":") > 1 and not value.startswith("["):
-        try:
-            ipaddress.IPv6Address(value)
-        except ValueError as e:  # pragma: no cover
-            raise SystemExit(f"Invalid IPv6 address '{value}': {e}")
-        return value, default_port, None, False
-
-    # Use urllib.parse for everything else (host[:port], :port, [ipv6][:port])
-    parsed = urlparse(f"//{value}")  # // prefix lets urlparse treat it as netloc
-    host = parsed.hostname
-    port = parsed.port
-
-    # Host may be None if empty (e.g. ':5500')
-    if not host:
-        host = DEFAULT_HOST
-    if port is None:
-        port = default_port
-
-    # Validate IP literals (optional; hostname passes through)
-    try:
-        # Strip brackets if somehow present (urlparse removes them already)
-        ipaddress.ip_address(host)
-    except ValueError:
-        # Not an IP address -> treat as hostname; no action
-        pass
-
-    return host, port, None, False
-
-
 def add_common_options(p: argparse.ArgumentParser) -> None:
    p.add_argument(
        "--rp-id", default="localhost", help="Relying Party ID (default: localhost)"
@@ -134,45 +75,52 @@ def main():
    logging.basicConfig(level=logging.INFO, format="%(message)s", force=True)

    parser = argparse.ArgumentParser(
-        prog="paskia", description="Paskia authentication server"
+        prog="paskia",
+        description="Paskia authentication server",
+        formatter_class=argparse.RawDescriptionHelpFormatter,
+        epilog=EPILOG,
    )
-    sub = parser.add_subparsers(dest="command", required=True)

-    # serve subcommand
-    serve = sub.add_parser(
-        "serve", help="Run the server (production style, no auto-reload)"
-    )
-    serve.add_argument(
-        "hostport",
+    # Subcommand for reset
+    parser.add_argument(
+        "command",
        nargs="?",
+        help="Command: 'reset' for credential reset, or omit to run server",
+    )
+    parser.add_argument(
+        "reset_query",
+        nargs="?",
+        help="For 'reset' command: user UUID or substring of display name",
+    )
+    parser.add_argument(
+        "-l",
+        "--listen",
+        metavar="LISTEN",
        help=(
-            "Endpoint (default: localhost:4401). Forms: host[:port] | :port | "
-            "[ipv6][:port] | ipv6 | unix:/path.sock"
+            "Endpoint to listen on (default: localhost:4401). "
+            "Forms: host:port  port  :port  [ipv6]:port  unix:path  /path.sock"
        ),
    )
-    add_common_options(serve)
-
-    # reset subcommand
-    reset = sub.add_parser(
-        "reset",
-        help=(
-            "Create a credential reset link for a user. Provide part of the display name or UUID. "
-            "If omitted, targets the master admin (first Administration role user in an auth:admin org)."
-        ),
-    )
-    reset.add_argument(
-        "query",
-        nargs="?",
-        help="User UUID (full) or case-insensitive substring of display name. If omitted, master admin is used.",
-    )
-    add_common_options(reset)
+    add_common_options(parser)

    args = parser.parse_args()

-    if args.command == "serve":
-        host, port, uds, all_ifaces = parse_endpoint(args.hostport, DEFAULT_SERVE_PORT)
+    # Detect "reset" subcommand
+    is_reset = args.command == "reset"
+
+    if is_reset:
+        endpoints = []
    else:
-        host = port = uds = all_ifaces = None  # type: ignore
+        if args.command is not None:
+            raise SystemExit(f"Unknown command: {args.command}")
+        # Parse endpoint using fastapi_vue.hostutil
+        endpoints = parse_endpoint(args.listen, DEFAULT_PORT)
+
+    # Extract host/port/uds from first endpoint for config display and site_url
+    ep = endpoints[0] if endpoints else {}
+    host = ep.get("host")
+    port = ep.get("port")
+    uds = ep.get("uds")

    # Collect and normalize origins, handle auth_host
    origins = [normalize_origin(o) for o in (getattr(args, "origins", None) or [])]
@@ -193,8 +141,13 @@ def main():
    origins = [x for x in origins if not (x in seen or seen.add(x))]

    # Compute site_url and site_path for reset links
-    # Priority: auth_host > first origin with localhost > http://localhost:port
-    if args.auth_host:
+    # Priority: PASKIA_SITE_URL (explicit) > auth_host > first origin with localhost > http://localhost:port
+    explicit_site_url = os.environ.get("PASKIA_SITE_URL")
+    if explicit_site_url:
+        # Explicit site URL from devserver or deployment config
+        site_url = explicit_site_url.rstrip("/")
+        site_path = "/" if args.auth_host else "/auth/"
+    elif args.auth_host:
        site_url = args.auth_host.rstrip("/")
        site_path = "/"
    elif origins:
@@ -215,8 +168,6 @@ def main():
        site_path = "/auth/"

    # Build runtime configuration
-    from paskia.config import PaskiaConfig
-
    config = PaskiaConfig(
        rp_id=args.rp_id,
        rp_name=args.rp_name or None,
@@ -230,8 +181,6 @@ def main():
    )

    # Export configuration via single JSON env variable for worker processes
-    import json
-
    config_json = {
        "rp_id": config.rp_id,
        "rp_name": config.rp_name,
@@ -242,93 +191,59 @@ def main():
    }
    os.environ["PASKIA_CONFIG"] = json.dumps(config_json)

-    # Initialize globals (without bootstrap yet)
-    from paskia import globals as _globals  # local import
+    startupbox.print_startup_config(config)

-    asyncio.run(
-        _globals.init(
+    devmode = bool(os.environ.get("FASTAPI_VUE_FRONTEND_URL"))
+
+    run_kwargs: dict = {
+        "log_level": "warning",  # Suppress startup messages; we use custom logging
+        "access_log": False,  # We use custom AccessLogMiddleware instead
+    }
+
+    if devmode:
+        # Security: dev mode must run on localhost:4402 to prevent
+        # accidental public exposure of the Vite dev server
+        if host != "localhost" or port != 4402:
+            raise SystemExit(f"Dev mode requires localhost:4402, got {host}:{port}")
+        run_kwargs["reload"] = True
+        run_kwargs["reload_dirs"] = ["paskia"]
+
+    async def async_main():
+        await _globals.init(
            rp_id=config.rp_id,
            rp_name=config.rp_name,
            origins=config.origins,
            bootstrap=False,
        )
-    )
+        await bootstrap_if_needed()
+        await flush()

-    # Print startup configuration
-    from paskia.util import startupbox
+        if is_reset:
+            exit_code = reset_cmd.run(args.reset_query)
+            raise SystemExit(exit_code)

-    startupbox.print_startup_config(config)
-
-    # Bootstrap after startup box is printed
-    from paskia.bootstrap import bootstrap_if_needed
-
-    asyncio.run(bootstrap_if_needed())
-
-    # Handle recover-admin command (no server start)
-    if args.command == "reset":
-        from paskia.fastapi import reset as reset_cmd  # local import
-
-        exit_code = reset_cmd.run(getattr(args, "query", None))
-        raise SystemExit(exit_code)
-
-    if args.command == "serve":
-        run_kwargs: dict = {
-            "log_level": "info",
-        }
-
-        # Dev mode: enable reload when PASKIA_DEVMODE is set
-        devmode = bool(os.environ.get("PASKIA_DEVMODE"))
-        if devmode:
-            # Security: dev mode must run on localhost:4402 to prevent
-            # accidental public exposure of the Vite dev server
-            if host != "localhost" or port != 4402:
-                raise SystemExit(f"Dev mode requires localhost:4402, got {host}:{port}")
-            run_kwargs["reload"] = True
-            run_kwargs["reload_dirs"] = ["paskia"]
-            # Suppress uvicorn startup messages in dev mode
-            run_kwargs["log_level"] = "warning"
-
-        if uds:
-            run_kwargs["uds"] = uds
+        if len(endpoints) > 1:
+            async with asyncio.TaskGroup() as tg:
+                for ep in endpoints:
+                    tg.create_task(
+                        Server(
+                            Config(app="paskia.fastapi:app", **run_kwargs, **ep)
+                        ).serve()
+                    )
+        elif devmode:
+            # Use uvicorn.run for proper reload support (it handles subprocess spawning)
+            ep = endpoints[0]
+            uvicorn_run("paskia.fastapi:app", **run_kwargs, **ep)
        else:
-            if not all_ifaces:
-                run_kwargs["host"] = host
-                run_kwargs["port"] = port
+            server = Server(
+                Config(app="paskia.fastapi:app", **run_kwargs, **endpoints[0])
+            )
+            await server.serve()

-        if all_ifaces and not uds:
-            # Dev mode with all interfaces: use simple single-server approach
-            if devmode:
-                run_kwargs["host"] = "::"
-                run_kwargs["port"] = port
-                uvicorn.run("paskia.fastapi:app", **run_kwargs)
-            else:
-                # Production: run separate servers for IPv4 and IPv6
-                from uvicorn import Config, Server  # noqa: E402 local import
-
-                from paskia.fastapi import (
-                    app as fastapi_app,  # noqa: E402 local import
-                )
-
-                async def serve_both():
-                    servers = []
-                    assert port is not None
-                    for h in ("0.0.0.0", "::"):
-                        try:
-                            cfg = Config(
-                                app=fastapi_app,
-                                host=h,
-                                port=port,
-                                log_level="info",
-                            )
-                            servers.append(Server(cfg))
-                        except Exception as e:  # pragma: no cover
-                            logging.warning(f"Failed to configure server for {h}: {e}")
-                    tasks = [asyncio.create_task(s.serve()) for s in servers]
-                    await asyncio.gather(*tasks)
-
-                asyncio.run(serve_both())
-        else:
-            uvicorn.run("paskia.fastapi:app", **run_kwargs)
+    try:
+        asyncio.run(async_main())
+    except KeyboardInterrupt:
+        pass


 if __name__ == "__main__":
@@ -1,58 +1,45 @@
 import logging
-from datetime import timezone
-from uuid import UUID, uuid4
+from uuid import UUID

-from fastapi import Body, FastAPI, HTTPException, Request, Response
+from fastapi import Body, FastAPI, HTTPException, Query, Request, Response
 from fastapi.responses import JSONResponse

+from paskia import aaguid as aaguid_mod
 from paskia import db
 from paskia.authsession import EXPIRES, reset_expires
+from paskia.db import Org as OrgDC
+from paskia.db import Permission as PermDC
+from paskia.db import Role as RoleDC
+from paskia.db import User as UserDC
 from paskia.fastapi import authz
+from paskia.fastapi.response import MsgspecResponse
 from paskia.fastapi.session import AUTH_COOKIE
+from paskia.globals import passkey
 from paskia.util import (
-    frontend,
    hostutil,
    passphrase,
    permutil,
    querysafe,
-    useragent,
+    vitedev,
 )
+from paskia.util.apistructs import ApiPermission, ApiSession, format_datetime
+from paskia.util.hostutil import normalize_host

-app = FastAPI()
+app = FastAPI(docs_url=None, redoc_url=None, openapi_url=None)


-def is_global_admin(ctx) -> bool:
-    """Check if user has global admin permission."""
-    effective_scopes = (
-        {p.scope for p in (ctx.permissions or [])}
-        if ctx.permissions
-        else set(ctx.role.permissions or [])
+def master_admin(ctx) -> bool:
+    return any(p.scope == "auth:admin" for p in ctx.permissions)
+
+
+def org_admin(ctx, org_uuid: UUID) -> bool:
+    return ctx.org.uuid == org_uuid and any(
+        p.scope == "auth:org:admin" for p in ctx.permissions
    )
-    return "auth:admin" in effective_scopes
-
-
-def is_org_admin(ctx, org_uuid: UUID | None = None) -> bool:
-    """Check if user has org admin permission.
-
-    If org_uuid is provided, checks if user is admin of that specific org.
-    If org_uuid is None, checks if user is admin of their own org.
-    """
-    effective_scopes = (
-        {p.scope for p in (ctx.permissions or [])}
-        if ctx.permissions
-        else set(ctx.role.permissions or [])
-    )
-    if "auth:org:admin" not in effective_scopes:
-        return False
-    if org_uuid is None:
-        return True
-    # User must belong to the target org (via their role)
-    return ctx.org.uuid == org_uuid


 def can_manage_org(ctx, org_uuid: UUID) -> bool:
-    """Check if user can manage the specified organization."""
-    return is_global_admin(ctx) or is_org_admin(ctx, org_uuid)
+    return master_admin(ctx) or org_admin(ctx, org_uuid)


@app.exception_handler(ValueError)
@@ -77,7 +64,7 @@ async def general_exception_handler(_request, exc: Exception):  # pragma: no cov

@app.get("/")
 async def adminapp(request: Request, auth=AUTH_COOKIE):
-    return Response(*await frontend.read("/auth/admin/index.html"))
+    return Response(*await vitedev.read("/auth/admin/index.html"))


 # -------------------- Organizations --------------------
@@ -91,39 +78,39 @@ async def admin_list_orgs(request: Request, auth=AUTH_COOKIE):
        match=permutil.has_any,
        host=request.headers.get("host"),
    )
-    orgs = db.list_organizations()
-    if not is_global_admin(ctx):
+    orgs = list(db.data().orgs.values())
+    if not master_admin(ctx):
        # Org admins can only see their own organization
        orgs = [o for o in orgs if o.uuid == ctx.org.uuid]

-    def role_to_dict(r):
+    def org_to_dict(o):
+        users = db.get_organization_users(o.uuid)
        return {
-            "uuid": str(r.uuid),
-            "org_uuid": str(r.org_uuid),
-            "display_name": r.display_name,
-            "permissions": r.permissions,
-        }
-
-    async def org_to_dict(o):
-        users = db.get_organization_users(str(o.uuid))
-        return {
-            "uuid": str(o.uuid),
+            "uuid": o.uuid,
            "display_name": o.display_name,
-            "permissions": o.permissions,
-            "roles": [role_to_dict(r) for r in o.roles],
+            "permissions": {p.uuid for p in o.permissions},
+            "roles": [
+                {
+                    "uuid": r.uuid,
+                    "org": r.org_uuid,
+                    "display_name": r.display_name,
+                    "permissions": list(r.permissions.keys()),
+                }
+                for r in o.roles
+            ],
            "users": [
                {
-                    "uuid": str(u.uuid),
+                    "uuid": u.uuid,
                    "display_name": u.display_name,
                    "role": role_name,
                    "visits": u.visits,
-                    "last_seen": u.last_seen.isoformat() if u.last_seen else None,
+                    "last_seen": u.last_seen,
                }
                for (u, role_name) in users
            ],
        }

-    return [await org_to_dict(o) for o in orgs]
+    return MsgspecResponse([org_to_dict(o) for o in orgs])


@app.post("/orgs")
@@ -133,15 +120,16 @@ async def admin_create_org(
    ctx = await authz.verify(
        auth, ["auth:admin"], host=request.headers.get("host"), match=permutil.has_all
    )
-    from ..db import Org as OrgDC  # local import to avoid cycles

-    org_uuid = uuid4()
    display_name = payload.get("display_name") or "New Organization"
    permissions = payload.get("permissions") or []
-    org = OrgDC(uuid=org_uuid, display_name=display_name, permissions=permissions)
-    db.create_organization(org, ctx=ctx)
+    org = OrgDC.create(display_name=display_name)
+    db.create_org(org, ctx=ctx)
+    # Grant requested permissions to the new org
+    for perm in permissions:
+        db.add_permission_to_org(str(org.uuid), perm, ctx=ctx)

-    return {"uuid": str(org_uuid)}
+    return {"uuid": str(org.uuid)}


@app.patch("/orgs/{org_uuid}")
@@ -166,7 +154,7 @@ async def admin_update_org_name(
    if not display_name:
        raise ValueError("display_name is required")

-    db.update_organization_name(org_uuid, display_name, ctx=ctx)
+    db.update_org_name(org_uuid, display_name, ctx=ctx)
    return {"status": "ok"}


@@ -188,7 +176,7 @@ async def admin_delete_org(org_uuid: UUID, request: Request, auth=AUTH_COOKIE):

    # Delete organization-specific permissions
    org_perm_pattern = f"org:{str(org_uuid).lower()}"
-    all_permissions = db.list_permissions()
+    all_permissions = list(db.data().permissions.values())
    for perm in all_permissions:
        perm_scope_lower = perm.scope.lower()
        # Check if permission contains "org:{uuid}" separated by colons or at boundaries
@@ -198,39 +186,43 @@ async def admin_delete_org(org_uuid: UUID, request: Request, auth=AUTH_COOKIE):
            or perm_scope_lower.endswith(f":{org_perm_pattern}")
            or perm_scope_lower == org_perm_pattern
        ):
-            db.delete_permission(str(perm.uuid), ctx=ctx)
+            db.delete_permission(perm.uuid, ctx=ctx)

-    db.delete_organization(org_uuid, ctx=ctx)
+    db.delete_org(org_uuid, ctx=ctx)
    return {"status": "ok"}


@app.post("/orgs/{org_uuid}/permission")
 async def admin_add_org_permission(
    org_uuid: UUID,
-    permission_id: str,
    request: Request,
+    permission_uuid: UUID = Query(...),
    auth=AUTH_COOKIE,
 ):
    ctx = await authz.verify(
        auth, ["auth:admin"], host=request.headers.get("host"), match=permutil.has_all
    )
-    db.add_permission_to_organization(str(org_uuid), permission_id, ctx=ctx)
+
+    db.add_permission_to_org(org_uuid, permission_uuid, ctx=ctx)
    return {"status": "ok"}


@app.delete("/orgs/{org_uuid}/permission")
 async def admin_remove_org_permission(
    org_uuid: UUID,
-    permission_id: str,
    request: Request,
+    permission_uuid: UUID = Query(...),
    auth=AUTH_COOKIE,
 ):
    ctx = await authz.verify(
        auth, ["auth:admin"], host=request.headers.get("host"), match=permutil.has_all
    )

+    db.remove_permission_from_org(org_uuid, permission_uuid, ctx=ctx)
+
    # Guard rail: prevent removing auth:admin from your own org if it would lock you out
-    if permission_id == "auth:admin" and ctx.org.uuid == org_uuid:
+    perm = db.data().permissions.get(permission_uuid)
+    if perm and perm.scope == "auth:admin" and ctx.org.uuid == org_uuid:
        # Check if any other org grants auth:admin that we're a member of
        # (we only know our current org, so this effectively means we can't remove it from our own org)
        raise ValueError(
@@ -238,7 +230,7 @@ async def admin_remove_org_permission(
            "This would lock you out of admin access."
        )

-    db.remove_permission_from_organization(str(org_uuid), permission_id, ctx=ctx)
+    db.remove_permission_from_org(org_uuid, permission_uuid, ctx=ctx)
    return {"status": "ok"}


@@ -262,33 +254,31 @@ async def admin_create_role(
        raise authz.AuthException(
            status_code=403, detail="Insufficient permissions", mode="forbidden"
        )
-    from ..db import Role as RoleDC

-    role_uuid = uuid4()
    display_name = payload.get("display_name") or "New Role"
    perms = payload.get("permissions") or []
-    org = db.get_organization(str(org_uuid))
-    grantable = set(org.permissions or [])
+    if org_uuid not in db.data().orgs:
+        raise HTTPException(status_code=404, detail="Organization not found")
+    org = db.data().orgs[org_uuid]
+    grantable = {p.uuid for p in org.permissions}

    # Normalize permission IDs to UUIDs
-    permission_uuids = []
+    permission_uuids: set[UUID] = set()
    for pid in perms:
-        perm = db.get_permission(pid)
+        perm = db.data().permissions.get(UUID(pid))
        if not perm:
            raise ValueError(f"Permission {pid} not found")
-        perm_uuid_str = str(perm.uuid)
-        if perm_uuid_str not in grantable:
+        if perm.uuid not in grantable:
            raise ValueError(f"Permission not grantable by org: {pid}")
-        permission_uuids.append(perm_uuid_str)
+        permission_uuids.add(perm.uuid)

-    role = RoleDC(
-        uuid=role_uuid,
-        org_uuid=org_uuid,
+    role = RoleDC.create(
+        org=org_uuid,
        display_name=display_name,
        permissions=permission_uuids,
    )
    db.create_role(role, ctx=ctx)
-    return {"uuid": str(role_uuid)}
+    return {"uuid": str(role.uuid)}


@app.patch("/orgs/{org_uuid}/roles/{role_uuid}")
@@ -310,8 +300,8 @@ async def admin_update_role_name(
        raise authz.AuthException(
            status_code=403, detail="Insufficient permissions", mode="forbidden"
        )
-    role = db.get_role(role_uuid)
-    if role.org_uuid != org_uuid:
+    role = db.data().roles.get(role_uuid)
+    if not role or role.org_uuid != org_uuid:
        raise HTTPException(status_code=404, detail="Role not found in organization")

    display_name = payload.get("display_name")
@@ -342,16 +332,15 @@ async def admin_add_role_permission(
            status_code=403, detail="Insufficient permissions", mode="forbidden"
        )

-    role = db.get_role(role_uuid)
-    if role.org_uuid != org_uuid:
+    role = db.data().roles.get(role_uuid)
+    if not role or role.org_uuid != org_uuid:
        raise HTTPException(status_code=404, detail="Role not found in organization")

    # Verify permission exists and org can grant it
-    perm = db.get_permission(permission_uuid)
+    perm = db.data().permissions.get(permission_uuid)
    if not perm:
        raise HTTPException(status_code=404, detail="Permission not found")
-    org = db.get_organization(str(org_uuid))
-    if str(permission_uuid) not in org.permissions:
+    if org_uuid not in perm.orgs:
        raise ValueError("Permission not grantable by organization")

    db.add_permission_to_role(role_uuid, permission_uuid, ctx=ctx)
@@ -378,21 +367,19 @@ async def admin_remove_role_permission(
            status_code=403, detail="Insufficient permissions", mode="forbidden"
        )

-    role = db.get_role(role_uuid)
-    if role.org_uuid != org_uuid:
+    role = db.data().roles.get(role_uuid)
+    if not role or role.org_uuid != org_uuid:
        raise HTTPException(status_code=404, detail="Role not found in organization")

    # Sanity check: prevent admin from removing their own access
-    # Find auth:admin and auth:org:admin permission UUIDs
-    perm_uuid_str = str(permission_uuid)
-    perm = db.get_permission(permission_uuid)
+    perm = db.data().permissions.get(permission_uuid)
    if ctx.org.uuid == org_uuid and ctx.role.uuid == role_uuid:
        if perm and perm.scope in ["auth:admin", "auth:org:admin"]:
            # Check if removing this permission would leave no admin access
-            remaining_perms = set(role.permissions) - {perm_uuid_str}
+            remaining_perms = role.permission_set - {permission_uuid}
            has_admin = False
            for rp_uuid in remaining_perms:
-                rp = db.get_permission(rp_uuid)
+                rp = db.data().permissions.get(rp_uuid)
                if rp and rp.scope in ["auth:admin", "auth:org:admin"]:
                    has_admin = True
                    break
@@ -421,8 +408,8 @@ async def admin_delete_role(
        raise authz.AuthException(
            status_code=403, detail="Insufficient permissions", mode="forbidden"
        )
-    role = db.get_role(role_uuid)
-    if role.org_uuid != org_uuid:
+    role = db.data().roles.get(role_uuid)
+    if not role or role.org_uuid != org_uuid:
        raise HTTPException(status_code=404, detail="Role not found in organization")

    # Sanity check: prevent admin from deleting their own role
@@ -457,22 +444,20 @@ async def admin_create_user(
    role_name = payload.get("role")
    if not display_name or not role_name:
        raise ValueError("display_name and role are required")
-    from ..db import User as UserDC

-    roles = db.get_roles_by_organization(str(org_uuid))
-    role_obj = next((r for r in roles if r.display_name == role_name), None)
+    org = db.data().orgs[org_uuid]
+    role_obj = next(
+        (r for r in org.roles if r.display_name == role_name),
+        None,
+    )
    if not role_obj:
        raise ValueError("Role not found in organization")
-    user_uuid = uuid4()
-    user = UserDC(
-        uuid=user_uuid,
+    user = UserDC.create(
        display_name=display_name,
-        role_uuid=role_obj.uuid,
-        visits=0,
-        created_at=None,
+        role=role_obj.uuid,
    )
    db.create_user(user, ctx=ctx)
-    return {"uuid": str(user_uuid)}
+    return {"uuid": str(user.uuid)}


@app.patch("/orgs/{org_uuid}/users/{user_uuid}/role")
@@ -502,7 +487,7 @@ async def admin_update_user_role(
        raise ValueError("User not found")
    if user_org.uuid != org_uuid:
        raise ValueError("User does not belong to this organization")
-    roles = db.get_roles_by_organization(str(org_uuid))
+    roles = user_org.roles
    if not any(r.display_name == new_role for r in roles):
        raise ValueError("Role not found in organization")

@@ -513,7 +498,7 @@ async def admin_update_user_role(
            # Check if any permission in the new role is an admin permission
            has_admin_access = False
            for perm_uuid in new_role_obj.permissions:
-                perm = db.get_permission(perm_uuid)
+                perm = db.data().permissions.get(perm_uuid)
                if perm and perm.scope in ["auth:admin", "auth:org:admin"]:
                    has_admin_access = True
                    break
@@ -552,8 +537,8 @@ async def admin_create_user_registration_link(
        )

    # Check if user has existing credentials
-    credentials = db.get_credentials_by_user_uuid(user_uuid)
-    token_type = "user registration" if not credentials else "account recovery"
+    has_credentials = db.get_user_credential_ids(user_uuid)
+    token_type = "user registration" if not has_credentials else "account recovery"

    token = passphrase.generate()
    expiry = reset_expires()
@@ -567,11 +552,7 @@ async def admin_create_user_registration_link(
    url = hostutil.reset_link_url(token)
    return {
        "url": url,
-        "expires": (
-            expiry.astimezone(timezone.utc).isoformat().replace("+00:00", "Z")
-            if expiry.tzinfo
-            else expiry.replace(tzinfo=timezone.utc).isoformat().replace("+00:00", "Z")
-        ),
+        "expires": format_datetime(expiry),
    }


@@ -598,122 +579,40 @@ async def admin_get_user_detail(
        raise authz.AuthException(
            status_code=403, detail="Insufficient permissions", mode="forbidden"
        )
-    user = db.get_user_by_uuid(user_uuid)
-    user_creds = db.get_credentials_by_user_uuid(user_uuid)
-    creds: list[dict] = []
-    aaguids: set[str] = set()
-    for c in user_creds:
-        aaguid_str = str(c.aaguid)
-        aaguids.add(aaguid_str)
-        creds.append(
-            {
-                "credential_uuid": str(c.uuid),
-                "aaguid": aaguid_str,
-                "created_at": (
-                    c.created_at.astimezone(timezone.utc)
-                    .isoformat()
-                    .replace("+00:00", "Z")
-                    if c.created_at.tzinfo
-                    else c.created_at.replace(tzinfo=timezone.utc)
-                    .isoformat()
-                    .replace("+00:00", "Z")
-                ),
-                "last_used": (
-                    c.last_used.astimezone(timezone.utc)
-                    .isoformat()
-                    .replace("+00:00", "Z")
-                    if c.last_used and c.last_used.tzinfo
-                    else (
-                        c.last_used.replace(tzinfo=timezone.utc)
-                        .isoformat()
-                        .replace("+00:00", "Z")
-                        if c.last_used
-                        else None
-                    )
-                ),
-                "last_verified": (
-                    c.last_verified.astimezone(timezone.utc)
-                    .isoformat()
-                    .replace("+00:00", "Z")
-                    if c.last_verified and c.last_verified.tzinfo
-                    else (
-                        c.last_verified.replace(tzinfo=timezone.utc)
-                        .isoformat()
-                        .replace("+00:00", "Z")
-                        if c.last_verified
-                        else None
-                    )
+    user = db.data().users.get(user_uuid)
+    normalized_host = hostutil.normalize_host(request.headers.get("host"))
+
+    return MsgspecResponse(
+        {
+            "display_name": user.display_name,
+            "org": {"display_name": user_org.display_name},
+            "role": role_name,
+            "visits": user.visits,
+            "created_at": user.created_at,
+            "last_seen": user.last_seen,
+            "credentials": [
+                {
+                    "credential": c.uuid,
+                    "aaguid": c.aaguid,
+                    "created_at": c.created_at,
+                    "last_used": c.last_used,
+                    "last_verified": c.last_verified,
+                    "sign_count": c.sign_count,
+                }
+                for c in user.credentials
+            ],
+            "aaguid_info": aaguid_mod.filter(c.aaguid for c in user.credentials),
+            "sessions": [
+                ApiSession.from_db(
+                    s,
+                    current_key=auth,
+                    normalized_host=normalized_host,
+                    expires_delta=EXPIRES,
                )
-                if c.last_verified
-                else None,
-                "sign_count": c.sign_count,
-            }
-        )
-    from .. import aaguid as aaguid_mod
-
-    aaguid_info = aaguid_mod.filter(aaguids)
-
-    # Get sessions for the user
-    normalized_request_host = hostutil.normalize_host(request.headers.get("host"))
-    session_records = db.list_sessions_for_user(user_uuid)
-    current_session_key = auth
-    sessions_payload: list[dict] = []
-    for entry in session_records:
-        renewed = entry.expiry - EXPIRES
-        sessions_payload.append(
-            {
-                "id": entry.key,
-                "credential_uuid": str(entry.credential_uuid),
-                "host": entry.host,
-                "ip": entry.ip,
-                "user_agent": useragent.compact_user_agent(entry.user_agent),
-                "last_renewed": (
-                    renewed.astimezone(timezone.utc).isoformat().replace("+00:00", "Z")
-                    if renewed.tzinfo
-                    else renewed.replace(tzinfo=timezone.utc)
-                    .isoformat()
-                    .replace("+00:00", "Z")
-                ),
-                "is_current": entry.key == current_session_key,
-                "is_current_host": bool(
-                    normalized_request_host
-                    and entry.host
-                    and entry.host == normalized_request_host
-                ),
-            }
-        )
-
-    return {
-        "display_name": user.display_name,
-        "org": {"display_name": user_org.display_name},
-        "role": role_name,
-        "visits": user.visits,
-        "created_at": (
-            user.created_at.astimezone(timezone.utc).isoformat().replace("+00:00", "Z")
-            if user.created_at and user.created_at.tzinfo
-            else (
-                user.created_at.replace(tzinfo=timezone.utc)
-                .isoformat()
-                .replace("+00:00", "Z")
-                if user.created_at
-                else None
-            )
-        ),
-        "last_seen": (
-            user.last_seen.astimezone(timezone.utc).isoformat().replace("+00:00", "Z")
-            if user.last_seen and user.last_seen.tzinfo
-            else (
-                user.last_seen.replace(tzinfo=timezone.utc)
-                .isoformat()
-                .replace("+00:00", "Z")
-                if user.last_seen
-                else None
-            )
-        ),
-        "credentials": creds,
-        "aaguid_info": aaguid_info,
-        "sessions": sessions_payload,
-    }
+                for s in user.sessions
+            ],
+        }
+    )


@app.patch("/orgs/{org_uuid}/users/{user_uuid}/display-name")
@@ -803,11 +702,11 @@ async def admin_delete_user_session(
            status_code=403, detail="Insufficient permissions", mode="forbidden"
        )

-    target_session = db.get_session(session_id)
+    target_session = db.data().sessions.get(session_id)
    if not target_session or target_session.user_uuid != user_uuid:
        raise HTTPException(status_code=404, detail="Session not found")

-    db.delete_session(session_id, ctx=ctx)
+    db.delete_session(session_id, ctx=ctx, action="admin:delete_session")

    # Check if admin terminated their own session
    current_terminated = session_id == auth
@@ -817,19 +716,10 @@ async def admin_delete_user_session(
 # -------------------- Permissions (global) --------------------


-def _perm_to_dict(p):
-    """Convert Permission to dict, omitting domain if None."""
-    d = {"uuid": str(p.uuid), "scope": p.scope, "display_name": p.display_name}
-    if p.domain is not None:
-        d["domain"] = p.domain
-    return d
-
-
 def _validate_permission_domain(domain: str | None) -> None:
    """Validate that domain is rp_id or a subdomain of it."""
    if domain is None:
        return
-    from paskia.globals import passkey

    rp_id = passkey.instance.rp_id
    if domain == rp_id or domain.endswith(f".{rp_id}"):
@@ -845,13 +735,12 @@ def _check_admin_lockout(
    Raises ValueError if this change would result in no auth:admin permissions
    being accessible from the current host.
    """
-    from paskia.util.hostutil import normalize_host

    normalized_host = normalize_host(current_host)
    host_without_port = normalized_host.rsplit(":", 1)[0] if normalized_host else None

    # Get all auth:admin permissions
-    all_perms = db.list_permissions()
+    all_perms = list(db.data().permissions.values())
    admin_perms = [p for p in all_perms if p.scope == "auth:admin"]

    # Check if at least one auth:admin would remain accessible
@@ -880,13 +769,12 @@ def _check_admin_lockout_on_delete(perm_uuid: str, current_host: str | None) ->
    Raises ValueError if this deletion would result in no auth:admin permissions
    being accessible from the current host.
    """
-    from paskia.util.hostutil import normalize_host

    normalized_host = normalize_host(current_host)
    host_without_port = normalized_host.rsplit(":", 1)[0] if normalized_host else None

    # Get all auth:admin permissions
-    all_perms = db.list_permissions()
+    all_perms = list(db.data().permissions.values())
    admin_perms = [p for p in all_perms if p.scope == "auth:admin"]

    # Check if at least one auth:admin would remain accessible after deletion
@@ -918,16 +806,8 @@ async def admin_list_permissions(request: Request, auth=AUTH_COOKIE):
        match=permutil.has_any,
        host=request.headers.get("host"),
    )
-    perms = db.list_permissions()
-
-    # Global admins see all permissions
-    if is_global_admin(ctx):
-        return [_perm_to_dict(p) for p in perms]
-
-    # Org admins only see permissions their org can grant (by UUID)
-    grantable = set(ctx.org.permissions or [])
-    filtered_perms = [p for p in perms if str(p.uuid) in grantable]
-    return [_perm_to_dict(p) for p in filtered_perms]
+    perms = db.data().permissions.values() if master_admin(ctx) else ctx.org.permissions
+    return MsgspecResponse([ApiPermission.from_db(p) for p in perms])


@app.post("/permissions")
@@ -943,9 +823,6 @@ async def admin_create_permission(
        match=permutil.has_all,
        max_age="5m",
    )
-    import uuid7
-
-    from ..db import Permission as PermDC

    scope = payload.get("scope") or payload.get(
        "id"
@@ -957,9 +834,7 @@ async def admin_create_permission(
    querysafe.assert_safe(scope, field="scope")
    _validate_permission_domain(domain)
    db.create_permission(
-        PermDC(
-            uuid=uuid7.create(), scope=scope, display_name=display_name, domain=domain
-        ),
+        PermDC.create(scope=scope, display_name=display_name, domain=domain),
        ctx=ctx,
    )
    return {"status": "ok"}
@@ -969,29 +844,27 @@ async def admin_create_permission(
 async def admin_update_permission(
    request: Request,
    auth=AUTH_COOKIE,
-    permission_uuid: str | None = None,
-    permission_id: str | None = None,  # Backwards compat - treated as scope
-    display_name: str | None = None,
-    scope: str | None = None,
-    domain: str | None = None,
+    permission_uuid: UUID = Query(...),
+    display_name: str | None = Query(None),
+    scope: str | None = Query(None),
+    domain: str | None = Query(None),
 ):
    ctx = await authz.verify(
        auth, ["auth:admin"], host=request.headers.get("host"), match=permutil.has_all
    )

-    # permission_uuid or permission_id (scope) to identify the permission
-    perm_identifier = permission_uuid or permission_id
-    if not perm_identifier:
-        raise ValueError("permission_uuid or permission_id required")
-
    # Get existing permission
-    perm = db.get_permission(perm_identifier)
+    perm = db.data().permissions.get(permission_uuid)

    # Update fields that were provided
    new_scope = scope if scope is not None else perm.scope
    new_display_name = display_name if display_name is not None else perm.display_name
    domain_value = domain if domain else None

+    # Sanity check: prevent changing the auth:admin permission scope
+    if perm.scope == "auth:admin" and new_scope != "auth:admin":
+        raise ValueError("Cannot rename the master admin permission")
+
    if not new_display_name:
        raise ValueError("display_name is required")
    querysafe.assert_safe(new_scope, field="scope")
@@ -1001,71 +874,21 @@ async def admin_update_permission(
    if perm.scope == "auth:admin" or new_scope == "auth:admin":
        _check_admin_lockout(str(perm.uuid), domain_value, request.headers.get("host"))

-    from ..db import Permission as PermDC
-
    db.update_permission(
-        PermDC(
-            uuid=perm.uuid,
-            scope=new_scope,
-            display_name=new_display_name,
-            domain=domain_value,
-        ),
+        uuid=perm.uuid,
+        scope=new_scope,
+        display_name=new_display_name,
+        domain=domain_value,
        ctx=ctx,
    )
    return {"status": "ok"}


-@app.post("/permission/rename")
-async def admin_rename_permission(
-    request: Request,
-    payload: dict = Body(...),
-    auth=AUTH_COOKIE,
-):
-    ctx = await authz.verify(
-        auth, ["auth:admin"], host=request.headers.get("host"), match=permutil.has_all
-    )
-    old_scope = payload.get("old_scope") or payload.get("old_id")  # Support both
-    new_scope = payload.get("new_scope") or payload.get("new_id")  # Support both
-    display_name = payload.get("display_name")
-    domain = payload.get(
-        "domain"
-    )  # Can be None (not provided), empty string (clear), or value
-    if not old_scope or not new_scope:
-        raise ValueError("old_scope and new_scope required")
-
-    # Sanity check: prevent renaming critical permissions
-    if old_scope == "auth:admin":
-        raise ValueError("Cannot rename the master admin permission")
-
-    querysafe.assert_safe(old_scope, field="old_scope")
-    querysafe.assert_safe(new_scope, field="new_scope")
-
-    # Get existing permission to preserve values not being changed
-    perm = db.get_permission(old_scope)
-    if display_name is None:
-        display_name = perm.display_name
-    # domain=None means "not provided, keep existing", domain="" means "clear it"
-    if domain is None:
-        domain_value = perm.domain
-    else:
-        domain_value = domain if domain else None
-    _validate_permission_domain(domain_value)
-
-    # Safety check: prevent admin lockout when setting domain on auth:admin
-    if perm.scope == "auth:admin" or new_scope == "auth:admin":
-        _check_admin_lockout(str(perm.uuid), domain_value, request.headers.get("host"))
-
-    # All current backends support rename_permission
-    db.rename_permission(old_scope, new_scope, display_name, domain_value, ctx=ctx)
-    return {"status": "ok"}
-
-
@app.delete("/permission")
 async def admin_delete_permission(
    request: Request,
+    permission_uuid: UUID = Query(...),
    auth=AUTH_COOKIE,
-    permission_uuid: str | None = None,
-    permission_id: str | None = None,  # Backwards compat - treated as scope
 ):
    ctx = await authz.verify(
        auth,
@@ -1075,17 +898,12 @@ async def admin_delete_permission(
        max_age="5m",
    )

-    perm_identifier = permission_uuid or permission_id
-    if not perm_identifier:
-        raise ValueError("permission_uuid or permission_id required")
-    querysafe.assert_safe(perm_identifier, field="permission_id")
-
    # Get the permission to check its scope
-    perm = db.get_permission(perm_identifier)
+    perm = db.data().permissions.get(permission_uuid)

    # Sanity check: prevent deleting critical permissions if it would lock out admin
    if perm.scope == "auth:admin":
        _check_admin_lockout_on_delete(str(perm.uuid), request.headers.get("host"))

-    db.delete_permission(str(perm.uuid), ctx=ctx)
+    db.delete_permission(permission_uuid, ctx=ctx)
    return {"status": "ok"}
@@ -1,6 +1,6 @@
 import logging
 from contextlib import suppress
-from datetime import datetime, timedelta, timezone
+from datetime import UTC, datetime, timedelta

 from fastapi import (
    Depends,
@@ -14,20 +14,16 @@ from fastapi.responses import JSONResponse
 from fastapi.security import HTTPBearer

 from paskia import db
-from paskia.authsession import (
-    EXPIRES,
-    get_reset,
-    get_session,
-    refresh_session_token,
-)
+from paskia.authsession import EXPIRES, expires, get_reset
 from paskia.fastapi import authz, session, user
+from paskia.fastapi.response import MsgspecResponse
 from paskia.fastapi.session import AUTH_COOKIE, AUTH_COOKIE_NAME
 from paskia.globals import passkey as global_passkey
-from paskia.util import frontend, hostutil, htmlutil, passphrase, userinfo
+from paskia.util import hostutil, htmlutil, passphrase, userinfo, vitedev

 bearer_auth = HTTPBearer(auto_error=True)

-app = FastAPI()
+app = FastAPI(docs_url=None, redoc_url=None, openapi_url=None)

 app.mount("/user", user.app)

@@ -78,16 +74,11 @@ async def validate_token(
    max_age: str | None = Query(None),
    auth=AUTH_COOKIE,
 ):
-    """Validate the current session and extend its expiry.
-
-    Always refreshes the session (sliding expiration) and re-sets the cookie with a
-    renewed max-age. This keeps active users logged in without needing a separate
-    refresh endpoint.
-    """
+    """Validate session and return context. Refreshes session expiry."""
    try:
        ctx = await authz.verify(
            auth,
-            perm,
+            " ".join(perm).split(),
            host=request.headers.get("host"),
            max_age=max_age,
        )
@@ -96,26 +87,24 @@ async def validate_token(
        raise
    renewed = False
    if auth:
-        consumed = EXPIRES - (ctx.session.expiry - datetime.now(timezone.utc))
+        consumed = EXPIRES - (ctx.session.expiry - datetime.now(UTC))
        if not timedelta(0) < consumed < _REFRESH_INTERVAL:
-            try:
-                await refresh_session_token(
-                    auth,
-                    ip=request.client.host if request.client else "",
-                    user_agent=request.headers.get("user-agent") or "",
-                )
-                session.set_session_cookie(response, auth)
-                renewed = True
-            except ValueError:
-                # Session disappeared, e.g. due to concurrent logout; global handler will clear
-                raise authz.AuthException(
-                    status_code=401, detail="Session expired", mode="login"
-                )
-    return {
-        "valid": True,
-        "user_uuid": str(ctx.session.user_uuid),
-        "renewed": renewed,
-    }
+            db.update_session(
+                auth,
+                ip=request.client.host if request.client else "",
+                user_agent=request.headers.get("user-agent") or "",
+                expiry=expires(),
+                ctx=ctx,
+            )
+            session.set_session_cookie(response, auth)
+            renewed = True
+    return MsgspecResponse(
+        {
+            "valid": True,
+            "renewed": renewed,
+            "ctx": userinfo.build_session_context(ctx),
+        }
+    )


@app.get("/forward")
@@ -142,11 +131,15 @@ async def forward_authentication(
    """
    try:
        ctx = await authz.verify(
-            auth, perm, host=request.headers.get("host"), max_age=max_age
+            auth,
+            " ".join(perm).split(),
+            host=request.headers.get("host"),
+            max_age=max_age,
+        )
+        # Build permission scopes for Remote-Groups header
+        role_permissions = (
+            {p.scope for p in ctx.permissions} if ctx.permissions else set()
        )
-        role_permissions = set(ctx.role.permissions or [])
-        if ctx.permissions:
-            role_permissions.update(permission.scope for permission in ctx.permissions)

        remote_headers: dict[str, str] = {
            "Remote-User": str(ctx.user.uuid),
@@ -157,15 +150,13 @@ async def forward_authentication(
            "Remote-Role": str(ctx.role.uuid),
            "Remote-Role-Name": ctx.role.display_name,
            "Remote-Session-Expires": (
-                ctx.session.expiry.astimezone(timezone.utc)
-                .isoformat()
-                .replace("+00:00", "Z")
+                ctx.session.expiry.astimezone(UTC).isoformat().replace("+00:00", "Z")
                if ctx.session.expiry.tzinfo
-                else ctx.session.expiry.replace(tzinfo=timezone.utc)
+                else ctx.session.expiry.replace(tzinfo=UTC)
                .isoformat()
                .replace("+00:00", "Z")
            ),
-            "Remote-Credential": str(ctx.session.credential_uuid),
+            "Remote-Credential": str(ctx.session.credential),
        }
        return Response(status_code=204, headers=remote_headers)
    except authz.AuthException as e:
@@ -180,7 +171,7 @@ async def forward_authentication(
        if wants_html:
            # Browser request - return full-page HTML with metadata
            data_attrs = {"mode": e.mode, **e.metadata}
-            html = (await frontend.read("/int/forward/index.html"))[0]
+            html = (await vitedev.read("/int/forward/index.html"))[0]
            html = htmlutil.patch_html_data_attrs(html, **data_attrs)
            return Response(
                html, status_code=e.status_code, media_type="text/html; charset=UTF-8"
@@ -207,92 +198,61 @@ async def get_settings():
    }


-@app.get("/token-info")
-async def api_token_info(token: str):
-    """Get information about a reset token.
-
-    Returns:
-        - type: "reset"
-        - user_name: display name of the user
-        - token_type: type of reset token
-    """
-    if not passphrase.is_well_formed(token):
-        raise HTTPException(status_code=404, detail="Invalid token")
-
-    # Check if this is a reset token
-    try:
-        reset_token = await get_reset(token)
-        user = db.get_user_by_uuid(reset_token.user_uuid)
-        return {
-            "type": "reset",
-            "user_name": user.display_name,
-            "token_type": reset_token.token_type,
-        }
-    except (ValueError, Exception):
-        raise HTTPException(status_code=404, detail="Token not found or expired")
-
-
@app.post("/user-info")
 async def api_user_info(
    request: Request,
    response: Response,
-    reset: str | None = None,
    auth=AUTH_COOKIE,
 ):
-    """Get user information including credentials, sessions, and permissions.
+    """Get full user profile including credentials and sessions."""
+    if auth is None:
+        raise authz.AuthException(
+            status_code=401,
+            detail="Authentication required",
+            mode="login",
+        )
+    ctx = db.data().session_ctx(auth, request.headers.get("host"))
+    if not ctx:
+        raise HTTPException(401, "Session expired")

-    Can be called with either:
-    - A session cookie (auth) for authenticated users
-    - A reset token for users in password reset flow
-    """
-    authenticated = False
-    session_record = None
-    reset_token = None
+    return MsgspecResponse(
+        await userinfo.build_user_info(
+            user_uuid=ctx.user.uuid,
+            auth=auth,
+            session_record=ctx.session,
+            request_host=request.headers.get("host"),
+        )
+    )
+
+
+@app.get("/token-info")
+async def token_info(credentials=Depends(bearer_auth)):
+    """Get reset/device-add token info. Pass token via Bearer header."""
+    token = credentials.credentials
+    if not passphrase.is_well_formed(token):
+        raise HTTPException(400, "Invalid token format")
    try:
-        if reset:
-            if not passphrase.is_well_formed(reset):
-                raise ValueError("Invalid reset token")
-            reset_token = await get_reset(reset)
-            target_user_uuid = reset_token.user_uuid
-        else:
-            if auth is None:
-                raise authz.AuthException(
-                    status_code=401,
-                    detail="Authentication required",
-                    mode="login",
-                )
-            session_record = await get_session(auth, host=request.headers.get("host"))
-            authenticated = True
-            target_user_uuid = session_record.user_uuid
+        reset_token = get_reset(token)
    except ValueError as e:
        raise HTTPException(401, str(e))

-    # Return minimal response for reset tokens
-    if not authenticated and reset_token:
-        return await userinfo.format_reset_user_info(target_user_uuid, reset_token)
-
-    # Return full user info for authenticated users
-    assert auth is not None
-    assert session_record is not None
-
-    return await userinfo.format_user_info(
-        user_uuid=target_user_uuid,
-        auth=auth,
-        session_record=session_record,
-        request_host=request.headers.get("host"),
-    )
+    u = reset_token.user
+    return {
+        "token_type": reset_token.token_type,
+        "display_name": u.display_name,
+    }


@app.post("/logout")
 async def api_logout(request: Request, response: Response, auth=AUTH_COOKIE):
    if not auth:
        return {"message": "Already logged out"}
-    try:
-        _s = await get_session(auth, host=request.headers.get("host"))
-    except ValueError:
+    host = request.headers.get("host")
+    ctx = db.data().session_ctx(auth, host)
+    if not ctx:
        return {"message": "Already logged out"}
    with suppress(Exception):
-        db.delete_session(auth)
+        db.delete_session(auth, ctx=ctx, action="logout")
    session.clear_session_cookie(response)
    return {"message": "Logged out successfully"}

@@ -301,9 +261,11 @@ async def api_logout(request: Request, response: Response, auth=AUTH_COOKIE):
 async def api_set_session(
    request: Request, response: Response, auth=Depends(bearer_auth)
 ):
-    user = await get_session(auth.credentials, host=request.headers.get("host"))
+    ctx = db.data().session_ctx(auth.credentials, request.headers.get("host"))
+    if not ctx:
+        raise HTTPException(401, "Session expired")
    session.set_session_cookie(response, auth.credentials)
    return {
        "message": "Session cookie set successfully",
-        "user_uuid": str(user.user_uuid),
+        "user": str(ctx.user.uuid),
    }
@@ -2,6 +2,7 @@ import logging

 from fastapi import HTTPException

+from paskia.fastapi.logging import log_permission_denied
 from paskia.util import permutil, sessionutil

 logger = logging.getLogger(__name__)
@@ -79,6 +80,9 @@ async def verify(
            mode="login",
            clear_session=True,
        )
+    # User's theme preference for iframe (only if explicitly set)
+    user_theme = ctx.user.theme if ctx.user.theme else None
+
    # Check max_age requirement if specified
    if max_age:
        try:
@@ -87,29 +91,27 @@ async def verify(
                    status_code=401,
                    detail="Additional authentication required",
                    mode="reauth",
+                    theme=user_theme,
                )
        except ValueError as e:
            # Invalid max_age format - log but don't fail the request
            logger.warning(f"Invalid max_age format '{max_age}': {e}")

    if not match(ctx, perm):
-        # Determine which permissions are missing for clearer diagnostics
        effective_scopes = (
            {p.scope for p in (ctx.permissions or [])}
            if ctx.permissions
            else set(ctx.role.permissions or [])
        )
        missing = sorted(set(perm) - effective_scopes)
-        logger.warning(
-            "Permission denied: user=%s role=%s missing=%s required=%s granted=%s",  # noqa: E501
-            getattr(ctx.user, "uuid", "?"),
-            getattr(ctx.role, "display_name", "?"),
-            missing,
-            perm,
-            list(effective_scopes),
+        log_permission_denied(
+            ctx, perm, missing, require_all=(match == permutil.has_all)
        )
        raise AuthException(
-            status_code=403, mode="forbidden", detail="Permission required"
+            status_code=403,
+            mode="forbidden",
+            detail="Permission required",
+            theme=user_theme,
        )

    return ctx
@@ -0,0 +1,261 @@
+"""Custom access logging middleware for FastAPI/Uvicorn."""
+
+import logging
+import sys
+import time
+from ipaddress import IPv6Address
+from typing import TYPE_CHECKING
+
+from starlette.middleware.base import BaseHTTPMiddleware
+
+if TYPE_CHECKING:
+    from paskia.db.structs import SessionContext
+from starlette.requests import Request
+from starlette.responses import Response
+
+logger = logging.getLogger("paskia.access")
+
+_RESET = "\033[0m"
+_STATUS_INFO = "\033[32m"  # 1xx (green)
+_STATUS_OK = "\033[1;92m"  # 2xx (bright green)
+_STATUS_REDIRECT = "\033[32m"  # 3xx (green)
+_STATUS_CLIENT_ERR = "\033[0;31m"  # 4xx (red)
+_STATUS_SERVER_ERR = "\033[1;91m"  # 5xx (bold bright red)
+_METHOD_READ = "\033[0;34m"  # GET, HEAD, OPTIONS (blue)
+_METHOD_WRITE = "\033[1;94m"  # POST, PUT, DELETE, PATCH (bold bright blue)
+_HOST = "\033[38;5;242m"  # hostname (dark grey)
+_PATH = "\033[38;5;250m"  # path (white)
+_TIMING = "\033[38;5;242m"  # timing/devmode (dark grey)
+_WS_OPEN = "\033[1;93m"  # WebSocket connect (bold bright yellow)
+_WS_CLOSE = "\033[33m"  # WebSocket disconnect (yellow)
+_WS_STATUS = "\033[38;5;242m"  # WebSocket close status (dark grey)
+_AUTHZ_DENIED = "\033[0;31m"  # Permission denied (red)
+_AUTHZ_USER = "\033[1;34m"  # User info (light blue)
+_AUTHZ_ORG = "\033[34m"  # User info (blue)
+_AUTHZ_NEEDS = "\033[1;38;5;231m"  # Needs (brightest white)
+_AUTHZ_MISSING = "\033[1;31m"  # Missing scope (bold red)
+_AUTHZ_GRANTED = "\033[0;32m"  # Granted scope (green)
+
+
+def format_ipv6_network(ip: str) -> str:
+    """Format IPv6 address to show only network part (first 64 bits)."""
+    try:
+        addr = IPv6Address(ip)
+        # Get the integer representation and mask to first 64 bits
+        network_int = int(addr) >> 64
+        # Format as IPv6 with trailing ::
+        # Split into 4 groups of 16 bits
+        groups = []
+        for _ in range(4):
+            groups.insert(0, format(network_int & 0xFFFF, "x"))
+            network_int >>= 16
+        # Compress consecutive zero groups
+        result = ":".join(groups) + "::"
+        # Simplify leading zeros in groups and compress, then strip trailing ::
+        return str(IPv6Address(result + "0")).removesuffix("::")
+    except Exception:
+        return ip
+
+
+def format_client_ip(ip: str) -> str:
+    """Format client IP, compressing IPv6 to network part only."""
+    if not ip or ip == "-":
+        return "-"
+    if ":" in ip:
+        return format_ipv6_network(ip)
+    return ip
+
+
+def status_color(status: int) -> str:
+    """Return color code based on HTTP status."""
+    if status < 200:
+        return _STATUS_INFO
+    if status < 300:
+        return _STATUS_OK
+    if status < 400:
+        return _STATUS_REDIRECT
+    if status < 500:
+        return _STATUS_CLIENT_ERR
+    return _STATUS_SERVER_ERR
+
+
+def method_color(method: str) -> str:
+    """Return color code based on HTTP method."""
+    if method in ("GET", "HEAD", "OPTIONS"):
+        return _METHOD_READ
+    return _METHOD_WRITE
+
+
+def format_access_log(
+    client: str, status: int, method: str, host: str, path: str, duration_ms: float
+) -> str:
+    """Format access log line with colors and aligned fields."""
+    use_color = sys.stderr.isatty()
+
+    # Format components with fixed widths for alignment
+    ip = format_client_ip(client).ljust(19)  # IPv6 network max 19 chars
+    timing = f"{duration_ms:.0f}ms"
+    method_padded = method.ljust(7)  # Longest method is OPTIONS (7)
+
+    if use_color:
+        status_str = f"{status_color(status)}{status}{_RESET}"
+        timing_str = f"{_TIMING}{timing}{_RESET}"
+        method_str = f"{method_color(method)}{method_padded}{_RESET}"
+        host_str = f"{_HOST}{host}{_RESET}"
+        path_str = f"{_PATH}{path}{_RESET}"
+    else:
+        status_str = str(status)
+        timing_str = timing
+        method_str = method_padded
+        host_str = host
+        path_str = path
+
+    # Format: "IP STATUS METHOD host path TIMING"
+    return f"{ip} {status_str} {method_str} {host_str}{path_str} {timing_str}"
+
+
+# WebSocket connection counter (mod 100)
+_ws_counter = 0
+
+
+def _next_ws_id() -> int:
+    """Get next WebSocket connection ID (0-99)."""
+    global _ws_counter
+    ws_id = _ws_counter
+    _ws_counter = (_ws_counter + 1) % 100
+    return ws_id
+
+
+def log_ws_open(ws) -> int:
+    """Log WebSocket connection open. Returns connection ID for use in close."""
+    use_color = sys.stderr.isatty()
+    ws_id = _next_ws_id()
+
+    client = ws.client.host if ws.client else "-"
+    host = ws.headers.get("host", "-")
+    path = ws.url.path
+    origin = ws.headers.get("origin")
+
+    ip = format_client_ip(client).ljust(19)
+    id_str = f"{ws_id:02d}".ljust(7)  # Align with method field (7 chars)
+
+    # Determine if origin should be shown (omit when same as host)
+    # Origin header includes scheme (e.g., "https://example.com"), compare host part
+    origin_host = origin.split("://", 1)[-1] if origin else None
+    show_origin = origin_host and origin_host != host
+
+    if use_color:
+        # 🔌 aligned with status (takes ~2 char width), ID aligned with method
+        prefix = f"🔌  {_WS_OPEN}{id_str}{_RESET}"
+        host_str = f"{_HOST}{host}{_RESET}"
+        path_str = f"{_PATH}{path}{_RESET}"
+        origin_str = (
+            f" {_RESET}from {_HOST}{origin_host}{_RESET}" if show_origin else ""
+        )
+    else:
+        prefix = f"WS+ {id_str}"
+        host_str = host
+        path_str = path
+        origin_str = f" from {origin_host}" if show_origin else ""
+
+    logger.info(f"{ip} {prefix} {host_str}{path_str}{origin_str}")
+    return ws_id
+
+
+# WebSocket close codes to human-readable status
+WS_CLOSE_CODES = {
+    1000: "ok",
+    1001: "going away",
+    1002: "protocol error",
+    1003: "unsupported",
+    1005: "no status",
+    1006: "abnormal",
+    1007: "invalid data",
+    1008: "policy violation",
+    1009: "too large",
+    1010: "extension required",
+    1011: "server error",
+    1012: "restarting",
+    1013: "try again",
+    1014: "bad gateway",
+    1015: "tls error",
+}
+
+
+def log_ws_close(ws_id: int, close_code: int | None, duration: float) -> None:
+    """Log WebSocket connection close with duration and status."""
+    use_color = sys.stderr.isatty()
+
+    id_str = f"{ws_id:02d}".ljust(7)  # Align with method field (7 chars)
+    timing = f"{duration * 1000:.0f}ms"
+
+    # Convert close code to status text
+    if close_code is None:
+        status = "closed"
+    else:
+        status = WS_CLOSE_CODES.get(close_code, f"code {close_code}")
+
+    if use_color:
+        # 🔌 aligned with status, ID aligned with method
+        prefix = f"🔌  {_WS_CLOSE}{id_str}{_RESET}"
+        status_str = f"{_WS_STATUS}{status}{_RESET}"
+        timing_str = f"{_TIMING}{timing}{_RESET}"
+    else:
+        prefix = f"WS- {id_str}"
+        status_str = status
+        timing_str = timing
+
+    logger.info(f"{' ' * 19} {prefix} {status_str} {timing_str}")
+
+
+def log_permission_denied(
+    ctx: "SessionContext", required: list[str], missing: list[str], *, require_all: bool
+) -> None:
+    """Log permission denied with org, role, user and highlighted missing scopes."""
+    missing_set = set(missing)
+    scopes = " ".join(
+        f"{_AUTHZ_MISSING}{s}✗{_RESET}"
+        if s in missing_set
+        else f"{_AUTHZ_GRANTED}{s}✓{_RESET}"
+        for s in required
+    )
+    n = "" if len(required) == 1 else " all" if require_all else " any"
+    logger.warning(
+        f"{_AUTHZ_DENIED}Permission denied{_RESET} "
+        f"{_AUTHZ_USER}{ctx.user.display_name}{_RESET} "
+        f"{_AUTHZ_ORG}({ctx.org.display_name} {ctx.role.display_name}){_RESET} "
+        f"{_AUTHZ_NEEDS}needs{n}:{_RESET} {scopes}"
+    )
+
+
+class AccessLogMiddleware(BaseHTTPMiddleware):
+    """Middleware that logs HTTP requests with custom format."""
+
+    async def dispatch(self, request: Request, call_next) -> Response:
+        start = time.perf_counter()
+        response = await call_next(request)
+        duration_ms = (time.perf_counter() - start) * 1000
+
+        client = request.client.host if request.client else "-"
+        host = request.headers.get("host", "-")
+        method = request.method
+        path = request.url.path
+        if request.url.query:
+            path = f"{path}?{request.url.query}"
+        status = response.status_code
+
+        line = format_access_log(client, status, method, host, path, duration_ms)
+        logger.info(line)
+
+        return response
+
+
+def configure_access_logging():
+    """Configure the access logger to output to stderr."""
+    handler = logging.StreamHandler(sys.stderr)
+    handler.setFormatter(logging.Formatter("%(message)s"))
+    logger.addHandler(handler)
+    logger.setLevel(logging.INFO)
+    logger.propagate = False
+    # Suppress watchfiles "X changes detected" INFO messages (keep WARNING for reload notification)
+    logging.getLogger("watchfiles.main").setLevel(logging.WARNING)
@@ -1,3 +1,4 @@
+import json
 import logging
 import os
 from contextlib import asynccontextmanager
@@ -5,11 +6,29 @@ from pathlib import Path

 from fastapi import FastAPI, HTTPException, Request, Response
 from fastapi.responses import FileResponse, RedirectResponse
-from fastapi.staticfiles import StaticFiles
+from fastapi_vue import Frontend

+from paskia import globals
+from paskia.db import start_background, stop_background
+from paskia.db.logging import configure_db_logging
 from paskia.fastapi import admin, api, auth_host, ws
+from paskia.fastapi.logging import AccessLogMiddleware, configure_access_logging
 from paskia.fastapi.session import AUTH_COOKIE
-from paskia.util import frontend, hostutil, passphrase
+from paskia.util import hostutil, passphrase, vitedev
+
+# Configure custom logging
+configure_access_logging()
+configure_db_logging()
+
+_access_logger = logging.getLogger("paskia.access")
+
+# Vue Frontend static files
+frontend = Frontend(
+    Path(__file__).parent.parent / "frontend-build",
+    cached=["/auth/assets/"],
+    favicon="/paskia.webp",
+)
+

 # Path to examples/index.html when running from source tree
 _EXAMPLES_DIR = Path(__file__).parent.parent.parent / "examples"
@@ -23,10 +42,6 @@ async def lifespan(app: FastAPI):  # pragma: no cover - startup path
    so that uvicorn reload / multiprocess workers inherit the settings.
    All keys are guaranteed to exist; values are already normalized by __main__.py.
    """
-    import json
-
-    from paskia import globals
-
    config = json.loads(os.environ["PASKIA_CONFIG"])

    try:
@@ -42,15 +57,27 @@ async def lifespan(app: FastAPI):  # pragma: no cover - startup path
        # Re-raise to fail fast
        raise

-    # Restore info level logging after startup (suppressed during uvicorn init in dev mode)
-    if frontend.is_dev_mode():
+    # Restore uvicorn info logging (suppressed during startup in dev mode)
+    # Keep uvicorn.error at WARNING to suppress WebSocket "connection open/closed" messages
+    if frontend.devmode:
        logging.getLogger("uvicorn").setLevel(logging.INFO)
-        logging.getLogger("uvicorn.access").setLevel(logging.INFO)
-
+    logging.getLogger("uvicorn.error").setLevel(logging.WARNING)
+    await frontend.load()
+    await start_background()
    yield
+    await stop_background()


-app = FastAPI(lifespan=lifespan, redirect_slashes=False)
+app = FastAPI(
+    lifespan=lifespan,
+    redirect_slashes=False,
+    docs_url=None,
+    redoc_url=None,
+    openapi_url=None,
+)
+
+# Custom access logging (uvicorn's access_log is disabled)
+app.add_middleware(AccessLogMiddleware)

 # Apply redirections to auth-host if configured (deny access to restricted endpoints, remove /auth/)
 app.middleware("http")(auth_host.redirect_middleware)
@@ -59,19 +86,11 @@ app.mount("/auth/api/admin/", admin.app)
 app.mount("/auth/api/", api.app)
 app.mount("/auth/ws/", ws.app)

-# In dev mode (PASKIA_DEVMODE=1), Vite serves assets directly; skip static files mount
-if not frontend.is_dev_mode():
-    app.mount(
-        "/auth/assets/",
-        StaticFiles(directory=frontend.file("auth", "assets")),
-        name="assets",
-    )
-

@app.get("/auth/restricted/")
 async def restricted_view():
    """Serve the restricted/authentication UI for iframe embedding."""
-    return Response(*await frontend.read("/auth/restricted/index.html"))
+    return Response(*await vitedev.read("/auth/restricted/index.html"))


 # Navigable URLs are defined here. We support both / and /auth/ as the base path
@@ -86,7 +105,7 @@ async def frontapp(request: Request, response: Response, auth=AUTH_COOKIE):
    The frontend handles mode detection (host mode vs full profile) based on settings.
    Access control is handled via APIs.
    """
-    return Response(*await frontend.read("/auth/index.html"))
+    return Response(*await vitedev.read("/auth/index.html"))


@app.get("/admin", include_in_schema=False)
@@ -117,6 +136,11 @@ async def examples_page():
    return FileResponse(index_file, media_type="text/html")


+# Frontend static files - must be before /{token} catch-all routes
+# (actual routes registered during lifespan after frontend.load())
+frontend.route(app, "/")
+
+
 # Note: this catch-all handler must be the last route defined
@app.get("/{token}")
@app.get("/auth/{token}")
@@ -128,4 +152,4 @@ async def token_link(token: str):
    if not passphrase.is_well_formed(token):
        raise HTTPException(status_code=404)

-    return Response(*await frontend.read("/int/reset/index.html"))
+    return Response(*await vitedev.read("/int/reset/index.html"))
@@ -16,13 +16,14 @@ import base64url
 from fastapi import FastAPI, WebSocket, WebSocketDisconnect

 from paskia import db, remoteauth
-from paskia.fastapi.session import infodict
+from paskia.authsession import expires
+from paskia.fastapi.session import AUTH_COOKIE, infodict
+from paskia.fastapi.wschat import authenticate_and_login
 from paskia.fastapi.wsutil import validate_origin, websocket_error_handler
-from paskia.globals import passkey
-from paskia.util import passphrase, pow
+from paskia.util import passphrase, pow, useragent

 # Create a FastAPI subapp for remote auth WebSocket endpoints
-app = FastAPI()
+app = FastAPI(docs_url=None, redoc_url=None, openapi_url=None)


@app.websocket("/request")
@@ -179,7 +180,7 @@ async def websocket_remote_auth_request(ws: WebSocket):
                        ):
                            response = {
                                "status": "authenticated",
-                                "user_uuid": str(result_data["user_uuid"]),
+                                "user": str(result_data["user_uuid"]),
                            }
                            if result_data.get("session_token"):
                                response["session_token"] = result_data["session_token"]
@@ -251,7 +252,7 @@ async def websocket_remote_auth_request(ws: WebSocket):

@app.websocket("/permit")
@websocket_error_handler
-async def websocket_remote_auth_permit(ws: WebSocket):
+async def websocket_remote_auth_permit(ws: WebSocket, auth=AUTH_COOKIE):
    """Complete a remote authentication request using a 3-word pairing code.

    This endpoint is called from the user's profile on the authenticating device.
@@ -268,9 +269,8 @@ async def websocket_remote_auth_permit(ws: WebSocket):
    6. Client sends WebAuthn response
    7. Server sends {status: "success", message: "..."}
    """
-    from paskia.util import useragent

-    origin = validate_origin(ws)
+    validate_origin(ws)

    if remoteauth.instance is None:
        raise ValueError("Remote authentication is not available")
@@ -289,7 +289,6 @@ async def websocket_remote_auth_permit(ws: WebSocket):
    )

    request = None
-    webauthn_challenge = None
    explicitly_denied = False

    try:
@@ -311,79 +310,31 @@ async def websocket_remote_auth_permit(ws: WebSocket):

            # Handle authenticate request (no PoW needed - already validated during lookup)
            if msg.get("authenticate") and request is not None:
-                # Generate authentication options
-                options, webauthn_challenge = passkey.instance.auth_generate_options(
-                    credential_ids=None
-                )
-                await ws.send_json({"optionsJSON": options})
+                ctx = await authenticate_and_login(ws, auth)

-                # Wait for WebAuthn response
-                credential = passkey.instance.auth_parse(await ws.receive_json())
-
-                # Fetch and verify credential
-                try:
-                    stored_cred = db.get_credential_by_id(credential.raw_id)
-                except ValueError:
-                    raise ValueError(
-                        f"This passkey is no longer registered with {passkey.instance.rp_name}"
-                    )
-
-                # Verify the credential
-                passkey.instance.auth_verify(
-                    credential, webauthn_challenge, stored_cred, origin
-                )
-
-                # Create a session for the REQUESTING device
-                assert stored_cred.uuid is not None
-
-                session_token = None
+                session_token = ctx.session.key
                reset_token = None

                if request.action == "register":
                    # For registration, create a reset token for device addition
-                    from paskia.authsession import expires
-                    from paskia.util import hostutil
-
                    token_str = passphrase.generate()
                    expiry = expires()
                    db.create_reset_token(
-                        user_uuid=stored_cred.user_uuid,
+                        user_uuid=ctx.user.uuid,
                        passphrase=token_str,
                        expiry=expiry,
                        token_type="device addition",
+                        user=str(ctx.user.uuid),
                    )
                    reset_token = token_str
-                    # Also create a session so the device is logged in
-                    normalized_host = hostutil.normalize_host(request.host)
-                    session_token = db.login(
-                        user_uuid=stored_cred.user_uuid,
-                        credential=stored_cred,
-                        host=normalized_host,
-                        ip=request.ip,
-                        user_agent=request.user_agent,
-                        expiry=expires(),
-                    )
-                else:
-                    # Default login action
-                    from paskia.authsession import expires
-                    from paskia.util import hostutil
-
-                    normalized_host = hostutil.normalize_host(request.host)
-                    session_token = db.login(
-                        user_uuid=stored_cred.user_uuid,
-                        credential=stored_cred,
-                        host=normalized_host,
-                        ip=request.ip,
-                        user_agent=request.user_agent,
-                        expiry=expires(),
-                    )

                # Complete the remote auth request (notifies the waiting device)
+                cred = db.data().credentials[ctx.session.credential_uuid]
                completed = await remoteauth.instance.complete_request(
                    token=request.key,
                    session_token=session_token,
-                    user_uuid=stored_cred.user_uuid,
-                    credential_uuid=stored_cred.uuid,
+                    user_uuid=ctx.user.uuid,
+                    credential_uuid=cred.uuid,
                    reset_token=reset_token,
                )

@@ -10,13 +10,11 @@ display name. If multiple users match, they are listed and the command
 aborts. A new one-time reset link is always created.
 """

-from __future__ import annotations
-
 import asyncio
 from uuid import UUID

 from paskia import authsession as _authsession
-from paskia import db as _db
+from paskia import db
 from paskia.util import hostutil, passphrase


@@ -26,23 +24,30 @@ async def _resolve_targets(query: str | None):
        targets: list[tuple] = []
        try:
            q_uuid = UUID(query)
-            perm_orgs = _db.get_permission_organizations("auth:admin")
-            for o in perm_orgs:
-                users = _db.get_organization_users(str(o.uuid))
-                for u, role_name in users:
-                    if u.uuid == q_uuid:
-                        return [(u, role_name)]
+            p = next(
+                (p for p in db.data().permissions.values() if p.scope == "auth:admin"),
+                None,
+            )
+            if p:
+                for org_uuid in p.orgs:
+                    users = db.get_organization_users(org_uuid)
+                    for u, role_name in users:
+                        if u.uuid == q_uuid:
+                            return [(u, role_name)]
            # UUID not found among admin orgs -> fall back to substring search (rare case)
        except ValueError:
            pass
        # Substring search
        needle = query.lower()
-        perm_orgs = _db.get_permission_organizations("auth:admin")
-        for o in perm_orgs:
-            users = _db.get_organization_users(str(o.uuid))
-            for u, role_name in users:
-                if needle in (u.display_name or "").lower():
-                    targets.append((u, role_name))
+        p = next(
+            (p for p in db.data().permissions.values() if p.scope == "auth:admin"), None
+        )
+        if p:
+            for org_uuid in p.orgs:
+                users = db.get_organization_users(org_uuid)
+                for u, role_name in users:
+                    if needle in (u.display_name or "").lower():
+                        targets.append((u, role_name))
        # De-duplicate
        seen = set()
        deduped = []
@@ -52,10 +57,13 @@ async def _resolve_targets(query: str | None):
                deduped.append((u, role_name))
        return deduped
    # No query -> master admin
-    perm_orgs = _db.get_permission_organizations("auth:admin")
-    if not perm_orgs:
+    p = next(
+        (p for p in db.data().permissions.values() if p.scope == "auth:admin"), None
+    )
+    if not p or not p.orgs:
        return []
-    users = _db.get_organization_users(str(perm_orgs[0].uuid))
+    first_org_uuid = next(iter(p.orgs))
+    users = db.get_organization_users(first_org_uuid)
    admin_users = [pair for pair in users if pair[1] == "Administration"]
    return admin_users[:1]

@@ -63,7 +71,7 @@ async def _resolve_targets(query: str | None):
 async def _create_reset(user, role_name: str):
    token = passphrase.generate()
    expiry = _authsession.reset_expires()
-    _db.create_reset_token(
+    db.create_reset_token(
        passphrase=token,
        user_uuid=user.uuid,
        expiry=expiry,
@@ -0,0 +1,22 @@
+"""FastAPI response utilities for msgspec.Struct serialization."""
+
+import msgspec
+from fastapi import Response
+
+
+class MsgspecResponse(Response):
+    """Response that uses msgspec for JSON encoding.
+
+    Use this for returning msgspec.Struct, dict, or list with proper serialization.
+    """
+
+    media_type = "application/json"
+
+    def __init__(
+        self,
+        content: msgspec.Struct | dict | list,
+        status_code: int = 200,
+        headers: dict | None = None,
+    ):
+        body = msgspec.json.encode(content)
+        super().__init__(content=body, status_code=status_code, headers=headers)
@@ -19,8 +19,8 @@ AUTH_COOKIE = Cookie(None, alias=AUTH_COOKIE_NAME)
 def infodict(request: Request | WebSocket, type: str) -> dict:
    """Extract client information from request."""
    return {
-        "ip": request.client.host if request.client else None,
-        "user_agent": request.headers.get("user-agent", "")[:500] or None,
+        "ip": request.client.host if request.client else "",
+        "user_agent": request.headers.get("user-agent", "")[:500],
        "session_type": type,
    }

@@ -1,4 +1,4 @@
-from datetime import timezone
+from datetime import UTC
 from uuid import UUID

 from fastapi import (
@@ -14,13 +14,12 @@ from paskia import db
 from paskia.authsession import (
    delete_credential,
    expires,
-    get_session,
 )
 from paskia.fastapi import authz, session
 from paskia.fastapi.session import AUTH_COOKIE
 from paskia.util import hostutil, passphrase

-app = FastAPI()
+app = FastAPI(docs_url=None, redoc_url=None, openapi_url=None)


@app.exception_handler(authz.AuthException)
@@ -43,18 +42,40 @@ async def user_update_display_name(
        raise authz.AuthException(
            status_code=401, detail="Authentication Required", mode="login"
        )
-    try:
-        s = await get_session(auth, host=request.headers.get("host"))
-    except ValueError as e:
+    host = request.headers.get("host")
+    ctx = db.data().session_ctx(auth, host)
+    if not ctx:
        raise authz.AuthException(
            status_code=401, detail="Session expired", mode="login"
-        ) from e
+        )
    new_name = (payload.get("display_name") or "").strip()
    if not new_name:
        raise HTTPException(status_code=400, detail="display_name required")
    if len(new_name) > 64:
        raise HTTPException(status_code=400, detail="display_name too long")
-    db.update_user_display_name(s.user_uuid, new_name)
+    db.update_user_display_name(ctx.user.uuid, new_name, ctx=ctx)
+    return {"status": "ok"}
+
+
+@app.patch("/theme")
+async def user_update_theme(
+    request: Request,
+    payload: dict = Body(...),
+    auth=AUTH_COOKIE,
+):
+    if not auth:
+        raise authz.AuthException(
+            status_code=401, detail="Authentication Required", mode="login"
+        )
+    ctx = db.data().session_ctx(auth, request.headers.get("host"))
+    if not ctx:
+        raise authz.AuthException(
+            status_code=401, detail="Session expired", mode="login"
+        )
+    theme = payload.get("theme", "")
+    if theme not in ("", "light", "dark"):
+        raise HTTPException(status_code=400, detail="Invalid theme")
+    db.update_user_theme(ctx.user.uuid, theme, ctx=ctx)
    return {"status": "ok"}


@@ -62,13 +83,13 @@ async def user_update_display_name(
 async def api_logout_all(request: Request, response: Response, auth=AUTH_COOKIE):
    if not auth:
        return {"message": "Already logged out"}
-    try:
-        s = await get_session(auth, host=request.headers.get("host"))
-    except ValueError:
+    host = request.headers.get("host")
+    ctx = db.data().session_ctx(auth, host)
+    if not ctx:
        raise authz.AuthException(
            status_code=401, detail="Session expired", mode="login"
        )
-    db.delete_sessions_for_user(s.user_uuid)
+    db.delete_sessions_for_user(ctx.user.uuid, ctx=ctx)
    session.clear_session_cookie(response)
    return {"message": "Logged out from all hosts"}

@@ -84,18 +105,18 @@ async def api_delete_session(
        raise authz.AuthException(
            status_code=401, detail="Authentication Required", mode="login"
        )
-    try:
-        current_session = await get_session(auth, host=request.headers.get("host"))
-    except ValueError as exc:
+    host = request.headers.get("host")
+    ctx = db.data().session_ctx(auth, host)
+    if not ctx:
        raise authz.AuthException(
            status_code=401, detail="Session expired", mode="login"
-        ) from exc
+        )

-    target_session = db.get_session(session_id)
-    if not target_session or target_session.user_uuid != current_session.user_uuid:
+    target_session = db.data().sessions.get(session_id)
+    if not target_session or target_session.user_uuid != ctx.user.uuid:
        raise HTTPException(status_code=404, detail="Session not found")

-    db.delete_session(session_id)
+    db.delete_session(session_id, ctx=ctx)
    current_terminated = session_id == auth
    if current_terminated:
        session.clear_session_cookie(response)  # explicit because 200
@@ -112,7 +133,7 @@ async def api_delete_credential(
    # Require recent authentication for sensitive operation
    await authz.verify(auth, [], host=request.headers.get("host"), max_age="5m")
    try:
-        await delete_credential(uuid, auth, host=request.headers.get("host"))
+        delete_credential(uuid, auth, host=request.headers.get("host"))
    except ValueError as e:
        raise authz.AuthException(
            status_code=401, detail="Session expired", mode="login"
@@ -127,28 +148,23 @@ async def api_create_link(
    auth=AUTH_COOKIE,
 ):
    # Require recent authentication for sensitive operation
-    await authz.verify(auth, [], host=request.headers.get("host"), max_age="5m")
-    try:
-        s = await get_session(auth, host=request.headers.get("host"))
-    except ValueError as e:
-        raise authz.AuthException(
-            status_code=401, detail="Session expired", mode="login"
-        ) from e
+    ctx = await authz.verify(auth, [], host=request.headers.get("host"), max_age="5m")
    token = passphrase.generate()
    expiry = expires()
    db.create_reset_token(
-        user_uuid=s.user_uuid,
+        user_uuid=ctx.user.uuid,
        passphrase=token,
        expiry=expiry,
        token_type="device addition",
+        ctx=ctx,
    )
    url = hostutil.reset_link_url(token)
    return {
        "message": "Registration link generated successfully",
        "url": url,
        "expires": (
-            expiry.astimezone(timezone.utc).isoformat().replace("+00:00", "Z")
+            expiry.astimezone(UTC).isoformat().replace("+00:00", "Z")
            if expiry.tzinfo
-            else expiry.replace(tzinfo=timezone.utc).isoformat().replace("+00:00", "Z")
+            else expiry.replace(tzinfo=UTC).isoformat().replace("+00:00", "Z")
        ),
    }
@@ -1,40 +1,21 @@
-from uuid import UUID
-
 from fastapi import FastAPI, WebSocket

 from paskia import db
-from paskia.authsession import expires, get_reset, get_session
+from paskia.authsession import get_reset
 from paskia.fastapi import authz, remote
 from paskia.fastapi.session import AUTH_COOKIE, infodict
+from paskia.fastapi.wschat import authenticate_and_login, register_chat
 from paskia.fastapi.wsutil import validate_origin, websocket_error_handler
 from paskia.globals import passkey
-from paskia.util import hostutil, passphrase
+from paskia.util import passphrase

 # Create a FastAPI subapp for WebSocket endpoints
-app = FastAPI()
+app = FastAPI(docs_url=None, redoc_url=None, openapi_url=None)

 # Mount the remote auth WebSocket endpoints
 app.mount("/remote-auth", remote.app)


-async def register_chat(
-    ws: WebSocket,
-    user_uuid: UUID,
-    user_name: str,
-    origin: str,
-    credential_ids: list[bytes] | None = None,
-):
-    """Generate registration options and send them to the client."""
-    options, challenge = passkey.instance.reg_generate_options(
-        user_id=user_uuid,
-        user_name=user_name,
-        credential_ids=credential_ids,
-    )
-    await ws.send_json({"optionsJSON": options})
-    response = await ws.receive_json()
-    return passkey.instance.reg_verify(response, challenge, user_uuid, origin=origin)
-
-
@app.websocket("/register")
@websocket_error_handler
 async def websocket_register_add(
@@ -56,7 +37,7 @@ async def websocket_register_add(
            raise ValueError(
                f"The reset link for {passkey.instance.rp_name} is invalid or has expired"
            )
-        s = await get_reset(reset)
+        s = get_reset(reset)
        user_uuid = s.user_uuid
    else:
        # Require recent authentication for adding a new passkey
@@ -65,35 +46,35 @@ async def websocket_register_add(
        s = ctx.session

    # Get user information and determine effective user_name for this registration
-    user = db.get_user_by_uuid(user_uuid)
+    user = db.data().users[user_uuid]
    user_name = user.display_name
    if name is not None:
        stripped = name.strip()
        if stripped:
            user_name = stripped
-    challenge_ids = db.get_credentials_by_user_uuid(user_uuid)
+    credential_ids = db.get_user_credential_ids(user_uuid) or None

    # WebAuthn registration
-    credential = await register_chat(ws, user_uuid, user_name, origin, challenge_ids)
+    credential = await register_chat(ws, user_uuid, user_name, origin, credential_ids)

    # Create a new session and store everything in database
    metadata = infodict(ws, "authenticated")
-    token = db.create_credential_session(  # type: ignore[attr-defined]
+    token = db.create_credential_session(
        user_uuid=user_uuid,
        credential=credential,
        reset_key=(s.key if reset is not None else None),
        display_name=user_name,
        host=host,
-        ip=metadata.get("ip"),
-        user_agent=metadata.get("user_agent"),
+        ip=metadata["ip"],
+        user_agent=metadata["user_agent"],
    )
    auth = token

    assert isinstance(auth, str) and len(auth) == 16
    await ws.send_json(
        {
-            "user_uuid": str(user.uuid),
-            "credential_uuid": str(credential.uuid),
+            "user": str(user.uuid),
+            "credential": str(credential.uuid),
            "session_token": auth,
            "message": "New credential added successfully",
        }
@@ -108,59 +89,20 @@ async def websocket_authenticate(ws: WebSocket, auth=AUTH_COOKIE):

    # If there's an existing session, restrict to that user's credentials (reauth)
    session_user_uuid = None
-    credential_ids = None
    if auth:
-        try:
-            session = await get_session(auth, host=host)
-            session_user_uuid = session.user_uuid
-            credential_ids = db.get_credentials_by_user_uuid(session_user_uuid)
-        except ValueError:
-            pass  # Invalid/expired session - allow normal authentication
+        existing_ctx = db.data().session_ctx(auth, host)
+        if existing_ctx:
+            session_user_uuid = existing_ctx.user.uuid

-    options, challenge = passkey.instance.auth_generate_options(
-        credential_ids=credential_ids
-    )
-    await ws.send_json({"optionsJSON": options})
-    # Wait for the client to use his authenticator to authenticate
-    credential = passkey.instance.auth_parse(await ws.receive_json())
-    # Fetch from the database by credential ID
-    try:
-        stored_cred = db.get_credential_by_id(credential.raw_id)
-    except ValueError:
-        raise ValueError(
-            f"This passkey is no longer registered with {passkey.instance.rp_name}"
-        )
+    ctx = await authenticate_and_login(ws, auth)

    # If reauth mode, verify the credential belongs to the session's user
-    if session_user_uuid and stored_cred.user_uuid != session_user_uuid:
+    if session_user_uuid and ctx.user.uuid != session_user_uuid:
        raise ValueError("This passkey belongs to a different account")

-    # Verify the credential matches the stored data
-    passkey.instance.auth_verify(credential, challenge, stored_cred, origin)
-
-    # Create session and update user/credential in a single transaction
-    assert stored_cred.uuid is not None
-    metadata = infodict(ws, "auth")
-    normalized_host = hostutil.normalize_host(host)
-    if not normalized_host:
-        raise ValueError("Host required for session creation")
-    hostname = normalized_host.split(":")[0]
-    rp_id = passkey.instance.rp_id
-    if not (hostname == rp_id or hostname.endswith(f".{rp_id}")):
-        raise ValueError(f"Host must be the same as or a subdomain of {rp_id}")
-
-    token = db.login(
-        user_uuid=stored_cred.user_uuid,
-        credential=stored_cred,
-        host=normalized_host,
-        ip=metadata.get("ip") or "",
-        user_agent=metadata.get("user_agent") or "",
-        expiry=expires(),
-    )
-
    await ws.send_json(
        {
-            "user_uuid": str(stored_cred.user_uuid),
-            "session_token": token,
+            "user": str(ctx.user.uuid),
+            "session_token": ctx.session.key,
        }
    )
@@ -0,0 +1,115 @@
+"""
+WebSocket chat functions for WebAuthn registration and authentication flows.
+"""
+
+from uuid import UUID
+
+from fastapi import WebSocket
+
+from paskia import db
+from paskia.authsession import expires
+from paskia.db import Credential, SessionContext
+from paskia.fastapi.session import infodict
+from paskia.fastapi.wsutil import validate_origin
+from paskia.globals import passkey
+from paskia.util import hostutil
+
+
+async def register_chat(
+    ws: WebSocket,
+    user_uuid: UUID,
+    user_name: str,
+    origin: str,
+    credential_ids: list[bytes] | None = None,
+):
+    """Run WebAuthn registration flow and return the verified credential."""
+    options, challenge = passkey.instance.reg_generate_options(
+        user_id=user_uuid,
+        user_name=user_name,
+        credential_ids=credential_ids,
+    )
+    await ws.send_json({"optionsJSON": options})
+    response = await ws.receive_json()
+    return passkey.instance.reg_verify(response, challenge, user_uuid, origin=origin)
+
+
+async def authenticate_chat(
+    ws: WebSocket,
+    credential_ids: list[bytes] | None = None,
+) -> tuple[Credential, int]:
+    """Run WebAuthn authentication flow and return the credential and new sign count.
+
+    Returns:
+        tuple of (credential, new_sign_count) where new_sign_count comes from WebAuthn verification
+    """
+    origin = validate_origin(ws)
+    options, challenge = passkey.instance.auth_generate_options(
+        credential_ids=credential_ids
+    )
+    await ws.send_json({"optionsJSON": options})
+    authcred = passkey.instance.auth_parse(await ws.receive_json())
+
+    cred = next(
+        (
+            c
+            for c in db.data().credentials.values()
+            if c.credential_id == authcred.raw_id
+        ),
+        None,
+    )
+    if not cred:
+        raise ValueError(
+            f"This passkey is no longer registered with {passkey.instance.rp_name}"
+        )
+
+    verification = passkey.instance.auth_verify(authcred, challenge, cred, origin)
+    return cred, verification.new_sign_count
+
+
+async def authenticate_and_login(
+    ws: WebSocket,
+    auth: str | None = None,
+) -> SessionContext:
+    """Run WebAuthn authentication flow, create session, and return the session context.
+
+    If auth is provided, restrict authentication to credentials of that session's user.
+
+    Returns:
+        SessionContext for the authenticated session
+    """
+    origin = validate_origin(ws)
+    host = origin.split("://", 1)[1]
+    normalized_host = hostutil.normalize_host(host)
+    if not normalized_host:
+        raise ValueError("Host required for session creation")
+    hostname = normalized_host.split(":")[0]
+    rp_id = passkey.instance.rp_id
+    if not (hostname == rp_id or hostname.endswith(f".{rp_id}")):
+        raise ValueError(f"Host must be the same as or a subdomain of {rp_id}")
+    metadata = infodict(ws, "auth")
+
+    # Get credential IDs if restricting to a user's credentials
+    credential_ids = None
+    if auth:
+        existing_ctx = db.data().session_ctx(auth, host)
+        if existing_ctx:
+            credential_ids = db.get_user_credential_ids(existing_ctx.user.uuid) or None
+
+    cred, new_sign_count = await authenticate_chat(ws, credential_ids)
+
+    # Create session and update user/credential
+    token = db.login(
+        user_uuid=cred.user_uuid,
+        credential_uuid=cred.uuid,
+        sign_count=new_sign_count,
+        host=normalized_host,
+        ip=metadata["ip"],
+        user_agent=metadata["user_agent"],
+        expiry=expires(),
+    )
+
+    # Fetch and return the full session context
+    ctx = db.data().session_ctx(token, normalized_host)
+    if not ctx:
+        raise ValueError("Failed to create session context")
+    return ctx
@@ -3,6 +3,7 @@ Shared WebSocket utilities for FastAPI endpoints.
 """

 import logging
+import time
 from functools import wraps

 import base64url
@@ -10,6 +11,7 @@ from fastapi import WebSocket, WebSocketDisconnect
 from webauthn.helpers.exceptions import InvalidAuthenticationResponse

 from paskia.fastapi import authz
+from paskia.fastapi.logging import log_ws_close, log_ws_open
 from paskia.globals import passkey
 from paskia.util import pow

@@ -19,11 +21,15 @@ def websocket_error_handler(func):

    @wraps(func)
    async def wrapper(ws: WebSocket, *args, **kwargs):
+        start = time.perf_counter()
+        ws_id = log_ws_open(ws)
+        close_code = None
+
        try:
            await ws.accept()
            return await func(ws, *args, **kwargs)
-        except WebSocketDisconnect:
-            pass
+        except WebSocketDisconnect as e:
+            close_code = e.code
        except authz.AuthException as e:
            await ws.send_json(
                {
@@ -36,6 +42,8 @@ def websocket_error_handler(func):
        except Exception:
            logging.exception("Internal Server Error")
            await ws.send_json({"status": 500, "detail": "Internal Server Error"})
+        finally:
+            log_ws_close(ws_id, close_code, time.perf_counter() - start)

    return wrapper

@@ -1,5 +1,7 @@
 from typing import Generic, TypeVar

+from paskia import db, remoteauth
+from paskia.bootstrap import bootstrap_if_needed
 from paskia.sansio import Passkey

 T = TypeVar("T")
@@ -42,7 +44,6 @@ async def init(
        Set PASKIA_DB environment variable to specify the JSONL database file path.
        Default: paskia.jsonl
    """
-    from . import db, remoteauth

    # Initialize passkey instance with provided parameters
    passkey.instance = Passkey(
@@ -59,7 +60,6 @@ async def init(

    if bootstrap:
        # Bootstrap system if needed
-        from .bootstrap import bootstrap_if_needed

        await bootstrap_if_needed()

@@ -11,13 +11,28 @@ Or via the CLI entry point (if installed):
    paskia-migrate --sql sqlite+aiosqlite:///paskia.sqlite --json paskia.jsonl
 """

+import argparse
 import asyncio
-from datetime import datetime, timezone
+import re
+from datetime import UTC, datetime
 from uuid import UUID

 import base64url
+import uuid7
+from sqlalchemy import select

 from paskia.authsession import EXPIRES
+from paskia.db.jsonl import JsonlStore
+from paskia.db.structs import (
+    DB,
+    Credential,
+    Org,
+    Permission,
+    ResetToken,
+    Role,
+    Session,
+    User,
+)

 from .sql import (
    DB as SQLDB,
@@ -47,30 +62,14 @@ async def migrate_from_sql(
        sql_db_path: SQLAlchemy connection string for the source SQL database
        json_db_path: Path for the destination JSONL file
    """
-    # Import here to avoid circular imports and to not require JSON db at import time
-    import re
-
-    import uuid7
-    from sqlalchemy import select
-
-    from paskia.db.operations import DB as JSONDB
-    from paskia.db.structs import (
-        _CredentialData,
-        _OrgData,
-        _PermissionData,
-        _ResetTokenData,
-        _RoleData,
-        _SessionData,
-        _UserData,
-    )
-
    # Initialize source SQL database
    sql_db = SQLDB(sql_db_path)
    await sql_db.init_db()

    # Initialize destination JSON database (fresh, don't load existing)
-    json_db = JSONDB(json_db_path)
-    # Don't call json_db.load() - we want a fresh database, not to load existing
+    db = DB()
+    store = JsonlStore(db, json_db_path)
+    db._store = store

    print(f"Migrating from {sql_db_path} to {json_db_path}...")

@@ -90,11 +89,13 @@ async def migrate_from_sql(
    # Migrate permissions with UUID keys and scope field
    # Always create exactly one common auth:org:admin permission for all org admin needs
    org_admin_perm_uuid: UUID = uuid7.create()
-    json_db._data.permissions[org_admin_perm_uuid] = _PermissionData(
+    org_admin_perm = Permission(
        scope="auth:org:admin",
        display_name="Org Admin",
        orgs={},
    )
+    org_admin_perm.uuid = org_admin_perm_uuid
+    db.permissions[org_admin_perm_uuid] = org_admin_perm

    # Mapping from old permission ID to new permission UUID
    perm_id_to_uuid: dict[str, UUID] = {}
@@ -113,11 +114,13 @@ async def migrate_from_sql(

        # Regular permission - create with UUID key
        perm_uuid: UUID = uuid7.create()
-        json_db._data.permissions[perm_uuid] = _PermissionData(
+        new_perm = Permission(
            scope=perm.id,  # Old ID becomes the scope
            display_name=perm.display_name,
            orgs={},
        )
+        new_perm.uuid = perm_uuid
+        db.permissions[perm_uuid] = new_perm
        perm_id_to_uuid[perm.id] = perm_uuid
    print(
        f"  Migrated {len(permissions)} permissions (with {len(org_admin_uuids)} org-specific admins consolidated to auth:org:admin)"
@@ -127,16 +130,16 @@ async def migrate_from_sql(
    orgs = await sql_db.list_organizations()
    for org in orgs:
        org_key: UUID = org.uuid
-        json_db._data.orgs[org_key] = _OrgData(
-            display_name=org.display_name,
-        )
+        new_org = Org(display_name=org.display_name)
+        new_org.uuid = org_key
+        db.orgs[org_key] = new_org
        # Update permissions to allow this org to grant them (by UUID)
        for old_perm_id in org.permissions:
            perm_uuid = perm_id_to_uuid.get(old_perm_id)
-            if perm_uuid and perm_uuid in json_db._data.permissions:
-                json_db._data.permissions[perm_uuid].orgs[org_key] = True
+            if perm_uuid and perm_uuid in db.permissions:
+                db.permissions[perm_uuid].orgs[org_key] = True
        # Ensure every org can grant auth:org:admin
-        json_db._data.permissions[org_admin_perm_uuid].orgs[org_key] = True
+        db.permissions[org_admin_perm_uuid].orgs[org_key] = True
    print(f"  Migrated {len(orgs)} organizations")

    # Migrate roles - convert old permission IDs to UUIDs
@@ -150,11 +153,13 @@ async def migrate_from_sql(
                perm_uuid = perm_id_to_uuid.get(old_perm_id)
                if perm_uuid:
                    new_permissions[perm_uuid] = True
-            json_db._data.roles[role_key] = _RoleData(
-                org=role.org_uuid,
+            new_role = Role(
+                org_uuid=role.org_uuid,
                display_name=role.display_name,
                permissions=new_permissions,
            )
+            new_role.uuid = role_key
+            db.roles[role_key] = new_role
            role_count += 1
    print(f"  Migrated {role_count} roles")

@@ -163,15 +168,17 @@ async def migrate_from_sql(
        result = await session.execute(select(UserModel))
        user_models = result.scalars().all()
        for um in user_models:
-            user = um.as_dataclass()
-            user_key: UUID = user.uuid
-            json_db._data.users[user_key] = _UserData(
-                display_name=user.display_name,
-                role=user.role_uuid,
-                created_at=user.created_at or datetime.now(timezone.utc),
-                last_seen=user.last_seen,
-                visits=user.visits,
+            legacy_user = um.as_dataclass()
+            user_key: UUID = legacy_user.uuid
+            new_user = User(
+                display_name=legacy_user.display_name,
+                role_uuid=legacy_user.role_uuid,
+                created_at=legacy_user.created_at or datetime.now(UTC),
+                last_seen=legacy_user.last_seen,
+                visits=legacy_user.visits,
            )
+            new_user.uuid = user_key
+            db.users[user_key] = new_user
        print(f"  Migrated {len(user_models)} users")

    # Migrate credentials
@@ -179,18 +186,20 @@ async def migrate_from_sql(
        result = await session.execute(select(CredentialModel))
        cred_models = result.scalars().all()
        for cm in cred_models:
-            cred = cm.as_dataclass()
-            cred_key: UUID = cred.uuid
-            json_db._data.credentials[cred_key] = _CredentialData(
-                credential_id=cred.credential_id,
-                user=cred.user_uuid,
-                aaguid=cred.aaguid,
-                public_key=cred.public_key,
-                sign_count=cred.sign_count,
-                created_at=cred.created_at,
-                last_used=cred.last_used,
-                last_verified=cred.last_verified,
+            legacy_cred = cm.as_dataclass()
+            cred_key: UUID = legacy_cred.uuid
+            new_cred = Credential(
+                credential_id=legacy_cred.credential_id,
+                user_uuid=legacy_cred.user_uuid,
+                aaguid=legacy_cred.aaguid,
+                public_key=legacy_cred.public_key,
+                sign_count=legacy_cred.sign_count,
+                created_at=legacy_cred.created_at,
+                last_used=legacy_cred.last_used,
+                last_verified=legacy_cred.last_verified,
            )
+            new_cred.uuid = cred_key
+            db.credentials[cred_key] = new_cred
        print(f"  Migrated {len(cred_models)} credentials")

    # Migrate sessions
@@ -207,9 +216,9 @@ async def migrate_from_sql(
            else:
                # Already in new format or unknown - try to use as-is
                session_key = base64url.enc(old_key[:12])
-            json_db._data.sessions[session_key] = _SessionData(
-                user=sess.user_uuid,
-                credential=sess.credential_uuid,
+            db.sessions[session_key] = Session(
+                user_uuid=sess.user_uuid,
+                credential_uuid=sess.credential_uuid,
                host=sess.host,
                ip=sess.ip,
                user_agent=sess.user_agent,
@@ -231,26 +240,24 @@ async def migrate_from_sql(
            else:
                # Already in new format or unknown - truncate to 9 bytes
                token_key = old_key[:9]
-            json_db._data.reset_tokens[token_key] = _ResetTokenData(
-                user=token.user_uuid,
+            db.reset_tokens[token_key] = ResetToken(
+                user_uuid=token.user_uuid,
                expiry=token.expiry,
                token_type=token.token_type,
            )
        print(f"  Migrated {len(token_models)} reset tokens")

-    # Queue and flush all changes with actor "migrate"
-    json_db._current_actor = "migrate"
-    json_db._queue_change()
-    from paskia.db.jsonl import flush_changes
+    # Queue and flush all changes using the transaction mechanism
+    with db.transaction("migrate:sql"):
+        pass  # All data already added to _data, transaction commits on exit

-    await flush_changes(json_db.db_path, json_db._pending_changes)
+    await store.flush()

    print("Migration complete!")


 def main():
    """CLI entry point for migration."""
-    import argparse

    parser = argparse.ArgumentParser(
        description="Migrate Paskia database from SQL to JSON"
@@ -9,7 +9,7 @@ DO NOT use this module for new code. Use paskia.db instead.

 from contextlib import asynccontextmanager
 from dataclasses import dataclass
-from datetime import datetime, timezone
+from datetime import UTC, datetime
 from uuid import UUID

 from sqlalchemy import (
@@ -25,13 +25,81 @@ from sqlalchemy.dialects.sqlite import BLOB
 from sqlalchemy.ext.asyncio import async_sessionmaker, create_async_engine
 from sqlalchemy.orm import DeclarativeBase, Mapped, mapped_column

-from paskia.db import (
-    Credential,
-    Org,
-    ResetToken,
-    Role,
-    User,
-)
+
+# Legacy User class for SQL schema (uses 'role_uuid' not 'role')
+@dataclass
+class _LegacyUser:
+    """User as stored in the old SQL schema with role_uuid field."""
+
+    uuid: UUID
+    display_name: str
+    role_uuid: UUID
+    created_at: datetime | None = None
+    last_seen: datetime | None = None
+    visits: int = 0
+
+
+# Legacy Credential class for SQL schema (uses 'user_uuid' not 'user')
+@dataclass
+class _LegacyCredential:
+    """Credential as stored in the old SQL schema with user_uuid field."""
+
+    uuid: UUID
+    credential_id: bytes
+    user_uuid: UUID
+    aaguid: UUID
+    public_key: bytes
+    sign_count: int
+    created_at: datetime
+    last_used: datetime | None = None
+    last_verified: datetime | None = None
+
+
+# Legacy Role class for SQL schema (uses 'org_uuid' not 'org')
+@dataclass
+class _LegacyRole:
+    """Role as stored in the old SQL schema with org_uuid field."""
+
+    uuid: UUID
+    org_uuid: UUID
+    display_name: str
+    permissions: list[str] | None = None
+
+
+# Legacy Org class for SQL schema (has mutable permissions/roles lists)
+@dataclass
+class _LegacyOrg:
+    """Org as stored in the old SQL schema with mutable permissions/roles."""
+
+    uuid: UUID
+    display_name: str
+    permissions: list[str] | None = None
+    roles: list[_LegacyRole] | None = None
+
+
+# Legacy Session class for SQL schema (uses 'key' as field, 'user_uuid', 'credential_uuid')
+@dataclass
+class _LegacySession:
+    """Session as stored in the old SQL schema."""
+
+    key: bytes
+    user_uuid: UUID
+    credential_uuid: UUID
+    host: str
+    ip: str
+    user_agent: str
+    renewed: datetime
+
+
+# Legacy ResetToken class for SQL schema (uses 'key' as field, 'user_uuid')
+@dataclass
+class _LegacyResetToken:
+    """ResetToken as stored in the old SQL schema."""
+
+    key: bytes
+    user_uuid: UUID
+    token_type: str
+    expiry: datetime


 # Local Permission class for SQL schema (uses 'id' not 'uuid' + 'scope')
@@ -46,26 +114,12 @@ class SqlPermission:
 DB_PATH_DEFAULT = "sqlite+aiosqlite:///paskia.sqlite"


-# Local Session class for SQL schema (uses 'renewed' not 'expiry')
-@dataclass
-class _SqlSession:
-    """Session as stored in the old SQL schema with renewed timestamp."""
-
-    key: bytes
-    user_uuid: UUID
-    credential_uuid: UUID
-    host: str
-    ip: str
-    user_agent: str
-    renewed: datetime
-
-
 def _normalize_dt(value: datetime | None) -> datetime | None:
    if value is None:
        return None
    if value.tzinfo is None:
-        return value.replace(tzinfo=timezone.utc)
-    return value.astimezone(timezone.utc)
+        return value.replace(tzinfo=UTC)
+    return value.astimezone(UTC)


 class Base(DeclarativeBase):
@@ -80,10 +134,13 @@ class OrgModel(Base):

    def as_dataclass(self):
        # Base Org without permissions/roles (filled by data accessors)
-        return Org(UUID(bytes=self.uuid), self.display_name)
+        return _LegacyOrg(
+            uuid=UUID(bytes=self.uuid),
+            display_name=self.display_name,
+        )

    @staticmethod
-    def from_dataclass(org: Org):
+    def from_dataclass(org: _LegacyOrg):
        return OrgModel(uuid=org.uuid.bytes, display_name=org.display_name)


@@ -98,14 +155,14 @@ class RoleModel(Base):

    def as_dataclass(self):
        # Base Role without permissions (filled by data accessors)
-        return Role(
+        return _LegacyRole(
            uuid=UUID(bytes=self.uuid),
            org_uuid=UUID(bytes=self.org_uuid),
            display_name=self.display_name,
        )

    @staticmethod
-    def from_dataclass(role: Role):
+    def from_dataclass(role: _LegacyRole):
        return RoleModel(
            uuid=role.uuid.bytes,
            org_uuid=role.org_uuid.bytes,
@@ -122,15 +179,15 @@ class UserModel(Base):
        LargeBinary(16), ForeignKey("roles.uuid", ondelete="CASCADE"), nullable=False
    )
    created_at: Mapped[datetime] = mapped_column(
-        DateTime(timezone=True), default=lambda: datetime.now(timezone.utc)
+        DateTime(timezone=True), default=lambda: datetime.now(UTC)
    )
    last_seen: Mapped[datetime | None] = mapped_column(
        DateTime(timezone=True), nullable=True
    )
    visits: Mapped[int] = mapped_column(Integer, nullable=False, default=0)

-    def as_dataclass(self) -> User:
-        return User(
+    def as_dataclass(self) -> "_LegacyUser":
+        return _LegacyUser(
            uuid=UUID(bytes=self.uuid),
            display_name=self.display_name,
            role_uuid=UUID(bytes=self.role_uuid),
@@ -140,12 +197,12 @@ class UserModel(Base):
        )

    @staticmethod
-    def from_dataclass(user: User):
+    def from_dataclass(user: "_LegacyUser"):
        return UserModel(
            uuid=user.uuid.bytes,
            display_name=user.display_name,
            role_uuid=user.role_uuid.bytes,
-            created_at=user.created_at or datetime.now(timezone.utc),
+            created_at=user.created_at or datetime.now(UTC),
            last_seen=user.last_seen,
            visits=user.visits,
        )
@@ -165,7 +222,7 @@ class CredentialModel(Base):
    public_key: Mapped[bytes] = mapped_column(BLOB, nullable=False)
    sign_count: Mapped[int] = mapped_column(Integer, nullable=False)
    created_at: Mapped[datetime] = mapped_column(
-        DateTime(timezone=True), default=lambda: datetime.now(timezone.utc)
+        DateTime(timezone=True), default=lambda: datetime.now(UTC)
    )
    last_used: Mapped[datetime | None] = mapped_column(
        DateTime(timezone=True), nullable=True
@@ -175,7 +232,7 @@ class CredentialModel(Base):
    )

    def as_dataclass(self):
-        return Credential(
+        return _LegacyCredential(
            uuid=UUID(bytes=self.uuid),
            credential_id=self.credential_id,
            user_uuid=UUID(bytes=self.user_uuid),
@@ -205,12 +262,12 @@ class SessionModel(Base):
    user_agent: Mapped[str] = mapped_column(String(512), nullable=False)
    renewed: Mapped[datetime] = mapped_column(
        DateTime(timezone=True),
-        default=lambda: datetime.now(timezone.utc),
+        default=lambda: datetime.now(UTC),
        nullable=False,
    )

    def as_dataclass(self):
-        return _SqlSession(
+        return _LegacySession(
            key=self.key,
            user_uuid=UUID(bytes=self.user_uuid),
            credential_uuid=UUID(bytes=self.credential_uuid),
@@ -221,7 +278,7 @@ class SessionModel(Base):
        )

    @staticmethod
-    def from_dataclass(session: _SqlSession):
+    def from_dataclass(session: _LegacySession):
        return SessionModel(
            key=session.key,
            user_uuid=session.user_uuid.bytes,
@@ -243,8 +300,8 @@ class ResetTokenModel(Base):
    token_type: Mapped[str] = mapped_column(String, nullable=False)
    expiry: Mapped[datetime] = mapped_column(DateTime(timezone=True), nullable=False)

-    def as_dataclass(self) -> ResetToken:
-        return ResetToken(
+    def as_dataclass(self) -> _LegacyResetToken:
+        return _LegacyResetToken(
            key=self.key,
            user_uuid=UUID(bytes=self.user_uuid),
            token_type=self.token_type,
@@ -338,7 +395,7 @@ class DB:
            result = await session.execute(select(PermissionModel))
            return [p.as_dataclass() for p in result.scalars().all()]

-    async def list_organizations(self) -> list[Org]:
+    async def list_organizations(self) -> list[_LegacyOrg]:
        async with self.session() as session:
            # Load all orgs
            orgs_result = await session.execute(select(OrgModel))
@@ -365,13 +422,13 @@ class DB:
                perms_by_role.setdefault(rp.role_uuid, []).append(rp.permission_id)

            # Build org dataclasses with roles and permission IDs
-            roles_by_org: dict[bytes, list[Role]] = {}
+            roles_by_org: dict[bytes, list[_LegacyRole]] = {}
            for rm in role_models:
                r_dc = rm.as_dataclass()
                r_dc.permissions = perms_by_role.get(rm.uuid, [])
                roles_by_org.setdefault(rm.org_uuid, []).append(r_dc)

-            orgs: list[Org] = []
+            orgs: list[_LegacyOrg] = []
            for om in org_models:
                o_dc = om.as_dataclass()
                o_dc.permissions = perms_by_org.get(om.uuid, [])
@@ -19,12 +19,12 @@ The first 3 words of the token serve as the pairing code for manual entry.

 import asyncio
 import logging
+from collections.abc import Callable
 from dataclasses import dataclass
-from datetime import datetime, timedelta, timezone
-from typing import Callable
+from datetime import UTC, datetime, timedelta
 from uuid import UUID

-from paskia.util import passphrase
+from paskia.util import passphrase, pow

 # Remote auth requests expire after this duration
 REMOTE_AUTH_LIFETIME = timedelta(minutes=5)
@@ -94,7 +94,7 @@ class RemoteAuthManager:

    async def _cleanup_expired(self):
        """Remove expired requests and notify waiting clients."""
-        now = datetime.now(timezone.utc)
+        now = datetime.now(UTC)
        expired_keys = []
        async with self._lock:
            for key, req in self._requests.items():
@@ -123,7 +123,7 @@ class RemoteAuthManager:
        Returns:
            (code, expiry) - The 3-word passphrase code and expiration time
        """
-        now = datetime.now(timezone.utc)
+        now = datetime.now(UTC)
        expiry = now + REMOTE_AUTH_LIFETIME

        async with self._lock:
@@ -160,7 +160,7 @@ class RemoteAuthManager:
            req = self._requests.get(normalized)
            if req is None:
                return None
-            now = datetime.now(timezone.utc)
+            now = datetime.now(UTC)
            if now > req.created_at + REMOTE_AUTH_LIFETIME:
                # Expired
                del self._requests[normalized]
@@ -319,7 +319,6 @@ class RemoteAuthManager:
        Returns:
            PoW work units (pow.NORMAL or pow.HARD)
        """
-        from paskia.util import pow

        count = self.get_connection_count()
        return pow.HARD if count >= 10 else pow.NORMAL
@@ -332,7 +331,7 @@ class RemoteAuthManager:
            req = self._requests.get(token)
            if req is None:
                return None
-            now = datetime.now(timezone.utc)
+            now = datetime.now(UTC)
            if now > req.created_at + REMOTE_AUTH_LIFETIME:
                del self._requests[token]
                return None
@@ -8,11 +8,9 @@ This module provides a unified interface for WebAuthn operations including:
 """

 import json
-from datetime import datetime, timezone
 from urllib.parse import urlparse
 from uuid import UUID

-import uuid7
 from webauthn import (
    generate_authentication_options,
    generate_registration_options,
@@ -176,14 +174,12 @@ class Passkey:
            expected_origin=origin,
            expected_rp_id=self.rp_id,
        )
-        return Credential(
-            uuid=uuid7.create(),
+        return Credential.create(
            credential_id=credential.raw_id,
-            user_uuid=user_uuid,
+            user=user_uuid,
            aaguid=UUID(registration.aaguid),
            public_key=registration.credential_public_key,
            sign_count=registration.sign_count,
-            created_at=datetime.now(timezone.utc),
        )

    ### Authentication Methods ###
@@ -234,8 +230,11 @@ class Passkey:
        Args:
            credential: The authentication credential response from the client
            expected_challenge: The earlier generated challenge bytes
-            stored_cred: The server stored credential record (modified by this function)
+            stored_cred: The server stored credential record (NOT modified)
            origin: The origin URL (required, must be pre-validated)
+
+        Returns:
+            VerifiedAuthentication with new_sign_count and user_verified status
        """
        # Verify the authentication response
        verification = verify_authentication_response(
@@ -246,11 +245,6 @@ class Passkey:
            credential_public_key=stored_cred.public_key,
            credential_current_sign_count=stored_cred.sign_count,
        )
-        stored_cred.sign_count = verification.new_sign_count
-        now = datetime.now(timezone.utc)
-        stored_cred.last_used = now
-        if verification.user_verified:
-            stored_cred.last_verified = now
        return verification


@@ -0,0 +1,110 @@
+"""API response utilities using msgspec for JSON serialization.
+
+msgspec handles UUID and datetime conversion automatically.
+API structs inherit from db structs with kw_only=True to add uuid/key fields.
+"""
+
+from datetime import UTC, datetime
+from uuid import UUID
+
+import msgspec
+
+from paskia.db.structs import Org, Permission, Role, User
+from paskia.util import useragent
+
+
+def _utc_datetime(dt: datetime | None) -> datetime | None:
+    """Convert datetime to UTC, handling both aware and naive datetimes."""
+    if dt is None:
+        return None
+    if dt.tzinfo:
+        return dt.astimezone(UTC)
+    return dt.replace(tzinfo=UTC)
+
+
+def format_datetime(dt: datetime | None) -> str | None:
+    """Format a datetime to ISO 8601 string with Z suffix for UTC."""
+    if dt is None:
+        return None
+    utc_dt = _utc_datetime(dt)
+    return utc_dt.isoformat().replace("+00:00", "Z") if utc_dt else None
+
+
+# -------------------------------------------------------------------------
+# API structs - inherit from db structs, add uuid for serialization
+# -------------------------------------------------------------------------
+
+
+class ApiUser(User, kw_only=True):
+    """User with uuid serialized."""
+
+    uuid: UUID
+
+    @classmethod
+    def from_db(cls, u: User) -> "ApiUser":
+        return cls(uuid=u.uuid, **msgspec.structs.asdict(u))
+
+
+class ApiOrg(Org, kw_only=True):
+    """Org with uuid serialized."""
+
+    uuid: UUID
+
+    @classmethod
+    def from_db(cls, o: Org) -> "ApiOrg":
+        return cls(uuid=o.uuid, **msgspec.structs.asdict(o))
+
+
+class ApiRole(Role, kw_only=True):
+    """Role with uuid serialized."""
+
+    uuid: UUID
+
+    @classmethod
+    def from_db(cls, r: Role) -> "ApiRole":
+        return cls(uuid=r.uuid, **msgspec.structs.asdict(r))
+
+
+class ApiPermission(Permission, kw_only=True):
+    """Permission with uuid serialized."""
+
+    uuid: UUID
+
+    @classmethod
+    def from_db(cls, p: Permission) -> "ApiPermission":
+        return cls(uuid=p.uuid, **msgspec.structs.asdict(p))
+
+
+class ApiSession(msgspec.Struct):
+    """Session for API responses with computed fields."""
+
+    id: str
+    credential_uuid: UUID = msgspec.field(name="credential")
+    host: str
+    ip: str
+    user_agent: str
+    last_renewed: datetime
+    is_current: bool = False
+    is_current_host: bool = False
+
+    @classmethod
+    def from_db(
+        cls,
+        s,  # Session
+        *,
+        current_key: str,
+        normalized_host: str | None,
+        expires_delta,  # timedelta
+    ) -> "ApiSession":
+        return cls(
+            id=s.key,
+            credential_uuid=s.credential_uuid,
+            host=s.host,
+            ip=s.ip,
+            user_agent=useragent.compact_user_agent(s.user_agent),
+            last_renewed=s.expiry - expires_delta,
+            is_current=s.key == current_key,
+            is_current_host=bool(
+                normalized_host and s.host and s.host == normalized_host
+            ),
+        )
@@ -11,7 +11,7 @@ __all__ = ["path", "file", "read", "is_dev_mode"]

 def _get_dev_server() -> str | None:
    """Get the dev server URL from environment, or None if not in dev mode."""
-    return os.environ.get("PASKIA_DEVMODE") or None
+    return os.environ.get("FASTAPI_VUE_FRONTEND_URL") or None


 def _resolve_static_dir() -> Path:
@@ -3,7 +3,7 @@
 import json
 import os
 from functools import lru_cache
-from urllib.parse import urlsplit
+from urllib.parse import urlparse, urlsplit


@lru_cache(maxsize=1)
@@ -24,7 +24,6 @@ def dedicated_auth_host() -> str | None:
    auth_host = _load_config().get("auth_host")
    if not auth_host:
        return None
-    from urllib.parse import urlparse

    parsed = urlparse(auth_host if "://" in auth_host else f"//{auth_host}")
    return parsed.netloc or parsed.path or None
@@ -40,4 +40,4 @@ async def session_context(auth: str | None, host: str | None = None):
    if not auth:
        return None
    normalized_host = normalize_host(host) if host else None
-    return db.get_session_context(auth, normalized_host)
+    return db.data().session_ctx(auth, normalized_host)
@@ -1,6 +1,6 @@
 """Utility functions for session validation and checking."""

-from datetime import datetime, timezone
+from datetime import UTC, datetime

 from paskia.authsession import EXPIRES
 from paskia.db import SessionContext
@@ -34,5 +34,5 @@ def check_session_age(ctx: SessionContext, max_age: str | None) -> bool:
    else:
        auth_time = ctx.session.expiry - EXPIRES

-    time_since_auth = datetime.now(timezone.utc) - auth_time
+    time_since_auth = datetime.now(UTC) - auth_time
    return time_since_auth <= max_age_delta
@@ -1,6 +1,7 @@
 """Startup configuration box formatting utilities."""

 import os
+import re
 from sys import stderr
 from typing import TYPE_CHECKING

@@ -11,12 +12,26 @@ if TYPE_CHECKING:

 BOX_WIDTH = 60  # Inner width (excluding box chars)

+# ANSI color codes
+RESET = "\033[0m"
+YELLOW = "\033[33m"  # Dark yellow
+BRIGHT_YELLOW = "\033[93m"  # Bright yellow
+BRIGHT_WHITE = "\033[1;37m"  # Bold bright white
+
+
+def _visible_len(text: str) -> int:
+    """Calculate visible length of text, ignoring ANSI escape codes."""
+    return len(re.sub(r"\033\[[0-9;]*m", "", text))
+

 def line(text: str = "") -> str:
    """Format a line inside the box with proper padding, truncating if needed."""
-    if len(text) > BOX_WIDTH:
+    visible = _visible_len(text)
+    if visible > BOX_WIDTH:
        text = text[: BOX_WIDTH - 1] + "…"
-    return f"┃ {text:<{BOX_WIDTH}} ┃\n"
+        visible = BOX_WIDTH
+    padding = BOX_WIDTH - visible
+    return f"┃ {text}{' ' * padding} ┃\n"


 def top() -> str:
@@ -29,19 +44,32 @@ def bottom() -> str:

 def print_startup_config(config: "PaskiaConfig") -> None:
    """Print server configuration on startup."""
+    # Key graphic with yellow shading (bright for highlights, dark for body)
+    Y = YELLOW  # Dark yellow for main body
+    B = BRIGHT_YELLOW  # Bright yellow for highlights/edges
+    W = BRIGHT_WHITE  # Bold white for URL
+    R = RESET
+
    lines = [top()]
-    lines.append(line(" ▄▄▄▄▄"))
-    lines.append(line("█     █ Paskia " + __version__))
-    lines.append(line("█     █▄▄▄▄▄▄▄▄▄▄▄▄"))
-    lines.append(line("█     █▀▀▀▀█▀▀█▀▀█    " + config.site_url + config.site_path))
-    lines.append(line(" ▀▀▀▀▀"))
+    lines.append(line(f" {B}▄▄▄▄▄{R}"))
+    lines.append(line(f"{B}█{Y}     {B}█{R} Paskia " + __version__))
+    lines.append(line(f"{B}█{Y}     {B}█{Y}▄▄▄▄▄▄▄▄▄▄▄▄{R}"))
+    lines.append(
+        line(
+            f"{B}█{Y}     {B}█{Y}▀▀▀▀{B}█{Y}▀▀{B}█{Y}▀▀{B}█{R}    {W}"
+            + config.site_url
+            + config.site_path
+            + R
+        )
+    )
+    lines.append(line(f" {Y}▀▀▀▀▀{R}"))

    # Format auth host section
    if config.auth_host:
        lines.append(line(f"Auth Host:      {config.auth_host}"))

    # Show frontend URL if in dev mode
-    devmode = os.environ.get("PASKIA_DEVMODE")
+    devmode = os.environ.get("FASTAPI_VUE_FRONTEND_URL")
    if devmode:
        lines.append(line(f"Dev Frontend:   {devmode}"))

@@ -1,145 +1,63 @@
 """User information formatting and retrieval logic."""

-from datetime import timezone
-
 from paskia import aaguid, db
 from paskia.authsession import EXPIRES
-from paskia.util import hostutil, permutil, useragent
+from paskia.db import SessionContext
+from paskia.util import hostutil, permutil
+from paskia.util.apistructs import ApiSession


-def _format_datetime(dt):
-    """Format a datetime object to ISO 8601 string with UTC timezone."""
-    if dt is None:
-        return None
-    if dt.tzinfo:
-        return dt.astimezone(timezone.utc).isoformat().replace("+00:00", "Z")
-    else:
-        return dt.replace(tzinfo=timezone.utc).isoformat().replace("+00:00", "Z")
+def build_session_context(ctx: SessionContext) -> dict:
+    """Build session context dict from SessionContext."""
+    result = {
+        "user": {"uuid": ctx.user.uuid, "display_name": ctx.user.display_name},
+        "org": {"uuid": ctx.org.uuid, "display_name": ctx.org.display_name},
+        "role": {"uuid": ctx.role.uuid, "display_name": ctx.role.display_name},
+        "permissions": [p.scope for p in ctx.permissions],
+    }
+    if ctx.user.theme:
+        result["user"]["theme"] = ctx.user.theme
+    return result


-async def format_user_info(
+async def build_user_info(
    *,
    user_uuid,
    auth: str,
    session_record,
    request_host: str | None,
 ) -> dict:
-    """Format complete user information for authenticated users.
-
-    Args:
-        user_uuid: UUID of the user to fetch information for
-        auth: Authentication token
-        session_record: Current session record
-        request_host: Host header from the request
-
-    Returns:
-        Dictionary containing formatted user information including:
-        - User details
-        - Organization and role information
-        - Credentials list
-        - Sessions list
-        - Permissions
-    """
-    u = db.get_user_by_uuid(user_uuid)
+    """Build user info dict for authenticated users."""
    ctx = await permutil.session_context(auth, request_host)
+    user = db.data().users[user_uuid]
+    normalized_host = hostutil.normalize_host(request_host)

-    # Fetch and format credentials
-    user_credentials = db.get_credentials_by_user_uuid(user_uuid)
-    credentials: list[dict] = []
-    user_aaguids: set[str] = set()
-
-    for c in user_credentials:
-        aaguid_str = str(c.aaguid)
-        user_aaguids.add(aaguid_str)
-        credentials.append(
+    credentials = sorted(user.credentials, key=lambda c: c.created_at)
+    return {
+        "ctx": build_session_context(ctx),
+        "created_at": ctx.user.created_at,
+        "last_seen": ctx.user.last_seen,
+        "visits": ctx.user.visits,
+        "credentials": [
            {
-                "credential_uuid": str(c.uuid),
-                "aaguid": aaguid_str,
-                "created_at": _format_datetime(c.created_at),
-                "last_used": _format_datetime(c.last_used),
-                "last_verified": _format_datetime(c.last_verified),
+                "credential": c.uuid,
+                "aaguid": c.aaguid,
+                "created_at": c.created_at,
+                "last_used": c.last_used,
+                "last_verified": c.last_verified,
                "sign_count": c.sign_count,
-                "is_current_session": session_record.credential_uuid == c.uuid,
+                "is_current_session": session_record.credential == c.uuid,
            }
-        )
-
-    credentials.sort(key=lambda cred: cred["created_at"])
-    aaguid_info = aaguid.filter(user_aaguids)
-
-    # Format role and org information
-    role_info = None
-    org_info = None
-    effective_permissions: list[str] = []
-
-    if ctx:
-        role_info = {
-            "uuid": str(ctx.role.uuid),
-            "display_name": ctx.role.display_name,
-            "permissions": ctx.role.permissions,
-        }
-        org_info = {
-            "uuid": str(ctx.org.uuid),
-            "display_name": ctx.org.display_name,
-            "permissions": ctx.org.permissions,
-        }
-        effective_permissions = [p.scope for p in (ctx.permissions or [])]
-
-    # Format sessions
-    normalized_request_host = hostutil.normalize_host(request_host)
-    session_records = db.list_sessions_for_user(user_uuid)
-    current_session_key = auth
-    sessions_payload: list[dict] = []
-
-    for entry in session_records:
-        sessions_payload.append(
-            {
-                "id": entry.key,
-                "credential_uuid": str(entry.credential_uuid),
-                "host": entry.host,
-                "ip": entry.ip,
-                "user_agent": useragent.compact_user_agent(entry.user_agent),
-                "last_renewed": _format_datetime(entry.expiry - EXPIRES),
-                "is_current": entry.key == current_session_key,
-                "is_current_host": bool(
-                    normalized_request_host
-                    and entry.host
-                    and entry.host == normalized_request_host
-                ),
-            }
-        )
-
-    return {
-        "authenticated": True,
-        "user": {
-            "user_uuid": str(u.uuid),
-            "user_name": u.display_name,
-            "created_at": _format_datetime(u.created_at),
-            "last_seen": _format_datetime(u.last_seen),
-            "visits": u.visits,
-        },
-        "org": org_info,
-        "role": role_info,
-        "permissions": effective_permissions,
-        "credentials": credentials,
-        "aaguid_info": aaguid_info,
-        "sessions": sessions_payload,
-    }
-
-
-async def format_reset_user_info(user_uuid, reset_token) -> dict:
-    """Format minimal user information for reset token requests.
-
-    Args:
-        user_uuid: UUID of the user
-        reset_token: Reset token record
-
-    Returns:
-        Dictionary with minimal user info for password reset flow
-    """
-    u = db.get_user_by_uuid(user_uuid)
-
-    return {
-        "authenticated": False,
-        "session_type": reset_token.token_type,
-        "user": {"user_uuid": str(u.uuid), "user_name": u.display_name},
+            for c in credentials
+        ],
+        "aaguid_info": aaguid.filter(c.aaguid for c in credentials),
+        "sessions": [
+            ApiSession.from_db(
+                s,
+                current_key=auth,
+                normalized_host=normalized_host,
+                expires_delta=EXPIRES,
+            )
+            for s in user.sessions
+        ],
    }
@@ -0,0 +1,71 @@
+"""Vite dev server proxy for fetching frontend files during development.
+
+In dev mode (FASTAPI_VUE_FRONTEND_URL set), fetches files from Vite.
+In production, reads from the static build directory.
+
+This complements fastapi_vue.Frontend which handles static file serving
+but doesn't provide server-side fetching of HTML content.
+"""
+
+import asyncio
+import mimetypes
+import os
+from importlib import resources
+from pathlib import Path
+
+import httpx
+
+__all__ = ["read"]
+
+
+def _get_dev_server() -> str | None:
+    """Get the dev server URL from environment, or None if not in dev mode."""
+    return os.environ.get("FASTAPI_VUE_FRONTEND_URL") or None
+
+
+def _resolve_static_dir() -> Path:
+    """Resolve the static files directory."""
+
+    # Try packaged path via importlib.resources (works for wheel/installed).
+    try:  # pragma: no cover - trivial path resolution
+        pkg_dir = resources.files("paskia") / "frontend-build"
+        fs_path = Path(str(pkg_dir))
+        if fs_path.is_dir():
+            return fs_path
+    except Exception:  # pragma: no cover - defensive
+        pass
+    # Fallback for editable/development before build.
+    return Path(__file__).parent.parent / "frontend-build"
+
+
+_static_dir: Path = _resolve_static_dir()
+
+
+async def read(filepath: str) -> tuple[bytes, int, dict[str, str]]:
+    """Read file content and return response tuple.
+
+    In dev mode, fetches from the Vite dev server.
+    In production, reads from the static build directory.
+
+    Args:
+        filepath: Path relative to frontend root, e.g. "/auth/index.html"
+
+    Returns:
+        Tuple of (content, status_code, headers) suitable for
+        FastAPI Response(*args).
+    """
+    dev_server = _get_dev_server()
+    if dev_server:
+        async with httpx.AsyncClient() as client:
+            resp = await client.get(f"{dev_server}{filepath}")
+            resp.raise_for_status()
+            mime = resp.headers.get("content-type", "application/octet-stream")
+            # Strip charset suffix if present
+            mime = mime.split(";")[0].strip()
+            return resp.content, resp.status_code, {"content-type": mime}
+    else:
+        # Production: read from static build
+        file_path = _static_dir / filepath.lstrip("/")
+        content = await asyncio.to_thread(file_path.read_bytes)
+        mime, _ = mimetypes.guess_type(str(file_path))
+        return content, 200, {"content-type": mime or "application/octet-stream"}
@@ -22,8 +22,9 @@ dependencies = [
    "jsondiff>=2.2.1",
    "msgspec>=0.20.0",
    "aiofiles>=25.1.0",
+    "fastapi-vue>=0.3.0",
 ]
-requires-python = ">=3.10"
+requires-python = ">=3.11"

 [project.urls]
 Homepage = "https://git.zi.fi/LeoVasanko/paskia"
@@ -73,12 +74,8 @@ filterwarnings = [
    "ignore::DeprecationWarning",
 ]

-[tool.ruff]
-target-version = "py39"
-line-length = 88
-
 [tool.ruff.lint]
-select = ["E", "F", "I", "N", "W", "UP"]
+select = ["E", "F", "I", "N", "W", "UP", "PLC0415"]
 ignore = ["E501"]  # Line too long
 isort.known-first-party = ["paskia"]

@@ -99,3 +96,5 @@ paskia-migrate = "paskia.migrate:main"
 [tool.hatch.build]
 artifacts = ["paskia/frontend-build"]
 targets.sdist.hooks.custom.path = "scripts/build-frontend.py"
+packages = ["paskia"]
+only-packages = true
@@ -1,43 +1,43 @@
-import shutil
+"""Hatch build hook for building paskia-js and Vue frontend during package build."""
+
 import subprocess
 from pathlib import Path
 from sys import stderr

-from hatchling.builders.hooks.plugin.interface import BuildHookInterface
+from hatchling.builders.hooks.plugin.interface import BuildHookInterface  # type: ignore
+
+# Import utilities from fastapi-vue
+exec(Path(__file__).parent.joinpath("fastapi-vue", "util.py").read_text("UTF-8"))  # noqa: S102


 def run(cmd, **kwargs):
+    """Run a command and display it."""
    display_cmd = [Path(cmd[0]).name, *cmd[1:]]
    stderr.write(f"### {' '.join(display_cmd)}\n")
    subprocess.run(cmd, check=True, **kwargs)


-def find_build_tool():
-    install = [
-        ("deno", "install", "--allow-scripts=npm:vue-demi"),
-        ("npm", "install"),
-        ("bun", "--bun", "install"),
-    ]
-
-    build = [
-        ("deno", "task", "build"),
-        ("npm", "run", "build"),
-        ("bun", "--bun", "run", "build"),
-    ]
-
-    for i, b in zip(install, build, strict=False):
-        if tool := shutil.which(i[0]):
-            return [tool, *i[1:]], [tool, *b[1:]]
-
-    raise RuntimeError("Deno, npm or Bun is required for building but none was found")
-
-
 class CustomBuildHook(BuildHookInterface):
+    """Build hook that compiles paskia-js and Vue frontend before packaging."""
+
    def initialize(self, version, build_data):
        super().initialize(version, build_data)
-        stderr.write(">>> Building the frontend\n")
+        stderr.write(">>> Building paskia-js library\n")

-        install_cmd, build_cmd = find_build_tool()
+        install_cmd, build_cmd = find_build_tool()  # noqa: F821 # type: ignore
+
+        try:
+            # Install dependencies for paskia-js
+            run(install_cmd, cwd="paskia-js")
+            stderr.write("\n")
+            # Build paskia-js
+            run(build_cmd, cwd="paskia-js")
+            stderr.write("\n")
+        except Exception as e:
+            stderr.write(f"Error occurred while building paskia-js: {e}\n")
+            raise
+
+        stderr.write(">>> Building the frontend\n")

        try:
            run(install_cmd, cwd="frontend")
@@ -0,0 +1,277 @@
+#!/usr/bin/env -S uv run
+# auto-upgrade@fastapi-vue-setup - remove this if you modify this file
+"""Run Vite development server for frontend and FastAPI backend with auto-reload.
+
+Usage:
+    uv run scripts/devserver.py [host:port] [--backend host:port]
+
+The optional host:port argument sets where the Vite frontend listens.
+Supported forms: host[:port], :port (all interfaces), or just port.
+The --backend option sets where the FastAPI backend listens (default: localhost:5180).
+
+Environment:
+    JS_RUNTIME          Path or name of JS runtime to use (deno, npm/node or bun).
+    FASTAPI_VUE_FRONTEND_URL    Set by this script for the backend to know where Vite is.
+"""
+
+import argparse
+import asyncio
+import contextlib
+import os
+from pathlib import Path
+from sys import stderr
+
+import httpx
+from fastapi_vue.hostutil import parse_endpoint
+
+exec((Path(__file__).parent / "fastapi-vue/util.py").read_text("UTF-8"))  # noqa: S102
+
+DEFAULT_VITE_PORT = 5173
+DEFAULT_BACKEND_PORT = 5180
+FRONTEND_PATH = Path(__file__).parent.parent / "frontend"
+
+EPILOG = """
+  scripts/devserver.py                       # Default ports on localhost
+  scripts/devserver.py 3000                  # Vite on localhost:3000
+  scripts/devserver.py :3000 --backend 8000  # *:3000, localhost:8000
+"""
+
+BUN_BUG = """\
+┃ ⚠️  Bun cannot correctly proxy API requests to the backend.
+┃ Bug report: https://github.com/oven-sh/bun/issues/9882
+┃
+┃ Consider using deno or npm instead for development.
+"""
+
+
+def resolve_frontend_tools(
+    vite_port: int, all_ifaces: bool
+) -> tuple[list[str], list[str], str]:
+    """Resolve frontend install and dev commands.
+
+    Returns (install_cmd, dev_cmd, tool_name).
+    Raises SystemExit if tools are not available.
+    """
+    if not (FRONTEND_PATH / "package.json").exists():
+        stderr.write(f"┃ ⚠️  Frontend source not found at {FRONTEND_PATH}\n")
+        raise SystemExit(1)
+
+    result = find_js_runtime()  # noqa # type: ignore
+    if result is None:
+        if not os.environ.get("JS_RUNTIME"):
+            stderr.write("┃ ⚠️  deno, npm or bun needed to run the frontend server.\n")
+        raise SystemExit(1)
+
+    tool, name = result
+
+    install_args = {
+        "deno": ("install", "--quiet", "--allow-scripts=npm:vue-demi"),
+        "npm": ("install", "--silent"),
+        "bun": ("install", "--silent"),
+    }
+    dev_args = {
+        "deno": ("run", "dev", "--"),
+        "npm": ("--silent", "run", "dev", "--"),
+        "bun": ("run", "dev", "--"),
+    }
+
+    install_cmd = [tool, *install_args[name]]
+    dev_cmd = [
+        tool,
+        *dev_args[name],
+        "--clearScreen=false",
+        f"--port={vite_port}",
+    ]
+
+    if all_ifaces:
+        dev_cmd.append("--host")
+
+    if name == "bun":
+        stderr.write(BUN_BUG)
+
+    return install_cmd, dev_cmd, name
+
+
+async def wait_for_backend(host: str, port: int):
+    """Wait for the backend to be ready by polling the health endpoint."""
+    max_attempts = 50
+    url = f"http://{host}:{port}"
+
+    async with httpx.AsyncClient() as client:
+        for attempt in range(max_attempts):
+            try:
+                await client.get(url, timeout=1.0)
+                stderr.write("✓ Backend ready!\n")
+                return True
+            except httpx.RequestError:
+                if attempt == max_attempts - 1:
+                    stderr.write("┃ ⚠️  Backend didn't start in time\n")
+                    return False
+                await asyncio.sleep(0.1)
+    return False
+
+
+async def _terminate_process(proc: asyncio.subprocess.Process, name: str) -> None:
+    """Gracefully terminate a subprocess."""
+    if proc.returncode is not None:
+        return
+    try:
+        proc.terminate()
+    except ProcessLookupError:
+        return
+    try:
+        await asyncio.wait_for(proc.wait(), timeout=2)
+    except TimeoutError:
+        try:
+            proc.kill()
+        except ProcessLookupError:
+            return
+        await proc.wait()
+
+
+async def run_devserver(
+    vite_port: int,
+    all_ifaces: bool,
+    backend_host: str,
+    backend_port: int,
+) -> None:
+    """Run the development server with install, backend, and frontend."""
+    install_cmd, dev_cmd, tool_name = resolve_frontend_tools(vite_port, all_ifaces)
+
+    # Tell the backend where the Vite dev server is
+    os.environ["FASTAPI_VUE_FRONTEND_URL"] = f"http://localhost:{vite_port}"
+    # Tell Vite where the backend is (for proxying /api requests)
+    os.environ["FASTAPI_VUE_BACKEND_URL"] = f"http://{backend_host}:{backend_port}"
+
+    backend_cmd = [
+        "uvicorn",
+        "paskia.app:app",
+        "--host",
+        backend_host,
+        "--port",
+        str(backend_port),
+        "--reload",
+    ]
+
+    cwd = str(Path(__file__).parent.parent)
+    frontend_cwd = str(FRONTEND_PATH)
+
+    backend_proc: asyncio.subprocess.Process | None = None
+    install_proc: asyncio.subprocess.Process | None = None
+    frontend_proc: asyncio.subprocess.Process | None = None
+
+    try:
+        # Start install (concurrent with backend)
+        stderr.write(f">>> {tool_name} {' '.join(install_cmd[1:])}\n")
+        install_proc = await asyncio.create_subprocess_exec(
+            *install_cmd, cwd=frontend_cwd
+        )
+
+        await asyncio.sleep(0.1)
+
+        # Start backend (concurrent with install)
+        stderr.write(f">>> {' '.join(backend_cmd)}\n")
+        backend_proc = await asyncio.create_subprocess_exec(*backend_cmd, cwd=cwd)
+
+        # Wait for install to complete and backend to be ready
+        install_task = asyncio.create_task(install_proc.wait(), name="install")
+        backend_ready_task = asyncio.create_task(
+            wait_for_backend(backend_host, backend_port), name="backend_ready"
+        )
+
+        done, pending = await asyncio.wait(
+            {install_task, backend_ready_task},
+            return_when=asyncio.FIRST_COMPLETED,
+        )
+
+        for task in done:
+            if task.get_name() == "install":
+                if task.result() != 0:
+                    stderr.write("┃ ⚠️  Install failed\n")
+                    raise SystemExit(1)
+            elif task.get_name() == "backend_ready" and not task.result():
+                raise SystemExit(1)
+
+        if pending:
+            done2, _ = await asyncio.wait(pending)
+            for task in done2:
+                if task.get_name() == "install":
+                    if task.result() != 0:
+                        stderr.write("┃ ⚠️  Install failed\n")
+                        raise SystemExit(1)
+                elif task.get_name() == "backend_ready" and not task.result():
+                    raise SystemExit(1)
+
+        install_proc = None
+
+        # Start Vite dev server
+        stderr.write(f">>> {tool_name} {' '.join(dev_cmd[1:])}\n")
+        frontend_proc = await asyncio.create_subprocess_exec(*dev_cmd, cwd=frontend_cwd)
+
+        # Wait for either process to exit
+        done, pending = await asyncio.wait(
+            {
+                asyncio.create_task(backend_proc.wait(), name="backend"),
+                asyncio.create_task(frontend_proc.wait(), name="frontend"),
+            },
+            return_when=asyncio.FIRST_COMPLETED,
+        )
+        for t in done:
+            t.result()
+        for t in pending:
+            t.cancel()
+
+    except asyncio.CancelledError:
+        stderr.write("\n✓ Shutting down...\n")
+    finally:
+        if frontend_proc is not None:
+            await _terminate_process(frontend_proc, "frontend")
+        if install_proc is not None:
+            await _terminate_process(install_proc, "install")
+        if backend_proc is not None:
+            await _terminate_process(backend_proc, "backend")
+
+
+def main():
+    parser = argparse.ArgumentParser(
+        description="Run Vite and FastAPI development servers",
+        formatter_class=argparse.RawDescriptionHelpFormatter,
+        epilog=EPILOG,
+    )
+    parser.add_argument(
+        "frontend",
+        nargs="?",
+        metavar="host:port",
+        help="Vite frontend endpoint (default: localhost:5173)",
+    )
+    parser.add_argument(
+        "--backend",
+        metavar="host:port",
+        help="FastAPI backend endpoint (default: localhost:5180)",
+    )
+    args = parser.parse_args()
+
+    # parse_endpoint returns list of dicts with host/port or uds keys
+    # Multiple entries means bind all interfaces (IPv4 + IPv6)
+    vite_endpoints = parse_endpoint(args.frontend, DEFAULT_VITE_PORT)
+    backend_endpoints = parse_endpoint(args.backend, DEFAULT_BACKEND_PORT)
+
+    # Vite doesn't support unix sockets
+    if "uds" in vite_endpoints[0]:
+        stderr.write("┃ ⚠️  Unix sockets not supported for frontend\n")
+        raise SystemExit(1)
+    if "uds" in backend_endpoints[0]:
+        stderr.write("┃ ⚠️  Unix sockets not supported for backend\n")
+        raise SystemExit(1)
+
+    vite_port = vite_endpoints[0]["port"]
+    all_ifaces = len(vite_endpoints) > 1
+    backend_host = backend_endpoints[0]["host"]
+    backend_port = backend_endpoints[0]["port"]
+
+    with contextlib.suppress(KeyboardInterrupt):
+        asyncio.run(run_devserver(vite_port, all_ifaces, backend_host, backend_port))
+
+
+if __name__ == "__main__":
+    main()
@@ -6,12 +6,17 @@ not from the installed package. It starts both the Vite frontend dev server
 and the FastAPI backend with auto-reload enabled.

 Usage:
-    uv run scripts/dev.py [host:port] [options...]
+    uv run scripts/devserver.py [-l host:port] [options...]

-The optional host:port argument sets where the Vite frontend listens.
-All other options are forwarded to `paskia serve`.
+The optional -l/--listen argument sets where the Vite frontend listens.
+All other options are forwarded to `paskia`.
 Backend always listens on localhost:4402.

+Environment:
+    FASTAPI_VUE_FRONTEND_URL    Set by this script for the backend to know where Vite is.
+    FASTAPI_VUE_BACKEND_URL     Set by this script for Vite to know where to proxy API calls.
+    PASKIA_SITE_URL             User-facing URL for reset links (Caddy HTTPS or Vite HTTP).
+
 Options:
    --caddy         Run Caddy as HTTPS proxy on port 443 (requires sudo)
    --rp-id HOST    Relying Party ID (used as hostname for Caddy)
@@ -119,7 +124,11 @@ def parse_endpoint(


 def run_vite(
-    vite_url: str, vite_host: str | None, vite_port: int, auth_host: str | None = None
+    vite_url: str,
+    vite_host: str | None,
+    vite_port: int,
+    env: dict,
+    auth_host: str | None = None,
 ):
    """Spawn the frontend dev server (deno, npm, or bunx) as a background process."""
    devpath = Path(__file__).parent.parent / "frontend"
@@ -162,7 +171,7 @@ def run_vite(

            full_cmd = cmd + vite_args
            stderr.write(f">>> {' '.join([tool_name, *full_cmd[1:]])}\n")
-            vite_env = os.environ.copy()
+            vite_env = env.copy()
            if auth_host:
                vite_env["PASKIA_AUTH_HOST"] = auth_host
            vite_process = subprocess.Popen(
@@ -367,9 +376,15 @@ def run_caddy(origins: list[str], vite_port: int) -> subprocess.Popen | None:


 def main():
-    # Parse optional hostport argument for Vite frontend
+    # Parse optional listen argument for Vite frontend
    parser = argparse.ArgumentParser(add_help=False)
-    parser.add_argument("hostport", nargs="?", default=None)
+    parser.add_argument(
+        "-l",
+        "--listen",
+        metavar="ENDPOINT",
+        default=None,
+        help="Vite frontend endpoint (default: localhost:4403)",
+    )
    parser.add_argument("--caddy", action="store_true", help="Run Caddy as HTTPS proxy")
    parser.add_argument("--rp-id", default="localhost", help="Relying Party ID")
    parser.add_argument(
@@ -380,7 +395,7 @@ def main():

    # Parse Vite endpoint
    vite_host, vite_port, vite_uds, all_ifaces = parse_endpoint(
-        args.hostport, DEFAULT_VITE_PORT
+        args.listen, DEFAULT_VITE_PORT
    )

    if vite_uds:
@@ -391,7 +406,7 @@ def main():
    if all_ifaces:
        vite_host = "0.0.0.0"

-    # Build Vite URL for PASKIA_DEVMODE (always use localhost for URL)
+    # Build Vite URL for FASTAPI_VUE_FRONTEND_URL (always use localhost for URL)
    vite_url = f"http://localhost:{vite_port}"

    # Compute origins for Caddy (user-specified or auto-generated)
@@ -424,15 +439,21 @@ def main():
        if not run_caddy(caddy_origins, vite_port):
            raise SystemExit(1)

-    # Start Vite dev server
-    run_vite(vite_url, vite_host, vite_port, args.auth_host)
-
-    # Set dev mode with Vite URL in environment for subprocess
+    # Set dev mode env vars for subprocesses (fastapi-vue convention)
    env = os.environ.copy()
-    env["PASKIA_DEVMODE"] = vite_url
+    env["FASTAPI_VUE_FRONTEND_URL"] = vite_url
+    env["FASTAPI_VUE_BACKEND_URL"] = f"http://localhost:{BACKEND_PORT}"
+    # User-facing URL: Caddy HTTPS when running, else Vite HTTP
+    if args.caddy:
+        env["PASKIA_SITE_URL"] = caddy_origins[0]  # auth-host or https://{rp-id}
+    else:
+        env["PASKIA_SITE_URL"] = vite_url
+
+    # Start Vite dev server
+    run_vite(vite_url, vite_host, vite_port, env, args.auth_host)

    # Build command with origin args
-    cmd = ["paskia", "serve", f"localhost:{BACKEND_PORT}"]
+    cmd = ["paskia", "-l", f"localhost:{BACKEND_PORT}"]

    # Pass through rp-id (always pass, has default)
    cmd.extend(["--rp-id", args.rp_id])
@@ -0,0 +1,34 @@
+"""Hatch build hook for building Vue frontend during package build."""
+
+import subprocess
+from pathlib import Path
+from sys import stderr
+
+from hatchling.builders.hooks.plugin.interface import BuildHookInterface  # type: ignore
+
+exec(Path(__file__).with_name("util.py").read_text("UTF-8"))  # noqa: S102
+
+
+def run(cmd, **kwargs):
+    """Run a command and display it."""
+    display_cmd = [Path(cmd[0]).name, *cmd[1:]]
+    stderr.write(f"### {' '.join(display_cmd)}\n")
+    subprocess.run(cmd, check=True, **kwargs)
+
+
+class CustomBuildHook(BuildHookInterface):
+    """Build hook that compiles Vue frontend before packaging."""
+
+    def initialize(self, version, build_data):
+        super().initialize(version, build_data)
+        stderr.write(">>> Building the frontend\n")
+
+        install_cmd, build_cmd = find_build_tool()  # noqa # type: ignore
+
+        try:
+            run(install_cmd, cwd="frontend")
+            stderr.write("\n")
+            run(build_cmd, cwd="frontend")
+        except Exception as e:
+            stderr.write(f"Error occurred while building frontend: {e}\n")
+            raise
@@ -0,0 +1,87 @@
+"""Shared utilities for build and dev scripts."""
+
+import os
+import shutil
+from pathlib import Path
+from sys import stderr
+
+
+def find_js_runtime() -> tuple[str, str] | None:
+    """Find a JavaScript runtime from JS_RUNTIME env or auto-detect.
+
+    Returns (tool_path, tool_name) where tool_name is "deno", "npm", or "bun".
+    Returns None if no runtime is found.
+    """
+    options = ["deno", "npm", "bun"]
+
+    # Check for JS_RUNTIME environment variable
+    if js_runtime_env := os.environ.get("JS_RUNTIME"):
+        js_runtime = js_runtime_env
+        js_path = Path(js_runtime)
+        runtime_name = js_path.name
+        # Map node to npm
+        if runtime_name == "node":
+            runtime_name = "npm"
+            js_runtime = str(js_path.parent / "npm") if js_path.parent.name else "npm"
+        for option in options:
+            if option == runtime_name or runtime_name.startswith(option):
+                tool = shutil.which(js_runtime)
+                if tool is None:
+                    stderr.write(f"┃ ⚠️  JS_RUNTIME={js_runtime_env} not found\n")
+                    return None
+                return tool, option
+        stderr.write(f"┃ ⚠️  JS_RUNTIME={js_runtime_env} not recognized\n")
+        return None
+
+    # Auto-detect
+    for option in options:
+        if tool := shutil.which(option):
+            return tool, option
+    return None
+
+
+def find_build_tool():
+    """Find JavaScript runtime and construct install/build commands.
+
+    Returns (install_cmd, build_cmd) tuples of command lists.
+    Raises RuntimeError if no runtime is found.
+    """
+    install = {
+        "deno": ("install", "--allow-scripts=npm:vue-demi"),
+        "npm": ("install",),
+        "bun": ("--bun", "install"),
+    }
+    # Run vite directly for deno to avoid npm-run-all2/run-p issues
+    build = {
+        "deno": ("run", "-A", "npm:vite", "build"),
+        "npm": ("run", "build"),
+        "bun": ("--bun", "run", "build"),
+    }
+
+    result = find_js_runtime()
+    if result is None:
+        raise RuntimeError(
+            "Deno, npm or Bun is required for building but none was found"
+        )
+
+    tool, name = result
+    return [tool, *install[name]], [tool, *build[name]]
+
+
+def find_dev_tool():
+    """Find JavaScript runtime and construct dev command.
+
+    Returns (dev_cmd, tool_name) or (None, None) if not found.
+    """
+    dev_args = {
+        "deno": ("run", "dev", "--"),
+        "npm": ("--silent", "run", "dev", "--"),
+        "bun": ("run", "dev", "--"),
+    }
+
+    result = find_js_runtime()
+    if result is None:
+        return None, None
+
+    tool, name = result
+    return [tool, *dev_args[name]], name
@@ -13,34 +13,33 @@ import asyncio
 import os
 import tempfile
 from collections.abc import AsyncGenerator
-from datetime import datetime, timezone
 from uuid import UUID

 import httpx
 import pytest
 import pytest_asyncio
-import uuid7

+import paskia.db.operations as ops_db
 from paskia import globals as paskia_globals
-from paskia.authsession import expires
+from paskia.authsession import expires, reset_expires
 from paskia.db import (
    Credential,
    Org,
    Permission,
    Role,
    User,
-    add_permission_to_organization,
    create_credential,
-    create_organization,
-    create_permission,
    create_reset_token,
    create_role,
    create_session,
    create_user,
 )
-from paskia.db.operations import DB, _create_token
+from paskia.db.jsonl import JsonlStore
+from paskia.db.operations import DB
+from paskia.fastapi.mainapp import app
 from paskia.fastapi.session import AUTH_COOKIE_NAME
 from paskia.sansio import Passkey
+from paskia.util.passphrase import generate


@pytest.fixture(scope="session")
@@ -55,17 +54,27 @@ def event_loop():
 async def test_db() -> AsyncGenerator[DB, None]:
    """Create an in-memory JSON database for testing.

-    Uses a temp file that gets cleaned up after each test.
+    Uses bootstrap() to properly initialize the database with:
+    - auth:admin and auth:org:admin permissions
+    - A default organization with Administration role
+    - An admin user with the Administration role
    """
-    import paskia.db.operations as ops_db

    with tempfile.NamedTemporaryFile(suffix=".jsonl", delete=True) as f:
-        db = DB(f.name)
-        await db.load()
+        db = DB()
+        store = JsonlStore(db, f.name)
+        db._store = store
+        await store.load()
        ops_db._db = db
+        ops_db._store = store
+        # Bootstrap creates the initial permissions, org, role, and admin user
+        ops_db.bootstrap(
+            org_name="Test Organization",
+            admin_name="Test Admin",
+        )
        yield db
-        # Clean up
        ops_db._db = None
+        ops_db._store = None


@pytest_asyncio.fixture(scope="function")
@@ -81,98 +90,56 @@ async def passkey_instance() -> Passkey:
    paskia_globals.passkey._instance = None


-@pytest_asyncio.fixture(scope="function")
-async def test_org(test_db: DB, admin_permission: Permission) -> Org:
-    """Create a test organization with admin permission."""
-    org = Org(
-        uuid=uuid7.create(),
-        display_name="Test Organization",
-        permissions=[str(admin_permission.uuid)],  # Org can grant this permission
-    )
-    create_organization(org)
-    return org
-
-
@pytest_asyncio.fixture(scope="function")
 async def admin_permission(test_db: DB) -> Permission:
-    """Create the auth:admin permission."""
-    import uuid7
-
-    perm = Permission(
-        uuid=uuid7.create(), scope="auth:admin", display_name="Master Admin"
-    )
-    create_permission(perm)
-    return perm
+    """Get the auth:admin permission created by bootstrap."""
+    return next(p for p in test_db.permissions.values() if p.scope == "auth:admin")


@pytest_asyncio.fixture(scope="function")
-async def org_admin_permission(test_db: DB, test_org: Org) -> Permission:
-    """Create the auth:org:admin permission."""
-    import uuid7
-
-    perm = Permission(
-        uuid=uuid7.create(), scope="auth:org:admin", display_name="Organization Admin"
-    )
-    create_permission(perm)
-    # Make it grantable by the org
-    add_permission_to_organization(str(test_org.uuid), "auth:org:admin")
-    return perm
+async def org_admin_permission(test_db: DB) -> Permission:
+    """Get the auth:org:admin permission created by bootstrap."""
+    return next(p for p in test_db.permissions.values() if p.scope == "auth:org:admin")


@pytest_asyncio.fixture(scope="function")
-async def test_role(
-    test_db: DB,
-    test_org: Org,
-    admin_permission: Permission,
-    org_admin_permission: Permission,
-) -> Role:
-    """Create a test role with admin permission."""
-    role = Role(
-        uuid=uuid7.create(),
-        org_uuid=test_org.uuid,
-        display_name="Test Admin Role",
-        permissions=[str(admin_permission.uuid), str(org_admin_permission.uuid)],
-    )
-    create_role(role)
-    return role
+async def test_org(test_db: DB) -> Org:
+    """Get the test organization created by bootstrap."""
+    # Bootstrap creates exactly one org
+    return next(iter(test_db.orgs.values()))
+
+
+@pytest_asyncio.fixture(scope="function")
+async def test_role(test_db: DB) -> Role:
+    """Get the Administration role created by bootstrap."""
+    # Bootstrap creates exactly one role (Administration)
+    return next(iter(test_db.roles.values()))


@pytest_asyncio.fixture(scope="function")
 async def user_role(test_db: DB, test_org: Org) -> Role:
    """Create a test role without admin permission (regular user)."""
-    role = Role(
-        uuid=uuid7.create(),
-        org_uuid=test_org.uuid,
+    role = Role.create(
+        org=test_org.uuid,
        display_name="User Role",
-        permissions=[],
    )
    create_role(role)
    return role


@pytest_asyncio.fixture(scope="function")
-async def test_user(test_db: DB, test_role: Role) -> User:
-    """Create a test user with admin role."""
-    user = User(
-        uuid=uuid7.create(),
-        display_name="Test Admin",
-        role_uuid=test_role.uuid,
-        created_at=datetime.now(timezone.utc),
-        visits=0,
-    )
-    create_user(user)
-    return user
+async def test_user(test_db: DB) -> User:
+    """Get the admin user created by bootstrap."""
+    # Bootstrap creates exactly one user (admin)
+    return next(iter(test_db.users.values()))


@pytest_asyncio.fixture(scope="function")
 async def regular_user(test_db: DB, user_role: Role) -> User:
    """Create a regular test user without admin permissions."""
-    user = User(
-        uuid=uuid7.create(),
+    user = User.create(
        display_name="Regular User",
-        role_uuid=user_role.uuid,
-        created_at=datetime.now(timezone.utc),
-        visits=0,
+        role=user_role.uuid,
    )
    create_user(user)
    return user
@@ -181,16 +148,12 @@ async def regular_user(test_db: DB, user_role: Role) -> User:
@pytest_asyncio.fixture(scope="function")
 async def test_credential(test_db: DB, test_user: User) -> Credential:
    """Create a test credential for the admin user."""
-    credential = Credential(
-        uuid=uuid7.create(),
+    credential = Credential.create(
        credential_id=os.urandom(32),
-        user_uuid=test_user.uuid,
+        user=test_user.uuid,
        aaguid=UUID("00000000-0000-0000-0000-000000000000"),
        public_key=os.urandom(64),
        sign_count=0,
-        created_at=datetime.now(timezone.utc),
-        last_used=None,
-        last_verified=None,
    )
    create_credential(credential)
    return credential
@@ -199,16 +162,12 @@ async def test_credential(test_db: DB, test_user: User) -> Credential:
@pytest_asyncio.fixture(scope="function")
 async def regular_credential(test_db: DB, regular_user: User) -> Credential:
    """Create a test credential for the regular user."""
-    credential = Credential(
-        uuid=uuid7.create(),
+    credential = Credential.create(
        credential_id=os.urandom(32),
-        user_uuid=regular_user.uuid,
+        user=regular_user.uuid,
        aaguid=UUID("00000000-0000-0000-0000-000000000000"),
        public_key=os.urandom(64),
        sign_count=0,
-        created_at=datetime.now(timezone.utc),
-        last_used=None,
-        last_verified=None,
    )
    create_credential(credential)
    return credential
@@ -219,17 +178,14 @@ async def session_token(
    test_db: DB, test_user: User, test_credential: Credential
 ) -> str:
    """Create a session for the admin user and return the token."""
-    token = _create_token()
-    create_session(
+    return create_session(
        user_uuid=test_user.uuid,
        credential_uuid=test_credential.uuid,
-        key=token,
        host="localhost:4401",
        ip="127.0.0.1",
        user_agent="pytest",
        expiry=expires(),
    )
-    return token


@pytest_asyncio.fixture(scope="function")
@@ -237,24 +193,19 @@ async def regular_session_token(
    test_db: DB, regular_user: User, regular_credential: Credential
 ) -> str:
    """Create a session for a regular user and return the token."""
-    token = _create_token()
-    create_session(
+    return create_session(
        user_uuid=regular_user.uuid,
        credential_uuid=regular_credential.uuid,
-        key=token,
        host="localhost:4401",
        ip="127.0.0.1",
        user_agent="pytest",
        expiry=expires(),
    )
-    return token


@pytest_asyncio.fixture(scope="function")
 async def reset_token(test_db: DB, test_user: User, test_credential: Credential) -> str:
    """Create a reset token for the test user."""
-    from paskia.authsession import reset_expires
-    from paskia.util.passphrase import generate

    token = generate()
    create_reset_token(
@@ -276,7 +227,6 @@ async def client(
    initialized first.
    """
    # Import app after globals are set
-    from paskia.fastapi.mainapp import app

    transport = httpx.ASGITransport(app=app)
    async with httpx.AsyncClient(
@@ -11,7 +11,9 @@ These tests cover:
 - Credential management
 """

-from datetime import datetime, timezone
+import os
+import secrets
+from datetime import UTC, datetime
 from uuid import UUID

 import httpx
@@ -19,6 +21,7 @@ import pytest
 import pytest_asyncio
 import uuid7

+from paskia import db
 from paskia.authsession import expires
 from paskia.db import (
    Credential,
@@ -26,15 +29,15 @@ from paskia.db import (
    Permission,
    Role,
    User,
-    add_permission_to_organization,
+    add_permission_to_org,
    create_credential,
-    create_organization,
+    create_org,
    create_permission,
    create_role,
    create_session,
    create_user,
 )
-from paskia.db.operations import DB, _create_token
+from paskia.db.operations import DB
 from tests.conftest import auth_headers

 # -------------------- Additional Fixtures --------------------
@@ -43,12 +46,10 @@ from tests.conftest import auth_headers
@pytest_asyncio.fixture(scope="function")
 async def second_org(test_db: DB) -> Org:
    """Create a second organization for deletion tests."""
-    org = Org(
-        uuid=uuid7.create(),
+    org = Org.create(
        display_name="Second Organization",
-        permissions=[],
    )
-    create_organization(org)
+    create_org(org)
    return org


@@ -57,11 +58,10 @@ async def second_org_role(
    test_db: DB, second_org: Org, admin_permission: Permission
 ) -> Role:
    """Create a role in the second org with admin permission."""
-    role = Role(
-        uuid=uuid7.create(),
-        org_uuid=second_org.uuid,
+    role = Role.create(
+        org=second_org.uuid,
        display_name="Second Org Admin Role",
-        permissions=[str(admin_permission.uuid)],
+        permissions={admin_permission.uuid},
    )
    create_role(role)
    return role
@@ -70,12 +70,9 @@ async def second_org_role(
@pytest_asyncio.fixture(scope="function")
 async def second_org_user(test_db: DB, second_org_role: Role) -> User:
    """Create a user in the second org."""
-    user = User(
-        uuid=uuid7.create(),
+    user = User.create(
        display_name="Second Org User",
-        role_uuid=second_org_role.uuid,
-        created_at=datetime.now(timezone.utc),
-        visits=0,
+        role=second_org_role.uuid,
    )
    create_user(user)
    return user
@@ -84,18 +81,13 @@ async def second_org_user(test_db: DB, second_org_role: Role) -> User:
@pytest_asyncio.fixture(scope="function")
 async def second_org_credential(test_db: DB, second_org_user: User) -> Credential:
    """Create a credential for the second org user."""
-    import os

-    credential = Credential(
-        uuid=uuid7.create(),
+    credential = Credential.create(
        credential_id=os.urandom(32),
-        user_uuid=second_org_user.uuid,
+        user=second_org_user.uuid,
        aaguid=UUID("00000000-0000-0000-0000-000000000000"),
        public_key=os.urandom(64),
        sign_count=0,
-        created_at=datetime.now(timezone.utc),
-        last_used=datetime.now(timezone.utc),
-        last_verified=datetime.now(timezone.utc),
    )
    create_credential(credential)
    return credential
@@ -106,17 +98,14 @@ async def second_org_session_token(
    test_db: DB, second_org_user: User, second_org_credential: Credential
 ) -> str:
    """Create a session for the second org admin user."""
-    token = _create_token()
-    create_session(
+    return create_session(
        user_uuid=second_org_user.uuid,
        credential_uuid=second_org_credential.uuid,
-        key=token,
        host="localhost:4401",
        ip="127.0.0.1",
        user_agent="pytest",
        expiry=expires(),
    )
-    return token


@pytest_asyncio.fixture(scope="function")
@@ -124,11 +113,10 @@ async def org_admin_role(
    test_db: DB, test_org: Org, org_admin_permission: Permission
 ) -> Role:
    """Create a role with org admin permission only (no global admin)."""
-    role = Role(
-        uuid=uuid7.create(),
-        org_uuid=test_org.uuid,
+    role = Role.create(
+        org=test_org.uuid,
        display_name="Org Admin Role",
-        permissions=[str(org_admin_permission.uuid)],
+        permissions={org_admin_permission.uuid},
    )
    create_role(role)
    return role
@@ -137,14 +125,12 @@ async def org_admin_role(
@pytest_asyncio.fixture(scope="function")
 async def org_admin_user(test_db: DB, org_admin_role: Role) -> User:
    """Create a user with org admin permission only."""
-    user = User(
-        uuid=uuid7.create(),
+    user = User.create(
        display_name="Org Admin User",
-        role_uuid=org_admin_role.uuid,
-        created_at=datetime.now(timezone.utc),
-        visits=5,
-        last_seen=datetime.now(timezone.utc),
+        role=org_admin_role.uuid,
    )
+    user.visits = 5
+    user.last_seen = datetime.now(UTC)
    create_user(user)
    return user

@@ -152,18 +138,13 @@ async def org_admin_user(test_db: DB, org_admin_role: Role) -> User:
@pytest_asyncio.fixture(scope="function")
 async def org_admin_credential(test_db: DB, org_admin_user: User) -> Credential:
    """Create a credential for the org admin user."""
-    import os

-    credential = Credential(
-        uuid=uuid7.create(),
+    credential = Credential.create(
        credential_id=os.urandom(32),
-        user_uuid=org_admin_user.uuid,
+        user=org_admin_user.uuid,
        aaguid=UUID("00000000-0000-0000-0000-000000000000"),
        public_key=os.urandom(64),
        sign_count=0,
-        created_at=datetime.now(timezone.utc),
-        last_used=datetime.now(timezone.utc),
-        last_verified=None,
    )
    create_credential(credential)
    return credential
@@ -174,30 +155,23 @@ async def org_admin_session_token(
    test_db: DB, org_admin_user: User, org_admin_credential: Credential
 ) -> str:
    """Create a session for the org admin user."""
-    token = _create_token()
-    create_session(
+    return create_session(
        user_uuid=org_admin_user.uuid,
        credential_uuid=org_admin_credential.uuid,
-        key=token,
        host="localhost:4401",
        ip="127.0.0.1",
        user_agent="pytest",
        expiry=expires(),
    )
-    return token


@pytest_asyncio.fixture(scope="function")
 async def grantable_permission(test_db: DB, test_org: Org) -> Permission:
    """Create a permission and add it to org's grantable permissions."""
-    import uuid7
-
-    perm = Permission(
-        uuid=uuid7.create(), scope="test:grantable:perm", display_name="Grantable Perm"
-    )
+    perm = Permission.create(scope="test:grantable:perm", display_name="Grantable Perm")
    create_permission(perm)
    # Add to org's grantable permissions
-    add_permission_to_organization(str(test_org.uuid), perm.scope)
+    add_permission_to_org(test_org.uuid, perm.uuid)
    return perm


@@ -390,10 +364,13 @@ class TestAdminOrganizations:
    ):
        """Org admin cannot remove their org admin permission from org's permissions."""
        # The auth:org:admin perm is already created and added by org_admin_permission fixture
+        org_admin_perm = next(
+            p for p in db.data().permissions.values() if p.scope == "auth:org:admin"
+        )

        # Try to remove org admin perm (this is validated server-side in the remove endpoint)
        response = await client.delete(
-            f"/auth/api/admin/orgs/{test_org.uuid}/permission?permission_id=auth:org:admin",
+            f"/auth/api/admin/orgs/{test_org.uuid}/permission?permission_uuid={org_admin_perm.uuid}",
            headers={**auth_headers(org_admin_session_token), "Host": "localhost:4401"},
        )
        # This should fail because only global admin can remove perms from org
@@ -420,19 +397,14 @@ class TestAdminOrganizations:
        test_db: DB,
    ):
        """Admin should be able to delete another organization."""
-        import uuid7
-
        # Create org to delete
-        org_to_delete = Org(
-            uuid=uuid7.create(),
+        org_to_delete = Org.create(
            display_name="Org To Delete",
-            permissions=[],
        )
-        create_organization(org_to_delete)
+        create_org(org_to_delete)

        # Create some org-specific permissions to test cleanup
-        org_perm = Permission(
-            uuid=uuid7.create(),
+        org_perm = Permission.create(
            scope=f"test:org:{org_to_delete.uuid}:feature",
            display_name="Org Feature",
        )
@@ -459,15 +431,12 @@ class TestAdminOrgPermissions:
    ):
        """Admin should be able to add a permission to an org."""
        # First create a permission
-        await client.post(
-            "/auth/api/admin/permissions",
-            json={"scope": "test:org:addable", "display_name": "Addable"},
-            headers={**auth_headers(session_token), "Host": "localhost:4401"},
-        )
+        perm = Permission.create(scope="test:org:addable", display_name="Addable")
+        create_permission(perm)

        # Add it to the org
        response = await client.post(
-            f"/auth/api/admin/orgs/{test_org.uuid}/permission?permission_id=test:org:addable",
+            f"/auth/api/admin/orgs/{test_org.uuid}/permission?permission_uuid={perm.uuid}",
            headers={**auth_headers(session_token), "Host": "localhost:4401"},
        )
        assert response.status_code == 200
@@ -482,8 +451,11 @@ class TestAdminOrgPermissions:
        test_org,
    ):
        """Org admin cannot add permissions to org (requires global admin)."""
+        admin_perm = next(
+            p for p in db.data().permissions.values() if p.scope == "auth:admin"
+        )
        response = await client.post(
-            f"/auth/api/admin/orgs/{test_org.uuid}/permission?permission_id=auth:admin",
+            f"/auth/api/admin/orgs/{test_org.uuid}/permission?permission_uuid={admin_perm.uuid}",
            headers={**auth_headers(org_admin_session_token), "Host": "localhost:4401"},
        )
        assert response.status_code == 403
@@ -494,19 +466,16 @@ class TestAdminOrgPermissions:
    ):
        """Admin should be able to remove a permission from an org."""
        # First create and add a permission
+        perm = Permission.create(scope="test:org:removable", display_name="Removable")
+        create_permission(perm)
        await client.post(
-            "/auth/api/admin/permissions",
-            json={"scope": "test:org:removable", "display_name": "Removable"},
-            headers={**auth_headers(session_token), "Host": "localhost:4401"},
-        )
-        await client.post(
-            f"/auth/api/admin/orgs/{test_org.uuid}/permission?permission_id=test:org:removable",
+            f"/auth/api/admin/orgs/{test_org.uuid}/permission?permission_uuid={perm.uuid}",
            headers={**auth_headers(session_token), "Host": "localhost:4401"},
        )

        # Remove it
        response = await client.delete(
-            f"/auth/api/admin/orgs/{test_org.uuid}/permission?permission_id=test:org:removable",
+            f"/auth/api/admin/orgs/{test_org.uuid}/permission?permission_uuid={perm.uuid}",
            headers={**auth_headers(session_token), "Host": "localhost:4401"},
        )
        assert response.status_code == 200
@@ -521,8 +490,11 @@ class TestAdminOrgPermissions:
        test_org,
    ):
        """Org admin cannot remove permissions from org (requires global admin)."""
+        admin_perm = next(
+            p for p in db.data().permissions.values() if p.scope == "auth:admin"
+        )
        response = await client.delete(
-            f"/auth/api/admin/orgs/{test_org.uuid}/permission?permission_id=auth:admin",
+            f"/auth/api/admin/orgs/{test_org.uuid}/permission?permission_uuid={admin_perm.uuid}",
            headers={**auth_headers(org_admin_session_token), "Host": "localhost:4401"},
        )
        assert response.status_code == 403
@@ -590,7 +562,7 @@ class TestAdminRoles:
            f"/auth/api/admin/orgs/{test_org.uuid}/roles",
            json={
                "display_name": "Role With Perms",
-                "permissions": [grantable_permission.scope],
+                "permissions": [str(grantable_permission.uuid)],
            },
            headers={**auth_headers(session_token), "Host": "localhost:4401"},
        )
@@ -608,10 +580,7 @@ class TestAdminRoles:
    ):
        """Creating role with non-grantable permission should fail."""
        # Create permission but don't add to org
-        import uuid7
-
-        perm = Permission(
-            uuid=uuid7.create(),
+        perm = Permission.create(
            scope="test:not:grantable",
            display_name="Not Grantable",
        )
@@ -621,7 +590,7 @@ class TestAdminRoles:
            f"/auth/api/admin/orgs/{test_org.uuid}/roles",
            json={
                "display_name": "Bad Role",
-                "permissions": ["test:not:grantable"],
+                "permissions": [str(perm.uuid)],
            },
            headers={**auth_headers(session_token), "Host": "localhost:4401"},
        )
@@ -683,10 +652,7 @@ class TestAdminRoles:
        test_db: DB,
    ):
        """Adding non-grantable permission to role should fail."""
-        import uuid7
-
-        perm = Permission(
-            uuid=uuid7.create(),
+        perm = Permission.create(
            scope="test:not:grantable:update",
            display_name="Not Grantable",
        )
@@ -1110,12 +1076,9 @@ class TestAdminUsersInOrg:
    ):
        """Creating link for user without credentials should return registration link."""
        # Create user without credentials
-        user_no_cred = User(
-            uuid=uuid7.create(),
+        user_no_cred = User.create(
            display_name="User Without Creds",
-            role_uuid=user_role.uuid,
-            created_at=datetime.now(timezone.utc),
-            visits=0,
+            role=user_role.uuid,
        )
        create_user(user_no_cred)

@@ -1202,11 +1165,9 @@ class TestAdminSessions:
    ):
        """Admin should be able to delete a user's session."""
        # Create an additional session to delete
-        extra_token = _create_token()
-        create_session(
+        extra_token = create_session(
            user_uuid=test_user.uuid,
            credential_uuid=test_credential.uuid,
-            key=extra_token,
            host="other.host:4401",
            ip="192.168.1.1",
            user_agent="other-agent",
@@ -1287,7 +1248,7 @@ class TestAdminSessions:
    ):
        """Deleting non-existent session should fail."""
        # Use a valid format but non-existent key
-        fake_token = _create_token()
+        fake_token = secrets.token_urlsafe(12)
        response = await client.delete(
            f"/auth/api/admin/orgs/{test_org.uuid}/users/{test_user.uuid}/sessions/{fake_token}",
            headers={**auth_headers(session_token), "Host": "localhost:4401"},
@@ -1391,15 +1352,11 @@ class TestAdminPermissions:
    ):
        """Admin should be able to update a permission."""
        # Create permission first
-        import uuid7
-
-        perm = Permission(
-            uuid=uuid7.create(), scope="test:updateable", display_name="Updateable"
-        )
+        perm = Permission.create(scope="test:updateable", display_name="Updateable")
        create_permission(perm)

        response = await client.patch(
-            "/auth/api/admin/permission?permission_id=test:updateable&display_name=Updated%20Name",
+            f"/auth/api/admin/permission?permission_uuid={perm.uuid}&display_name=Updated%20Name",
            headers={**auth_headers(session_token), "Host": "localhost:4401"},
        )
        assert response.status_code == 200
@@ -1412,15 +1369,11 @@ class TestAdminPermissions:
    ):
        """Updating permission with empty name should fail."""
        # Create permission first
-        import uuid7
-
-        perm = Permission(
-            uuid=uuid7.create(), scope="test:perm", display_name="Test Perm"
-        )
+        perm = Permission.create(scope="test:perm", display_name="Test Perm")
        create_permission(perm)

        response = await client.patch(
-            "/auth/api/admin/permission?permission_id=test:perm&display_name=",
+            f"/auth/api/admin/permission?permission_uuid={perm.uuid}&display_name=",
            headers={**auth_headers(session_token), "Host": "localhost:4401"},
        )
        assert response.status_code == 400
@@ -1428,47 +1381,32 @@ class TestAdminPermissions:
        assert "display_name is required" in data["detail"]

    @pytest.mark.asyncio
-    async def test_rename_permission(
+    async def test_update_permission_scope(
        self, client: httpx.AsyncClient, session_token: str, test_db: DB
    ):
-        """Admin should be able to rename a permission."""
+        """Admin should be able to update a permission's scope via PATCH."""
        # Create permission first
-        import uuid7
-
-        perm = Permission(
-            uuid=uuid7.create(), scope="test:renameable2", display_name="Renameable"
-        )
+        perm = Permission.create(scope="test:renameable2", display_name="Renameable")
        create_permission(perm)

-        response = await client.post(
-            "/auth/api/admin/permission/rename",
-            json={"old_scope": "test:renameable2", "new_scope": "test:renamed2"},
+        response = await client.patch(
+            f"/auth/api/admin/permission?permission_uuid={perm.uuid}&scope=test:renamed2",
            headers={**auth_headers(session_token), "Host": "localhost:4401"},
        )
        assert response.status_code == 200

    @pytest.mark.asyncio
-    async def test_rename_permission_missing_ids(
+    async def test_update_permission_auth_admin_scope_fails(
        self, client: httpx.AsyncClient, session_token: str
    ):
-        """Renaming permission without IDs should fail."""
-        response = await client.post(
-            "/auth/api/admin/permission/rename",
-            json={},
-            headers={**auth_headers(session_token), "Host": "localhost:4401"},
-        )
-        assert response.status_code == 400
-        data = response.json()
-        assert "required" in data["detail"]
+        """Cannot change the auth:admin permission scope."""
+        # Get the auth:admin permission

-    @pytest.mark.asyncio
-    async def test_rename_permission_auth_admin_fails(
-        self, client: httpx.AsyncClient, session_token: str
-    ):
-        """Cannot rename the auth:admin permission."""
-        response = await client.post(
-            "/auth/api/admin/permission/rename",
-            json={"old_id": "auth:admin", "new_id": "auth:superadmin"},
+        perms = list(db.data().permissions.values())
+        admin_perm = next(p for p in perms if p.scope == "auth:admin")
+
+        response = await client.patch(
+            f"/auth/api/admin/permission?permission_uuid={admin_perm.uuid}&scope=auth:superadmin",
            headers={**auth_headers(session_token), "Host": "localhost:4401"},
        )
        assert response.status_code == 400
@@ -1476,24 +1414,15 @@ class TestAdminPermissions:
        assert "Cannot rename the master admin" in data["detail"]

    @pytest.mark.asyncio
-    async def test_rename_permission_with_display_name(
+    async def test_update_permission_scope_and_display_name(
        self, client: httpx.AsyncClient, session_token: str, test_db: DB
    ):
-        """Renaming permission can also update display name."""
-        import uuid7
-
-        perm = Permission(
-            uuid=uuid7.create(), scope="test:rename:withname", display_name="Old Name"
-        )
+        """Updating permission can change scope and display name together."""
+        perm = Permission.create(scope="test:rename:withname", display_name="Old Name")
        create_permission(perm)

-        response = await client.post(
-            "/auth/api/admin/permission/rename",
-            json={
-                "old_scope": "test:rename:withname",
-                "new_scope": "test:renamed:withname",
-                "display_name": "New Display Name",
-            },
+        response = await client.patch(
+            f"/auth/api/admin/permission?permission_uuid={perm.uuid}&scope=test:renamed:withname&display_name=New%20Display%20Name",
            headers={**auth_headers(session_token), "Host": "localhost:4401"},
        )
        assert response.status_code == 200
@@ -1504,15 +1433,11 @@ class TestAdminPermissions:
    ):
        """Admin should be able to delete a permission."""
        # Create permission first
-        import uuid7
-
-        perm = Permission(
-            uuid=uuid7.create(), scope="test:deleteable", display_name="Deleteable"
-        )
+        perm = Permission.create(scope="test:deleteable", display_name="Deleteable")
        create_permission(perm)

        response = await client.delete(
-            "/auth/api/admin/permission?permission_id=test:deleteable",
+            f"/auth/api/admin/permission?permission_uuid={perm.uuid}",
            headers={**auth_headers(session_token), "Host": "localhost:4401"},
        )
        assert response.status_code == 200
@@ -1524,8 +1449,13 @@ class TestAdminPermissions:
        self, client: httpx.AsyncClient, session_token: str
    ):
        """Cannot delete the only auth:admin permission (would lock out admin)."""
+        # Get the auth:admin permission
+
+        perms = list(db.data().permissions.values())
+        admin_perm = next(p for p in perms if p.scope == "auth:admin")
+
        response = await client.delete(
-            "/auth/api/admin/permission?permission_id=auth:admin",
+            f"/auth/api/admin/permission?permission_uuid={admin_perm.uuid}",
            headers={**auth_headers(session_token), "Host": "localhost:4401"},
        )
        assert response.status_code == 400
@@ -1537,19 +1467,21 @@ class TestAdminPermissions:
        self, client: httpx.AsyncClient, session_token: str, test_db: DB
    ):
        """Can delete an auth:admin permission if another accessible one exists."""
-        import uuid7
-
-        from paskia.db import Permission

        # Create a second auth:admin permission (no domain restriction)
-        perm2 = Permission(
-            uuid=uuid7.create(), scope="auth:admin", display_name="Secondary Admin"
-        )
+        perm2 = Permission.create(scope="auth:admin", display_name="Secondary Admin")
        create_permission(perm2)

+        # Get the original auth:admin permission (the one created in setup)
+
+        perms = list(db.data().permissions.values())
+        admin_perms = [p for p in perms if p.scope == "auth:admin"]
+        # Delete the first one (not the one we just created)
+        original_admin_perm = next(p for p in admin_perms if p.uuid != perm2.uuid)
+
        # Now we can delete the original one
        response = await client.delete(
-            "/auth/api/admin/permission?permission_id=auth:admin",
+            f"/auth/api/admin/permission?permission_uuid={original_admin_perm.uuid}",
            headers={**auth_headers(session_token), "Host": "localhost:4401"},
        )
        assert response.status_code == 200
@@ -1561,13 +1493,9 @@ class TestAdminPermissions:
        self, client: httpx.AsyncClient, session_token: str, test_db: DB
    ):
        """Cannot delete auth:admin if remaining one has mismatched domain."""
-        import uuid7
-
-        from paskia.db import Permission

        # Create a second auth:admin permission with a different domain
-        perm2 = Permission(
-            uuid=uuid7.create(),
+        perm2 = Permission.create(
            scope="auth:admin",
            display_name="Other Domain Admin",
            domain="other.example.com",
@@ -1575,8 +1503,14 @@ class TestAdminPermissions:
        create_permission(perm2)

        # Cannot delete the original one because the remaining one is not accessible
+        # Get the original auth:admin permission
+
+        perms = list(db.data().permissions.values())
+        admin_perms = [p for p in perms if p.scope == "auth:admin" and p.domain is None]
+        original_admin_perm = admin_perms[0]  # The one without domain
+
        response = await client.delete(
-            "/auth/api/admin/permission?permission_id=auth:admin",
+            f"/auth/api/admin/permission?permission_uuid={original_admin_perm.uuid}",
            headers={**auth_headers(session_token), "Host": "localhost:4401"},
        )
        assert response.status_code == 400
@@ -1588,8 +1522,11 @@ class TestAdminPermissions:
        self, client: httpx.AsyncClient, session_token: str, test_org
    ):
        """Cannot remove auth:admin permission from your own organization."""
+        admin_perm = next(
+            p for p in db.data().permissions.values() if p.scope == "auth:admin"
+        )
        response = await client.delete(
-            f"/auth/api/admin/orgs/{test_org.uuid}/permission?permission_id=auth:admin",
+            f"/auth/api/admin/orgs/{test_org.uuid}/permission?permission_uuid={admin_perm.uuid}",
            headers={**auth_headers(session_token), "Host": "localhost:4401"},
        )
        assert response.status_code == 400
@@ -10,12 +10,15 @@ These tests cover:
 - /auth/api/set-session - Set session from bearer token
 """

-from datetime import datetime, timezone
+import secrets
+from datetime import UTC, datetime, timedelta

 import httpx
 import pytest

+from paskia.authsession import EXPIRES
 from paskia.db import create_session, delete_session
+from paskia.util.passphrase import generate
 from tests.conftest import auth_headers


@@ -76,7 +79,9 @@ class TestValidateEndpoint:
        assert response.status_code == 200
        data = response.json()
        assert data["valid"] is True
-        assert "user_uuid" in data
+        assert "ctx" in data
+        assert "user" in data["ctx"]
+        assert "uuid" in data["ctx"]["user"]

    @pytest.mark.asyncio
    async def test_validate_with_permission_check(
@@ -243,9 +248,9 @@ class TestUserInfoEndpoint:
        )
        assert response.status_code == 200
        data = response.json()
-        assert "user" in data
-        assert data["user"]["user_uuid"] == str(test_user.uuid)
-        assert data["user"]["user_name"] == test_user.display_name
+        assert "ctx" in data
+        assert data["ctx"]["user"]["uuid"] == str(test_user.uuid)
+        assert data["ctx"]["user"]["display_name"] == test_user.display_name

    @pytest.mark.asyncio
    async def test_user_info_includes_credentials(
@@ -286,19 +291,20 @@ class TestUserInfoEndpoint:
        )
        assert response.status_code == 200
        data = response.json()
-        assert "permissions" in data
+        assert "ctx" in data
+        assert "permissions" in data["ctx"]


 class TestSetSessionEndpoint:
    """Tests for POST /auth/api/set-session"""

    @pytest.mark.asyncio
-    async def test_set_session_without_bearer_returns_403(
+    async def test_set_session_without_bearer_returns_401(
        self, client: httpx.AsyncClient
    ):
-        """Set session without bearer token should return 403."""
+        """Set session without bearer token should return 401."""
        response = await client.post("/auth/api/set-session")
-        assert response.status_code == 403
+        assert response.status_code == 401

    @pytest.mark.asyncio
    async def test_set_session_with_valid_bearer_token(
@@ -314,7 +320,7 @@ class TestSetSessionEndpoint:
        )
        assert response.status_code == 200
        data = response.json()
-        assert "user_uuid" in data
+        assert "user" in data
        # Check that Set-Cookie header is present
        assert "set-cookie" in response.headers

@@ -392,47 +398,43 @@ class TestForwardAuthHtmlResponse:
        assert data["auth"]["mode"] == "login"


-class TestUserInfoWithResetToken:
-    """Tests for user-info endpoint with reset tokens"""
+class TestTokenInfoEndpoint:
+    """Tests for token-info endpoint with reset tokens"""

    @pytest.mark.asyncio
-    async def test_user_info_with_invalid_reset_token(self, client: httpx.AsyncClient):
-        """User info with invalid reset token format should return 401."""
-        # Invalid format - not a well-formed passphrase (wrong separator)
-        response = await client.post(
-            "/auth/api/user-info?reset=invalid-token-format",
+    async def test_token_info_with_invalid_token(self, client: httpx.AsyncClient):
+        """Token info with invalid token format should return 400."""
+        response = await client.get(
+            "/auth/api/token-info",
+            headers={"Authorization": "Bearer invalid-token-format"},
        )
-        # Invalid format raises ValueError which gets converted to 401 HTTPException
-        assert response.status_code == 401
-        data = response.json()
-        assert "Invalid reset token" in data["detail"]
+        assert response.status_code == 400

    @pytest.mark.asyncio
-    async def test_user_info_with_nonexistent_reset_token(
-        self, client: httpx.AsyncClient
-    ):
-        """User info with well-formed but non-existent reset token should return 401."""
-        # We need a well-formed passphrase that doesn't exist in DB
-        from paskia.util.passphrase import generate
+    async def test_token_info_with_nonexistent_token(self, client: httpx.AsyncClient):
+        """Token info with well-formed but non-existent token should return 401."""

-        fake_token = generate()  # Generates a well-formed token
-        response = await client.post(
-            f"/auth/api/user-info?reset={fake_token}",
+        fake_token = generate()
+        response = await client.get(
+            "/auth/api/token-info",
+            headers={"Authorization": f"Bearer {fake_token}"},
        )
-        # Should return 401 for non-existent token
        assert response.status_code == 401

    @pytest.mark.asyncio
-    async def test_user_info_with_valid_reset_token(
+    async def test_token_info_with_valid_token(
        self, client: httpx.AsyncClient, reset_token: str, test_user
    ):
-        """User info with valid reset token should return minimal user info."""
-        response = await client.post(
-            f"/auth/api/user-info?reset={reset_token}",
+        """Token info with valid reset token should return token type and display name."""
+        response = await client.get(
+            "/auth/api/token-info",
+            headers={"Authorization": f"Bearer {reset_token}"},
        )
        assert response.status_code == 200
        data = response.json()
-        assert "user" in data
+        assert "token_type" in data
+        assert "display_name" in data
+        assert data["display_name"] == test_user.display_name


 class TestSetSessionErrors:
@@ -442,7 +444,7 @@ class TestSetSessionErrors:
    async def test_set_session_with_invalid_bearer_token(
        self, client: httpx.AsyncClient
    ):
-        """Set session with invalid (malformed) bearer token should return 400."""
+        """Set session with invalid (malformed) bearer token should return 401."""
        response = await client.post(
            "/auth/api/set-session",
            headers={
@@ -450,8 +452,8 @@ class TestSetSessionErrors:
                "Host": "localhost:4401",
            },
        )
-        # Invalid token format returns 400
-        assert response.status_code == 400
+        # Invalid token returns 401 (session not found)
+        assert response.status_code == 401

    @pytest.mark.asyncio
    async def test_set_session_with_nonexistent_token(self, client: httpx.AsyncClient):
@@ -465,8 +467,8 @@ class TestSetSessionErrors:
                "Host": "localhost:4401",
            },
        )
-        # Non-existent session returns 400 (ValueError -> 400)
-        assert response.status_code == 400
+        # Non-existent session returns 401 (session expired)
+        assert response.status_code == 401


 class TestValidateSessionRefresh:
@@ -499,10 +501,9 @@ class TestValidateSessionRefresh:
        self, client: httpx.AsyncClient, test_db
    ):
        """Validate should handle session expiry during refresh attempt."""
-        from paskia.db.operations import _create_token

        # Create a token but don't create a session for it
-        token = _create_token()
+        token = secrets.token_urlsafe(12)
        response = await client.post(
            "/auth/api/validate",
            headers={**auth_headers(token), "Host": "localhost:4401"},
@@ -519,18 +520,12 @@ class TestValidateSessionRefresh:
        test_credential,
    ):
        """Validate should return 401 if session disappears during refresh."""
-        from datetime import timedelta
-
-        from paskia.authsession import EXPIRES
-        from paskia.db.operations import _create_token

        # Create a session with an old expiry time to trigger refresh
-        token = _create_token()
-        old_expiry = datetime.now(timezone.utc) + EXPIRES - timedelta(minutes=10)
-        create_session(
+        old_expiry = datetime.now(UTC) + EXPIRES - timedelta(minutes=10)
+        token = create_session(
            user_uuid=test_user.uuid,
            credential_uuid=test_credential.uuid,
-            key=token,
            host="localhost:4401",
            ip="127.0.0.1",
            user_agent="pytest",
Author	SHA1	Message	Date
LeoVasanko	632278d4ce	Change CLI to use --listen rather than positional hostport argument. Fix listening on all interfaces (runs lifespan twice, which needs to be OK). Update README with various CLI changes and more.	2026-02-05 02:54:07 +00:00
LeoVasanko	3faaeee7be	Add missing __init__ that was causing ModuleFoundError trying to import paskia.util.	2026-02-05 02:33:05 +00:00
LeoVasanko	0f51f8501d	Console startup box themed as well.	2026-01-31 00:30:14 +00:00
LeoVasanko	a7e6eb7341	Missing theme file. Added favicon.	2026-01-31 00:25:38 +00:00
LeoVasanko	1800dc12ae	Light/dark selection in user profile, if set this is preferred on the whole system, together with app overrides (the first one on the URL wins).	2026-01-30 23:31:06 +00:00
LeoVasanko	cc55474e62	Light/dark override for in-app login dialogs to match app style e.g. light only	2026-01-30 22:59:52 +00:00
LeoVasanko	8ac2c8e5fa	Screenshots on README.	2026-01-29 22:50:54 +00:00
LeoVasanko	2ee8ddf1d1	Log proper action for delete_session depending on what function it performs: logout, delete_session (user's own) or admin:delete_session.	2026-01-29 22:44:22 +00:00
LeoVasanko	d58b3742b1	Smarter change logging on console, properly display newly created items (not available via jsondiffs).	2026-01-29 22:39:16 +00:00
LeoVasanko	5879be39a5	Better change entry logging.	2026-01-29 22:09:26 +00:00
LeoVasanko	5b3406025c	Silence type checker about our unconventional imports.	2026-01-29 22:09:03 +00:00
LeoVasanko	dda57ac27d	Fix WS access log IP margin size change missed in earlier commit.	2026-01-29 21:39:30 +00:00
LeoVasanko	5e12dcba76	Add paskia-js to Python build; update build-frontend to use fastapi-vue utils for JS_RUNTIME that also can be set via env now. Fix paskia-js compatibility issue with deno, now works with all three runtimes.	2026-01-29 21:33:09 +00:00
LeoVasanko	be7a9e7f00	Smarter access log formatting with IPv6.	2026-01-29 21:17:50 +00:00
LeoVasanko	3d2151fed7	Add support for perm=foo+bar to specify multiple scopes that are required. Multiple perm args are acceptable too. Pretty logging of permission denied errors.	2026-01-29 21:11:29 +00:00
LeoVasanko	58b56a09a4	Restrict remote auth to the existing granting user's credentials.	2026-01-29 20:24:26 +00:00
LeoVasanko	731b36b456	Cleanup auth WS code, refactor to remove duplication and pass proper context.	2026-01-29 20:15:01 +00:00
LeoVasanko	8f9cd1124c	Add missing context on update_session.	2026-01-29 19:51:56 +00:00
LeoVasanko	7e49ef296a	Create a stand-alone paskia npm package (paskia-js). Make the frontend use it (but from source tree to keep synced).	2026-01-29 19:46:26 +00:00
LeoVasanko	af35ff3d4c	Add a screenshot.	2026-01-29 19:15:17 +00:00
LeoVasanko	dac1415a86	More of a normal white path color.	2026-01-29 16:57:30 +00:00
LeoVasanko	433844cf08	Refactor to separate paskia lib functionality generally useful for various apps.	2026-01-29 16:55:46 +00:00
LeoVasanko	c9ea1c8948	Consistent and stronger session revalidation checks in Auth profile and Admin App. Fix missing handling of link generation network errors.	2026-01-29 16:02:29 +00:00
LeoVasanko	58f46c6abf	Logging cleanup, better colors, suppress more useless messages. Enable reloading in devmode again (needs uvicorn.run to function).	2026-01-29 14:48:59 +00:00
LeoVasanko	7c4418e631	Smarter change logging on console.	2026-01-28 23:22:03 +00:00
LeoVasanko	1648c8641f	Improved access logging.	2026-01-28 23:01:35 +00:00
LeoVasanko	63eb088dbd	Cleanup	2026-01-28 20:31:33 +00:00
LeoVasanko	e88cc004dd	Implement versioning in metadata, outside of the DB itself. Cleanup to migration handling and changes. Implement new migration step using msgspec normalization.	2026-01-28 20:21:09 +00:00
LeoVasanko	76921e8b31	Add migrate:msgspec for changes in schema that don't require version bump. Rename the other migrations to migrate:sql and migrate:v{N}.	2026-01-28 19:24:15 +00:00
LeoVasanko	c1b0aab296	Cleanup	2026-01-28 19:17:24 +00:00
LeoVasanko	8f89bb6d4b	Modules missing git add	2026-01-28 19:04:18 +00:00
LeoVasanko	d16d1ed1c2	Make database changes outside of transaction a fatal error. Fix bootstrap and migrate to work with various latest changes.	2026-01-28 19:04:00 +00:00
LeoVasanko	2cfca81672	Fix a bug with validate returning 401 when a session was refreshed. Simplify & cleanup.	2026-01-28 18:45:02 +00:00
LeoVasanko	ce300ebdaf	API to use msgspec structs as well.	2026-01-28 18:31:45 +00:00
LeoVasanko	7329223784	Implement full ORM. Various other cleanup.	2026-01-28 17:19:56 +00:00
LeoVasanko	c8d659b5ca	Move get_session_context to DB.session_ctx().	2026-01-28 14:52:18 +00:00
LeoVasanko	29ea6426fe	Problem solved, remove extraneous migration, reset to v1.	2026-01-28 02:29:53 +00:00
LeoVasanko	88a170a37b	Debug DB problem	2026-01-28 02:27:26 +00:00
LeoVasanko	38d240d86d	Credential update was being done out of transaction, now part of login.	2026-01-28 02:22:47 +00:00
LeoVasanko	53362b8061	Debug DB problem	2026-01-28 02:19:54 +00:00
LeoVasanko	d3d5f5a3c8	Remove get_session_context setting of host (now read only op as expected). Make session host, ip and user_agent always set (the ua potentially empty string).	2026-01-28 02:14:34 +00:00
LeoVasanko	d156fb9221	Fix migration logic.	2026-01-28 02:02:18 +00:00
LeoVasanko	f868bc59d1	Fix migration logic.	2026-01-28 01:58:36 +00:00
LeoVasanko	0022986d4e	Implement migration to remove created_at timestamp from Orgs that already has one, bumping db v1.	2026-01-28 01:52:33 +00:00
LeoVasanko	b08cca754f	Remove Org.created_at to maintain compatibility with old versions (the field was not being used).	2026-01-28 01:31:35 +00:00
LeoVasanko	aa58f08bc5	Hardened PATCH handling (only allow updating select fields). Hardened DB transactions, rollback.	2026-01-28 01:13:05 +00:00
LeoVasanko	1062b5d6c8	Fix background task still running twice, and add a check to prevent that happening again (double expiry).	2026-01-27 23:51:13 +00:00
LeoVasanko	3d49cbf2d6	Disable API docs that display very much broken due to missing request/response typing.	2026-01-27 23:27:42 +00:00
LeoVasanko	13c49aebfd	Remove unnecessary use of async now that db access doesn't need awaiting.	2026-01-27 23:16:17 +00:00
LeoVasanko	abec77d561	Broken import	2026-01-27 22:46:49 +00:00
LeoVasanko	9b505ff553	DB background worker cleanup, avoid issue with double cleanup. Faster write to disk.	2026-01-27 22:21:33 +00:00
LeoVasanko	ddd70e6130	Cleaner typing to avoid some checking errors.	2026-01-27 22:04:14 +00:00
LeoVasanko	cf1124c251	DB transactions cleanup, better actor/user data. Simplified admin API. Use UUID to refer to a specific permission in admin API. Other cleanup.	2026-01-27 21:48:21 +00:00
LeoVasanko	7504aaf7e0	Move imports to top of file.	2026-01-27 20:16:32 +00:00
LeoVasanko	e8247a2c7f	Remove most remaining DB getters. Add ws auth chat helper function to avoid repetition, along with the existing register chat in wschat.py.	2026-01-27 20:01:17 +00:00
LeoVasanko	968964c4c9	Remove db.get_session.	2026-01-27 18:28:32 +00:00
LeoVasanko	6aa1a08e39	Remove list_sessions_for_user, inline db access at call sites.	2026-01-27 18:25:29 +00:00
LeoVasanko	31f40d874c	DB cleanup: removed get_permission_organizations and build_org. Using db.data() for read access at call sites.	2026-01-27 18:23:17 +00:00
LeoVasanko	7530d7a710	DB cleanup continued: Made the working copy data public in DB class.	2026-01-27 18:02:16 +00:00
LeoVasanko	90d5f0e45f	Remove runtime expiry checks; the db background cleanup makes this unnecessary.	2026-01-27 16:55:07 +00:00
LeoVasanko	f0d1b86d6b	Database cleanup continues, build functions replaced by post init. Simplified some APIs.	2026-01-27 16:53:13 +00:00
LeoVasanko	dbdd1dbd3c	Missing import in migrate script.	2026-01-27 16:26:48 +00:00
LeoVasanko	8f862fb4d1	Consistently use UUID type in APIs instead of UUID str as option.	2026-01-27 16:24:02 +00:00
LeoVasanko	cfb917da46	DB getter refactoring. Documented call sites. Added separate function for by-scope permission lookup.	2026-01-27 15:54:28 +00:00
LeoVasanko	3a8e7d1f4f	Remove credentials: 'include', a mechanism that we don't actually use.	2026-01-27 15:23:19 +00:00
LeoVasanko	86966526c4	Finalize database API class merge.	2026-01-27 03:00:18 +00:00
LeoVasanko	3196aa7688	Refactor API to match database, no _uuid postfixes.	2026-01-27 02:32:46 +00:00
LeoVasanko	2fadaea19c	Update E2E tests with changes since a while back.	2026-01-27 02:24:09 +00:00
LeoVasanko	cb84a81a06	Update the API to use new naming matching database.	2026-01-27 02:22:29 +00:00
LeoVasanko	9bdca1f43a	Finish the database key-in-object refactoring.	2026-01-27 02:11:09 +00:00
LeoVasanko	0f29544bdb	Database cleanup, better UUID passing and construction (User model).	2026-01-27 01:25:52 +00:00
LeoVasanko	4ddaa9fdf4	Cleanup and bugfixes on Bootstrap and JSONL handling.	2026-01-26 23:54:03 +00:00
LeoVasanko	7e568dbd10	Refactor validate endpoint to return session context, leaving user-info only for extra profile data. Completely separate token-info for reset tokens. Simplified by reusing same data structures in various places and mandating fields to have values not needing fallbacks. Implemented consistent AccessDenied view in profile and admin apps.	2026-01-26 19:40:48 +00:00
LeoVasanko	fbc6108b7a	Fix frontend-build location. Cleanup.	2026-01-25 03:26:22 +00:00
LeoVasanko	6e649f1f07	Fix test expected HTTP code.	2026-01-25 03:20:28 +00:00
LeoVasanko	8d68e5d237	Add missing set_session_host on dunder all.	2026-01-25 03:17:32 +00:00
LeoVasanko	5ee7443801	Use fastapi-vue-setup, merging its template scripts to old Paskia entry point and devserver. Simplified CLI, no longer uses serve subcommand. Fixed the URL displayed on banner to show to actual frontend/caddy server even in devmode.	2026-01-25 03:15:50 +00:00