Make config part of bootstrap.

.gitignore

@@ -5,7 +5,7 @@ dist/
 *.lock
 package-lock.json
 paskia.sqlite
-paskia.jsonl
+*.paskiadb
 /paskia/frontend-build
 /paskia/_version.py
 coverage-html/

README.md

@@ -1,38 +1,47 @@
 # Paskia
 
+![Login dialog screenshot](https://git.zi.fi/leovasanko/paskia/raw/main/docs/screenshots/login-light.webp)
+
 An easy to install passkey-based authentication service that protects any web application with strong passwordless login.
 
 ## What is Paskia?
 
 - Easy to use fully featured auth&auth system (login and permissions)
-- Organization and role-based access control (optional)
+- Organization and role-based access control
    * Org admins control their users and roles
-   * Master admin can create multiple independent orgs
+   * Multiple independent orgs
-   * Master admin makes permissions available for orgs to assign
+   * Master admin can do everything or delegate to org admins
-- User Profile and Administration by API and web interface.
+- User Profile and Admin by API and web interface
-under `/auth/` or `auth.example.com`
+- Implements login/reauth/forbidden flows for you
-- Reset tokens and additional device linking via QR code or codewords.
+- Single Sign-On (SSO): Users register once and authenticate across your services
-- Pure Python, FastAPI, packaged with prebuilt Vue frontend
+- Remote autentication by entering random keywords from another device (like 2fa)
+- No CORS, NodeJS or anything extra needed.
+
+## Authenticate to get to your app, or in your app
 
-Two interfaces:
 - API fetch: auth checks and login without leaving your app
 - Forward-auth proxy: protect any unprotected site or service (Caddy, Nginx)
 
 The API mode is useful for applications that can be customized to run with Paskia. Forward auth can also protect your javascript and other assets. Each provides fine-grained permission control and reauthentication requests where needed, and both can be mixed where needed.
 
-Single Sign-On (SSO): Users register once and authenticate across all applications under your domain name (configured rp-id).
+## Authentication flows already done
+
+![Forbidden dialog, dark mode](https://git.zi.fi/leovasanko/paskia/raw/main/docs/screenshots/forbidden-dark.webp)
+**Automatic light/dark mode switching with overrides by user profile and protected app's theme.**
+
+Paskia includes set of login, reauthentication and forbidden dialogs that it can use to perform the needed flows. We never leave the URL, no redirections, and if you make use of API mode, we won't even interrupt whatever your app was doing but retry the blocked API fetch after login like nothing happened.
 
 ## Quick Start
 
 Install [UV](https://docs.astral.sh/uv/getting-started/installation/) and run:
 
 ```fish
-uvx paskia serve --rp-id example.com
+uvx paskia --rp-id example.com
 ```
 
-On the first run it downloads the software and prints a registration link for the Admin.  The server will start up on [localhost:4401](http://localhost:4401) *for authentication required*, serving for `*.example.com`. If you are going to be connecting `localhost` directly, for testing, leave out the rp-id.
+On the first run it downloads the software and prints a registration link for the Admin. The server starts on [localhost:4401](http://localhost:4401), serving authentication for `*.example.com`. For local testing, leave out `--rp-id`.
 
-Otherwise you will need a web server such as [Caddy](https://caddyserver.com/) to serve HTTPS on your actual domain names and proxy requests to Paskia and your backend apps (see documentation below).
+For production you need a web server such as [Caddy](https://caddyserver.com/) to serve HTTPS on your actual domain names and proxy requests to Paskia and your backend apps (see documentation below).
 
 For a permanent install of `paskia` CLI command, not needing `uvx`:
 
@@ -42,19 +51,157 @@ uv tool install paskia
 
 ## Configuration
 
-There is no config file. Pass only the options on CLI:
+You will need to specify your main domain to which all passkeys will be tied as rp-id. Use your main domain even if Paskia is not running there. All other options are optional.
 
 ```text
-paskia serve [options]
+paskia [options]
 ```
 
 | Option | Description | Default |
 |--------|-------------|---------|
-| Listen address | One of *host***:***port* (default all hosts, port 4401) or **unix:***path***/paskia.socket** (Unix socket) | **localhost:4401** |
+| -l, --listen *endpoint* | Listen address: *host*:*port*, :*port* (all interfaces), or */path.sock* | **localhost:4401** |
-| --rp-id *domain* | Main/top domain | **localhost** |
+| --rp-id *domain* | Main/top domain for passkeys | **localhost** |
-| --rp-name *"text"* | Name of your company or site | Same as rp-id |
+| --rp-name *"text"* | Branding name for the entire system (passkey auth, login dialog). | Same as rp-id |
-| --origin *url* | Explicitly list the domain names served | **https://**_rp-id_ |
+| --origin *url* | Only sites listed can login (repeatable) | rp-id and all subdomains |
-| --auth-host *domain* | Dedicated authentication site (e.g., **auth.example.com**) | **Unspecified:** we use **/auth/** on **every** site under rp-id.|
+| --auth-host *url* | Dedicated authentication site, e.g. **auth.example.com** | Use **/auth/** path on each site |
+| --save | Save current options to database | (only --rp-id required on further invocations) |
+
+To clear a stored setting, pass an empty value like `--auth-host=`. The database is stored in `{rp-id}.paskiadb` in current directory. This can be overridden by environment `PASKIA_DB` if needed.
+
+## Tutorial: From Local Testing to Production
+
+This section walks you through a complete example, from running Paskia locally to protecting a real site in production.
+
+### Step 1: Local Testing
+
+For development and testing, run Paskia without any arguments:
+
+```fish
+paskia
+```
+
+This starts the server on [localhost:4401](http://localhost:4401) with passkeys bound to `localhost`. On first run, Paskia prints a registration link for the Master Admin—click it to register your first passkey.
+
+### Step 2: Production Configuration
+
+For a real deployment, configure Paskia with your domain name (rp-id). This enables SSO setup for that domain and any subdomains.
+
+```fish
+paskia --rp-id example.com --rp-name "Example Corp" --save
+```
+
+This binds passkeys to `*.example.com`. The `--rp-name` is shown to users during passkey registration. The `--save` option stores these settings in the database, so future runs only need `paskia --rp-id example.com`.
+
+### Step 3: Set Up Caddy
+
+Install [Caddy](https://caddyserver.com/) and copy the [auth folder](caddy/auth) to `/etc/caddy/auth`. Say your current unprotected Caddyfile looks like this:
+
+```caddyfile
+app.example.com {
+    reverse_proxy :3000
+}
+```
+
+Add Paskia full site protection:
+
+```caddyfile
+app.example.com {
+    import auth/setup
+    handle {
+        import auth/require perm=myapp:login
+        reverse_proxy :3000
+    }
+}
+```
+
+Run `systemctl reload caddy`. Now `app.example.com` requires the `myapp:login` permission. Try accessing it and you'll land on a login dialog.
+
+### Step 4: Assign Permissions via Admin Panel
+
+![Admin panel permissions](https://git.zi.fi/leovasanko/paskia/raw/main/docs/screenshots/master-permissions.webp)
+
+1. Go to `app.example.com/auth/admin/`
+2. Create a permission, give it a name and scope `myapp:login`
+3. Assign it to Organization
+4. In that organization, assign it to the Administration role
+
+Now you have granted yourself the new permission.
+
+Permission scopes are text identifiers with colons as separators that we can use for permission checks. The `myapp:` prefix is a convention to namespace permissions per application—you but you can use other forms as you see fit (urlsafe characters, no spaces allowed).
+
+### Step 5: Add API Authentication to Your App
+
+Your backend already receives `Remote-*` headers from Caddy's forward-auth. For frontend API calls, we provide a [JS paskia module](https://www.npmjs.com/package/paskia):
+
+```js
+import { apiJson } from 'https://cdn.jsdelivr.net/npm/paskia@latest/dist/paskia.js'
+
+const data = await apiJson('/api/sensitive', { method: 'POST' })
+```
+
+When a 401/403 occurs, the auth dialog appears automatically, and the request retries after authentication.
+
+To protect the API path with a different permission, update your Caddyfile:
+
+```caddyfile
+app.example.com {
+    import auth/setup
+
+    @api path /api/*
+    handle @api {
+        import auth/require perm=myapp:api
+        reverse_proxy :3000
+    }
+
+    handle {
+        import auth/require perm=myapp:login
+        reverse_proxy :3000
+    }
+}
+```
+
+Create the `myapp:api` permission in the admin panel, that will be required for all API access. Link to `/auth/` for the built-in profile page.
+
+You may also remove the `myapp:login` protection from the rest of your site paths, unless you wish to keep all your assets behind a login page. Having this as the last entry in your config allows free access to everything not matched by other sections.
+
+```Caddyfile
+    handle {
+        reverse_proxy :3000
+    }
+```
+
+### Step 6: Run Paskia as a Service
+
+Create a system user paskia, install UV on the system, and create a systemd unit:
+
+```fish
+sudo useradd --system --home-dir /srv/paskia --create-home paskia
+curl -LsSf https://astral.sh/uv/install.sh | sudo env UV_INSTALL_DIR=/usr/local/bin sh
+sudo systemctl edit --force --full paskia.service
+```
+
+Paste the following and save:
+
+```ini
+[Unit]
+Description=Paskia Authentication Server
+
+[Service]
+Type=simple
+User=paskia
+WorkingDirectory=/srv/paskia
+ExecStart=uvx paskia --rp-id=example.com
+
+[Install]
+WantedBy=multi-user.target
+```
+
+Then enable and start, view output for registration link:
+
+```fish
+sudo systemctl enable --now paskia && sudo journalctl -u paskia -f -n 20 -o cat
+```
+
 
 ## Further Documentation
 

docs/Integration.md

@@ -1,43 +1,198 @@
 # Integrating Paskia with your App
 
-Protect API routes with forward-auth (see [Caddy configuration](Caddy.md)). Optionally protect your app assets and not just the API.
+This guide covers frontend and backend integration with Paskia. For Caddy forward-auth setup, see [Caddy configuration](Caddy.md).
 
-Catch response status 401/403 in fetch calls to protected endpoints and implement authentication flow in this case. The response is JSON and contains `detail` (an error message describing what is needed) and `auth.iframe` (a URL). Render that URL in an iframe and retry the request after authentication (see below).
+## Frontend Integration
 
-While the app is in (active) use, call `/auth/api/validate` occasionally to keep the session alive (session lifetime is 24h), otherwise the user will have to login every day. Max-age limits are unaffected by this and can be used on endpoints needing to reauthenticate with passkey more frequently.
+### Using the paskia-js Module
 
-Fetch `/auth/api/user-info` to display user/session details, or link to `/auth/` if you prefer using the built-in profile UI and not having to do anything more.
+The [paskia](https://www.npmjs.com/package/paskia) JavaScript module provides utilities for API calls, session validation, and authentication overlays. Works with any framework or vanilla JS.
 
-## Authentication Flow (iframe)
+```html
-
+<script type="module">
-```js
+  import { apiJson, apiFetch, SessionValidator } from 'https://cdn.jsdelivr.net/npm/paskia@latest/dist/paskia.js'
-// Show an authentication dialog
+</script>
-const iframe = document.createElement('iframe')
-iframe.src = auth.url   // from 401/403 response JSON
-iframe.style.cssText = `
-  position: fixed;
-  inset: 0;
-  width: 100%;
-  height: 100%;
-  border: 0;
-  z-index: 9999;
-  background: transparent;
-  backdrop-filter: blur(0.1rem) brightness(0.7);
-`
-document.body.appendChild(iframe)
-
-// Wait until user is finished with the dialog
-const handler = ev => {
-  if (ev.origin !== location.origin) return
-  iframe.remove()
-  removeEventListener('message', handler)
-  if (ev.data?.type === 'auth-success') retry_original_fetch()
-}
-addEventListener('message', handler)
 ```
 
-This describes the frontend flow for handling 401/403 responses from endpoints protected by Paskia forward-auth, without ever exiting your app.
+Or install to your project:
 
-When a protected request fails, the backend returns 401 (needs auth / reauth) or 403 (missing permission). For API requests, the response is JSON that includes an iframe URL. Your app should render that URL in a full-screen iframe overlay, and retry the request after the iframe reports success. If it reports `auth-cancel`, don't try again. The backdrop for the dialog is a stylistic choice, and you can style the background shown with the dialog any way you wish, and consider using CSS file with the iframe rather than inline styles as used in the example.
+```sh
+npm install paskia
+```
 
-Following this flow the user gets authenticated properly and after that your app keeps running as if nothing ever happened.
+### API Fetch with Automatic Auth
+
+Use `apiJson` or `apiFetch` for API calls. When a 401/403 response includes an auth URL, the authentication dialog appears automatically, then the request retries. The JSON variant is purely for convenience, doing JSON headers and conversions for you.
+
+```js
+import { apiJson, apiFetch, AuthCancelledError } from 'paskia'
+
+// JSON API call (sets Content-Type, parses response)
+try {
+  const data = await apiJson('/api/endpoint', { method: 'POST', body: { key: 'value' } })
+} catch (e) {
+  if (e instanceof AuthCancelledError) {
+    // User cancelled auth dialog
+  }
+}
+
+// Raw fetch with auth handling (returns Response object)
+const response = await apiFetch('/api/endpoint')
+```
+
+For requests that shouldn't trigger auth dialogs, use standard `fetch` or our `fetchJson`.
+
+### Session Validation Polling
+
+Keep sessions alive and detect when the user logs out or switches accounts:
+
+```js
+import { SessionValidator } from 'paskia'
+
+const validator = new SessionValidator(
+  () => currentUser?.uuid,              // getter for current user ID
+  (error) => handleSessionLost(error)   // callback when session is lost or user changes
+)
+
+validator.start()  // start polling (pauses on idle)
+validator.stop()   // stop polling
+```
+
+The validator calls `/auth/api/validate` periodically to:
+- Renew the session cookie (24h lifetime)
+- Detect if the user logged out or switched accounts
+- Pause polling when the page is idle, allowing sessions to expire when not used
+
+### Manual Auth Flow
+
+If you need custom control, handle 401/403 responses manually:
+
+```js
+import { showAuthIframe, AuthCancelledError } from 'paskia'
+
+const response = await fetch('/api/protected')
+if (response.status === 401 || response.status === 403) {
+  const data = await response.json()
+  if (data.auth?.iframe) {
+    try {
+      await showAuthIframe(data.auth.iframe)
+      // Retry the original request
+    } catch (e) {
+      if (e instanceof AuthCancelledError) {
+        // User clicked Back
+      }
+    }
+  }
+}
+```
+
+### User Info and Profile
+
+Get current user details:
+
+```js
+const user = await apiJson('/auth/api/user-info', { method: 'POST' })
+// Returns: { uuid, display_name, credentials, sessions, permissions, ... }
+```
+
+Or link to the built-in profile page: `/auth/`
+
+## Backend Integration
+
+### Using Forward-Auth Headers
+
+When using Caddy forward-auth, your backend receives `Remote-*` headers on authenticated requests. See [Headers](Headers.md) for the full list.
+
+```python
+# Example: Python/FastAPI
+@app.get("/api/data")
+def get_data(request: Request):
+    user_id = request.headers.get("Remote-User")
+    org_id = request.headers.get("Remote-Org")
+    permissions = request.headers.get("Remote-Groups", "").split(",")
+    # ...
+```
+
+### Direct Validation from Backend
+
+Your backend can validate sessions directly by calling Paskia's validate endpoint:
+
+```python
+import httpx
+
+async def validate_session(request) -> dict:
+    """Validate a session cookie and check permissions."""
+    authcookie = request.get("__Host-paskia")
+    response = await httpx.post(
+        "http://localhost:4401/auth/api/validate?perm=myapp:login+myapp:api",
+        headers={
+            "Host": request.headers["host"]
+            "X-Forwarded-For": request.client.host,
+            "Cookie": f"__Host-paskia={}",
+        },
+    )
+    if response.status_code != 200:
+        return response.json()  # Return to client
+    # User authenticated... We are good to go!
+    ctx = response.json()  # User and session information
+```
+
+This is useful for:
+- WebSocket connections where headers aren't available after handshake
+- Background jobs that need to verify a stored session
+- APIs not behind forward-auth (auth/restrict)
+
+### Validate Endpoint Parameters
+
+`POST /auth/api/validate` accepts query parameters:
+
+| Parameter | Description |
+|-----------|-------------|
+| `perm=scope:name` | Require this permission (repeatable) |
+| `max_age=5min` | Require recent passkey use |
+
+Returns 200 with user info on success, 401/403 on failure.
+
+## Proxying /auth/ to Paskia
+
+Your app server needs to proxy `/auth/` paths to Paskia. This can be done by your application but is much easier done by Caddy or Nginx.
+
+### Caddy
+
+This handles both HTTP and WebSocket connections. Caddy's `reverse_proxy` handles HTTP and WebSocket transparently. This is essentially what our Caddy [auth/setup](../caddy/auth/setup) snippet does: `reverse_proxy :4401`.
+
+```caddyfile
+app.example.com {
+    import auth/setup
+    # ... your routes in handle blocks
+}
+```
+
+### Nginx
+
+Certain headers need to be configured for correct host and WS support:
+
+```nginx
+location /auth/ {
+    proxy_pass http://localhost:4401;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection "upgrade";
+    proxy_set_header Host $host;
+}
+```
+
+### Node.js / Express
+
+Using `http-proxy-middleware`:
+
+```js
+import { createProxyMiddleware } from 'http-proxy-middleware'
+
+app.use('/auth', createProxyMiddleware({ target: 'http://localhost:4401', ws: true, changeOrigin: false }))
+```
+
+### Python / FastAPI
+
+You will need to process and handle `/auth/` for HTTP requests and `/auth/ws/` for WebSockets manually, which is beyond the scope of this documentation.
+
+We highly recommend Caddy instead as the simpler and more production-worthy solution that Just Works.

examples/index.html

@@ -8,26 +8,6 @@
         :root {
             color-scheme: light dark;  /* Automatic themes by browser */
         }
-        /* Login/reauth/forbidden dialog will appear in this iframe */
-        #auth-iframe {
-            /* Full viewport overlay */
-            border: none;
-            position: fixed;
-            top: 0;
-            left: 0;
-            width: 100%;
-            height: 100%;
-            z-index: 9999;
-            /* Optional transparent background with optional blur backdrop */
-            color-scheme: auto;
-            background: transparent;
-            backdrop-filter: blur(.1rem) brightness(0.7);
-            -webkit-backdrop-filter: blur(.1rem) brightness(0.7);
-        }
-        /* Prevent background scroll when auth-iframe is shown */
-        body:has(#auth-iframe) {
-            overflow: hidden;
-        }
     </style>
 </head>
 <body>
@@ -65,99 +45,50 @@
         </div>
     </div>
 
-    <script>
+    <script type="module">
+        import { apiFetch, apiJson, AuthCancelledError } from '/paskia-js/dist/paskia.js'
+
         const output = document.getElementById('output');
-        let pendingCall = null;  // Stores the API call to retry after auth
-
-        // The auth iframe posts messages when authentication completes or is cancelled.
-        // Message types: 'auth-success' (proceed), 'auth-back' (user cancelled)
-        // Errors during auth stay in the dialog allowing retry, no message is sent.
-        window.addEventListener('message', (event) => {
-            const { type, message } = event.data || {};
-
-            if (type === 'auth-success') {
-                log('✓ Authentication successful, retrying...');
-                hideAuthIframe();
-                // Retry the original API call that triggered authentication
-                if (pendingCall) {
-                    const { url, method } = pendingCall;
-                    pendingCall = null;
-                    apiCall(url, method);
-                }
-            } else if (type === 'auth-back') {
-                log(message || 'Authentication cancelled');
-                hideAuthIframe();
-                pendingCall = null;
-            }
-        });
-
-        // Make an API call, handling 401/403 by showing the auth iframe.
-        // The server returns JSON with auth.iframe URL when authentication is needed.
-        async function apiCall(url, method = 'GET') {
-            log(`${method} ${url}...`);
-
-            const response = await fetch(url, { method });
-
-            // Server returns 401 (login/reauth) or 403 (missing permissions)
-            // with a JSON body containing the iframe URL for authentication
-            if (response.status === 401 || response.status === 403) {
-                const data = await response.json();
-                if (data.auth?.iframe) {
-                    const mode = data.auth.mode;  // 'login' or 'reauth'
-                    log(`${mode === 'reauth' ? 'Re-authentication' : 'Authentication'} required...`);
-                    pendingCall = { url, method };
-                    showAuthIframe(data.auth.iframe);
-                    return;
-                }
-                log(`Error: ${response.status} - ${data.detail}`);
-                return;
-            }
-
-            // Forward endpoint returns 204 on success (Caddy then adds Remote-* headers)
-            if (response.status === 204) {
-                log('✓ Success (204 No Content)\nHeaders:\n' +
-                    [...response.headers].filter(([k]) => k.startsWith('remote-'))
-                        .map(([k, v]) => `  ${k}: ${v}`).join('\n'));
-                return;
-            }
-
-            if (!response.ok) {
-                log(`Error: ${response.status} ${response.statusText}`);
-                return;
-            }
-
-            const data = await response.json();
-            log('✓ Response:\n' + JSON.stringify(data, null, 2));
-        }
-
-        async function logout() {
-            await fetch('/auth/api/logout', { method: 'POST' });
-            log('Logged out');
-        }
-
-        // Create fullscreen iframe for authentication.
-        // The 'allow' attribute enables WebAuthn (passkey) API inside the iframe.
-        function showAuthIframe(url) {
-            hideAuthIframe();
-            const iframe = document.createElement('iframe');
-            iframe.id = 'auth-iframe';
-            iframe.src = url;
-            document.body.appendChild(iframe);
-            log("Authentication dialog open...")
-        }
-
-        function hideAuthIframe() {
-            document.getElementById('auth-iframe')?.remove();
-        }
 
         function log(msg) {
             output.textContent = msg;
         }
 
+        // Make an API call using paskia module (handles 401/403 automatically)
+        window.apiCall = async function(url, method = 'GET') {
+            log(`${method} ${url}...`);
+            try {
+                const response = await apiFetch(url, { method });
+
+                // Forward endpoint returns 204 on success
+                if (response.status === 204) {
+                    log('✓ Success (204 No Content)');
+                    return;
+                }
+
+                if (!response.ok) {
+                    log(`Error: ${response.status} ${response.statusText}`);
+                    return;
+                }
+
+                const data = await response.json();
+                log('✓ Response:\n' + JSON.stringify(data, null, 2));
+            } catch (e) {
+                if (e instanceof AuthCancelledError) {
+                    log('Authentication cancelled');
+                } else {
+                    log(`Error: ${e.message}`);
+                }
+            }
+        }
+
+        window.logout = async function() {
+            await fetch('/auth/api/logout', { method: 'POST' });
+            log('Logged out');
+        }
+
         // Browser mode: open the forward endpoint directly in a new window.
-        // When Accept: text/html, the server redirects to the login page if needed,
+        window.browserNav = function(url) {
-        // then back to the original URL after authentication.
-        function browserNav(url) {
             log('Opening in new window...\nIf not authenticated, you\'ll see the login page.\nAfter auth, you\'ll see a 204 response (blank page = success).');
             window.open(url, '_blank');
         }

frontend/auth/App.vue

@@ -13,7 +13,8 @@
 <script setup>
 import { computed, onMounted, onUnmounted, ref } from 'vue'
 import { useAuthStore } from '@/stores/auth'
-import { apiJson, getAuthIframeUrl } from '@/utils/api'
+import { apiJson, SessionValidator, createAuthIframe, removeAuthIframe } from 'paskia'
+import { getAuthIframeUrl } from '@/utils/api'
 import StatusMessage from '@/components/StatusMessage.vue'
 import ProfileView from '@/components/ProfileView.vue'
 import HostProfileView from '@/components/HostProfileView.vue'
@@ -46,19 +47,23 @@ const isHostMode = computed(() => {
   const configuredHost = normalizeHost(authHost)
   return currentHost !== configuredHost
 })
-let validationTimer = null
+const userUuid = computed(() => store.userInfo?.ctx.user.uuid)
-let authIframe = null
 
 function terminateSession() {
   store.userInfo = null
   viewState.value = 'terminal'
 }
 
+const userUuidGetter = () => store.userInfo?.ctx.user.uuid
+const sessionValidator = new SessionValidator(userUuidGetter, terminateSession)
+
+onMounted(() => sessionValidator.start())
+onUnmounted(() => sessionValidator.stop())
+
 async function loadUserInfo() {
   try {
     store.userInfo = await apiJson('/auth/api/user-info', { method: 'POST' })
     viewState.value = 'profile'
-    startSessionValidation()
     return true
   } catch {
     store.userInfo = null
@@ -67,27 +72,11 @@ async function loadUserInfo() {
 }
 
 async function showAuthIframe() {
-  // Remove existing iframe if any
-  hideAuthIframe()
-
-  // Create new iframe for authentication using src URL
   const url = await getAuthIframeUrl('login')
-  authIframe = document.createElement('iframe')
+  createAuthIframe(url)
-  authIframe.id = 'auth-iframe'
-  authIframe.title = 'Authentication'
-  authIframe.allow = 'publickey-credentials-get; publickey-credentials-create'
-  authIframe.src = url
-  document.body.appendChild(authIframe)
   loadingMessage.value = 'Authentication required...'
 }
 
-function hideAuthIframe() {
-  if (authIframe) {
-    authIframe.remove()
-    authIframe = null
-  }
-}
-
 function handleAuthMessage(event) {
   const data = event.data
   if (!data?.type) return
@@ -95,7 +84,7 @@ function handleAuthMessage(event) {
   switch (data.type) {
     case 'auth-success':
       // Authentication successful - reload user info
-      hideAuthIframe()
+      removeAuthIframe()
       viewState.value = 'loading'
       loadingMessage.value = 'Loading user profile...'
       loadUserInfo()
@@ -117,39 +106,17 @@ function handleAuthMessage(event) {
 
     case 'auth-back':
       // User clicked Back - show terminal state
-      hideAuthIframe()
+      removeAuthIframe()
       terminateSession()
       break
 
     case 'auth-close-request':
       // Legacy support - treat as back
-      hideAuthIframe()
+      removeAuthIframe()
       break
   }
 }
 
-async function validateSession() {
-  try {
-    await apiJson('/auth/api/validate', { method: 'POST' })
-  } catch {
-    stopSessionValidation()
-    terminateSession()
-  }
-}
-
-function startSessionValidation() {
-  // Validate session every 2 minutes
-  stopSessionValidation()
-  validationTimer = setInterval(validateSession, 2 * 60 * 1000)
-}
-
-function stopSessionValidation() {
-  if (validationTimer) {
-    clearInterval(validationTimer)
-    validationTimer = null
-  }
-}
-
 onMounted(async () => {
   // Listen for postMessage from auth iframe
   window.addEventListener('message', handleAuthMessage)
@@ -178,8 +145,7 @@ onMounted(async () => {
 
 onUnmounted(() => {
   window.removeEventListener('message', handleAuthMessage)
-  stopSessionValidation()
+  removeAuthIframe()
-  hideAuthIframe()
 })
 </script>
 

frontend/auth/admin/AdminApp.vue

@@ -12,7 +12,7 @@ import AdminUserDetail from '@/admin/AdminUserDetail.vue'
 import AdminDialogs from '@/admin/AdminDialogs.vue'
 import { useAuthStore } from '@/stores/auth'
 import { adminUiPath, makeUiHref } from '@/utils/settings'
-import { apiJson } from '@/utils/api'
+import { apiJson, SessionValidator } from 'paskia'
 import { getDirection } from '@/utils/keynav'
 import { goBack } from '@/utils/helpers'
 
@@ -157,6 +157,21 @@ function clearSensitiveState() {
   authenticated.value = false
 }
 
+function onSessionLost(e) {
+  clearSensitiveState()
+  if (e.name === 'AuthCancelledError') {
+    showBackMessage.value = true
+  } else {
+    error.value = e.message
+  }
+}
+
+const userUuidGetter = () => info.value?.ctx.user.uuid
+const sessionValidator = new SessionValidator(userUuidGetter, onSessionLost)
+
+onMounted(() => sessionValidator.start())
+onUnmounted(() => sessionValidator.stop())
+
 async function load() {
   loading.value = true
   loadingMessage.value = 'Loading...'
@@ -177,12 +192,7 @@ async function load() {
       }
     } else parseHash()
   } catch (e) {
-    clearSensitiveState()
+    onSessionLost(e)
-    if (e.name === 'AuthCancelledError') {
-      showBackMessage.value = true
-    } else {
-      error.value = e.message
-    }
   } finally {
     loading.value = false
   }
@@ -229,12 +239,44 @@ function deleteOrg(org) {
 
 function createUserInRole(org, role) { openDialog('user-create', { org, role }) }
 
-async function moveUserToRole(org, user, targetRoleDisplayName) {
+function deleteUser(user, userDetail) {
-  if (user.role === targetRoleDisplayName) return
+  const credentialCount = userDetail?.credentials?.length || 0
+  const userUuid = user.uuid
+  const userName = user.display_name
+  const orgUuid = user.org  // org UUID is stored in selectedUser
+
+  if (credentialCount === 0) {
+    // No credentials, safe to delete directly
+    performUserDeletion(userUuid, userName, orgUuid)
+    return
+  }
+
+  const passkeys = credentialCount === 1 ? '1 passkey' : `${credentialCount} passkeys`
+  openDialog('confirm', {
+    message: `Delete user "${userName}" with ${passkeys}? This action cannot be undone.`,
+    action: async () => {
+      await performUserDeletion(userUuid, userName, orgUuid)
+    }
+  })
+}
+
+async function performUserDeletion(userUuid, userName, orgUuid) {
   try {
-    await apiJson(`/auth/api/admin/orgs/${org.uuid}/users/${user.uuid}/role`, {
+    await apiJson(`/auth/api/admin/users/${userUuid}`, { method: 'DELETE' })
+    authStore.showMessage(`User "${userName}" deleted.`, 'success', 2500)
+    await loadOrgs()
+    window.location.hash = `#org/${orgUuid}`
+  } catch (e) {
+    authStore.showMessage(e.message || 'Failed to delete user', 'error')
+  }
+}
+
+async function moveUserToRole(user, targetRoleUuid) {
+  if (user.role_uuid === targetRoleUuid) return
+  try {
+    await apiJson(`/auth/api/admin/users/${user.uuid}/role`, {
       method: 'PATCH',
-      body: { role: targetRoleDisplayName }
+      body: { role_uuid: targetRoleUuid }
     })
     await loadOrgs()
   } catch (e) {
@@ -258,7 +300,7 @@ function onRoleDrop(e, org, role) {
     const data = JSON.parse(e.dataTransfer.getData('text/plain'))
     if (data.org !== org.uuid) return // only within same org
     const user = org.roles.flatMap(r => r.users).find(u => u.uuid === data.user_uuid)
-    if (user) moveUserToRole(org, user, role.display_name)
+    if (user) moveUserToRole(user, role.uuid)
   } catch (_) { /* ignore */ }
 }
 
@@ -269,7 +311,7 @@ function updateRole(role) { openDialog('role-update', { role, name: role.display
 
 function deleteRole(role) {
   // UI only allows deleting empty roles, so no confirmation needed
-  apiJson(`/auth/api/admin/orgs/${role.org}/roles/${role.uuid}`, { method: 'DELETE' })
+  apiJson(`/auth/api/admin/roles/${role.uuid}`, { method: 'DELETE' })
     .then(() => {
       authStore.showMessage(`Role "${role.display_name}" deleted.`, 'success', 2500)
       loadOrgs()
@@ -289,7 +331,7 @@ async function toggleRolePermission(role, pid, checked) {
 
   try {
     const method = checked ? 'POST' : 'DELETE'
-    await apiJson(`/auth/api/admin/orgs/${role.org}/roles/${role.uuid}/permissions/${pid}`, {
+    await apiJson(`/auth/api/admin/roles/${role.uuid}/permissions/${pid}`, {
       method
     })
     await loadOrgs()
@@ -396,7 +438,7 @@ const breadcrumbEntries = computed(() => {
 watch(selectedUser, async (u) => {
   if (!u) { userDetail.value = null; return }
   try {
-    userDetail.value = await apiJson(`/auth/api/admin/orgs/${u.org}/users/${u.uuid}`)
+    userDetail.value = await apiJson(`/auth/api/admin/users/${u.uuid}`)
   } catch (e) {
     userDetail.value = { error: e.message }
   }
@@ -532,7 +574,7 @@ async function refreshUserDetail() {
   await loadOrgs()
   if (selectedUser.value) {
     try {
-      userDetail.value = await apiJson(`/auth/api/admin/orgs/${selectedUser.value.org}/users/${selectedUser.value.uuid}`)
+      userDetail.value = await apiJson(`/auth/api/admin/users/${selectedUser.value.uuid}`)
     } catch (e) { authStore.showMessage(e.message || 'Failed to reload user', 'error') }
   }
 }
@@ -594,7 +636,7 @@ async function submitDialog() {
 
       // Close dialog immediately, then perform async operation
       closeDialog()
-      apiJson(`/auth/api/admin/orgs/${role.org}/roles/${role.uuid}`, { method: 'PATCH', body: { display_name: name } })
+      apiJson(`/auth/api/admin/roles/${role.uuid}`, { method: 'PATCH', body: { display_name: name } })
         .then(() => {
           authStore.showMessage(`Role renamed to "${name}".`, 'success', 2500)
           loadOrgs()
@@ -622,7 +664,7 @@ async function submitDialog() {
 
       // Close dialog immediately, then perform async operation
       closeDialog()
-      apiJson(`/auth/api/admin/orgs/${user.org}/users/${user.uuid}/display-name`, { method: 'PATCH', body: { display_name: name } })
+      apiJson(`/auth/api/admin/users/${user.uuid}/display-name`, { method: 'PATCH', body: { display_name: name } })
         .then(() => {
           authStore.showMessage(`User renamed to "${name}".`, 'success', 2500)
           onUserNameSaved()
@@ -761,6 +803,7 @@ async function submitDialog() {
                   @edit-user-name="editUserName"
                   @close-reg-modal="showRegModal = false"
                   @navigate-out="handlePanelNavigateOut"
+                  @delete-user="deleteUser(selectedUser, userDetail)"
                 />
                 <AdminOrgDetail
                   v-else-if="selectedOrg"

frontend/auth/admin/index.html

@@ -3,7 +3,9 @@
   <head>
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-  <title>Admin</title>
+    <title>Admin</title>
+    <script>(localStorage.getItem('paskia-theme')==='dark'||localStorage.getItem('paskia-theme')!=='light'&&matchMedia('(prefers-color-scheme:dark)').matches)&&document.documentElement.classList.add('dark')</script>
+    <link rel="stylesheet" href="/src/assets/style.css">
   </head>
   <body>
     <div id="admin-app"></div>

frontend/auth/admin/main.js

@@ -1,4 +1,5 @@
-import '@/assets/style.css'
+import { initThemeFromCache } from '@/utils/theme'
+initThemeFromCache()
 
 import { createApp } from 'vue'
 import { createPinia } from 'pinia'

frontend/auth/index.html

@@ -4,6 +4,8 @@
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <title>Auth Profile</title>
+    <script>(localStorage.getItem('paskia-theme')==='dark'||localStorage.getItem('paskia-theme')!=='light'&&matchMedia('(prefers-color-scheme:dark)').matches)&&document.documentElement.classList.add('dark')</script>
+    <link rel="stylesheet" href="/src/assets/style.css">
   </head>
   <body>
     <div id="app"></div>

frontend/auth/main.js

@@ -1,4 +1,5 @@
-import '@/assets/style.css'
+import { initThemeFromCache } from '@/utils/theme'
+initThemeFromCache()
 
 import { createApp } from 'vue'
 import { createPinia } from 'pinia'

frontend/auth/restricted/RestrictedApi.vue

@@ -8,7 +8,7 @@
 </template>
 
 <script setup>
-import { computed, onMounted, ref } from 'vue'
+import { onMounted, ref } from 'vue'
 import RestrictedAuth from '@/components/RestrictedAuth.vue'
 
 // Check if this is a remote auth URL: /auth/{token}
@@ -30,14 +30,9 @@ function extractRemoteToken() {
   return null
 }
 
-// Detect mode from URL hash fragment
+// Parse URL hash fragment
-const authMode = computed(() => {
+const hashParams = new URLSearchParams(window.location.hash.slice(1))
-  const params = new URLSearchParams(window.location.hash.slice(1))
+const authMode = ['reauth', 'forbidden'].includes(hashParams.get('mode')) ? hashParams.get('mode') : 'login'
-  const mode = params.get('mode')
-  if (mode === 'reauth') return 'reauth'
-  if (mode === 'forbidden') return 'forbidden'
-  return 'login'
-})
 
 function postToParent(message) {
   if (window.parent && window.parent !== window) {

frontend/auth/restricted/index.html

@@ -3,6 +3,8 @@
   <head>
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <script>{let t=localStorage.getItem('paskia-theme');if(t!=='light'&&t!=='dark')t=new URLSearchParams(location.hash.slice(1)).get('theme');(t==='dark'||t!=='light'&&matchMedia('(prefers-color-scheme:dark)').matches)&&document.documentElement.classList.add('dark')}</script>
+    <link rel="stylesheet" href="/src/assets/style.css">
   </head>
   <body>
     <div id="app"></div>

frontend/auth/restricted/main.js

@@ -1,6 +1,6 @@
+import './theme.js'
 import { createApp } from 'vue'
 import RestrictedApi from './RestrictedApi.vue'
-import '@/assets/style.css'
 import { initKeyboardNavigation } from '@/utils/keynav'
 
 createApp(RestrictedApi).mount('#app')

frontend/auth/restricted/theme.js

@@ -0,0 +1,11 @@
+// Early theme for restricted app - first URL param wins, then localStorage
+import { applyTheme, getCachedTheme } from '@/utils/theme.js'
+
+function getTheme() {
+  const params = new URLSearchParams(location.hash.slice(1))
+  return params.get('theme') || getCachedTheme() || ''
+}
+
+// Apply theme class to document root
+applyTheme(getTheme())
+addEventListener('hashchange', () => applyTheme(getTheme()))

frontend/int/reset/ResetApp.vue

@@ -59,7 +59,7 @@
 import { computed, onMounted, reactive, ref } from 'vue'
 import passkey from '@/utils/passkey'
 import { getSettings, uiBasePath } from '@/utils/settings'
-import { apiJson, ApiError, getUserFriendlyErrorMessage } from '@/utils/api'
+import { apiJson, ApiError, getUserFriendlyErrorMessage } from 'paskia'
 
 const status = reactive({
   show: false,

frontend/package.json

@@ -10,6 +10,7 @@
   },
   "dependencies": {
     "@simplewebauthn/browser": "^13.1.2",
+    "paskia": "file:../paskia-js",
     "pinia": "^3.0.3",
     "qrcode": "^1.5.4",
     "sirv": "^3.0.2",

frontend/src/admin/AdminOrgDetail.vue

@@ -339,6 +339,7 @@ defineExpose({ focusFirstElement })
           <strong class="role-name" :title="r.uuid">
             <span>{{ r.display_name }}</span>
             <button @click="$emit('updateRole', r)" class="icon-btn" aria-label="Edit role" title="Edit role">✏️</button>
+            <button v-if="r.users.length === 0" @click="$emit('deleteRole', r)" class="icon-btn delete-icon" aria-label="Delete role" title="Delete role">❌</button>
           </strong>
           <div class="role-actions">
             <button @click="$emit('createUserInRole', selectedOrg, r)" class="plus-btn" aria-label="Add user" title="Add user">➕</button>
@@ -369,9 +370,8 @@ defineExpose({ focusFirstElement })
             </li>
           </ul>
         </template>
-        <div v-else class="empty-role" @keydown="e => handleEmptyRoleKeydown(e, roleIndex)">
+        <div v-else class="empty-role">
           <p class="empty-text muted">No members</p>
-          <button @click="$emit('deleteRole', r)" class="icon-btn delete-icon" aria-label="Delete empty role" title="Delete role">❌</button>
         </div>
       </div>
     </div>

frontend/src/admin/AdminUserDetail.vue

@@ -5,7 +5,7 @@ import CredentialList from '@/components/CredentialList.vue'
 import RegistrationLinkModal from '@/components/RegistrationLinkModal.vue'
 import SessionList from '@/components/SessionList.vue'
 import { useAuthStore } from '@/stores/auth'
-import { apiJson } from '@/utils/api'
+import { apiJson } from 'paskia'
 import { getDirection, navigateButtonRow, focusPreferred, focusAtIndex } from '@/utils/keynav'
 
 const props = defineProps({
@@ -17,7 +17,7 @@ const props = defineProps({
   navigationDisabled: { type: Boolean, default: false }
 })
 
-const emit = defineEmits(['generateUserRegistrationLink', 'goOverview', 'openOrg', 'onUserNameSaved', 'closeRegModal', 'editUserName', 'refreshUserDetail', 'navigateOut'])
+const emit = defineEmits(['generateUserRegistrationLink', 'goOverview', 'openOrg', 'onUserNameSaved', 'closeRegModal', 'editUserName', 'refreshUserDetail', 'navigateOut', 'deleteUser'])
 
 const authStore = useAuthStore()
 const terminatingSessions = ref({})
@@ -45,7 +45,7 @@ function handleEditName() {
 
 async function handleDelete(credential) {
   try {
-    const data = await apiJson(`/auth/api/admin/orgs/${props.selectedUser.org}/users/${props.selectedUser.uuid}/credentials/${credential.credential}`, { method: 'DELETE' })
+    const data = await apiJson(`/auth/api/admin/users/${props.selectedUser.uuid}/credentials/${credential.credential}`, { method: 'DELETE' })
     if (data.status === 'ok') {
       emit('onUserNameSaved') // Reuse to refresh user detail
     } else {
@@ -61,7 +61,7 @@ async function handleTerminateSession(session) {
   if (!sessionId) return
   terminatingSessions.value = { ...terminatingSessions.value, [sessionId]: true }
   try {
-    const data = await apiJson(`/auth/api/admin/orgs/${props.selectedUser.org}/users/${props.selectedUser.uuid}/sessions/${sessionId}`, { method: 'DELETE' })
+    const data = await apiJson(`/auth/api/admin/users/${props.selectedUser.uuid}/sessions/${sessionId}`, { method: 'DELETE' })
     if (data.status === 'ok') {
       if (data.current_session_terminated) {
         sessionStorage.clear()
@@ -83,6 +83,10 @@ async function handleTerminateSession(session) {
   }
 }
 
+async function handleDeleteUser() {
+  emit('deleteUser')
+}
+
 // Handle user info section keynav
 function handleUserInfoKeydown(event) {
   if (hasActiveModal.value || props.navigationDisabled) return
@@ -183,24 +187,27 @@ defineExpose({ focusFirstElement })
         :loading="loading"
         :org-display-name="userDetail.org.display_name"
         :role-name="userDetail.role"
-        :update-endpoint="`/auth/api/admin/orgs/${selectedUser.org}/users/${selectedUser.uuid}/display-name`"
+        :update-endpoint="`/auth/api/admin/users/${selectedUser.uuid}/display-name`"
         @saved="$emit('onUserNameSaved')"
         @edit-name="handleEditName"
-      />
+      >
+        <div class="admin-actions">
+          <button
+            class="btn-primary"
+            @click="$emit('generateUserRegistrationLink', selectedUser)"
+            :disabled="loading"
+          >{{ userDetail?.credentials?.length ? 'Recovery Link' : 'Registration Link' }}</button>
+          <button
+            class="btn-danger"
+            @click="handleDeleteUser"
+            :disabled="loading"
+            title="Delete this user"
+          >Delete User</button>
+        </div>
+      </UserBasicInfo>
     </div>
     <div v-if="userDetail?.error" class="error small">{{ userDetail.error }}</div>
     <template v-if="userDetail && !userDetail.error">
-      <div class="registration-actions" ref="regActionsRef" @keydown="handleRegActionsKeydown">
-        <button
-          class="btn-secondary reg-token-btn"
-          @click="$emit('generateUserRegistrationLink', selectedUser)"
-          :disabled="loading"
-        >Generate Registration Token</button>
-        <p class="matrix-hint muted">
-          Generate a one-time registration link so this user can register or add another passkey.
-          Copy the link from the dialog and send it to the user, or have the user scan the QR code on their device.
-        </p>
-      </div>
       <section class="section-block" data-section="registered-passkeys">
         <div class="section-header">
           <h2>Registered Passkeys</h2>
@@ -238,7 +245,7 @@ defineExpose({ focusFirstElement })
     </div>
     <RegistrationLinkModal
       v-if="showRegModal"
-      :endpoint="`/auth/api/admin/orgs/${selectedUser.org}/users/${selectedUser.uuid}/create-link`"
+      :endpoint="`/auth/api/admin/users/${selectedUser.uuid}/create-link`"
       :user-name="userDetail?.display_name || selectedUser.display_name"
       @close="$emit('closeRegModal')"
       @copied="onLinkCopied"
@@ -248,13 +255,11 @@ defineExpose({ focusFirstElement })
 
 <style scoped>
 .user-detail { display: flex; flex-direction: column; gap: var(--space-lg); }
+.admin-actions { display: flex; gap: 0.5rem; }
 .actions { display: flex; flex-wrap: wrap; gap: var(--space-sm); align-items: center; }
 .ancillary-actions { margin-top: -0.5rem; }
-.reg-token-btn { align-self: flex-start; }
-.registration-actions { display: flex; flex-direction: column; gap: 0.5rem; }
 .icon-btn { background: none; border: none; color: var(--color-text-muted); padding: 0.2rem; border-radius: var(--radius-sm); cursor: pointer; transition: background 0.2s ease, color 0.2s ease; }
 .icon-btn:hover { color: var(--color-heading); background: var(--color-surface-muted); }
-.matrix-hint { font-size: 0.8rem; color: var(--color-text-muted); }
 .error { color: var(--color-danger-text); }
 .small { font-size: 0.9rem; }
 .muted { color: var(--color-text-muted); }

frontend/src/assets/style.css

@@ -1,28 +1,37 @@
 
+@property --hue {
+  syntax: '<angle>';
+  inherits: true;
+  initial-value: 0.72turn;
+}
+
 :root {
   --font-sans: "Inter", "Inter var", "Segoe UI", system-ui, -apple-system, "Helvetica Neue", sans-serif;
   --font-mono: "DM Mono", "JetBrains Mono", "SFMono-Regular", Menlo, Monaco, Consolas, "Liberation Mono", monospace;
-  --color-canvas: #ffffff;
+  --color-canvas: white;
-  --color-surface: #eff6ff;
+  --color-surface: oklch(0.97 0.005 var(--hue));
-  --color-surface-subtle: #dbeafe;
+  --color-surface-subtle: oklch(0.94 0.01 var(--hue));
-  --color-border: #2563eb;
+  --color-dialog: white;
-  --color-border-strong: #1e40af;
+  --color-border: oklch(0.8 0.02 var(--hue));
-  --color-heading: #1e3a8a;
+  --color-border-strong: oklch(0.55 0.15 var(--hue));
-  --color-text: #1e293b;
+  --color-heading: oklch(0.3 0.05 var(--hue));
-  --color-text-muted: #475569;
+  --color-text: oklch(0.25 0.02 var(--hue));
-  --color-link: #1d4ed8;
+  --color-text-muted: oklch(0.5 0.02 var(--hue));
-  --color-link-hover: #1e40af;
+  --color-link: oklch(0.5 0.18 var(--hue));
-  --color-accent: #2563eb;
+  --color-link-hover: oklch(0.45 0.2 var(--hue));
-  --color-accent-strong: #1e40af;
+  --color-accent: oklch(0.55 0.2 var(--hue));
-  --color-accent-contrast: #ffffff;
+  --color-accent-strong: oklch(0.45 0.2 var(--hue));
-  --color-success-text: #166534;
+  --color-accent-contrast: white;
-  --color-success-bg: #dcfce7;
+  --color-secondary: oklch(0.55 0.05 var(--hue));
-  --color-error-text: #b91c1c;
+  --color-secondary-strong: oklch(0.45 0.05 var(--hue));
-  --color-error-bg: #fee2e2;
+  --color-success-text: oklch(0.4 0.15 0.4turn);
-  --color-info-text: #1e40af;
+  --color-success-bg: oklch(0.95 0.03 0.4turn);
-  --color-info-bg: #dbeafe;
+  --color-error-text: oklch(0.45 0.2 0.07turn);
-  --color-danger: #dc2626;
+  --color-error-bg: oklch(0.95 0.03 0.07turn);
-  --shadow-soft: 0 10px 30px rgba(30, 64, 175, 0.15);
+  --color-info-text: oklch(0.45 0.15 var(--hue));
+  --color-info-bg: oklch(0.95 0.02 var(--hue));
+  --color-danger: oklch(0.55 0.22 0.07turn);
+  --shadow-soft: 0 0 .2rem black;
   --radius-none: 0;
   --radius-sm: 4px;
   --radius-md: 6px;
@@ -39,30 +48,31 @@
   --focus-ring: 0 0 0 2px var(--color-accent);
 }
 
-@media (prefers-color-scheme: dark) {
+:root.dark {
-  :root {
+  --color-canvas: oklch(0.15 0.03 var(--hue));
-    --color-canvas: #0f172a;
+  --color-surface: oklch(0.18 0.03 var(--hue));
-    --color-surface: #141b2f;
+  --color-surface-subtle: oklch(0.22 0.03 var(--hue));
-    --color-surface-subtle: #1b243b;
+  --color-dialog: oklch(0.22 0.03 var(--hue));
-    --color-border: #25304a;
+  --color-border: oklch(0.3 0.03 var(--hue));
-    --color-border-strong: #3d4d6b;
+  --color-border-strong: oklch(0.4 0.04 var(--hue));
-    --color-heading: #fff;
+  --color-heading: white;
-    --color-text: #e2e8f0;
+  --color-text: oklch(0.9 0.01 var(--hue));
-    --color-text-muted: #94a3b8;
+  --color-text-muted: oklch(0.7 0.02 var(--hue));
-    --color-link: #60a5fa;
+  --color-link: oklch(0.7 0.15 var(--hue));
-    --color-link-hover: #93c5fd;
+  --color-link-hover: oklch(0.8 0.12 var(--hue));
-    --color-accent: #60a5fa;
+  --color-accent: oklch(0.7 0.15 var(--hue));
-    --color-accent-strong: #3b82f6;
+  --color-accent-strong: oklch(0.6 0.18 var(--hue));
-    --color-accent-contrast: #0b1120;
+  --color-accent-contrast: oklch(0.12 0.03 var(--hue));
-    --color-success-text: #34d399;
+  --color-secondary: oklch(0.6 0.05 var(--hue));
-    --color-success-bg: #1a4d2e;
+  --color-secondary-strong: oklch(0.5 0.05 var(--hue));
-    --color-error-text: #fca5a5;
+  --color-success-text: oklch(0.75 0.15 0.4turn);
-    --color-error-bg: #4a1f1f;
+  --color-success-bg: oklch(0.3 0.08 0.4turn);
-    --color-info-text: #bae6fd;
+  --color-error-text: oklch(0.8 0.12 0.07turn);
-    --color-info-bg: #1e3a5f;
+  --color-error-bg: oklch(0.3 0.08 0.07turn);
-    --color-danger: #f87171;
+  --color-info-text: oklch(0.8 0.1 var(--hue));
-    --shadow-soft: 0 0 0 #000000;
+  --color-info-bg: oklch(0.3 0.05 var(--hue));
-  }
+  --color-danger: oklch(0.7 0.18 0.07turn);
+  --shadow-soft: 0 0 0 black;
 }
 
 *,
@@ -78,7 +88,6 @@ html {
 }
 
 body {
-  color-scheme: light dark;
   overflow: auto;
   scrollbar-gutter: stable;
   height: 100%;
@@ -132,6 +141,7 @@ a:focus-visible {
 }
 
 .view-root {
+  position: relative;
   flex: 1;
   width: 100%;
   display: flex;
@@ -229,6 +239,7 @@ button {
   gap: 0.4rem;
   background: var(--color-surface);
   color: var(--color-text);
+  transition: box-shadow var(--transition-base), background var(--transition-base), border-color var(--transition-base);
 }
 
 button:disabled {
@@ -237,43 +248,41 @@ button:disabled {
 }
 
 .btn-primary {
-  background: var(--color-accent);
+  background: linear-gradient(to bottom, oklch(1 0 0 / 0.15), transparent 60%) var(--color-accent);
   color: var(--color-accent-contrast);
   border-color: var(--color-accent);
+}
+
+.btn-primary:hover:not(:disabled),
+.btn-primary:focus-visible {
+  background: linear-gradient(to bottom, oklch(1 0 0 / 0.15), transparent 60%) var(--color-accent-strong);
+  border-color: var(--color-accent-strong);
   box-shadow: var(--shadow-soft);
 }
 
-.btn-primary:hover:not(:disabled) {
-  background: var(--color-accent-strong);
-  border-color: var(--color-accent-strong);
-}
-
 .btn-secondary {
-  background: transparent;
+  background: linear-gradient(to bottom, oklch(1 0 0 / 0.15), transparent 60%) var(--color-secondary);
-  color: var(--color-text);
-  border-color: var(--color-border);
-}
-
-.btn-secondary:hover:not(:disabled) {
-  border-color: var(--color-border-strong);
-  background: var(--color-surface-subtle);
-}
-
-.btn-danger {
-  background: var(--color-danger);
   color: var(--color-accent-contrast);
   border-color: transparent;
 }
 
-.btn-danger:hover:not(:disabled) {
+.btn-secondary:hover:not(:disabled),
-  filter: brightness(0.92);
+.btn-secondary:focus-visible {
+  background: linear-gradient(to bottom, oklch(1 0 0 / 0.15), transparent 60%) var(--color-secondary-strong);
+  box-shadow: var(--shadow-soft);
 }
 
-/* Focus-visible outlines for buttons */
+.btn-danger {
-.btn-primary:focus-visible,
+  background: linear-gradient(to bottom, oklch(1 0 0 / 0.15), transparent 60%) var(--color-danger);
-.btn-secondary:focus-visible,
+  color: var(--color-accent-contrast);
+  border-color: transparent;
+}
+
+.btn-danger:hover:not(:disabled),
 .btn-danger:focus-visible {
-  outline: 1px solid var(-webkit-focus-ring-color);
+  background: linear-gradient(to bottom, oklch(1 0 0 / 0.15), transparent 60%) var(--color-danger);
+  filter: brightness(0.92);
+  box-shadow: var(--shadow-soft);
 }
 
 input[type="text"],
@@ -407,7 +416,7 @@ th {
 
 .device-dialog,
 .modal {
-  background: var(--color-surface);
+  background: var(--color-dialog);
   border: 1px solid var(--color-border);
   border-radius: var(--radius-md);
   width: min(520px, 100%);
@@ -429,7 +438,7 @@ th {
 
 .qr-code {
   padding: 1rem;
-  background: #fff;
+  background: white;
   box-shadow: var(--shadow-soft);
 }
 
@@ -567,7 +576,7 @@ th {
 }
 
 .btn-card-delete { background: transparent; border: none; color: var(--color-danger); padding: 0.35rem 0.5rem; font-size: 1.05rem; line-height: 1; border-radius: var(--radius-sm); cursor: pointer; display: inline-flex; align-items: center; justify-content: center; }
-.btn-card-delete:hover:not(:disabled) { background: #fee; }
+.btn-card-delete:hover:not(:disabled) { filter: brightness(0.85); }
 .btn-card-delete:disabled { filter: opacity(0.4); cursor: not-allowed; }
 
 
@@ -692,8 +701,8 @@ th {
   width: 100vw;
   height: 100vh;
   background: transparent;
-  backdrop-filter: blur(.1rem) brightness(0.7);
+  backdrop-filter: blur(.2rem) brightness(0.7);
-  -webkit-backdrop-filter: blur(.1rem) brightness(0.7);
+  -webkit-backdrop-filter: blur(.2rem) brightness(0.7);
   display: flex;
   align-items: center;
   justify-content: center;
@@ -711,7 +720,7 @@ th {
   width: 100%;
   max-width: 480px;
   padding: 2rem;
-  background: var(--color-surface);
+  background: var(--color-dialog);
   border-radius: var(--radius-lg);
   box-shadow: 0 20px 60px #1e293b;
   border: 1px solid var(--color-border);
@@ -731,42 +740,6 @@ th {
   }
 }
 
-/* Global backdrop controlled by api.js ref-counting */
-body::before {
-  content: '';
-  position: fixed;
-  inset: 0;
-  z-index: 1099;
-  background: transparent;
-  backdrop-filter: blur(0) brightness(1);
-  -webkit-backdrop-filter: blur(0) brightness(1);
-  pointer-events: none;
-  visibility: hidden;
-  transition: all 0.2s ease-out;
-}
-
-body.has-backdrop::before {
-  -webkit-backdrop-filter: blur(.2rem) brightness(0.5);
-  backdrop-filter: blur(.2rem) brightness(0.5);
-  visibility: visible;
-}
-
-body.has-backdrop {
-  overflow: auto;
-}
-
-#auth-iframe {
-  border: none;
-  position: fixed;
-  top: 0;
-  left: 0;
-  width: 100%;
-  height: 100%;
-  z-index: 9999;
-  color-scheme: auto;
-  background: transparent;
-}
-
 .slot-machine {
   padding: 0.875rem 1rem;
   background: var(--color-surface-hover, rgba(0, 0, 0, 0.03));

frontend/src/components/ProfileView.vue

@@ -1,5 +1,8 @@
 <template>
   <section class="view-root" data-view="profile">
+    <div class="theme-toggle">
+      <ThemeSelector />
+    </div>
     <header class="view-header">
       <h1>User Profile</h1>
       <Breadcrumbs ref="breadcrumbs" :entries="breadcrumbEntries" @keydown="handleBreadcrumbKeydown" />
@@ -117,6 +120,7 @@
 import { ref, onMounted, onUnmounted, computed, watch } from 'vue'
 import Breadcrumbs from '@/components/Breadcrumbs.vue'
 import CredentialList from '@/components/CredentialList.vue'
+import ThemeSelector from '@/components/ThemeSelector.vue'
 import UserBasicInfo from '@/components/UserBasicInfo.vue'
 import Modal from '@/components/Modal.vue'
 import NameEditForm from '@/components/NameEditForm.vue'
@@ -127,7 +131,7 @@ import { useAuthStore } from '@/stores/auth'
 import { adminUiPath, makeUiHref } from '@/utils/settings'
 import passkey from '@/utils/passkey'
 import { goBack } from '@/utils/helpers'
-import { apiJson } from '@/utils/api'
+import { apiJson } from 'paskia'
 import { navigateButtonRow, focusPreferred, focusAtIndex, getDirection } from '@/utils/keynav'
 
 const authStore = useAuthStore()
@@ -352,8 +356,6 @@ const saveName = async () => {
 .logout-note { margin: 0.75rem 0 0; color: var(--color-text-muted); font-size: 0.875rem; }
 .remote-auth-inline { display: flex; flex-direction: column; gap: 0.5rem; }
 .remote-auth-label { display: block; margin: 0; font-size: 0.875rem; color: var(--color-text-muted); font-weight: 500; }
-.remote-auth-description {
+.remote-auth-description { font-size: 0.75rem; color: var(--color-text-muted); }
-  font-size: 0.75rem;
+.theme-toggle { position: absolute; top: var(--layout-padding); right: var(--layout-padding); }
-  color: var(--color-text-muted);
-}
 </style>

frontend/src/components/RegistrationLinkModal.vue

@@ -3,14 +3,14 @@
     <div class="device-dialog" role="dialog" aria-modal="true" aria-labelledby="regTitle">
       <div class="reg-header-row">
         <h2 id="regTitle" class="reg-title">
-          📱 <span v-if="userName">Registration for {{ userName }}</span><span v-else>Add Another Device</span>
+          📱 <span v-if="userName">{{ tokenType === 'account recovery' ? 'Recovery' : 'Registration' }} for {{ userName }}</span><span v-else>Add Another Device</span>
         </h2>
         <button class="icon-btn" @click="$emit('close')" aria-label="Close" tabindex="-1">✕</button>
       </div>
 
       <div class="device-link-section">
         <p class="reg-help">
-          Scan this QR code on the new device, or copy the link and open it there.
+          {{ helpText }}
         </p>
 
         <QRCodeDisplay
@@ -33,11 +33,12 @@
 </template>
 
 <script setup>
-import { ref, onMounted, onUnmounted, nextTick } from 'vue'
+import { ref, computed, onMounted, onUnmounted, nextTick } from 'vue'
 import QRCodeDisplay from '@/components/QRCodeDisplay.vue'
-import { apiJson } from '@/utils/api'
+import { apiJson } from 'paskia'
 import { formatDate } from '@/utils/helpers'
 import { getDirection } from '@/utils/keynav'
+import { useAuthStore } from '@/stores/auth'
 
 const props = defineProps({
   endpoint: { type: String, required: true },
@@ -46,19 +47,35 @@ const props = defineProps({
 
 const emit = defineEmits(['close', 'copied'])
 
+const authStore = useAuthStore()
 const dialog = ref(null)
 const linkUrl = ref(null)
 const expiresAt = ref(null)
+const tokenType = ref(null)
 const actionsRow = ref(null)
 // Store the element that had focus before modal opened
 const previouslyFocusedElement = ref(null)
 
+// Determine if this is an admin action for another user
+const isAdminAction = computed(() => !!props.userName)
+
+// Compute the help text based on token type and context
+const helpText = computed(() => {
+  if (!isAdminAction.value) {
+    // User adding their own device
+    return 'Scan this QR code on the new device, or copy the link and open it there.'
+  }
+  // Admin action for another user
+  return `Send this link to ${props.userName}, or have them scan the QR code.`
+})
+
 async function generateLink() {
   try {
     const data = await apiJson(props.endpoint, { method: 'POST' })
     if (data.url) {
       linkUrl.value = data.url
       expiresAt.value = data.expires ? new Date(data.expires) : null
+      tokenType.value = data.token_type || null
 
       // Show the dialog as modal
       await nextTick()
@@ -73,7 +90,8 @@ async function generateLink() {
     } else {
       emit('close')
     }
-  } catch {
+  } catch (e) {
+    authStore.showMessage(e.message || 'Failed to generate link', 'error')
     emit('close')
   }
 }

frontend/src/components/RemoteAuthPermit.vue

@@ -53,7 +53,7 @@
       <!-- Device info display (shown when 3 words match a request) -->
       <div v-else-if="deviceInfo" class="device-info">
         <p class="device-permit-text">Permit {{ deviceInfo.action === 'register' ? 'registration' : 'login' }} to <strong>{{ deviceInfo.host }}</strong></p>
-        <p class="device-meta">{{ deviceInfo.user_agent_pretty }}</p>
+        <p class="device-meta">{{ deviceInfo.user_agent_pretty || '—' }}</p>
 
         <p v-if="error" class="error-message" style="margin-top: 0.5rem;">{{ error }}</p>
 

frontend/src/components/RestrictedAuth.vue

@@ -58,7 +58,7 @@
 import { computed, nextTick, onMounted, onUnmounted, reactive, ref, watch } from 'vue'
 import passkey from '@/utils/passkey'
 import { getSettings, uiBasePath } from '@/utils/settings'
-import { fetchJson, getUserFriendlyErrorMessage } from '@/utils/api'
+import { fetchJson, getUserFriendlyErrorMessage } from 'paskia'
 import RemoteAuthRequest from '@/components/RemoteAuthRequest.vue'
 import { focusDialogButton } from '@/utils/keynav'
 

frontend/src/components/SessionList.vue

@@ -30,7 +30,7 @@
                 @keydown="handleItemKeydown($event, session)"
               >
                 <div class="item-top">
-                  <h4 class="item-title">{{ session.user_agent }}</h4>
+                  <h4 class="item-title">{{ session.user_agent || '—' }}</h4>
                   <div class="item-actions">
                     <span v-if="session.is_current && !hoveredIp && !hoveredCredentialUuid" class="badge badge-current">Current</span>
                     <span v-else-if="hoveredSession?.id === session.id" class="badge badge-current">Selected</span>

frontend/src/components/ThemeSelector.vue

@@ -0,0 +1,48 @@
+<template>
+  <div class="theme-selector" @click.stop>
+    <button v-for="t in themes" :key="t.value" class="theme-icon" :class="{ hidden: isHidden(t.value) }"
+      :style="{ top: getPos(t.value).y + 'px', left: getPos(t.value).x + 'px' }" :title="t.title"
+      @click="handleClick(t.value)">{{ t.icon }}</button>
+  </div>
+</template>
+
+<script setup>
+import { ref, onMounted, onUnmounted } from 'vue'
+import { apiJson } from 'paskia'
+import { updateThemeFromSession, getCachedTheme } from '@/utils/theme'
+
+const open = ref(false), closing = ref(false), closingValue = ref(null), selected = ref(getCachedTheme())
+const themes = [{ value: '', icon: '🌓', title: 'Auto' }, { value: 'light', icon: '☀️', title: 'Light' }, { value: 'dark', icon: '🌙', title: 'Dark' }]
+const center = { x: 16, y: 16 }
+const expanded = { '': { x: 16, y: 0 }, light: { x: 0, y: 28 }, dark: { x: 32, y: 28 } }
+
+const getPos = v => closing.value ? (v === closingValue.value ? center : expanded[v]) : open.value ? expanded[v] : (v === selected.value ? center : expanded[v])
+const isHidden = v => closing.value ? v !== closingValue.value : !open.value && v !== selected.value
+
+function close(v) {
+  closingValue.value = v
+  closing.value = true
+  setTimeout(() => { open.value = closing.value = false; closingValue.value = null }, 200)
+}
+
+function handleClick(v) {
+  if (!open.value) { open.value = true; return }
+  close(v)
+  setTimeout(() => {
+    selected.value = v
+    updateThemeFromSession({ user: { theme: v } }, true)
+    apiJson('/auth/api/user/theme', { method: 'PATCH', body: { theme: v } }).catch(() => {})
+  }, 200)
+}
+
+function onOutside(e) { if (open.value && !closing.value && !e.target.closest('.theme-selector')) close(selected.value) }
+onMounted(() => document.addEventListener('click', onOutside))
+onUnmounted(() => document.removeEventListener('click', onOutside))
+</script>
+
+<style scoped>
+.theme-selector { position: relative; width: 2rem; height: 2rem; }
+.theme-icon { position: absolute; transform: translate(-50%, -50%); background: none; border: none; font-size: 1.25rem; cursor: pointer; padding: 0.25rem; transition: top 0.2s, left 0.2s, opacity 0.15s; }
+.theme-icon:hover, .theme-icon:focus-visible { transform: translate(-50%, -50%) scale(1.15); }
+.theme-icon.hidden { opacity: 0; pointer-events: none; }
+</style>

frontend/src/stores/auth.js

@@ -1,7 +1,8 @@
 import { defineStore } from 'pinia'
 import { register, authenticate } from '@/utils/passkey'
 import { getSettings } from '@/utils/settings'
-import { apiJson } from '@/utils/api'
+import { apiJson } from 'paskia'
+import { updateThemeFromSession } from '@/utils/theme'
 
 export const useAuthStore = defineStore('auth', {
   state: () => ({
@@ -86,6 +87,7 @@ export const useAuthStore = defineStore('auth', {
     async loadUserInfo() {
       try {
         this.userInfo = await apiJson('/auth/api/user-info', { method: 'POST' })
+        updateThemeFromSession(this.userInfo?.ctx)
         console.log('User info loaded:', this.userInfo)
       } catch (error) {
         // Suppress toast for 401/403 errors - the auth iframe will handle these

frontend/src/utils/api.js

@@ -1,77 +1,3 @@
-/**
- * API fetch wrapper that handles authentication errors with iframe-based re-authentication.
- *
- * When a 401 or 403 response is received with an `auth` object containing `iframe` URL,
- * this wrapper shows an authentication iframe and retries the original request after
- * successful authentication.
- */
-
-/** Default timeout for API requests in milliseconds */
-const DEFAULT_TIMEOUT_MS = 1000
-
-/**
- * Custom error class for API errors with full response context.
- */
-export class ApiError extends Error {
-  constructor(url, response, data) {
-    super(data?.detail || `Request failed: ${response.status}`)
-    this.name = 'ApiError'
-    this.url = url
-    this.status = response.status
-    this.statusText = response.statusText
-    this.data = data
-  }
-}
-
-/**
- * Custom error class for network/timeout errors.
- */
-export class NetworkError extends Error {
-  constructor(message, originalError = null) {
-    super(message)
-    this.name = 'NetworkError'
-    this.originalError = originalError
-  }
-}
-
-/**
- * Error thrown when user cancels authentication.
- */
-export class AuthCancelledError extends Error {
-  constructor() {
-    super('Authentication cancelled')
-    this.name = 'AuthCancelledError'
-  }
-}
-
-let authIframe = null
-let authPromise = null
-let authResolve = null
-let authReject = null
-
-// Global backdrop ref-count (works independently of Pinia store)
-let backdropHolders = 0
-
-/**
- * Hold global backdrop (increment ref-count).
- * Multiple callers can hold the backdrop; it only hides when all release.
- */
-export function holdGlobalBackdrop() {
-  backdropHolders++
-  document.body.classList.add('has-backdrop')
-}
-
-/**
- * Release global backdrop (decrement ref-count).
- * Backdrop hides only when ref-count reaches zero.
- */
-export function releaseGlobalBackdrop() {
-  backdropHolders = Math.max(0, backdropHolders - 1)
-  if (backdropHolders === 0) {
-    document.body.classList.remove('has-backdrop')
-  }
-}
-
 // Cache for auth iframe URL by mode
 const authIframeUrlCache = {}
 
@@ -104,302 +30,3 @@ export async function getAuthIframeUrl(mode = 'login') {
   }
   throw new Error('Unable to fetch auth iframe URL')
 }
-
-/**
- * Check if an auth iframe is already open (from any source).
- * @returns {boolean}
- */
-export function isAuthIframeOpen() {
-  return !!document.getElementById('auth-iframe')
-}
-
-/**
- * Show the authentication iframe and return a promise that resolves on success.
- * If an auth iframe is already open (from any source), hooks into its completion.
- * Uses global backdrop system to avoid flicker between auth and caller's UI.
- * @param {string} iframeUrl - The URL for the iframe src
- * @returns {Promise<void>}
- * @throws {AuthCancelledError} - If authentication is cancelled by user
- */
-export function showAuthIframe(iframeUrl) {
-  // If we already have a promise (from us), return it
-  if (authPromise) return authPromise
-
-  // If there's already an iframe in the DOM (from App.vue or elsewhere),
-  // create a promise that hooks into the message handler
-  if (document.getElementById('auth-iframe')) {
-    authPromise = new Promise((resolve, reject) => {
-      authResolve = resolve
-      authReject = reject
-    })
-    return authPromise
-  }
-
-  authPromise = new Promise((resolve, reject) => {
-    authResolve = resolve
-    authReject = reject
-  })
-
-  // Remove existing iframe if any
-  hideAuthIframe()
-
-  // Hold global backdrop for auth iframe
-  holdGlobalBackdrop()
-
-  // Create new iframe for authentication using src URL
-  authIframe = document.createElement('iframe')
-  authIframe.id = 'auth-iframe'
-  authIframe.title = 'Authentication'
-  authIframe.allow = 'publickey-credentials-get; publickey-credentials-create'
-  authIframe.src = iframeUrl
-  document.body.appendChild(authIframe)
-
-  return authPromise
-}
-
-function hideAuthIframe() {
-  if (authIframe) {
-    authIframe.remove()
-    authIframe = null
-    releaseGlobalBackdrop()
-  }
-}
-
-function handleAuthMessage(event) {
-  const data = event.data
-  if (!data?.type) return
-
-  switch (data.type) {
-    case 'auth-success':
-      hideAuthIframe()
-      if (authResolve) {
-        authResolve()
-        authPromise = null
-        authResolve = null
-        authReject = null
-      }
-      break
-
-    case 'auth-back':
-    case 'auth-close-request':
-      hideAuthIframe()
-      if (authReject) {
-        authReject(new AuthCancelledError())
-        authPromise = null
-        authResolve = null
-        authReject = null
-      }
-      break
-
-    case 'auth-error':
-      // Keep iframe open for retry, but if cancelled, treat as back
-      if (data.cancelled && authReject) {
-        hideAuthIframe()
-        authReject(new AuthCancelledError())
-        authPromise = null
-        authResolve = null
-        authReject = null
-      }
-      break
-  }
-}
-
-// Install global message listener
-if (typeof window !== 'undefined') {
-  window.addEventListener('message', handleAuthMessage)
-}
-
-/**
- * Fetch wrapper that handles auth errors with iframe-based re-authentication.
- * Loops until successful or user cancels authentication.
- *
- * @param {string|URL} url - The URL to fetch
- * @param {RequestInit} [options] - Fetch options
- * @param {number} [options.timeout] - Timeout in ms (default: 10000, use 0 to disable)
- * @returns {Promise<Response>} - The fetch response
- * @throws {AuthCancelledError} - If authentication is cancelled by user
- * @throws {NetworkError} - If network error or timeout occurs
- */
-export async function apiFetch(url, options = {}) {
-  const { timeout = DEFAULT_TIMEOUT_MS, ...fetchOptions } = options
-
-  // Ensure credentials are included for cookie-based auth
-  fetchOptions.credentials = fetchOptions.credentials || 'include'
-
-  while (true) {
-    let response
-    try {
-      response = await fetch(url, {...fetchOptions, signal: timeout && AbortSignal.timeout(timeout)})
-    } catch (error) {
-      // Handle network errors and timeouts
-      if (error.name === 'TimeoutError') {
-        throw new NetworkError('Request timed out', error)
-      }
-      if (error.name === 'AbortError') {
-        // Re-throw abort errors as-is (user-initiated cancellation)
-        throw error
-      }
-      if (error.name === 'TypeError' && error.message === 'Failed to fetch') {
-        throw new NetworkError('Unable to connect to server', error)
-      }
-      throw new NetworkError(error.message || 'Network error', error)
-    }
-
-    // Check for auth errors (401/403)
-    if (response.status === 401 || response.status === 403) {
-      // Try to parse the response to get the iframe URL
-      let authInfo = null
-      try {
-        const data = await response.clone().json()
-        authInfo = data.auth
-      } catch {
-        // If we can't parse JSON, no iframe available
-      }
-
-      // Authenticate via iframe (only in top-level window)
-      if (authInfo?.iframe && window === window.top) {
-        // Show auth iframe (or wait for existing one) and retry on success
-        // showAuthIframe returns existing promise if iframe is already open
-        await showAuthIframe(authInfo.iframe)
-        continue  // Retry the original request
-      }
-    }
-
-    return response
-  }
-}
-
-/**
- * Convenience method for JSON API calls.
- * Automatically sets Accept and Content-Type headers.
- * Returns parsed JSON directly if response is ok, throws ApiError otherwise.
- *
- * @param {string|URL} url - The URL to fetch
- * @param {RequestInit} [options] - Fetch options
- * @returns {Promise<any>} - Parsed JSON response
- * @throws {ApiError} - If response is not ok
- * @throws {NetworkError} - If network error or timeout occurs
- * @throws {AuthCancelledError} - If authentication is cancelled by user
- */
-export async function apiJson(url, options = {}) {
-  const fetchOptions = { ...options }
-
-  // Set default headers, allowing caller overrides
-  fetchOptions.headers = {
-    'Accept': 'application/json',
-    ...fetchOptions.headers,
-  }
-
-  // Set Content-Type for requests with JSON body
-  if (fetchOptions.body && typeof fetchOptions.body === 'object' && !(fetchOptions.body instanceof FormData)) {
-    fetchOptions.headers = {
-      'Content-Type': 'application/json',
-      ...fetchOptions.headers,
-    }
-    fetchOptions.body = JSON.stringify(fetchOptions.body)
-  }
-
-  const response = await apiFetch(url, fetchOptions)
-  const data = await response.json()
-
-  if (!response.ok) {
-    throw new ApiError(url, response, data)
-  }
-
-  return data
-}
-
-/**
- * Simple JSON fetch without auto-auth iframe handling.
- * Use this in contexts where showing an auth iframe would be inappropriate
- * (e.g., inside the auth iframe itself).
- *
- * @param {string|URL} url - The URL to fetch
- * @param {RequestInit} [options] - Fetch options
- * @returns {Promise<any>} - Parsed JSON response
- * @throws {ApiError} - If response is not ok
- */
-export async function fetchJson(url, options = {}) {
-  const fetchOptions = {
-    ...options,
-    headers: {
-      'Accept': 'application/json',
-      ...options.headers,
-    },
-  }
-
-  const response = await fetch(url, fetchOptions)
-  const data = await response.json()
-
-  if (!response.ok) {
-    throw new ApiError(url, response, data)
-  }
-
-  return data
-}
-
-/**
- * Convert an error to a user-friendly message.
- * @param {Error} error - The error to convert
- * @returns {string} - User-friendly error message
- */
-export function getUserFriendlyErrorMessage(error) {
-  if (error instanceof NetworkError) {
-    return error.message
-  }
-  if (error instanceof ApiError) {
-    return error.message
-  }
-  if (error.name === 'TimeoutError') {
-    return 'Request timed out'
-  }
-  if (error.name === 'TypeError' && error.message === 'Failed to fetch') {
-    return 'Unable to connect to server'
-  }
-  return error.message || 'An error occurred'
-}
-
-/**
- * Check if an error should show a toast to the user.
- * @param {Error} error - The error to check
- * @returns {boolean} - Whether to show a toast
- */
-export function shouldShowErrorToast(error) {
-  // Don't show toast for user cancellations
-  if (error instanceof AuthCancelledError) return false
-  if (error.name === 'AbortError') return false
-  // Don't show toast for 401/403 errors - the auth iframe will handle these
-  if (error instanceof ApiError && (error.status === 401 || error.status === 403)) return false
-  return true
-}
-
-/**
- * Create an API caller with error handling (toast + console.error).
- * Wraps apiJson calls with consistent error handling for apps.
- *
- * @param {Function} showMessage - Function to show toast messages: (message, type, duration) => void
- * @returns {Function} - Wrapped apiJson that handles errors
- */
-export function createApiCaller(showMessage) {
-  /**
-   * @param {string|URL} url - The URL to fetch
-   * @param {RequestInit} [options] - Fetch options
-   * @returns {Promise<any>} - Parsed JSON response, or undefined on error
-   */
-  return async function apiCall(url, options = {}) {
-    try {
-      return await apiJson(url, options)
-    } catch (error) {
-      if (!shouldShowErrorToast(error)) {
-        throw error
-      }
-      // Log full error details
-      console.error(`API error for ${url}:`, error instanceof ApiError ? { status: error.status, statusText: error.statusText, data: error.data } : error)
-      // Show user-friendly toast
-      showMessage(getUserFriendlyErrorMessage(error), 'error', 4000)
-      throw error
-    }
-  }
-}
-
-export default apiFetch

frontend/src/utils/passkey.js

@@ -1,7 +1,7 @@
 import { startRegistration, startAuthentication } from '@simplewebauthn/browser'
 import aWebSocket from '@/utils/awaitable-websocket'
 import { getSettings } from '@/utils/settings'
-import { showAuthIframe } from '@/utils/api'
+import { showAuthIframe } from 'paskia'
 
 // Generic path normalizer: if an auth_host is configured and differs from current
 // host, return absolute URL (scheme derived by aWebSocket). Otherwise, keep as-is.

frontend/src/utils/theme.js

@@ -0,0 +1,46 @@
+// Theme override utilities - shared across apps
+// User preference or URL hash can force light/dark mode
+
+const TRANSITION_ID = 'theme-transition'
+const STORAGE_KEY = 'paskia-theme'
+
+/** Apply theme by setting class on documentElement */
+export function applyTheme(theme, element = document.documentElement, animate = false) {
+  // Add temporary transition for smooth theme change
+  if (animate) {
+    let transitionStyle = document.getElementById(TRANSITION_ID)
+    if (!transitionStyle) {
+      transitionStyle = document.createElement('style')
+      transitionStyle.id = TRANSITION_ID
+      transitionStyle.textContent = '*, *::before, *::after { transition: background-color 0.3s, color 0.3s, border-color 0.3s, box-shadow 0.3s !important; }'
+      document.head.appendChild(transitionStyle)
+    }
+    setTimeout(() => document.getElementById(TRANSITION_ID)?.remove(), 350)
+  }
+  // If no explicit theme, check system preference
+  const isDark = theme === 'dark' || (theme !== 'light' && matchMedia('(prefers-color-scheme:dark)').matches)
+  element.classList.toggle('dark', isDark)
+}
+
+/** Get theme from localStorage cache */
+export function getCachedTheme() {
+  return localStorage.getItem(STORAGE_KEY) || ''
+}
+
+/** Cache theme in localStorage */
+export function setCachedTheme(theme) {
+  if (theme) localStorage.setItem(STORAGE_KEY, theme)
+  else localStorage.removeItem(STORAGE_KEY)
+}
+
+/** Initialize theme from user preference (with localStorage cache for fast load) */
+export function initThemeFromCache() {
+  applyTheme(getCachedTheme())
+}
+
+/** Update theme from session context (call after login/session load) */
+export function updateThemeFromSession(ctx, animate = false) {
+  const theme = ctx?.user?.theme || ''
+  setCachedTheme(theme)
+  applyTheme(theme, document.documentElement, animate)
+}

frontend/vite-plugin-fastapi.js

@@ -1,17 +1,18 @@
 /**
  * FastAPI-Vue Vite Plugin
+ * auto-upgrade@fastapi-vue-setup -- remove this if you edit the plugin
  *
  * Configures Vite for FastAPI backend integration:
  * - Proxies /api/* requests to the FastAPI backend
  * - Builds to the Python module's frontend-build directory
  *
- * Environment variables (with defaults):
+ * Options:
- *   FASTAPI_VUE_BACKEND_URL=http://localhost:5180 - Backend API URL for proxying
+ *   paths - Array of paths to proxy (default: ["/api"])
  */
 
-const backendUrl = process.env.FASTAPI_VUE_BACKEND_URL || "http://localhost:5180"
-
 export default function fastapiVue({ paths = ["/api"] } = {}) {
+  const backendUrl = process.env.PASKIA_BACKEND_URL || "http://localhost:4402"
+
   // Build proxy configuration for each path
   const proxy = {}
   for (const path of paths) {
@@ -23,7 +24,7 @@ export default function fastapiVue({ paths = ["/api"] } = {}) {
   }
 
   return {
-    name: "fastapi-vite",
+    name: "vite-plugin-fastapi-paskia",
     config: () => ({
       server: { proxy },
       build: {

frontend/vite.config.js

@@ -90,7 +90,9 @@ export default defineConfig(({ command }) => ({
     }
   ].filter(Boolean),
   resolve: {
-    alias: { '@': fileURLToPath(new URL('./src', import.meta.url)) }
+    alias: {
+      '@': fileURLToPath(new URL('./src', import.meta.url)),
+    }
   },
   base: '/',
   server: {

paskia-js/.gitignore

@@ -0,0 +1,30 @@
+# Logs
+logs
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+pnpm-debug.log*
+lerna-debug.log*
+
+node_modules
+.DS_Store
+dist
+dist-ssr
+coverage
+*.local
+
+/cypress/videos/
+/cypress/screenshots/
+
+# Editor directories and files
+.vscode/*
+!.vscode/extensions.json
+.idea
+*.suo
+*.ntvs*
+*.njsproj
+*.sln
+*.sw?
+
+*.tsbuildinfo

paskia-js/README.md

@@ -0,0 +1,131 @@
+# Paskia
+
+![Screenshot](https://git.zi.fi/leovasanko/paskia/raw/main/docs/screenshots/forbidden-light.webp)
+
+JavaScript utilities for [Paskia authentication system](https://git.zi.fi/leovasanko/paskia) integration into web apps.
+
+## Installation
+
+### NPM
+
+No framework dependencies. Works with any framework (Vue, React, Svelte, etc.) or vanilla JS. Typescript typing included.
+
+```sh
+npm install paskia
+```
+
+```js
+import { ... } from 'paskia'
+```
+
+### Plain JavaScript
+
+Fetch the module directly from a CDN, or [download](https://cdn.jsdelivr.net/npm/paskia@latest/dist/paskia.js) first and host yourself. No Node needed.
+
+```html
+<script type="module">
+  import { ... } from 'https://cdn.jsdelivr.net/npm/paskia@latest/dist/paskia.js'
+</script>
+```
+
+## Features
+
+### Session Validation
+
+Refresh session and track its validity with automatic polling. Pauses on lack of user activity to avoid useless traffic and to allow session expiry even when the page is left open but idle. This monitors that the same account stays logged in but doesn't do any permission checks.
+
+```js
+import { SessionValidator } from 'paskia'
+
+const validator = new SessionValidator(
+  () => currentUser?.uuid,  // getter for current user ID that we track
+  (error) => handleSessionLost(error)  // callback when session is lost
+)
+
+validator.start()  // call at your app startup/login
+validator.stop()   // stop the system (optional)
+```
+
+### API Fetch Utilities
+
+Enhanced fetch functions with automatic error handling and authentication retry:
+
+```js
+import { apiJson, apiFetch } from 'paskia'
+
+// JSON API calls with automatic auth handling
+const data = await apiJson('/api/endpoint', { method: 'POST', body: { key: 'value' } })
+
+// Raw fetch with auth handling
+const response = await apiFetch('/api/endpoint')
+```
+
+When a 401/403 response includes an auth iframe URL, the request automatically pauses, displays the authentication UI, and retries upon success. In case this is not needed, use standard `fetch` or our `fetchJson`.
+
+The JSON variants set headers automatically, with body and response in JSON.
+
+### Authentication Overlay
+
+Normally you use apiJson/apiFetch and they handle this automatically. If you need to wire it yourself, on a 401/403 response that includes `auth.iframe`, call `showAuthIframe(...)` and then retry the original request.
+
+The backend returns 401/403 responses with the correct URL for proper user feedback. Alternatively you may use `/auth/restricted/#mode=login`, `mode=reauth` or `mode=forbidden` to trigger the UX flow you need.
+
+```js
+import { showAuthIframe, AuthCancelledError } from 'paskia'
+
+const response = await fetch('/api/protected')
+if (response.status === 401 || response.status === 403) {
+  const data = await response.json()
+  if (data.auth?.iframe) {
+    await showAuthIframe(data.auth.iframe)  // Raises AuthCancelledError if the user cancels
+  }
+}
+```
+
+This resolves after the user authenticates (possibly with another account than previously), and you should usually retry the original API request. Note that successful authentication doesn't guarantee that the user still has rights to what originally failed.
+
+### Shared Blur Backdrop
+
+The authentication dialog displays with a blur backdrop (z-index 1099). The auth iframe uses z-index 9999. Your app dialogs should use z-index 1100–9998 to appear above the backdrop but below authentication.
+
+The backdrop is also reusable/refcounted, so you can keep consistent visuals for your own dialogs:
+
+```js
+import { holdGlobalBackdrop, releaseGlobalBackdrop } from 'paskia'
+
+holdGlobalBackdrop()
+try {
+  await your.own.dialog()
+} finally {
+  releaseGlobalBackdrop()
+}
+```
+
+The backdrop only disappears after all holders have released it.
+
+## Error Handling
+
+### AuthCancelledError (apiFetch, apiJson, showAuthIframe)
+
+If the user clicks Back in the authentication dialog, refusing to authenticate, `AuthCancelledError` is risen (as a response to postMessage from the iframe). The dialog closes as expected and it is up to the app how to continue from there.
+
+- Do nothing if the app can continue despite the failed operation (no UI notification needed)
+- Display a simple Access Denied page with suggestion/button to reload the page to try again
+
+Do not retry automatically.
+
+### UI feedback
+
+A set of small utilities are available for determining whether the user needs a notification and to format the error message.
+
+```js
+import { getUserFriendlyErrorMessage, shouldShowErrorToast } from 'paskia'
+
+try {
+  await apiJson('/api/action')
+} catch (e) {
+  if (shouldShowErrorToast(e)) {
+    your.message.display(getUserFriendlyErrorMessage(e))
+  }
+}
+```

paskia-js/package.json

@@ -0,0 +1,41 @@
+{
+  "name": "paskia",
+  "version": "0.1.3",
+  "description": "Paskia authentication utilities for JavaScript",
+  "author": "Leo Vasanko",
+  "license": "Unlicense",
+  "homepage": "https://git.zi.fi/LeoVasanko/paskia",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/LeoVasanko/paskia",
+    "directory": "paskia-js"
+  },
+  "type": "module",
+  "main": "./dist/paskia.js",
+  "types": "./dist/paskia.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/paskia.d.ts",
+      "import": "./dist/paskia.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "vite build",
+    "prepublishOnly": "npm run build"
+  },
+  "devDependencies": {
+    "typescript": "~5.8.0",
+    "vite": "^7.3.1",
+    "vite-plugin-dts": "^4.5.4"
+  },
+  "keywords": [
+    "auth",
+    "authentication",
+    "paskia",
+    "passkey",
+    "webauthn"
+  ]
+}

paskia-js/src/fetch.ts

@@ -0,0 +1,146 @@
+import { showAuthIframe, AuthCancelledError } from './overlay'
+
+export { AuthCancelledError }
+
+const DEFAULT_TIMEOUT_MS = 1000
+
+export interface ApiFetchOptions extends RequestInit {
+  timeout?: number
+}
+
+export interface FetchJsonOptions extends Omit<RequestInit, 'body'> {
+  timeout?: number
+  body?: BodyInit | Record<string, unknown> | null
+}
+
+export class ApiError extends Error {
+  readonly url: string
+  readonly status: number
+  readonly statusText: string
+  readonly data: unknown
+
+  constructor(url: string, response: Response, data: unknown) {
+    super((data as { detail?: string })?.detail || `Request failed: ${response.status}`)
+    this.name = 'ApiError'
+    this.url = url
+    this.status = response.status
+    this.statusText = response.statusText
+    this.data = data
+  }
+}
+
+export class NetworkError extends Error {
+  readonly originalError: Error | null
+
+  constructor(message: string, originalError: Error | null = null) {
+    super(message)
+    this.name = 'NetworkError'
+    this.originalError = originalError
+  }
+}
+
+export async function apiFetch(url: string, options: ApiFetchOptions = {}): Promise<Response> {
+  const { timeout = DEFAULT_TIMEOUT_MS, ...fetchOptions } = options
+  fetchOptions.credentials = fetchOptions.credentials || 'include'
+
+  while (true) {
+    let response: Response
+    try {
+      response = await fetch(url, {...fetchOptions, signal: timeout ? AbortSignal.timeout(timeout) : undefined})
+    } catch (error) {
+      const err = error as Error
+      if (err.name === 'TimeoutError') {
+        throw new NetworkError('Request timed out', err)
+      }
+      if (err.name === 'AbortError') {
+        throw error
+      }
+      if (err.name === 'TypeError' && err.message === 'Failed to fetch') {
+        throw new NetworkError('Unable to connect to server', err)
+      }
+      throw new NetworkError(err.message || 'Network error', err)
+    }
+
+    if (response.status === 401 || response.status === 403) {
+      let data: { auth?: { iframe?: string } } | null = null
+      try {
+        data = await response.clone().json()
+      } catch {}
+      if (data?.auth?.iframe && window === window.top) {
+        await showAuthIframe(data.auth.iframe)
+        continue  // Retry the original request after successful auth
+      }
+    }
+
+    return response
+  }
+}
+
+type FetchFn = (url: string, options?: RequestInit) => Promise<Response>
+
+export async function apiJson<T = unknown>(url: string, options: FetchJsonOptions = {}): Promise<T> {
+  return fetchJson<T>(url, options, apiFetch)
+}
+
+export async function fetchJson<T = unknown>(url: string, options: FetchJsonOptions = {}, fetchFn: FetchFn = fetch): Promise<T> {
+  const headers: Record<string, string> = {
+    'Accept': 'application/json',
+    ...(options.headers as Record<string, string>),
+  }
+
+  let body: BodyInit | undefined
+  if (options.body && typeof options.body === 'object' && !(options.body instanceof FormData)) {
+    headers['Content-Type'] = 'application/json'
+    body = JSON.stringify(options.body)
+  } else {
+    body = options.body as BodyInit
+  }
+
+  const opt: RequestInit = { ...options, headers, body }
+
+  const response = await fetchFn(url, opt)
+  const data = await response.json() as T
+
+  if (!response.ok) {
+    throw new ApiError(url, response, data)
+  }
+
+  return data
+}
+
+export function getUserFriendlyErrorMessage(error: Error): string {
+  if (error instanceof NetworkError) return error.message
+  if (error instanceof ApiError) return error.message
+  if (error.name === 'TimeoutError') return 'Request timed out'
+  if (error.name === 'TypeError' && error.message === 'Failed to fetch') {
+    return 'Unable to connect to server'
+  }
+  return error.message || 'An error occurred'
+}
+
+export function shouldShowErrorToast(error: Error): boolean {
+  if (error instanceof AuthCancelledError) return false
+  if (error.name === 'AbortError') return false
+  if (error instanceof ApiError && (error.status === 401 || error.status === 403)) return false
+  return true
+}
+
+type ShowMessageFn = (message: string, type: string, duration: number) => void
+
+export function createApiCaller(showMessage: ShowMessageFn) {
+  return async function apiCall<T = unknown>(url: string, options: FetchJsonOptions = {}): Promise<T> {
+    try {
+      return await apiJson<T>(url, options)
+    } catch (error) {
+      if (!shouldShowErrorToast(error as Error)) {
+        throw error
+      }
+      const err = error as Error
+      console.error(`API error for ${url}:`, err instanceof ApiError ? { status: err.status, statusText: err.statusText, data: err.data } : err)
+      showMessage(getUserFriendlyErrorMessage(err), 'error', 4000)
+      throw error
+    }
+  }
+}
+
+export default apiFetch

paskia-js/src/index.ts

@@ -0,0 +1,25 @@
+export {
+  ApiError,
+  NetworkError,
+  AuthCancelledError,
+  apiFetch,
+  apiJson,
+  fetchJson,
+  getUserFriendlyErrorMessage,
+  shouldShowErrorToast,
+  createApiCaller,
+} from './fetch'
+
+export type { ApiFetchOptions, FetchJsonOptions } from './fetch'
+
+export {
+  holdGlobalBackdrop,
+  releaseGlobalBackdrop,
+  isAuthIframeOpen,
+  hideAuthIframe,
+  showAuthIframe,
+  createAuthIframe,
+  removeAuthIframe,
+} from './overlay'
+
+export { SessionValidator } from './validate'

paskia-js/src/overlay.ts

@@ -0,0 +1,166 @@
+const AUTH_IFRAME_ID = 'paskia-iframe'
+const STYLES_ID = 'paskia-dialog'
+const STYLES_TEXT = `\
+body::before {
+  content: '';
+  position: fixed;
+  inset: 0;
+  z-index: 1099;
+  background: transparent;
+  backdrop-filter: blur(0) brightness(1);
+  -webkit-backdrop-filter: blur(0) brightness(1);
+  pointer-events: none;
+  visibility: hidden;
+  transition: all 0.2s ease-out;
+}
+body.paskia-backdrop::before {
+  backdrop-filter: blur(.2rem) brightness(0.7);
+  -webkit-backdrop-filter: blur(.2rem) brightness(0.7);
+  visibility: visible;
+}
+body.paskia-backdrop {
+  overflow: auto;
+}
+#${AUTH_IFRAME_ID} {
+  border: none;
+  position: fixed;
+  top: 0;
+  left: 0;
+  width: 100%;
+  height: 100%;
+  z-index: 9999;
+  color-scheme: auto;
+  background: transparent;
+}
+`
+
+let authIframe: HTMLIFrameElement | null = null
+let authPromise: Promise<void> | null = null
+let authResolve: (() => void) | null = null
+let authReject: ((error: Error) => void) | null = null
+let messageListenerInstalled = false
+let backdropHolders = 0
+
+function injectStyles(): void {
+  if (document.getElementById(STYLES_ID)) return
+  const style = document.createElement('style')
+  style.id = STYLES_ID
+  style.textContent = STYLES_TEXT
+  document.head.insertBefore(style, document.head.firstChild)
+}
+
+export class AuthCancelledError extends Error {
+  constructor() {
+    super('Authentication cancelled')
+    this.name = 'AuthCancelledError'
+  }
+}
+
+export function holdGlobalBackdrop(): void {
+  backdropHolders++
+  document.body.classList.add('paskia-backdrop')
+}
+
+export function releaseGlobalBackdrop(): void {
+  backdropHolders = Math.max(0, backdropHolders - 1)
+  if (backdropHolders === 0) {
+    document.body.classList.remove('paskia-backdrop')
+  }
+}
+
+export function isAuthIframeOpen(): boolean {
+  return !!document.getElementById(AUTH_IFRAME_ID)
+}
+
+export function hideAuthIframe(): void {
+  if (authIframe) {
+    authIframe.remove()
+    authIframe = null
+    releaseGlobalBackdrop()
+  }
+}
+
+function handleAuthMessage(event: MessageEvent): void {
+  const data = event.data as { type?: string }
+  if (!data?.type) return
+
+  switch (data.type) {
+    case 'auth-success':
+      hideAuthIframe()
+      if (authResolve) {
+        authResolve()
+        authPromise = null
+        authResolve = null
+        authReject = null
+      }
+      break
+
+    case 'auth-back':
+      hideAuthIframe()
+      if (authReject) {
+        authReject(new AuthCancelledError())
+        authPromise = null
+        authResolve = null
+        authReject = null
+      }
+      break
+  }
+}
+
+function ensureMessageListener(): void {
+  if (messageListenerInstalled) return
+  if (typeof window !== 'undefined') {
+    window.addEventListener('message', handleAuthMessage)
+    messageListenerInstalled = true
+  }
+}
+
+export function showAuthIframe(iframeUrl: string, title = 'Authentication'): Promise<void> {
+  injectStyles()
+  ensureMessageListener()
+
+  if (authPromise) return authPromise
+
+  if (document.getElementById(AUTH_IFRAME_ID)) {
+    authPromise = new Promise((resolve, reject) => {
+      authResolve = resolve
+      authReject = reject
+    })
+    return authPromise
+  }
+
+  authPromise = new Promise((resolve, reject) => {
+    authResolve = resolve
+    authReject = reject
+  })
+
+  hideAuthIframe()
+  holdGlobalBackdrop()
+
+  authIframe = document.createElement('iframe')
+  authIframe.id = AUTH_IFRAME_ID
+  authIframe.title = title
+  authIframe.src = iframeUrl
+  document.body.appendChild(authIframe)
+
+  return authPromise
+}
+
+export function createAuthIframe(iframeUrl: string, title = 'Authentication'): HTMLIFrameElement {
+  injectStyles()
+  const existing = document.getElementById(AUTH_IFRAME_ID)
+  if (existing) existing.remove()
+
+  const iframe = document.createElement('iframe')
+  iframe.id = AUTH_IFRAME_ID
+  iframe.title = title
+  iframe.src = iframeUrl
+  document.body.appendChild(iframe)
+
+  return iframe
+}
+
+export function removeAuthIframe(): void {
+  const iframe = document.getElementById(AUTH_IFRAME_ID)
+  if (iframe) iframe.remove()
+}

paskia-js/src/validate.ts

@@ -0,0 +1,66 @@
+import { apiJson } from './fetch'
+
+const POLL_INTERVAL = 60 * 1000
+const IDLE_TIMEOUT = 5 * 60 * 1000
+
+export class SessionValidator {
+  private userUuidGetter: () => string | undefined
+  private onSessionLost: (error: Error) => void
+  private pollTimer: ReturnType<typeof setInterval> | null = null
+  private idleTimer: ReturnType<typeof setTimeout> | null = null
+  private active = false
+
+  constructor(userUuidGetter: () => string | undefined, onSessionLost: (error: Error) => void) {
+    this.userUuidGetter = userUuidGetter
+    this.onSessionLost = onSessionLost
+    this.resetIdleTimer = this.resetIdleTimer.bind(this)
+  }
+
+  resetIdleTimer(): void {
+    if (this.idleTimer) clearTimeout(this.idleTimer)
+    if (!this.active) this.startPolling()
+    this.idleTimer = setTimeout(() => this.stopPolling(), IDLE_TIMEOUT)
+  }
+
+  async validate(): Promise<void> {
+    try {
+      const data = await apiJson<{ ctx?: { user?: { uuid?: string } } }>('/auth/api/validate', { method: 'POST' })
+      const newUuid = data.ctx?.user?.uuid
+      if (newUuid !== this.userUuidGetter()) {
+        window.location.reload()
+      }
+    } catch (error) {
+      if ((error as Error).name !== 'NetworkError') {
+        this.stopPolling()
+        this.onSessionLost(error as Error)
+      }
+    }
+  }
+
+  startPolling(): void {
+    if (this.active) return
+    this.active = true
+    this.pollTimer = setInterval(() => this.validate(), POLL_INTERVAL)
+  }
+
+  stopPolling(): void {
+    this.active = false
+    if (this.pollTimer) {
+      clearInterval(this.pollTimer)
+      this.pollTimer = null
+    }
+  }
+
+  start(): void {
+    window.addEventListener('pointermove', this.resetIdleTimer)
+    window.addEventListener('pointerdown', this.resetIdleTimer)
+    this.resetIdleTimer()
+  }
+
+  stop(): void {
+    window.removeEventListener('pointermove', this.resetIdleTimer)
+    window.removeEventListener('pointerdown', this.resetIdleTimer)
+    if (this.idleTimer) clearTimeout(this.idleTimer)
+    this.stopPolling()
+  }
+}

paskia-js/tsconfig.json

@@ -0,0 +1,15 @@
+{
+  "compilerOptions": {
+    "target": "ES2020",
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "strict": true,
+    "declaration": true,
+    "declarationDir": "./dist",
+    "outDir": "./dist",
+    "rootDir": "./src",
+    "lib": ["ES2020", "DOM"],
+    "skipLibCheck": true
+  },
+  "include": ["src/**/*.ts"]
+}

paskia-js/vite.config.js

@@ -0,0 +1,17 @@
+import { defineConfig } from 'vite'
+import { resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import dts from 'vite-plugin-dts'
+
+const __dirname = fileURLToPath(new URL('.', import.meta.url))
+
+export default defineConfig({
+  plugins: [dts({ rollupTypes: true })],
+  build: {
+    lib: {
+      entry: resolve(__dirname, 'src/index.ts'),
+      fileName: 'paskia',
+      formats: ['es'],
+    },
+  },
+})

paskia/bootstrap.py

@@ -10,38 +10,42 @@ import asyncio
 import logging
 
 from paskia import authsession, db, globals
-from paskia.util import hostutil, passphrase
+from paskia.db.structs import Config
+from paskia.util import hostutil
 
 logger = logging.getLogger(__name__)
 
 # Shared log message template for admin reset links
-ADMIN_RESET_MESSAGE = """\
+ADMIN_RESET_MESSAGE = """
-%s
-
 👤 Admin  %s
    - Use this link to register a Passkey for the admin user!
 """
 
 
-def _log_reset_link(message: str, passphrase: str) -> str:
+def _log_reset_link(passphrase: str, message: str | None = None) -> str:
     """Log a reset link message and return the URL."""
     reset_link = hostutil.reset_link_url(passphrase)
-    logger.info(ADMIN_RESET_MESSAGE, message, reset_link)
+    if message:
+        logger.info(message)
+    logger.info(ADMIN_RESET_MESSAGE, reset_link)
     return reset_link
 
 
-async def bootstrap_system() -> None:
+async def bootstrap_system(config: Config | None = None) -> None:
     """
     Bootstrap the entire system with default data.
 
     Uses db.bootstrap() which performs all operations in a single transaction.
     The transaction log will show a single "bootstrap" action with all changes.
+
+    Args:
+        config: Configuration to store (rp_id, rp_name, origins, etc.)
     """
     # Call the single-transaction bootstrap function
-    reset_passphrase = db.bootstrap()
+    reset_passphrase = db.bootstrap(config=config)
 
     # Log the reset link (this is separate from the transaction log)
-    _log_reset_link("✅ Bootstrap completed!", reset_passphrase)
+    _log_reset_link(reset_passphrase, "✅ Bootstrap completed!")
 
 
 async def check_admin_credentials() -> bool:
@@ -72,16 +76,15 @@ async def check_admin_credentials() -> bool:
 
         if not db.get_user_credential_ids(admin_user.uuid):
             # Admin exists but has no credentials, create reset link
+            logger.info("⚠️  Admin user has no credentials!")
 
-            token = passphrase.generate()
             expiry = authsession.reset_expires()
-            db.create_reset_token(
+            token = db.create_reset_token(
                 user_uuid=admin_user.uuid,
-                passphrase=token,
                 expiry=expiry,
                 token_type="admin registration",
             )
-            _log_reset_link("⚠️  Admin user has no credentials!", token)
+            _log_reset_link(token)
             return True
 
         return False
@@ -90,10 +93,13 @@ async def check_admin_credentials() -> bool:
         return False
 
 
-async def bootstrap_if_needed() -> bool:
+async def bootstrap_if_needed(config: Config | None = None) -> bool:
     """
     Check if system needs bootstrapping and perform it if necessary.
 
+    Args:
+        config: Configuration to store during bootstrap (rp_id, rp_name, origins, etc.)
+
     Returns:
         bool: True if bootstrapping was performed, False if system was already set up
     """
@@ -106,7 +112,7 @@ async def bootstrap_if_needed() -> bool:
 
     # No admin permission found, need to bootstrap
     # Bootstrap creates the admin user AND the reset link, so no need to check credentials after
-    await bootstrap_system()
+    await bootstrap_system(config=config)
     return True
 
 

paskia/db/__init__.py

@@ -47,6 +47,7 @@ from paskia.db.operations import (
     delete_session,
     delete_sessions_for_user,
     delete_user,
+    get_config,
     get_organization_users,
     get_reset_token,
     get_user_credential_ids,
@@ -55,6 +56,7 @@ from paskia.db.operations import (
     login,
     remove_permission_from_org,
     remove_permission_from_role,
+    set_config,
     set_session_host,
     update_credential_sign_count,
     update_org_name,
@@ -63,7 +65,7 @@ from paskia.db.operations import (
     update_session,
     update_user_display_name,
     update_user_role,
-    update_user_role_in_organization,
+    update_user_theme,
 )
 from paskia.db.structs import (
     DB,
@@ -110,6 +112,7 @@ __all__ = [
     "build_session",
     "build_user",
     # Read ops
+    "get_config",
     "get_organization_users",
     "get_reset_token",
     "get_user_credential_ids",
@@ -138,6 +141,7 @@ __all__ = [
     "login",
     "remove_permission_from_org",
     "remove_permission_from_role",
+    "set_config",
     "set_session_host",
     "update_credential_sign_count",
     "update_org_name",
@@ -146,5 +150,5 @@ __all__ = [
     "update_session",
     "update_user_display_name",
     "update_user_role",
-    "update_user_role_in_organization",
+    "update_user_theme",
 ]

paskia/db/background.py

@@ -74,21 +74,18 @@ async def start_background():
                     _logger.debug("Background task in different event loop, restarting")
                     _background_task = None
                 else:
-                    # Task is running in the same event loop - this is an error
+                    # Task is already running in same loop - idempotent, just return
-                    raise RuntimeError(
+                    # This happens with dual IPv4+IPv6 endpoints sharing the same process
-                        "Background task is already running. "
+                    _logger.debug(
-                        "start_background() must not be called multiple times in the same event loop."
+                        "Background task already running in same loop, skipping"
                     )
-            except RuntimeError:
+                    return
-                raise  # Re-raise RuntimeError from above
             except Exception as e:
                 _logger.debug("Error checking background task loop: %s, restarting", e)
                 _background_task = None
 
     if _background_task is None:
         _background_task = asyncio.create_task(_background_loop())
-    else:
-        _logger.debug("Background task already running: %s", _background_task)
 
 
 async def stop_background():

paskia/db/jsonl.py

@@ -4,6 +4,8 @@ JSONL persistence layer for the database.
 
 import copy
 import logging
+import os
+import signal
 from collections import deque
 from contextlib import contextmanager
 from datetime import UTC, datetime
@@ -67,53 +69,55 @@ def create_change_record(
 
 
 # Actions that are allowed to create a new database file
-_BOOTSTRAP_ACTIONS = frozenset({"bootstrap", "migrate:sql"})
+_BOOTSTRAP_ACTIONS = frozenset({"bootstrap"})
+
+# Flag to prevent duplicate error messages on fatal flush failure
+_flush_failed = False
 
 
 async def flush_changes(
     db_path: Path,
     pending_changes: deque[_ChangeRecord],
-) -> bool:
+) -> None:
     """Write all pending changes to disk.
 
     Args:
         db_path: Path to the JSONL database file
         pending_changes: Queue of pending change records (will be cleared on success)
 
-    Returns:
+    On failure, logs an error and sends SIGTERM to trigger graceful shutdown.
-        True if flush succeeded, False otherwise
     """
-    if not pending_changes:
+    global _flush_failed
-        return True
+    if _flush_failed or not pending_changes:
+        return
 
     if not db_path.exists():
         first_action = pending_changes[0].a
         if first_action not in _BOOTSTRAP_ACTIONS:
             _logger.error(
                 "Refusing to create database file with action '%s' - "
-                "only bootstrap or migrate can create a new database",
+                "only bootstrap can create a new database",
                 first_action,
             )
-            pending_changes.clear()
+            _flush_failed = True
-            return False
+            os.kill(os.getpid(), signal.SIGTERM)
+            return
 
     changes_to_write = list(pending_changes)
-    pending_changes.clear()
 
     try:
         lines = [_change_encoder.encode(change) for change in changes_to_write]
         if not lines:
-            return True
+            pending_changes.clear()
+            return
 
         async with aiofiles.open(db_path, "ab") as f:
             await f.write(b"\n".join(lines) + b"\n")
-        return True
+        pending_changes.clear()
-    except OSError:
+    except OSError as e:
-        _logger.exception("Failed to flush database changes")
+        _logger.error("Failed to flush database: %s", e)
-        # Re-queue the changes on failure
+        _flush_failed = True
-        for change in reversed(changes_to_write):
+        os.kill(os.getpid(), signal.SIGTERM)
-            pending_changes.appendleft(change)
-        return False
 
 
 class JsonlStore:
@@ -130,10 +134,13 @@ class JsonlStore:
         self._transaction_snapshot: dict[str, Any] | None = None
         self._current_version: int = DBVER  # Schema version for new databases
 
-    async def load(self, db_path: str | None = None) -> None:
+    async def load(
+        self, db_path: str | None = None, *, rp_id: str = "localhost"
+    ) -> None:
         """Load data from JSONL change log."""
         if db_path is not None:
             self.db_path = Path(db_path)
+        self._rp_id = rp_id
         if not self.db_path.exists():
             return
 
@@ -152,8 +159,10 @@ class JsonlStore:
                     self._current_version = change.get("v", 0)
                 except Exception as e:
                     raise ValueError(f"Error parsing line {line_num}: {e}")
-        except (OSError, ValueError, msgspec.DecodeError) as e:
+        except OSError as e:
-            raise ValueError(f"Failed to load database: {e}")
+            raise SystemExit(f"Failed to load database: {e}")
+        except (ValueError, msgspec.DecodeError) as e:
+            raise SystemExit(f"Failed to load database: {e}")
 
         if not data_dict:
             return
@@ -169,7 +178,9 @@ class JsonlStore:
             self._queue_change(action, new_version, current)
 
         # Apply schema migrations one at a time
-        await apply_all_migrations(data_dict, self._current_version, persist_migration)
+        await apply_all_migrations(
+            data_dict, self._current_version, persist_migration, rp_id=rp_id
+        )
 
         # Decode to msgspec struct
         decoder = msgspec.json.Decoder(DB)
@@ -198,7 +209,6 @@ class JsonlStore:
         if not diff:
             return
         self._pending_changes.append(create_change_record(action, version, diff, user))
-        self._previous_builtins = copy.deepcopy(current)
 
         # Log the change with user display name if available
         user_display = None
@@ -210,7 +220,8 @@ class JsonlStore:
             except (ValueError, KeyError):
                 user_display = user
 
-        log_change(action, diff, user_display)
+        log_change(action, diff, user_display, self._previous_builtins, self.db)
+        self._previous_builtins = copy.deepcopy(current)
 
     @contextmanager
     def transaction(
@@ -233,8 +244,8 @@ class JsonlStore:
         # Check for out-of-transaction modifications
         current_state = msgspec.to_builtins(self.db)
         if current_state != self._previous_builtins:
-            # Allow bootstrap/migrate to create a new database from empty state
+            # Allow bootstrap to create a new database from empty state
-            is_bootstrap = action in _BOOTSTRAP_ACTIONS or action.startswith("migrate:")
+            is_bootstrap = action in _BOOTSTRAP_ACTIONS
             if is_bootstrap and not self._previous_builtins:
                 pass  # Expected: creating database from scratch
             else:
@@ -277,6 +288,6 @@ class JsonlStore:
             self._in_transaction = False
             self._transaction_snapshot = None
 
-    async def flush(self) -> bool:
+    async def flush(self) -> None:
         """Write all pending changes to disk."""
-        return await flush_changes(self.db_path, self._pending_changes)
+        await flush_changes(self.db_path, self._pending_changes)

paskia/db/logging.py

@@ -3,15 +3,27 @@ Database change logging with pretty-printed diffs.
 
 Provides a logger for JSONL database changes that formats diffs
 in a human-readable path.notation style with color coding.
+
+UUIDs are replaced with display names where available, or the last
+section of the UUID hex for types without display names.
 """
 
 import logging
 import re
 import sys
-from typing import Any
+from typing import TYPE_CHECKING, Any
+from uuid import UUID
+
+if TYPE_CHECKING:
+    from paskia.db.structs import DB
 
 logger = logging.getLogger("paskia.db")
 
+# UUID regex pattern (8-4-4-4-12 hex format)
+_UUID_PATTERN = re.compile(
+    r"^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"
+)
+
 # Pattern to match control characters and bidirectional overrides
 _UNSAFE_CHARS = re.compile(
     r"[\x00-\x1f\x7f-\x9f"  # C0 and C1 control characters
@@ -26,20 +38,151 @@ _RESET = "\033[0m"
 _DIM = "\033[2m"
 _PATH_PREFIX = "\033[1;30m"  # Dark grey for path prefix (like host in access log)
 _PATH_FINAL = "\033[0m"  # Default for final element (like path in access log)
-_REPLACE = "\033[0;33m"  # Yellow for replacements
+_DELETE = "\033[1;31m"  # Red for deletions
-_DELETE = "\033[0;31m"  # Red for deletions
 _ADD = "\033[0;32m"  # Green for additions
 _ACTION = "\033[1;34m"  # Bold blue for action name
 _USER = "\033[0;34m"  # Blue for user display
 
 
+def _is_uuid(value: str) -> bool:
+    """Check if a string is a UUID."""
+    return bool(_UUID_PATTERN.match(value))
+
+
+def _uuid_suffix(uuid_str: str) -> str:
+    """Get the last section of a UUID (after the last hyphen)."""
+    return uuid_str.rsplit("-", 1)[-1]
+
+
+class UuidResolver:
+    """Resolve UUIDs to display names or short suffixes.
+
+    Uses the previous state for lookups to show the name before any changes.
+    """
+
+    def __init__(self, db: "DB | None" = None, previous: dict | None = None):
+        self._db = db
+        self._previous = previous
+
+    def resolve(self, uuid_str: str) -> str:
+        """Resolve a UUID to its display name or short suffix."""
+        display = self._get_display_name(uuid_str)
+        if display:
+            return display
+        return _uuid_suffix(uuid_str)
+
+    def _get_display_name(self, uuid_str: str) -> str | None:
+        """Look up display name for a UUID.
+
+        First checks the previous state (to show names before changes),
+        then falls back to the current database.
+        """
+        # Try previous state first (for showing name before a change)
+        name = self._lookup_in_previous(uuid_str)
+        if name:
+            return name
+
+        # Fall back to current database
+        return self._lookup_in_db(uuid_str)
+
+    def _lookup_in_previous(self, uuid_str: str) -> str | None:
+        """Look up display name in the previous state dict."""
+        if not self._previous:
+            return None
+
+        # Check users
+        if "users" in self._previous and uuid_str in self._previous["users"]:
+            user_data = self._previous["users"][uuid_str]
+            if isinstance(user_data, dict) and "display_name" in user_data:
+                return user_data["display_name"]
+
+        # Check orgs
+        if "orgs" in self._previous and uuid_str in self._previous["orgs"]:
+            org_data = self._previous["orgs"][uuid_str]
+            if isinstance(org_data, dict) and "display_name" in org_data:
+                return org_data["display_name"]
+
+        # Check roles
+        if "roles" in self._previous and uuid_str in self._previous["roles"]:
+            role_data = self._previous["roles"][uuid_str]
+            if isinstance(role_data, dict) and "display_name" in role_data:
+                return role_data["display_name"]
+
+        # Check permissions
+        if (
+            "permissions" in self._previous
+            and uuid_str in self._previous["permissions"]
+        ):
+            perm_data = self._previous["permissions"][uuid_str]
+            if isinstance(perm_data, dict) and "display_name" in perm_data:
+                return perm_data["display_name"]
+
+        # Check credentials - look up user name
+        if (
+            "credentials" in self._previous
+            and uuid_str in self._previous["credentials"]
+        ):
+            cred_data = self._previous["credentials"][uuid_str]
+            if isinstance(cred_data, dict) and "user" in cred_data:
+                user_uuid = cred_data["user"]
+                if "users" in self._previous and user_uuid in self._previous["users"]:
+                    user_data = self._previous["users"][user_uuid]
+                    if isinstance(user_data, dict) and "display_name" in user_data:
+                        return f"credential of {user_data['display_name']}"
+
+        return None
+
+    def _lookup_in_db(self, uuid_str: str) -> str | None:
+        """Look up display name in the current database."""
+        if not self._db:
+            return None
+
+        try:
+            uuid_obj = UUID(uuid_str)
+        except ValueError:
+            return None
+
+        # Check users
+        if uuid_obj in self._db.users:
+            return self._db.users[uuid_obj].display_name
+
+        # Check orgs
+        if uuid_obj in self._db.orgs:
+            return self._db.orgs[uuid_obj].display_name
+
+        # Check roles
+        if uuid_obj in self._db.roles:
+            return self._db.roles[uuid_obj].display_name
+
+        # Check permissions
+        if uuid_obj in self._db.permissions:
+            return self._db.permissions[uuid_obj].display_name
+
+        # Check credentials - identify by user name
+        if uuid_obj in self._db.credentials:
+            cred = self._db.credentials[uuid_obj]
+            if cred.user_uuid in self._db.users:
+                user_name = self._db.users[cred.user_uuid].display_name
+                return f"credential of {user_name}"
+
+        return None
+
+
 def _use_color() -> bool:
     """Check if we should use color output."""
     return sys.stderr.isatty()
 
 
-def _format_value(value: Any, use_color: bool, max_len: int = 60) -> str:
+def _format_value(
-    """Format a value for display, truncating if needed."""
+    value: Any,
+    use_color: bool,
+    max_len: int = 60,
+    resolver: UuidResolver | None = None,
+) -> str:
+    """Format a value for display, truncating if needed.
+
+    If resolver is provided, UUIDs are replaced with display names or short suffixes.
+    """
     if value is None:
         return "null"
 
@@ -50,6 +193,9 @@ def _format_value(value: Any, use_color: bool, max_len: int = 60) -> str:
         return str(value)
 
     if isinstance(value, str):
+        # Check if it's a UUID and resolve to display name
+        if resolver and _is_uuid(value):
+            return resolver.resolve(value)
         # Filter out control characters and bidirectional overrides
         value = _UNSAFE_CHARS.sub("", value)
         # Truncate long strings
@@ -60,18 +206,26 @@ def _format_value(value: Any, use_color: bool, max_len: int = 60) -> str:
     if isinstance(value, dict):
         if not value:
             return "{}"
-        # For small dicts, show inline
+        # Check if all values are True - render as set-like {key1, key2}
-        if len(value) == 1:
+        all_true = all(v is True for v in value.values())
-            k, v = next(iter(value.items()))
+        parts = []
-            return "{" + f"{k}: {_format_value(v, use_color, max_len=30)}" + "}"
+        for k, v in value.items():
-        return f"{{...{len(value)} keys}}"
+            # Replace UUID keys with display names
+            key_display = resolver.resolve(k) if resolver and _is_uuid(k) else k
+            if all_true:
+                parts.append(key_display)
+            else:
+                val_display = _format_value(v, use_color, max_len=30, resolver=resolver)
+                parts.append(f"{key_display}: {val_display}")
+        return "{" + ", ".join(parts) + "}"
 
     if isinstance(value, list):
         if not value:
             return "[]"
-        if len(value) == 1:
+        parts = [
-            return "[" + _format_value(value[0], use_color, max_len=30) + "]"
+            _format_value(v, use_color, max_len=30, resolver=resolver) for v in value
-        return f"[...{len(value)} items]"
+        ]
+        return "[" + ", ".join(parts) + "]"
 
     # Fallback for other types
     text = str(value)
@@ -80,10 +234,20 @@ def _format_value(value: Any, use_color: bool, max_len: int = 60) -> str:
     return text
 
 
-def _format_path(path: list[str], use_color: bool) -> str:
+def _format_path(
-    """Format a path as dot notation with prefix in dark grey, final in default."""
+    path: list[str], use_color: bool, resolver: UuidResolver | None = None
+) -> str:
+    """Format a path as dot notation with prefix in dark grey, final in default.
+
+    If resolver is provided, UUIDs in the path are replaced with display names.
+    """
     if not path:
         return ""
+
+    # Replace UUIDs in path with display names
+    if resolver:
+        path = [resolver.resolve(p) if _is_uuid(p) else p for p in path]
+
     if not use_color:
         return ".".join(path)
     if len(path) == 1:
@@ -93,18 +257,34 @@ def _format_path(path: list[str], use_color: bool) -> str:
     return f"{_PATH_PREFIX}{prefix}.{_RESET}{_PATH_FINAL}{final}{_RESET}"
 
 
+def _get_nested(data: dict | None, path: list[str]) -> Any:
+    """Get a nested value from a dict by path, or None if not found."""
+    if data is None:
+        return None
+    current = data
+    for key in path:
+        if not isinstance(current, dict) or key not in current:
+            return None
+        current = current[key]
+    return current
+
+
 def _collect_changes(
-    diff: dict, path: list[str], changes: list[tuple[str, list[str], Any, Any | None]]
+    diff: dict,
+    path: list[str],
+    changes: list[tuple[str, list[str], Any]],
+    previous: dict | None,
 ) -> None:
     """
     Recursively collect changes from a diff into a flat list.
 
-    Each change is a tuple of (change_type, path, new_value, old_value).
+    Each change is a tuple of (change_type, path, new_value).
-    change_type is one of: 'set', 'replace', 'delete'
+    change_type is one of: 'add', 'update', 'delete'
     """
     if not isinstance(diff, dict):
-        # Leaf value - this is a set operation
+        # Leaf value - check if it existed before
-        changes.append(("set", path, diff, None))
+        existed = _get_nested(previous, path) is not None
+        changes.append(("update" if existed else "add", path, diff))
         return
 
     for key, value in diff.items():
@@ -112,72 +292,167 @@ def _collect_changes(
             # $delete contains a list of keys to delete
             if isinstance(value, list):
                 for deleted_key in value:
-                    changes.append(("delete", path + [str(deleted_key)], None, None))
+                    changes.append(("delete", path + [str(deleted_key)], None))
             else:
-                changes.append(("delete", path + [str(value)], None, None))
+                changes.append(("delete", path + [str(value)], None))
 
         elif key == "$replace":
-            # $replace contains the new value for this path
+            # $replace replaces the entire collection at this path
+            # We need to track what was added and what was deleted
+            old_collection = _get_nested(previous, path)
+            old_keys = (
+                set(old_collection.keys())
+                if isinstance(old_collection, dict)
+                else set()
+            )
+            new_keys = set(value.keys()) if isinstance(value, dict) else set()
+
+            # Items that existed before but not in new = deleted
+            for deleted_key in old_keys - new_keys:
+                changes.append(("delete", path + [str(deleted_key)], None))
+
+            # Items in new collection
             if isinstance(value, dict):
-                # Replacing with a dict - show each key as a replacement
                 for rkey, rval in value.items():
-                    changes.append(("replace", path + [str(rkey)], rval, None))
+                    existed = rkey in old_keys
-                if not value:
+                    changes.append(
-                    # Empty replacement - clearing the collection
+                        ("update" if existed else "add", path + [str(rkey)], rval)
-                    changes.append(("replace", path, {}, None))
+                    )
-            else:
+            elif value or not old_keys:
-                changes.append(("replace", path, value, None))
+                # Non-dict replacement or empty replacement with nothing before
+                changes.append(
+                    ("update" if old_collection is not None else "add", path, value)
+                )
 
         elif key.startswith("$"):
             # Other special operations (future-proofing)
-            changes.append(("set", path, {key: value}, None))
+            changes.append(("add", path, {key: value}))
 
         else:
-            # Regular nested key
+            # Regular nested key - check if this item existed before
-            _collect_changes(value, path + [str(key)], changes)
+            new_path = path + [str(key)]
+            existed = _get_nested(previous, new_path) is not None
+            if existed:
+                # Item exists - recurse to show specific field changes
+                _collect_changes(value, new_path, changes, previous)
+            else:
+                # New item - record as add with full value, don't recurse
+                changes.append(("add", new_path, value))
 
 
-def _format_change_line(
+def _format_change_lines(
-    change_type: str, path: list[str], value: Any, use_color: bool
+    change_type: str,
-) -> str:
+    path: list[str],
-    """Format a single change as a one-line string."""
+    value: Any,
-    path_str = _format_path(path, use_color)
+    use_color: bool,
-    value_str = _format_value(value, use_color)
+    resolver: UuidResolver | None = None,
+) -> list[str]:
+    """Format a single change as one or more lines.
+
+    If resolver is provided, UUIDs are replaced with display names.
+    """
+
+    # Helper to format path with UUID replacement
+    def fmt_path(p: list[str]) -> list[str]:
+        if resolver:
+            return [resolver.resolve(x) if _is_uuid(x) else x for x in p]
+        return p
+
+    formatted_path = fmt_path(path)
 
     if change_type == "delete":
-        if use_color:
+        if not use_color:
-            return f"  ❌  {path_str}"
+            return [f"  {'.'.join(formatted_path)} ✗"]
-        return f"  - {path_str}"
+        if len(formatted_path) == 1:
+            return [f"  {_DELETE}{formatted_path[0]} ✗{_RESET}"]
+        prefix = ".".join(formatted_path[:-1])
+        final = formatted_path[-1]
+        return [f"  {_PATH_PREFIX}{prefix}.{_RESET}{_DELETE}{final} ✗{_RESET}"]
 
-    if change_type == "replace":
+    if change_type == "add":
-        if use_color:
+        # New item being created - only final element in green
-            return f"  {_REPLACE}⟳{_RESET} {path_str} {_DIM}={_RESET} {value_str}"
+        # For dict values, show children on separate indented lines
-        return f"  ~ {path_str} = {value_str}"
+        if isinstance(value, dict) and value:
+            lines = []
+            # First line: path with green final element and grey =
+            if not use_color:
+                lines.append(f"  {'.'.join(formatted_path)} =")
+            elif len(formatted_path) == 1:
+                lines.append(f"  {_ADD}{formatted_path[0]}{_RESET} {_DIM}={_RESET}")
+            else:
+                prefix = ".".join(formatted_path[:-1])
+                final = formatted_path[-1]
+                lines.append(
+                    f"  {_PATH_PREFIX}{prefix}.{_RESET}{_ADD}{final}{_RESET} {_DIM}={_RESET}"
+                )
+            # Child lines: indented key: value, with aligned values
+            # Format keys (may contain UUIDs)
+            formatted_items = []
+            for k, v in value.items():
+                k_display = resolver.resolve(k) if resolver and _is_uuid(k) else k
+                v_str = _format_value(v, use_color, resolver=resolver)
+                formatted_items.append((k_display, v_str))
+            max_key_len = max(len(k) for k, _ in formatted_items)
+            field_width = max(max_key_len, 12)  # minimum 12 chars
+            for k_display, v_str in formatted_items:
+                padding = " " * (field_width - len(k_display))
+                if use_color:
+                    lines.append(f"    {k_display}{_DIM}:{_RESET}{padding} {v_str}")
+                else:
+                    lines.append(f"    {k_display}:{padding} {v_str}")
+            return lines
+        else:
+            value_str = _format_value(value, use_color, resolver=resolver)
+            if not use_color:
+                return [f"  {'.'.join(formatted_path)} = {value_str}"]
+            if len(formatted_path) == 1:
+                return [
+                    f"  {_ADD}{formatted_path[0]}{_RESET} {_DIM}={_RESET} {value_str}"
+                ]
+            prefix = ".".join(formatted_path[:-1])
+            final = formatted_path[-1]
+            return [
+                f"  {_PATH_PREFIX}{prefix}.{_RESET}{_ADD}{final}{_RESET} {_DIM}={_RESET} {value_str}"
+            ]
 
-    # Default: set/add
+    # update: Existing item being updated - normal path colors
+    value_str = _format_value(value, use_color, resolver=resolver)
+    path_str = _format_path(path, use_color, resolver=resolver)
     if use_color:
-        return f"  {_ADD}+{_RESET} {path_str} {_DIM}={_RESET} {value_str}"
+        return [f"  {path_str} {_DIM}={_RESET} {value_str}"]
-    return f"  + {path_str} = {value_str}"
+    return [f"  {path_str} = {value_str}"]
 
 
-def format_diff(diff: dict) -> list[str]:
+def format_diff(
+    diff: dict, previous: dict | None = None, db: "DB | None" = None
+) -> list[str]:
     """
     Format a JSON diff as human-readable lines.
 
+    Args:
+        diff: The JSON diff dict
+        previous: The previous state dict (for determining add vs update)
+        db: Optional database for looking up display names
+
     Returns a list of formatted lines (without newlines).
-    Single changes return one line, multiple changes return multiple lines.
+    UUIDs are replaced with display names (using previous state for lookups).
     """
     use_color = _use_color()
-    changes: list[tuple[str, list[str], Any, Any | None]] = []
+    changes: list[tuple[str, list[str], Any]] = []
-    _collect_changes(diff, [], changes)
+    _collect_changes(diff, [], changes, previous)
 
     if not changes:
         return []
 
+    # Create resolver for UUID replacement (uses previous state for lookups)
+    resolver = UuidResolver(db, previous)
+
     # Format each change
     lines = []
-    for change_type, path, value, _ in changes:
+    for change_type, path, value in changes:
-        lines.append(_format_change_line(change_type, path, value, use_color))
+        lines.extend(
+            _format_change_lines(change_type, path, value, use_color, resolver)
+        )
 
     return lines
 
@@ -198,17 +473,28 @@ def format_action_header(action: str, user_display: str | None = None) -> str:
         return action
 
 
-def log_change(action: str, diff: dict, user_display: str | None = None) -> None:
+def log_change(
+    action: str,
+    diff: dict,
+    user_display: str | None = None,
+    previous: dict | None = None,
+    db: "DB | None" = None,
+) -> None:
     """
     Log a database change with pretty-printed diff.
 
+    UUIDs are replaced with display names for readability. For types without
+    display names (e.g., credentials), the last section of the UUID is used.
+
     Args:
         action: The action name (e.g., "login", "admin:delete_user")
         diff: The JSON diff dict
         user_display: Optional display name of the user who performed the action
+        previous: The previous state dict (for determining add vs update)
+        db: Optional database for looking up display names
     """
     header = format_action_header(action, user_display)
-    diff_lines = format_diff(diff)
+    diff_lines = format_diff(diff, previous, db)
 
     if not diff_lines:
         logger.info(header)

paskia/db/migrations.py

@@ -8,26 +8,34 @@ Each migration should be idempotent and only run when needed.
 from collections.abc import Awaitable, Callable
 
 
-def migrate_v1(d: dict) -> None:
+def migrate_v1(d: dict, **kwargs) -> None:
     """Remove Org.created_at fields."""
     for org_data in d["orgs"].values():
         org_data.pop("created_at", None)
 
 
+def migrate_v2(d: dict, *, rp_id: str = "localhost") -> None:
+    """Add config field if missing."""
+    if "config" not in d:
+        d["config"] = {"rp_id": rp_id}
+
+
 migrations = sorted(
     [f for n, f in globals().items() if n.startswith("migrate_v")],
     key=lambda f: int(f.__name__.removeprefix("migrate_v")),
 )
 
-DBVER = len(migrations)  # Used by bootstrap and migrate:sql to set initial version
+DBVER = len(migrations)  # Used by bootstrap to set initial version
 
 
 async def apply_all_migrations(
     data_dict: dict,
     current_version: int,
     persist: Callable[[str, int, dict], Awaitable[None]],
+    *,
+    rp_id: str = "localhost",
 ) -> None:
     while current_version < DBVER:
-        migrations[current_version](data_dict)
+        migrations[current_version](data_dict, rp_id=rp_id)
         current_version += 1
         await persist(f"migrate:v{current_version}", current_version, data_dict)

paskia/db/operations.py

@@ -17,11 +17,11 @@ import uuid7
 
 from paskia.config import SESSION_LIFETIME
 from paskia.db.jsonl import (
-    DB_PATH_DEFAULT,
     JsonlStore,
 )
 from paskia.db.structs import (
     DB,
+    Config,
     Credential,
     Org,
     Permission,
@@ -31,7 +31,6 @@ from paskia.db.structs import (
     SessionContext,
     User,
 )
-from paskia.util.passphrase import generate as generate_passphrase
 from paskia.util.passphrase import is_well_formed as _is_passphrase
 
 _logger = logging.getLogger(__name__)
@@ -43,16 +42,15 @@ _db._store = _store
 _initialized = False
 
 
-async def init(*args, **kwargs):
+async def init(rp_id: str = "localhost", *args, **kwargs):
     """Load database from JSONL file."""
     global _db, _initialized
     if _initialized:
         _logger.debug("Database already initialized, skipping reload")
         return
-    db_path = os.environ.get("PASKIA_DB", DB_PATH_DEFAULT)
+    default_path = f"{rp_id}.paskiadb"
-    if db_path.startswith("json:"):
+    db_path = os.environ.get("PASKIA_DB", default_path)
-        db_path = db_path[5:]
+    await _store.load(db_path, rp_id=rp_id)
-    await _store.load(db_path)
     _db = _store.db
     _initialized = True
 
@@ -68,12 +66,12 @@ def get_user_organization(user_uuid: UUID) -> tuple[Org, str]:
     Raises ValueError if user not found.
 
     Call sites:
-    - update_user_role_in_organization: org only
     - admin_create_user_registration_link: org only
     - admin_get_user_detail: org and role
     - admin_update_user_display_name: org only
     - admin_delete_user_credential: org only
     - admin_delete_user_session: org only
+    - admin_update_user_role: org only
     """
     if user_uuid not in _db.users:
         raise ValueError(f"User {user_uuid} not found")
@@ -352,6 +350,23 @@ def update_user_display_name(
         _db.users[uuid].display_name = display_name
 
 
+def update_user_theme(
+    uuid: UUID,
+    theme: str,
+    *,
+    ctx: SessionContext | None = None,
+) -> None:
+    """Update user theme preference ('' for auto, 'light', 'dark')."""
+    if isinstance(uuid, str):
+        uuid = UUID(uuid)
+    if uuid not in _db.users:
+        raise ValueError(f"User {uuid} not found")
+    if theme not in ("", "light", "dark"):
+        raise ValueError(f"Invalid theme: {theme}")
+    with _db.transaction("update_user_theme", ctx):
+        _db.users[uuid].theme = theme
+
+
 def update_user_role(
     uuid: UUID,
     role_uuid: UUID,
@@ -367,29 +382,6 @@ def update_user_role(
         _db.users[uuid].role_uuid = role_uuid
 
 
-def update_user_role_in_organization(
-    user_uuid: UUID,
-    role_name: str,
-    *,
-    ctx: SessionContext | None = None,
-) -> None:
-    """Update user's role by role name within their current organization."""
-    if user_uuid not in _db.users:
-        raise ValueError(f"User {user_uuid} not found")
-    user = _db.users[user_uuid]
-    org = user.org
-    # Find role by name in the same org
-    new_role_uuid = None
-    for r in org.roles:
-        if r.display_name == role_name:
-            new_role_uuid = r.uuid
-            break
-    if new_role_uuid is None:
-        raise ValueError(f"Role '{role_name}' not found in organization")
-    with _db.transaction("admin:update_user_role", ctx):
-        _db.users[user_uuid].role_uuid = new_role_uuid
-
-
 def delete_user(uuid: UUID, *, ctx: SessionContext | None = None) -> None:
     """Delete user and their credentials/sessions."""
     if uuid not in _db.users:
@@ -402,9 +394,10 @@ def delete_user(uuid: UUID, *, ctx: SessionContext | None = None) -> None:
         # Delete sessions
         for sess in user.sessions:
             del _db.sessions[sess.key]
-        # Delete reset tokens
+        # Delete reset tokens (iterate over dict items to get correct keys)
-        for token in user.reset_tokens:
+        for key, token in list(_db.reset_tokens.items()):
-            del _db.reset_tokens[token.key]
+            if token.user_uuid == uuid:
+                del _db.reset_tokens[key]
         del _db.users[uuid]
 
 
@@ -517,16 +510,18 @@ def set_session_host(key: str, host: str, *, ctx: SessionContext | None = None)
     update_session(key, host=host, ctx=ctx)
 
 
-def delete_session(key: str, *, ctx: SessionContext | None = None) -> None:
+def delete_session(
+    key: str, *, ctx: SessionContext | None = None, action: str = "delete_session"
+) -> None:
     """Delete a session.
 
     The acting user should be logged via ctx.
-    For user logout, pass ctx of the user's session.
+    For user logout, pass ctx of the user's session and action="logout".
     For admin terminating a session, pass admin's ctx.
     """
     if key not in _db.sessions:
         raise ValueError("Session not found")
-    with _db.transaction("delete_session", ctx):
+    with _db.transaction(action, ctx):
         del _db.sessions[key]
 
 
@@ -548,29 +543,34 @@ def delete_sessions_for_user(
 
 
 def create_reset_token(
-    passphrase: str,
     user_uuid: UUID,
     expiry: datetime,
     token_type: str,
     *,
     ctx: SessionContext | None = None,
-) -> None:
+    user: str | None = None,
-    """Create a reset token from a passphrase.
+) -> str:
+    """Create a reset token and return the passphrase.
 
     The acting user should be logged via ctx.
     For self-service (user creating own recovery link), pass user's ctx.
     For admin operations, pass admin's ctx.
     For system operations (bootstrap), pass neither to log no user.
+    For API operations where ctx is not available but user is known, pass user.
+
+    Returns:
+        The passphrase to give to the user.
     """
-    key = _reset_key(passphrase)
-    if key in _db.reset_tokens:
-        raise ValueError("Reset token already exists")
     if user_uuid not in _db.users:
         raise ValueError(f"User {user_uuid} not found")
-    with _db.transaction("create_reset_token", ctx):
+    token, passphrase = ResetToken.create(
-        _db.reset_tokens[key] = ResetToken(
+        user=user_uuid, expiry=expiry, token_type=token_type
-            user_uuid=user_uuid, expiry=expiry, token_type=token_type
+    )
-        )
+    if token.key in _db.reset_tokens:
+        raise ValueError("Reset token already exists")
+    with _db.transaction("create_reset_token", ctx, user=user):
+        _db.reset_tokens[token.key] = token
+    return passphrase
 
 
 def delete_reset_token(key: bytes, *, ctx: SessionContext | None = None) -> None:
@@ -723,6 +723,7 @@ def bootstrap(
     admin_name: str = "Admin",
     reset_passphrase: str | None = None,
     reset_expiry: datetime | None = None,
+    config: Config | None = None,
 ) -> str:
     """Bootstrap the entire system in a single transaction.
 
@@ -732,8 +733,9 @@ def bootstrap(
     - Organization with Administration role
     - Admin user with Administration role
     - Reset token for admin registration
+    - Config (if provided)
 
-    This is the only way to create a new database file (besides migrate).
+    This is the only way to create a new database file.
     All data is created atomically - if any step fails, nothing is written.
 
     Args:
@@ -741,6 +743,7 @@ def bootstrap(
         admin_name: Display name for the admin user (default: "Admin")
         reset_passphrase: Passphrase for the reset token (generated if not provided)
         reset_expiry: Expiry datetime for the reset token (default: 14 days)
+        config: Configuration to store (rp_id, rp_name, origins, etc.)
 
     Returns:
         The reset passphrase for admin registration.
@@ -760,14 +763,11 @@ def bootstrap(
     role_uuid = uuid7.create()
     user_uuid = uuid7.create()
 
-    # Generate reset token components
+    # Set reset token expiry (passphrase generated by ResetToken.create)
-    if reset_passphrase is None:
-        reset_passphrase = generate_passphrase()
     if reset_expiry is None:
         from paskia.authsession import reset_expires  # noqa: PLC0415
 
         reset_expiry = reset_expires()
-    reset_key = _reset_key(reset_passphrase)
 
     now = datetime.now(UTC)
 
@@ -816,10 +816,32 @@ def bootstrap(
         _db.users[user_uuid] = admin_user
 
         # Create reset token
-        _db.reset_tokens[reset_key] = ResetToken(
+        reset_token, reset_passphrase = ResetToken.create(
-            user_uuid=user_uuid,
+            user=user_uuid,
             expiry=reset_expiry,
             token_type="admin bootstrap",
+            passphrase=reset_passphrase,
         )
+        _db.reset_tokens[reset_token.key] = reset_token
+
+        # Set config if provided
+        if config is not None:
+            _db.config = config
 
     return reset_passphrase
+
+
+# -------------------------------------------------------------------------
+# Config operations
+# -------------------------------------------------------------------------
+
+
+def get_config() -> Config:
+    """Get the stored configuration."""
+    return _db.config
+
+
+async def set_config(config: Config) -> None:
+    """Update the stored configuration."""
+    with _db.transaction("update_config"):
+        _db.config = config

paskia/db/structs.py

@@ -1,14 +1,17 @@
 from __future__ import annotations
 
+import hashlib
 import secrets
 from datetime import UTC, datetime
 from uuid import UUID
 
 import msgspec
 import uuid7
+from msgspec import field
 
 from paskia import db
 from paskia.util.hostutil import normalize_host
+from paskia.util.passphrase import generate as generate_passphrase
 
 # Sentinel for uuid fields before they are set by create() or DB post init
 _UUID_UNSET = UUID(int=0)
@@ -147,10 +150,10 @@ class Role(msgspec.Struct, dict=True, omit_defaults=True):
         return role
 
 
-class User(msgspec.Struct, dict=True):
+class User(msgspec.Struct, dict=True, omit_defaults=True):
     """User data structure.
 
-    Mutable fields: display_name, role_uuid, last_seen, visits
+    Mutable fields: display_name, role_uuid, last_seen, visits, theme
     Immutable fields: created_at (set at creation, never modified)
     uuid is derived from created_at using uuid7.
     """
@@ -160,6 +163,7 @@ class User(msgspec.Struct, dict=True):
     created_at: datetime
     last_seen: datetime | None = None
     visits: int = 0
+    theme: str = ""  # "" or "auto" = OS default, "light", "dark"
 
     def __post_init__(self):
         if not hasattr(self, "uuid"):
@@ -352,6 +356,38 @@ class ResetToken(msgspec.Struct, dict=True):
         """Get the User object for this reset token."""
         return db.data().users[self.user_uuid]
 
+    @classmethod
+    def create(
+        cls,
+        user: UUID | User,
+        expiry: datetime,
+        token_type: str,
+        passphrase: str | None = None,
+    ) -> tuple[ResetToken, str]:
+        """Create a new ResetToken with auto-generated or provided passphrase.
+
+        Args:
+            user: User UUID or User object
+            expiry: Token expiration datetime
+            token_type: Type of token (e.g., "device addition", "account recovery")
+            passphrase: Optional passphrase to use (auto-generated if not provided)
+
+        Returns:
+            Tuple of (token, passphrase) where passphrase is the human-readable
+            code to give to the user.
+        """
+        if passphrase is None:
+            passphrase = generate_passphrase()
+        key = hashlib.sha512(passphrase.encode()).digest()[:9]
+        user_uuid = user if isinstance(user, UUID) else user.uuid
+        token = cls(
+            user_uuid=user_uuid,
+            expiry=expiry,
+            token_type=token_type,
+        )
+        token.key = key
+        return token, passphrase
+
 
 class SessionContext(msgspec.Struct):
     session: Session
@@ -362,6 +398,16 @@ class SessionContext(msgspec.Struct):
     permissions: list[Permission] = []
 
 
+class Config(msgspec.Struct, frozen=True, dict=True, omit_defaults=True):
+    """Stored configuration for the instance."""
+
+    rp_id: str
+    rp_name: str | None = None
+    origins: list[str] | None = None
+    auth_host: str | None = None
+    listen: str | None = None
+
+
 # -------------------------------------------------------------------------
 # Database storage structure
 # -------------------------------------------------------------------------
@@ -377,6 +423,7 @@ class DB(msgspec.Struct, dict=True, omit_defaults=False):
     credentials: dict[UUID, Credential] = {}
     sessions: dict[str, Session] = {}
     reset_tokens: dict[bytes, ResetToken] = {}
+    config: Config = field(default_factory=lambda: Config(rp_id="localhost"))
 
     def __post_init__(self):
         # Store reference for persistence (not serialized)
@@ -418,8 +465,11 @@ class DB(msgspec.Struct, dict=True, omit_defaults=False):
         except KeyError:
             return None
 
+        # Normalize host for comparison (stored hosts are already normalized)
+        normalized_input = normalize_host(host)
+
         # Validate host matches (sessions are always created with a host)
-        if s.host != host:
+        if s.host != normalized_input:
             # Session bound to different host
             return None
 
@@ -434,10 +484,6 @@ class DB(msgspec.Struct, dict=True, omit_defaults=False):
         # Effective permissions: role's permissions that the org can grant
         # Also filter by domain if host is provided
         org_perm_uuids = {p.uuid for p in org.permissions}
-        normalized_host = normalize_host(host)
-        host_without_port = (
-            normalized_host.rsplit(":", 1)[0] if normalized_host else None
-        )
 
         effective_perms = []
         for perm_uuid in role.permission_set:
@@ -447,8 +493,8 @@ class DB(msgspec.Struct, dict=True, omit_defaults=False):
                 p = self.permissions[perm_uuid]
             except KeyError:
                 continue
-            # Check domain restriction
+            # Check domain restriction (normalized_input already has port stripped)
-            if p.domain is not None and p.domain != host_without_port:
+            if p.domain is not None and p.domain != normalized_input:
                 continue
             effective_perms.append(p)
 

paskia/fastapi/__main__.py

@@ -6,25 +6,26 @@ import os
 from urllib.parse import urlparse
 
 from fastapi_vue.hostutil import parse_endpoint
-from uvicorn import Config, Server
+from uvicorn import Config as UvicornConfig
+from uvicorn import Server
+from uvicorn import run as uvicorn_run
 
 from paskia import globals as _globals
 from paskia.bootstrap import bootstrap_if_needed
 from paskia.config import PaskiaConfig
+from paskia.db import get_config, set_config
+from paskia.db import init as db_init
 from paskia.db.background import flush
-from paskia.fastapi import app as fastapi_app
+from paskia.db.structs import Config
-from paskia.fastapi import reset as reset_cmd
 from paskia.util import startupbox
 from paskia.util.hostutil import normalize_origin
 
 DEFAULT_PORT = 4401
+DEVMODE = bool(os.getenv("PASKIA_FRONTEND_URL"))
 
 EPILOG = """\
-Examples:
+Example:
-  paskia                      # localhost:4401
+  paskia --rp-id example.com --rp-name "Example Corporation" --auth-host auth.example.com
-  paskia :8080                # All interfaces, port 8080
-  paskia unix:/tmp/paskia.sock
-  paskia reset [user]         # Generate passkey reset link
 """
 
 
@@ -63,10 +64,12 @@ def add_common_options(p: argparse.ArgumentParser) -> None:
     )
     p.add_argument(
         "--auth-host",
-        help=(
+        help=("Dedicated authentication site (optionally with scheme/port)"),
-            "Dedicated host (optionally with scheme/port) to serve the auth UI at the root,"
+    )
-            " e.g. auth.example.com or https://auth.example.com"
+    p.add_argument(
-        ),
+        "--save",
+        action="store_true",
+        help="Save the CLI options to database for future runs.",
     )
 
 
@@ -81,32 +84,43 @@ def main():
         epilog=EPILOG,
     )
 
-    # Primary argument: either host:port or "reset" subcommand
     parser.add_argument(
-        "hostport",
+        "-l",
-        nargs="?",
+        "--listen",
+        metavar="LISTEN",
         help=(
-            "Endpoint (default: localhost:4401). Forms: host[:port] | :port | "
+            "Endpoint to listen on (default: localhost:4401). "
-            "[ipv6][:port] | ipv6 | unix:/path.sock | 'reset' for credential reset"
+            "Forms: host:port  port  :port  [ipv6]:port  unix:path  /path.sock"
         ),
     )
-    parser.add_argument(
-        "reset_query",
-        nargs="?",
-        help="For 'reset' command: user UUID or substring of display name",
-    )
     add_common_options(parser)
 
     args = parser.parse_args()
 
-    # Detect "reset" subcommand (first positional is "reset")
+    # Handle clearing options
-    is_reset = args.hostport == "reset"
+    if getattr(args, "auth_host", None) == "":
+        args.auth_host = None
+    if getattr(args, "rp_name", None) == "":
+        args.rp_name = None
+    if getattr(args, "listen", None) == "":
+        args.listen = None
 
-    if is_reset:
+    # Init db and load stored config
-        endpoints = []
+    asyncio.run(db_init(rp_id=args.rp_id))
-    else:
+    stored_config = get_config()
-        # Parse endpoint using fastapi_vue.hostutil
+
-        endpoints = parse_endpoint(args.hostport, DEFAULT_PORT)
+    # Apply defaults from stored config
+    if args.rp_name is None and stored_config.rp_name is not None:
+        args.rp_name = stored_config.rp_name
+    if args.origins is None and stored_config.origins is not None:
+        args.origins = stored_config.origins
+    if args.auth_host is None and stored_config.auth_host is not None:
+        args.auth_host = stored_config.auth_host
+    if args.listen is None and stored_config.listen is not None:
+        args.listen = stored_config.listen
+
+    # Parse endpoint using fastapi_vue.hostutil
+    endpoints = parse_endpoint(args.listen, DEFAULT_PORT)
 
     # Extract host/port/uds from first endpoint for config display and site_url
     ep = endpoints[0] if endpoints else {}
@@ -185,22 +199,27 @@ def main():
 
     startupbox.print_startup_config(config)
 
-    devmode = bool(os.environ.get("FASTAPI_VUE_FRONTEND_URL"))
+    # Build config to save (for bootstrap or explicit --save)
+    cli_config = Config(
+        rp_id=args.rp_id,
+        rp_name=args.rp_name,
+        origins=args.origins,
+        auth_host=args.auth_host,
+        listen=args.listen,
+    )
 
     run_kwargs: dict = {
-        "log_level": "info",
+        "log_level": "warning",  # Suppress startup messages; we use custom logging
         "access_log": False,  # We use custom AccessLogMiddleware instead
     }
 
-    if devmode:
+    if DEVMODE:
         # Security: dev mode must run on localhost:4402 to prevent
         # accidental public exposure of the Vite dev server
         if host != "localhost" or port != 4402:
             raise SystemExit(f"Dev mode requires localhost:4402, got {host}:{port}")
         run_kwargs["reload"] = True
         run_kwargs["reload_dirs"] = ["paskia"]
-        # Suppress uvicorn startup messages in dev mode
-        run_kwargs["log_level"] = "warning"
 
     async def async_main():
         await _globals.init(
@@ -209,21 +228,29 @@ def main():
             origins=config.origins,
             bootstrap=False,
         )
-        await bootstrap_if_needed()
+        # Pass config to bootstrap - it will be saved within the bootstrap transaction
+        await bootstrap_if_needed(config=cli_config)
+        # Also save config if --save was explicitly used (even without bootstrap)
+        if args.save:
+            await set_config(cli_config)
         await flush()
 
-        if is_reset:
-            exit_code = reset_cmd.run(args.reset_query)
-            raise SystemExit(exit_code)
-
         if len(endpoints) > 1:
             async with asyncio.TaskGroup() as tg:
                 for ep in endpoints:
                     tg.create_task(
-                        Server(Config(app=fastapi_app, **run_kwargs, **ep)).serve()
+                        Server(
+                            UvicornConfig(app="paskia.fastapi:app", **run_kwargs, **ep)
+                        ).serve()
                     )
+        elif DEVMODE:
+            # Use uvicorn.run for proper reload support (it handles subprocess spawning)
+            ep = endpoints[0]
+            uvicorn_run("paskia.fastapi:app", **run_kwargs, **ep)
         else:
-            server = Server(Config(app=fastapi_app, **run_kwargs, **endpoints[0]))
+            server = Server(
+                UvicornConfig(app="paskia.fastapi:app", **run_kwargs, **endpoints[0])
+            )
             await server.serve()
 
     try:

paskia/fastapi/admin.py

@@ -17,7 +17,6 @@ from paskia.fastapi.session import AUTH_COOKIE
 from paskia.globals import passkey
 from paskia.util import (
     hostutil,
-    passphrase,
     permutil,
     querysafe,
     vitedev,
@@ -103,6 +102,7 @@ async def admin_list_orgs(request: Request, auth=AUTH_COOKIE):
                     "uuid": u.uuid,
                     "display_name": u.display_name,
                     "role": role_name,
+                    "role_uuid": u.role_uuid,
                     "visits": u.visits,
                     "last_seen": u.last_seen,
                 }
@@ -127,7 +127,7 @@ async def admin_create_org(
     db.create_org(org, ctx=ctx)
     # Grant requested permissions to the new org
     for perm in permissions:
-        db.add_permission_to_org(str(org.uuid), perm)
+        db.add_permission_to_org(str(org.uuid), perm, ctx=ctx)
 
     return {"uuid": str(org.uuid)}
 
@@ -281,28 +281,27 @@ async def admin_create_role(
     return {"uuid": str(role.uuid)}
 
 
-@app.patch("/orgs/{org_uuid}/roles/{role_uuid}")
+@app.patch("/roles/{role_uuid}")
 async def admin_update_role_name(
-    org_uuid: UUID,
     role_uuid: UUID,
     request: Request,
     payload: dict = Body(...),
     auth=AUTH_COOKIE,
 ):
     """Update role display name only."""
+    role = db.data().roles.get(role_uuid)
+    if not role:
+        raise HTTPException(status_code=404, detail="Role not found")
     ctx = await authz.verify(
         auth,
         ["auth:admin", "auth:org:admin"],
         match=permutil.has_any,
         host=request.headers.get("host"),
     )
-    if not can_manage_org(ctx, org_uuid):
+    if not can_manage_org(ctx, role.org_uuid):
         raise authz.AuthException(
             status_code=403, detail="Insufficient permissions", mode="forbidden"
         )
-    role = db.data().roles.get(role_uuid)
-    if not role or role.org_uuid != org_uuid:
-        raise HTTPException(status_code=404, detail="Role not found in organization")
 
     display_name = payload.get("display_name")
     if not display_name:
@@ -312,68 +311,64 @@ async def admin_update_role_name(
     return {"status": "ok"}
 
 
-@app.post("/orgs/{org_uuid}/roles/{role_uuid}/permissions/{permission_uuid}")
+@app.post("/roles/{role_uuid}/permissions/{permission_uuid}")
 async def admin_add_role_permission(
-    org_uuid: UUID,
     role_uuid: UUID,
     permission_uuid: UUID,
     request: Request,
     auth=AUTH_COOKIE,
 ):
     """Add a permission to a role (intent-based API)."""
+    role = db.data().roles.get(role_uuid)
+    if not role:
+        raise HTTPException(status_code=404, detail="Role not found")
     ctx = await authz.verify(
         auth,
         ["auth:admin", "auth:org:admin"],
         match=permutil.has_any,
         host=request.headers.get("host"),
     )
-    if not can_manage_org(ctx, org_uuid):
+    if not can_manage_org(ctx, role.org_uuid):
         raise authz.AuthException(
             status_code=403, detail="Insufficient permissions", mode="forbidden"
         )
 
-    role = db.data().roles.get(role_uuid)
-    if not role or role.org_uuid != org_uuid:
-        raise HTTPException(status_code=404, detail="Role not found in organization")
-
     # Verify permission exists and org can grant it
     perm = db.data().permissions.get(permission_uuid)
     if not perm:
         raise HTTPException(status_code=404, detail="Permission not found")
-    if org_uuid not in perm.orgs:
+    if role.org_uuid not in perm.orgs:
         raise ValueError("Permission not grantable by organization")
 
     db.add_permission_to_role(role_uuid, permission_uuid, ctx=ctx)
     return {"status": "ok"}
 
 
-@app.delete("/orgs/{org_uuid}/roles/{role_uuid}/permissions/{permission_uuid}")
+@app.delete("/roles/{role_uuid}/permissions/{permission_uuid}")
 async def admin_remove_role_permission(
-    org_uuid: UUID,
     role_uuid: UUID,
     permission_uuid: UUID,
     request: Request,
     auth=AUTH_COOKIE,
 ):
     """Remove a permission from a role (intent-based API)."""
+    role = db.data().roles.get(role_uuid)
+    if not role:
+        raise HTTPException(status_code=404, detail="Role not found")
     ctx = await authz.verify(
         auth,
         ["auth:admin", "auth:org:admin"],
         match=permutil.has_any,
         host=request.headers.get("host"),
     )
-    if not can_manage_org(ctx, org_uuid):
+    if not can_manage_org(ctx, role.org_uuid):
         raise authz.AuthException(
             status_code=403, detail="Insufficient permissions", mode="forbidden"
         )
 
-    role = db.data().roles.get(role_uuid)
-    if not role or role.org_uuid != org_uuid:
-        raise HTTPException(status_code=404, detail="Role not found in organization")
-
     # Sanity check: prevent admin from removing their own access
     perm = db.data().permissions.get(permission_uuid)
-    if ctx.org.uuid == org_uuid and ctx.role.uuid == role_uuid:
+    if ctx.org.uuid == role.org_uuid and ctx.role.uuid == role_uuid:
         if perm and perm.scope in ["auth:admin", "auth:org:admin"]:
             # Check if removing this permission would leave no admin access
             remaining_perms = role.permission_set - {permission_uuid}
@@ -390,13 +385,15 @@ async def admin_remove_role_permission(
     return {"status": "ok"}
 
 
-@app.delete("/orgs/{org_uuid}/roles/{role_uuid}")
+@app.delete("/roles/{role_uuid}")
 async def admin_delete_role(
-    org_uuid: UUID,
     role_uuid: UUID,
     request: Request,
     auth=AUTH_COOKIE,
 ):
+    role = db.data().roles.get(role_uuid)
+    if not role:
+        raise HTTPException(status_code=404, detail="Role not found")
     ctx = await authz.verify(
         auth,
         ["auth:admin", "auth:org:admin"],
@@ -404,13 +401,10 @@ async def admin_delete_role(
         host=request.headers.get("host"),
         max_age="5m",
     )
-    if not can_manage_org(ctx, org_uuid):
+    if not can_manage_org(ctx, role.org_uuid):
         raise authz.AuthException(
             status_code=403, detail="Insufficient permissions", mode="forbidden"
         )
-    role = db.data().roles.get(role_uuid)
-    if not role or role.org_uuid != org_uuid:
-        raise HTTPException(status_code=404, detail="Role not found in organization")
 
     # Sanity check: prevent admin from deleting their own role
     if ctx.role.uuid == role_uuid:
@@ -460,60 +454,58 @@ async def admin_create_user(
     return {"uuid": str(user.uuid)}
 
 
-@app.patch("/orgs/{org_uuid}/users/{user_uuid}/role")
+@app.patch("/users/{user_uuid}/role")
 async def admin_update_user_role(
-    org_uuid: UUID,
     user_uuid: UUID,
     request: Request,
     payload: dict = Body(...),
     auth=AUTH_COOKIE,
 ):
+    try:
+        user_org, _current_role = db.get_user_organization(user_uuid)
+    except ValueError:
+        raise HTTPException(status_code=404, detail="User not found")
     ctx = await authz.verify(
         auth,
         ["auth:admin", "auth:org:admin"],
         match=permutil.has_any,
         host=request.headers.get("host"),
     )
-    if not can_manage_org(ctx, org_uuid):
+    if not can_manage_org(ctx, user_org.uuid):
         raise authz.AuthException(
             status_code=403, detail="Insufficient permissions", mode="forbidden"
         )
-    new_role = payload.get("role")
+    role_uuid_str = payload.get("role_uuid")
-    if not new_role:
+    if not role_uuid_str:
-        raise ValueError("role is required")
+        raise ValueError("role_uuid is required")
     try:
-        user_org, _current_role = db.get_user_organization(user_uuid)
+        new_role_uuid = UUID(role_uuid_str)
-    except ValueError:
+    except (ValueError, TypeError):
-        raise ValueError("User not found")
+        raise ValueError("Invalid role UUID")
-    if user_org.uuid != org_uuid:
+    new_role = db.data().roles.get(new_role_uuid)
-        raise ValueError("User does not belong to this organization")
+    if not new_role or new_role.org_uuid != user_org.uuid:
-    roles = user_org.roles
-    if not any(r.display_name == new_role for r in roles):
         raise ValueError("Role not found in organization")
 
     # Sanity check: prevent admin from removing their own access
     if ctx.user.uuid == user_uuid:
-        new_role_obj = next((r for r in roles if r.display_name == new_role), None)
+        # Check if any permission in the new role is an admin permission
-        if new_role_obj:  # pragma: no branch - always true, role validated above
+        has_admin_access = False
-            # Check if any permission in the new role is an admin permission
+        for perm_uuid in new_role.permissions:
-            has_admin_access = False
+            perm = db.data().permissions.get(perm_uuid)
-            for perm_uuid in new_role_obj.permissions:
+            if perm and perm.scope in ["auth:admin", "auth:org:admin"]:
-                perm = db.data().permissions.get(perm_uuid)
+                has_admin_access = True
-                if perm and perm.scope in ["auth:admin", "auth:org:admin"]:
+                break
-                    has_admin_access = True
+        if not has_admin_access:
-                    break
+            raise ValueError(
-            if not has_admin_access:
+                "Cannot change your own role to one without admin permissions"
-                raise ValueError(
+            )
-                    "Cannot change your own role to one without admin permissions"
-                )
 
-    db.update_user_role_in_organization(user_uuid, new_role, ctx=ctx)
+    db.update_user_role(user_uuid, new_role_uuid, ctx=ctx)
     return {"status": "ok"}
 
 
-@app.post("/orgs/{org_uuid}/users/{user_uuid}/create-link")
+@app.post("/users/{user_uuid}/create-link")
 async def admin_create_user_registration_link(
-    org_uuid: UUID,
     user_uuid: UUID,
     request: Request,
     auth=AUTH_COOKIE,
@@ -522,8 +514,6 @@ async def admin_create_user_registration_link(
         user_org, _role_name = db.get_user_organization(user_uuid)
     except ValueError:
         raise HTTPException(status_code=404, detail="User not found")
-    if user_org.uuid != org_uuid:
-        raise HTTPException(status_code=404, detail="User not found in organization")
     ctx = await authz.verify(
         auth,
         ["auth:admin", "auth:org:admin"],
@@ -531,7 +521,7 @@ async def admin_create_user_registration_link(
         host=request.headers.get("host"),
         max_age="5m",
     )
-    if not can_manage_org(ctx, org_uuid):
+    if not can_manage_org(ctx, user_org.uuid):
         raise authz.AuthException(
             status_code=403, detail="Insufficient permissions", mode="forbidden"
         )
@@ -540,11 +530,9 @@ async def admin_create_user_registration_link(
     has_credentials = db.get_user_credential_ids(user_uuid)
     token_type = "user registration" if not has_credentials else "account recovery"
 
-    token = passphrase.generate()
     expiry = reset_expires()
-    db.create_reset_token(
+    token = db.create_reset_token(
         user_uuid=user_uuid,
-        passphrase=token,
         expiry=expiry,
         token_type=token_type,
         ctx=ctx,
@@ -553,12 +541,12 @@ async def admin_create_user_registration_link(
     return {
         "url": url,
         "expires": format_datetime(expiry),
+        "token_type": token_type,
     }
 
 
-@app.get("/orgs/{org_uuid}/users/{user_uuid}")
+@app.get("/users/{user_uuid}")
 async def admin_get_user_detail(
-    org_uuid: UUID,
     user_uuid: UUID,
     request: Request,
     auth=AUTH_COOKIE,
@@ -567,15 +555,13 @@ async def admin_get_user_detail(
         user_org, role_name = db.get_user_organization(user_uuid)
     except ValueError:
         raise HTTPException(status_code=404, detail="User not found")
-    if user_org.uuid != org_uuid:
-        raise HTTPException(status_code=404, detail="User not found in organization")
     ctx = await authz.verify(
         auth,
         ["auth:admin", "auth:org:admin"],
         match=permutil.has_any,
         host=request.headers.get("host"),
     )
-    if not can_manage_org(ctx, org_uuid):
+    if not can_manage_org(ctx, user_org.uuid):
         raise authz.AuthException(
             status_code=403, detail="Insufficient permissions", mode="forbidden"
         )
@@ -615,9 +601,8 @@ async def admin_get_user_detail(
     )
 
 
-@app.patch("/orgs/{org_uuid}/users/{user_uuid}/display-name")
+@app.patch("/users/{user_uuid}/display-name")
 async def admin_update_user_display_name(
-    org_uuid: UUID,
     user_uuid: UUID,
     request: Request,
     payload: dict = Body(...),
@@ -627,15 +612,13 @@ async def admin_update_user_display_name(
         user_org, _role_name = db.get_user_organization(user_uuid)
     except ValueError:
         raise HTTPException(status_code=404, detail="User not found")
-    if user_org.uuid != org_uuid:
-        raise HTTPException(status_code=404, detail="User not found in organization")
     ctx = await authz.verify(
         auth,
         ["auth:admin", "auth:org:admin"],
         match=permutil.has_any,
         host=request.headers.get("host"),
     )
-    if not can_manage_org(ctx, org_uuid):
+    if not can_manage_org(ctx, user_org.uuid):
         raise authz.AuthException(
             status_code=403, detail="Insufficient permissions", mode="forbidden"
         )
@@ -648,9 +631,37 @@ async def admin_update_user_display_name(
     return {"status": "ok"}
 
 
-@app.delete("/orgs/{org_uuid}/users/{user_uuid}/credentials/{credential_uuid}")
+@app.delete("/users/{user_uuid}")
+async def admin_delete_user(
+    user_uuid: UUID,
+    request: Request,
+    auth=AUTH_COOKIE,
+):
+    """Delete a user and all their credentials/sessions."""
+    try:
+        user_org, _role_name = db.get_user_organization(user_uuid)
+    except ValueError:
+        raise HTTPException(status_code=404, detail="User not found")
+    ctx = await authz.verify(
+        auth,
+        ["auth:admin", "auth:org:admin"],
+        match=permutil.has_any,
+        host=request.headers.get("host"),
+        max_age="5m",
+    )
+    if not can_manage_org(ctx, user_org.uuid):
+        raise authz.AuthException(
+            status_code=403, detail="Insufficient permissions", mode="forbidden"
+        )
+    # Prevent admin from deleting themselves
+    if ctx.user.uuid == user_uuid:
+        raise ValueError("Cannot delete your own account")
+    db.delete_user(user_uuid, ctx=ctx)
+    return {"status": "ok"}
+
+
+@app.delete("/users/{user_uuid}/credentials/{credential_uuid}")
 async def admin_delete_user_credential(
-    org_uuid: UUID,
     user_uuid: UUID,
     credential_uuid: UUID,
     request: Request,
@@ -660,8 +671,6 @@ async def admin_delete_user_credential(
         user_org, _role_name = db.get_user_organization(user_uuid)
     except ValueError:
         raise HTTPException(status_code=404, detail="User not found")
-    if user_org.uuid != org_uuid:
-        raise HTTPException(status_code=404, detail="User not found in organization")
     ctx = await authz.verify(
         auth,
         ["auth:admin", "auth:org:admin"],
@@ -669,7 +678,7 @@ async def admin_delete_user_credential(
         host=request.headers.get("host"),
         max_age="5m",
     )
-    if not can_manage_org(ctx, org_uuid):
+    if not can_manage_org(ctx, user_org.uuid):
         raise authz.AuthException(
             status_code=403, detail="Insufficient permissions", mode="forbidden"
         )
@@ -677,9 +686,8 @@ async def admin_delete_user_credential(
     return {"status": "ok"}
 
 
-@app.delete("/orgs/{org_uuid}/users/{user_uuid}/sessions/{session_id}")
+@app.delete("/users/{user_uuid}/sessions/{session_id}")
 async def admin_delete_user_session(
-    org_uuid: UUID,
     user_uuid: UUID,
     session_id: str,
     request: Request,
@@ -689,15 +697,13 @@ async def admin_delete_user_session(
         user_org, _role_name = db.get_user_organization(user_uuid)
     except ValueError:
         raise HTTPException(status_code=404, detail="User not found")
-    if user_org.uuid != org_uuid:
-        raise HTTPException(status_code=404, detail="User not found in organization")
     ctx = await authz.verify(
         auth,
         ["auth:admin", "auth:org:admin"],
         match=permutil.has_any,
         host=request.headers.get("host"),
     )
-    if not can_manage_org(ctx, org_uuid):
+    if not can_manage_org(ctx, user_org.uuid):
         raise authz.AuthException(
             status_code=403, detail="Insufficient permissions", mode="forbidden"
         )
@@ -706,7 +712,7 @@ async def admin_delete_user_session(
     if not target_session or target_session.user_uuid != user_uuid:
         raise HTTPException(status_code=404, detail="Session not found")
 
-    db.delete_session(session_id, ctx=ctx)
+    db.delete_session(session_id, ctx=ctx, action="admin:delete_session")
 
     # Check if admin terminated their own session
     current_terminated = session_id == auth

paskia/fastapi/api.py

@@ -17,7 +17,7 @@ from paskia import db
 from paskia.authsession import EXPIRES, expires, get_reset
 from paskia.fastapi import authz, session, user
 from paskia.fastapi.response import MsgspecResponse
-from paskia.fastapi.session import AUTH_COOKIE, AUTH_COOKIE_NAME
+from paskia.fastapi.session import AUTH_COOKIE, AUTH_COOKIE_NAME, get_client_ip
 from paskia.globals import passkey as global_passkey
 from paskia.util import hostutil, htmlutil, passphrase, userinfo, vitedev
 
@@ -78,7 +78,7 @@ async def validate_token(
     try:
         ctx = await authz.verify(
             auth,
-            perm,
+            " ".join(perm).split(),
             host=request.headers.get("host"),
             max_age=max_age,
         )
@@ -91,9 +91,10 @@ async def validate_token(
         if not timedelta(0) < consumed < _REFRESH_INTERVAL:
             db.update_session(
                 auth,
-                ip=request.client.host if request.client else "",
+                ip=get_client_ip(request),
                 user_agent=request.headers.get("user-agent") or "",
                 expiry=expires(),
+                ctx=ctx,
             )
             session.set_session_cookie(response, auth)
             renewed = True
@@ -130,7 +131,10 @@ async def forward_authentication(
     """
     try:
         ctx = await authz.verify(
-            auth, perm, host=request.headers.get("host"), max_age=max_age
+            auth,
+            " ".join(perm).split(),
+            host=request.headers.get("host"),
+            max_age=max_age,
         )
         # Build permission scopes for Remote-Groups header
         role_permissions = (
@@ -248,7 +252,7 @@ async def api_logout(request: Request, response: Response, auth=AUTH_COOKIE):
     if not ctx:
         return {"message": "Already logged out"}
     with suppress(Exception):
-        db.delete_session(auth, ctx=ctx)
+        db.delete_session(auth, ctx=ctx, action="logout")
     session.clear_session_cookie(response)
     return {"message": "Logged out successfully"}
 

paskia/fastapi/authz.py

@@ -2,6 +2,7 @@ import logging
 
 from fastapi import HTTPException
 
+from paskia.fastapi.logging import log_permission_denied
 from paskia.util import permutil, sessionutil
 
 logger = logging.getLogger(__name__)
@@ -79,6 +80,9 @@ async def verify(
             mode="login",
             clear_session=True,
         )
+    # User's theme preference for iframe (only if explicitly set)
+    user_theme = ctx.user.theme if ctx.user.theme else None
+
     # Check max_age requirement if specified
     if max_age:
         try:
@@ -87,29 +91,27 @@ async def verify(
                     status_code=401,
                     detail="Additional authentication required",
                     mode="reauth",
+                    theme=user_theme,
                 )
         except ValueError as e:
             # Invalid max_age format - log but don't fail the request
             logger.warning(f"Invalid max_age format '{max_age}': {e}")
 
     if not match(ctx, perm):
-        # Determine which permissions are missing for clearer diagnostics
         effective_scopes = (
             {p.scope for p in (ctx.permissions or [])}
             if ctx.permissions
             else set(ctx.role.permissions or [])
         )
         missing = sorted(set(perm) - effective_scopes)
-        logger.warning(
+        log_permission_denied(
-            "Permission denied: user=%s role=%s missing=%s required=%s granted=%s",  # noqa: E501
+            ctx, perm, missing, require_all=(match == permutil.has_all)
-            getattr(ctx.user, "uuid", "?"),
-            getattr(ctx.role, "display_name", "?"),
-            missing,
-            perm,
-            list(effective_scopes),
         )
         raise AuthException(
-            status_code=403, mode="forbidden", detail="Permission required"
+            status_code=403,
+            mode="forbidden",
+            detail="Permission required",
+            theme=user_theme,
         )
 
     return ctx

paskia/fastapi/logging.py

@@ -4,8 +4,12 @@ import logging
 import sys
 import time
 from ipaddress import IPv6Address
+from typing import TYPE_CHECKING
 
 from starlette.middleware.base import BaseHTTPMiddleware
+
+if TYPE_CHECKING:
+    from paskia.db.structs import SessionContext
 from starlette.requests import Request
 from starlette.responses import Response
 
@@ -13,25 +17,54 @@ logger = logging.getLogger("paskia.access")
 
 _RESET = "\033[0m"
 _STATUS_INFO = "\033[32m"  # 1xx (green)
-_STATUS_OK = "\033[92m"  # 2xx (bright green)
+_STATUS_OK = "\033[1;92m"  # 2xx (bright green)
 _STATUS_REDIRECT = "\033[32m"  # 3xx (green)
 _STATUS_CLIENT_ERR = "\033[0;31m"  # 4xx (red)
-_STATUS_SERVER_ERR = "\033[1;31m"  # 5xx (bright red)
+_STATUS_SERVER_ERR = "\033[1;91m"  # 5xx (bold bright red)
 _METHOD_READ = "\033[0;34m"  # GET, HEAD, OPTIONS (blue)
-_METHOD_WRITE = "\033[1;34m"  # POST, PUT, DELETE, PATCH (bright blue)
+_METHOD_WRITE = "\033[1;94m"  # POST, PUT, DELETE, PATCH (bold bright blue)
-_HOST = "\033[1;30m"  # hostname (dark grey)
+_HOST = "\033[38;5;242m"  # hostname (dark grey)
-_PATH = "\033[0m"  # path (default)
+_PATH = "\033[38;5;250m"  # path (white)
-_TIMING = "\033[2m"  # timing (dim)
+_TIMING = "\033[38;5;242m"  # timing/devmode (dark grey)
-_WS_OPEN = "\033[1;33m"  # WebSocket connect (bright yellow)
+_WS_OPEN = "\033[1;93m"  # WebSocket connect (bold bright yellow)
-_WS_CLOSE = "\033[0;33m"  # WebSocket disconnect (yellow)
+_WS_CLOSE = "\033[33m"  # WebSocket disconnect (yellow)
-_WS_STATUS = "\033[1;30m"  # WebSocket close status (dark grey)
+_WS_STATUS = "\033[38;5;242m"  # WebSocket close status (dark grey)
+_AUTHZ_DENIED = "\033[0;31m"  # Permission denied (red)
+_AUTHZ_USER = "\033[1;34m"  # User info (light blue)
+_AUTHZ_ORG = "\033[34m"  # User info (blue)
+_AUTHZ_NEEDS = "\033[1;38;5;231m"  # Needs (brightest white)
+_AUTHZ_MISSING = "\033[1;31m"  # Missing scope (bold red)
+_AUTHZ_GRANTED = "\033[0;32m"  # Granted scope (green)
 
 
 def format_ipv6_network(ip: str) -> str:
-    """Format IPv6 address to show only network part (first 64 bits)."""
+    """Format IPv6 address to show only network part (first 64 bits).
+
+    Special addresses are returned as-is for clarity:
+    - ::1 (loopback)
+    - :: (unspecified)
+    - ::ffff:x.x.x.x (IPv4-mapped, returns just the IPv4 part)
+    - fe80:: (link-local, returned as-is since interface-specific)
+    """
     try:
+        # Strip brackets that some proxies add around IPv6
+        ip = ip.strip("[]")
+        # Strip zone ID (e.g., fe80::1%eth0)
+        if "%" in ip:
+            ip = ip.split("%")[0]
         addr = IPv6Address(ip)
-        # Get the integer representation and mask to first 64 bits
+
+        # Special cases - return as-is or with minimal processing
+        if addr.is_loopback:  # ::1
+            return "::1"
+        if addr.is_unspecified:  # ::
+            return "::"
+        if addr.ipv4_mapped:  # ::ffff:x.x.x.x
+            return str(addr.ipv4_mapped)
+        if addr.is_link_local:  # fe80::/10 - interface-specific, keep full
+            return str(addr)
+
+        # Regular addresses: truncate to /64 network prefix
         network_int = int(addr) >> 64
         # Format as IPv6 with trailing ::
         # Split into 4 groups of 16 bits
@@ -41,8 +74,8 @@ def format_ipv6_network(ip: str) -> str:
             network_int >>= 16
         # Compress consecutive zero groups
         result = ":".join(groups) + "::"
-        # Simplify leading zeros in groups and compress
+        # Simplify leading zeros in groups and compress, then strip trailing ::
-        return str(IPv6Address(result + "0"))
+        return str(IPv6Address(result + "0")).removesuffix("::")
     except Exception:
         return ip
 
@@ -51,7 +84,9 @@ def format_client_ip(ip: str) -> str:
     """Format client IP, compressing IPv6 to network part only."""
     if not ip or ip == "-":
         return "-"
-    if ":" in ip:
+    # Strip brackets for detection (some proxies add them)
+    stripped = ip.strip("[]")
+    if ":" in stripped:
         return format_ipv6_network(ip)
     return ip
 
@@ -83,7 +118,7 @@ def format_access_log(
     use_color = sys.stderr.isatty()
 
     # Format components with fixed widths for alignment
-    ip = format_client_ip(client).ljust(15)  # IPv4 max 15 chars
+    ip = format_client_ip(client).ljust(19)  # IPv6 network max 19 chars
     timing = f"{duration_ms:.0f}ms"
     method_padded = method.ljust(7)  # Longest method is OPTIONS (7)
 
@@ -116,25 +151,39 @@ def _next_ws_id() -> int:
     return ws_id
 
 
-def log_ws_open(client: str, host: str, path: str) -> int:
+def log_ws_open(ws) -> int:
     """Log WebSocket connection open. Returns connection ID for use in close."""
     use_color = sys.stderr.isatty()
     ws_id = _next_ws_id()
 
-    ip = format_client_ip(client).ljust(15)
+    client = ws.client.host if ws.client else "-"
+    host = ws.headers.get("host", "-")
+    path = ws.url.path
+    origin = ws.headers.get("origin")
+
+    ip = format_client_ip(client).ljust(19)
     id_str = f"{ws_id:02d}".ljust(7)  # Align with method field (7 chars)
 
+    # Determine if origin should be shown (omit when same as host)
+    # Origin header includes scheme (e.g., "https://example.com"), compare host part
+    origin_host = origin.split("://", 1)[-1] if origin else None
+    show_origin = origin_host and origin_host != host
+
     if use_color:
         # 🔌 aligned with status (takes ~2 char width), ID aligned with method
         prefix = f"🔌  {_WS_OPEN}{id_str}{_RESET}"
         host_str = f"{_HOST}{host}{_RESET}"
         path_str = f"{_PATH}{path}{_RESET}"
+        origin_str = (
+            f" {_RESET}from {_HOST}{origin_host}{_RESET}" if show_origin else ""
+        )
     else:
         prefix = f"WS+ {id_str}"
         host_str = host
         path_str = path
+        origin_str = f" from {origin_host}" if show_origin else ""
 
-    logger.info(f"{ip} {prefix} {host_str}{path_str}")
+    logger.info(f"{ip} {prefix} {host_str}{path_str}{origin_str}")
     return ws_id
 
 
@@ -158,15 +207,12 @@ WS_CLOSE_CODES = {
 }
 
 
-def log_ws_close(
+def log_ws_close(ws_id: int, close_code: int | None, duration: float) -> None:
-    client: str, ws_id: int, close_code: int | None, duration_ms: float
-) -> None:
     """Log WebSocket connection close with duration and status."""
     use_color = sys.stderr.isatty()
 
-    ip = format_client_ip(client).ljust(15)
     id_str = f"{ws_id:02d}".ljust(7)  # Align with method field (7 chars)
-    timing = f"{duration_ms:.0f}ms"
+    timing = f"{duration * 1000:.0f}ms"
 
     # Convert close code to status text
     if close_code is None:
@@ -184,7 +230,27 @@ def log_ws_close(
         status_str = status
         timing_str = timing
 
-    logger.info(f"{ip} {prefix} {status_str} {timing_str}")
+    logger.info(f"{' ' * 19} {prefix} {status_str} {timing_str}")
+
+
+def log_permission_denied(
+    ctx: "SessionContext", required: list[str], missing: list[str], *, require_all: bool
+) -> None:
+    """Log permission denied with org, role, user and highlighted missing scopes."""
+    missing_set = set(missing)
+    scopes = " ".join(
+        f"{_AUTHZ_MISSING}{s}✗{_RESET}"
+        if s in missing_set
+        else f"{_AUTHZ_GRANTED}{s}✓{_RESET}"
+        for s in required
+    )
+    n = "" if len(required) == 1 else " all" if require_all else " any"
+    logger.warning(
+        f"{_AUTHZ_DENIED}Permission denied{_RESET} "
+        f"{_AUTHZ_USER}{ctx.user.display_name}{_RESET} "
+        f"{_AUTHZ_ORG}({ctx.org.display_name} {ctx.role.display_name}){_RESET} "
+        f"{_AUTHZ_NEEDS}needs{n}:{_RESET} {scopes}"
+    )
 
 
 class AccessLogMiddleware(BaseHTTPMiddleware):
@@ -216,3 +282,5 @@ def configure_access_logging():
     logger.addHandler(handler)
     logger.setLevel(logging.INFO)
     logger.propagate = False
+    # Suppress watchfiles "X changes detected" INFO messages (keep WARNING for reload notification)
+    logging.getLogger("watchfiles.main").setLevel(logging.WARNING)

paskia/fastapi/mainapp.py

@@ -12,6 +12,7 @@ from paskia import globals
 from paskia.db import start_background, stop_background
 from paskia.db.logging import configure_db_logging
 from paskia.fastapi import admin, api, auth_host, ws
+from paskia.fastapi.__main__ import DEVMODE
 from paskia.fastapi.logging import AccessLogMiddleware, configure_access_logging
 from paskia.fastapi.session import AUTH_COOKIE
 from paskia.util import hostutil, passphrase, vitedev
@@ -20,10 +21,13 @@ from paskia.util import hostutil, passphrase, vitedev
 configure_access_logging()
 configure_db_logging()
 
+_access_logger = logging.getLogger("paskia.access")
+
 # Vue Frontend static files
 frontend = Frontend(
     Path(__file__).parent.parent / "frontend-build",
     cached=["/auth/assets/"],
+    favicon="/paskia.webp",
 )
 
 
@@ -56,10 +60,9 @@ async def lifespan(app: FastAPI):  # pragma: no cover - startup path
 
     # Restore uvicorn info logging (suppressed during startup in dev mode)
     # Keep uvicorn.error at WARNING to suppress WebSocket "connection open/closed" messages
-    if frontend.devmode:
+    if app.debug:
         logging.getLogger("uvicorn").setLevel(logging.INFO)
     logging.getLogger("uvicorn.error").setLevel(logging.WARNING)
-
     await frontend.load()
     await start_background()
     yield
@@ -72,6 +75,7 @@ app = FastAPI(
     docs_url=None,
     redoc_url=None,
     openapi_url=None,
+    debug=DEVMODE,
 )
 
 # Custom access logging (uvicorn's access_log is disabled)
@@ -134,6 +138,11 @@ async def examples_page():
     return FileResponse(index_file, media_type="text/html")
 
 
+# Frontend static files - must be before /{token} catch-all routes
+# (actual routes registered during lifespan after frontend.load())
+frontend.route(app, "/")
+
+
 # Note: this catch-all handler must be the last route defined
 @app.get("/{token}")
 @app.get("/auth/{token}")
@@ -146,7 +155,3 @@ async def token_link(token: str):
         raise HTTPException(status_code=404)
 
     return Response(*await vitedev.read("/int/reset/index.html"))
-
-
-# Final catch-all route for frontend files (keep at end of file)
-frontend.route(app, "/")

paskia/fastapi/remote.py

@@ -17,10 +17,10 @@ from fastapi import FastAPI, WebSocket, WebSocketDisconnect
 
 from paskia import db, remoteauth
 from paskia.authsession import expires
-from paskia.fastapi.session import infodict
+from paskia.fastapi.session import AUTH_COOKIE, infodict
-from paskia.fastapi.wschat import authenticate_chat
+from paskia.fastapi.wschat import authenticate_and_login
 from paskia.fastapi.wsutil import validate_origin, websocket_error_handler
-from paskia.util import hostutil, passphrase, pow, useragent
+from paskia.util import pow, useragent
 
 # Create a FastAPI subapp for remote auth WebSocket endpoints
 app = FastAPI(docs_url=None, redoc_url=None, openapi_url=None)
@@ -252,7 +252,7 @@ async def websocket_remote_auth_request(ws: WebSocket):
 
 @app.websocket("/permit")
 @websocket_error_handler
-async def websocket_remote_auth_permit(ws: WebSocket):
+async def websocket_remote_auth_permit(ws: WebSocket, auth=AUTH_COOKIE):
     """Complete a remote authentication request using a 3-word pairing code.
 
     This endpoint is called from the user's profile on the authenticating device.
@@ -270,7 +270,7 @@ async def websocket_remote_auth_permit(ws: WebSocket):
     7. Server sends {status: "success", message: "..."}
     """
 
-    origin = validate_origin(ws)
+    validate_origin(ws)
 
     if remoteauth.instance is None:
         raise ValueError("Remote authentication is not available")
@@ -310,56 +310,27 @@ async def websocket_remote_auth_permit(ws: WebSocket):
 
             # Handle authenticate request (no PoW needed - already validated during lookup)
             if msg.get("authenticate") and request is not None:
-                cred, new_sign_count = await authenticate_chat(ws, origin)
+                ctx = await authenticate_and_login(ws, auth)
 
-                # Create a session for the REQUESTING device
+                session_token = ctx.session.key
-                assert cred.uuid is not None
-
-                session_token = None
                 reset_token = None
 
                 if request.action == "register":
                     # For registration, create a reset token for device addition
-
-                    token_str = passphrase.generate()
                     expiry = expires()
-                    db.create_reset_token(
+                    reset_token = db.create_reset_token(
-                        user_uuid=cred.user_uuid,
+                        user_uuid=ctx.user.uuid,
-                        passphrase=token_str,
                         expiry=expiry,
                         token_type="device addition",
-                    )
+                        user=str(ctx.user.uuid),
-                    reset_token = token_str
-                    # Also create a session so the device is logged in
-                    normalized_host = hostutil.normalize_host(request.host)
-                    session_token = db.login(
-                        user_uuid=cred.user_uuid,
-                        credential_uuid=cred.uuid,
-                        sign_count=new_sign_count,
-                        host=normalized_host,
-                        ip=request.ip,
-                        user_agent=request.user_agent,
-                        expiry=expires(),
-                    )
-                else:
-                    # Default login action
-
-                    normalized_host = hostutil.normalize_host(request.host)
-                    session_token = db.login(
-                        user_uuid=cred.user_uuid,
-                        credential_uuid=cred.uuid,
-                        sign_count=new_sign_count,
-                        host=normalized_host,
-                        ip=request.ip,
-                        user_agent=request.user_agent,
-                        expiry=expires(),
                     )
 
                 # Complete the remote auth request (notifies the waiting device)
+                cred = db.data().credentials[ctx.session.credential_uuid]
                 completed = await remoteauth.instance.complete_request(
                     token=request.key,
                     session_token=session_token,
-                    user_uuid=cred.user_uuid,
+                    user_uuid=ctx.user.uuid,
                     credential_uuid=cred.uuid,
                     reset_token=reset_token,
                 )

paskia/fastapi/reset.py

@@ -1,108 +0,0 @@
-"""CLI support for creating user credential reset links.
-
-Usage (via main CLI):
-    paskia reset [query]
-
-If query is omitted, the master admin (first Administration role user in
-an organization granting auth:admin) is targeted. Otherwise query is
-matched as either an exact UUID or a case-insensitive substring of the
-display name. If multiple users match, they are listed and the command
-aborts. A new one-time reset link is always created.
-"""
-
-import asyncio
-from uuid import UUID
-
-from paskia import authsession as _authsession
-from paskia import db
-from paskia.util import hostutil, passphrase
-
-
-async def _resolve_targets(query: str | None):
-    if query:
-        # Try UUID
-        targets: list[tuple] = []
-        try:
-            q_uuid = UUID(query)
-            p = next(
-                (p for p in db.data().permissions.values() if p.scope == "auth:admin"),
-                None,
-            )
-            if p:
-                for org_uuid in p.orgs:
-                    users = db.get_organization_users(org_uuid)
-                    for u, role_name in users:
-                        if u.uuid == q_uuid:
-                            return [(u, role_name)]
-            # UUID not found among admin orgs -> fall back to substring search (rare case)
-        except ValueError:
-            pass
-        # Substring search
-        needle = query.lower()
-        p = next(
-            (p for p in db.data().permissions.values() if p.scope == "auth:admin"), None
-        )
-        if p:
-            for org_uuid in p.orgs:
-                users = db.get_organization_users(org_uuid)
-                for u, role_name in users:
-                    if needle in (u.display_name or "").lower():
-                        targets.append((u, role_name))
-        # De-duplicate
-        seen = set()
-        deduped = []
-        for u, role_name in targets:
-            if u.uuid not in seen:
-                seen.add(u.uuid)
-                deduped.append((u, role_name))
-        return deduped
-    # No query -> master admin
-    p = next(
-        (p for p in db.data().permissions.values() if p.scope == "auth:admin"), None
-    )
-    if not p or not p.orgs:
-        return []
-    first_org_uuid = next(iter(p.orgs))
-    users = db.get_organization_users(first_org_uuid)
-    admin_users = [pair for pair in users if pair[1] == "Administration"]
-    return admin_users[:1]
-
-
-async def _create_reset(user, role_name: str):
-    token = passphrase.generate()
-    expiry = _authsession.reset_expires()
-    db.create_reset_token(
-        passphrase=token,
-        user_uuid=user.uuid,
-        expiry=expiry,
-        token_type="manual reset",
-    )
-    return hostutil.reset_link_url(token), token
-
-
-async def _main(query: str | None) -> int:
-    try:
-        candidates = await _resolve_targets(query)
-        if not candidates:
-            print("No matching users found")
-            return 1
-        if len(candidates) > 1:
-            print("Multiple matches. Refine your query:")
-            for u, role_name in candidates:
-                print(f" - {u.display_name}  ({u.uuid}) role={role_name}")
-            return 2
-        user, role_name = candidates[0]
-        link, token = await _create_reset(user, role_name)
-        print(f"Reset link for {user.display_name} ({user.uuid}):\n{link}\n")
-        return 0
-    except Exception as e:  # pragma: no cover
-        print("Failed to create reset link:", e)
-        return 1
-
-
-def run(query: str | None) -> int:
-    """Synchronous wrapper for CLI entrypoint."""
-    return asyncio.run(_main(query))
-
-
-__all__ = ["run"]

paskia/fastapi/session.py

@@ -8,6 +8,8 @@ This module provides FastAPI-specific session management functionality:
 Generic session management functions have been moved to authsession.py
 """
 
+from ipaddress import IPv4Address, IPv6Address
+
 from fastapi import Cookie, Request, Response, WebSocket
 
 from paskia.authsession import EXPIRES
@@ -16,10 +18,44 @@ AUTH_COOKIE_NAME = "__Host-paskia"
 AUTH_COOKIE = Cookie(None, alias=AUTH_COOKIE_NAME)
 
 
+def normalize_ip(ip: str) -> str:
+    """Normalize IP address, stripping brackets and validating format.
+
+    Proxies may pass IPv6 in brackets like [::1] or with zone IDs.
+    IPv4-mapped IPv6 addresses (::ffff:x.x.x.x) are converted to plain IPv4.
+    Returns empty string for invalid addresses.
+    """
+    if not ip:
+        return ""
+    # Strip brackets that some proxies add around IPv6
+    ip = ip.strip("[]")
+    # Strip zone ID (e.g., fe80::1%eth0)
+    if "%" in ip:
+        ip = ip.split("%")[0]
+    try:
+        # Validate and normalize
+        if ":" in ip:
+            addr = IPv6Address(ip)
+            # Convert IPv4-mapped addresses to plain IPv4
+            if addr.ipv4_mapped:
+                return str(addr.ipv4_mapped)
+            return str(addr)
+        return str(IPv4Address(ip))
+    except ValueError:
+        return ip  # Return as-is if not a valid IP (could be hostname)
+
+
+def get_client_ip(request: Request | WebSocket) -> str:
+    """Get client IP from request, normalized."""
+    if not request.client:
+        return ""
+    return normalize_ip(request.client.host)
+
+
 def infodict(request: Request | WebSocket, type: str) -> dict:
     """Extract client information from request."""
     return {
-        "ip": request.client.host if request.client else "",
+        "ip": get_client_ip(request),
         "user_agent": request.headers.get("user-agent", "")[:500],
         "session_type": type,
     }

paskia/fastapi/user.py

@@ -17,7 +17,7 @@ from paskia.authsession import (
 )
 from paskia.fastapi import authz, session
 from paskia.fastapi.session import AUTH_COOKIE
-from paskia.util import hostutil, passphrase
+from paskia.util import hostutil
 
 app = FastAPI(docs_url=None, redoc_url=None, openapi_url=None)
 
@@ -57,6 +57,28 @@ async def user_update_display_name(
     return {"status": "ok"}
 
 
+@app.patch("/theme")
+async def user_update_theme(
+    request: Request,
+    payload: dict = Body(...),
+    auth=AUTH_COOKIE,
+):
+    if not auth:
+        raise authz.AuthException(
+            status_code=401, detail="Authentication Required", mode="login"
+        )
+    ctx = db.data().session_ctx(auth, request.headers.get("host"))
+    if not ctx:
+        raise authz.AuthException(
+            status_code=401, detail="Session expired", mode="login"
+        )
+    theme = payload.get("theme", "")
+    if theme not in ("", "light", "dark"):
+        raise HTTPException(status_code=400, detail="Invalid theme")
+    db.update_user_theme(ctx.user.uuid, theme, ctx=ctx)
+    return {"status": "ok"}
+
+
 @app.post("/logout-all")
 async def api_logout_all(request: Request, response: Response, auth=AUTH_COOKIE):
     if not auth:
@@ -127,11 +149,9 @@ async def api_create_link(
 ):
     # Require recent authentication for sensitive operation
     ctx = await authz.verify(auth, [], host=request.headers.get("host"), max_age="5m")
-    token = passphrase.generate()
     expiry = expires()
-    db.create_reset_token(
+    token = db.create_reset_token(
         user_uuid=ctx.user.uuid,
-        passphrase=token,
         expiry=expiry,
         token_type="device addition",
         ctx=ctx,
@@ -145,4 +165,5 @@ async def api_create_link(
             if expiry.tzinfo
             else expiry.replace(tzinfo=UTC).isoformat().replace("+00:00", "Z")
         ),
+        "token_type": "device addition",
     }

paskia/fastapi/ws.py

@@ -1,10 +1,10 @@
 from fastapi import FastAPI, WebSocket
 
 from paskia import db
-from paskia.authsession import expires, get_reset
+from paskia.authsession import get_reset
 from paskia.fastapi import authz, remote
 from paskia.fastapi.session import AUTH_COOKIE, infodict
-from paskia.fastapi.wschat import authenticate_chat, register_chat
+from paskia.fastapi.wschat import authenticate_and_login, register_chat
 from paskia.fastapi.wsutil import validate_origin, websocket_error_handler
 from paskia.globals import passkey
 from paskia.util import hostutil, passphrase
@@ -31,7 +31,7 @@ async def websocket_register_add(
     - Reset token supplied as ?reset=... (auth cookie ignored)
     """
     origin = validate_origin(ws)
-    host = origin.split("://", 1)[1]
+    host = hostutil.normalize_host(origin.split("://", 1)[1])
     if reset is not None:
         if not passphrase.is_well_formed(reset):
             raise ValueError(
@@ -46,7 +46,7 @@ async def websocket_register_add(
         s = ctx.session
 
     # Get user information and determine effective user_name for this registration
-    user = db.data().users.get(user_uuid)
+    user = db.data().users[user_uuid]
     user_name = user.display_name
     if name is not None:
         stripped = name.strip()
@@ -59,7 +59,7 @@ async def websocket_register_add(
 
     # Create a new session and store everything in database
     metadata = infodict(ws, "authenticated")
-    token = db.create_credential_session(  # type: ignore[attr-defined]
+    token = db.create_credential_session(
         user_uuid=user_uuid,
         credential=credential,
         reset_key=(s.key if reset is not None else None),
@@ -89,43 +89,20 @@ async def websocket_authenticate(ws: WebSocket, auth=AUTH_COOKIE):
 
     # If there's an existing session, restrict to that user's credentials (reauth)
     session_user_uuid = None
-    credential_ids = None
     if auth:
-        ctx = db.data().session_ctx(auth, host)
+        existing_ctx = db.data().session_ctx(auth, host)
-        if ctx:
+        if existing_ctx:
-            session_user_uuid = ctx.user.uuid
+            session_user_uuid = existing_ctx.user.uuid
-            credential_ids = db.get_user_credential_ids(session_user_uuid) or None
 
-    cred, new_sign_count = await authenticate_chat(ws, origin, credential_ids)
+    ctx = await authenticate_and_login(ws, auth)
 
     # If reauth mode, verify the credential belongs to the session's user
-    if session_user_uuid and cred.user_uuid != session_user_uuid:
+    if session_user_uuid and ctx.user.uuid != session_user_uuid:
         raise ValueError("This passkey belongs to a different account")
 
-    # Create session and update user/credential in a single transaction
-    assert cred.uuid is not None
-    metadata = infodict(ws, "auth")
-    normalized_host = hostutil.normalize_host(host)
-    if not normalized_host:
-        raise ValueError("Host required for session creation")
-    hostname = normalized_host.split(":")[0]
-    rp_id = passkey.instance.rp_id
-    if not (hostname == rp_id or hostname.endswith(f".{rp_id}")):
-        raise ValueError(f"Host must be the same as or a subdomain of {rp_id}")
-
-    token = db.login(
-        user_uuid=cred.user_uuid,
-        credential_uuid=cred.uuid,
-        sign_count=new_sign_count,
-        host=normalized_host,
-        ip=metadata["ip"],
-        user_agent=metadata["user_agent"],
-        expiry=expires(),
-    )
-
     await ws.send_json(
         {
-            "user": str(cred.user_uuid),
+            "user": str(ctx.user.uuid),
-            "session_token": token,
+            "session_token": ctx.session.key,
         }
     )

paskia/fastapi/wschat.py

@@ -7,8 +7,12 @@ from uuid import UUID
 from fastapi import WebSocket
 
 from paskia import db
-from paskia.db import Credential
+from paskia.authsession import expires
+from paskia.db import Credential, SessionContext
+from paskia.fastapi.session import infodict
+from paskia.fastapi.wsutil import validate_origin
 from paskia.globals import passkey
+from paskia.util import hostutil
 
 
 async def register_chat(
@@ -31,7 +35,6 @@ async def register_chat(
 
 async def authenticate_chat(
     ws: WebSocket,
-    origin: str,
     credential_ids: list[bytes] | None = None,
 ) -> tuple[Credential, int]:
     """Run WebAuthn authentication flow and return the credential and new sign count.
@@ -39,6 +42,7 @@ async def authenticate_chat(
     Returns:
         tuple of (credential, new_sign_count) where new_sign_count comes from WebAuthn verification
     """
+    origin = validate_origin(ws)
     options, challenge = passkey.instance.auth_generate_options(
         credential_ids=credential_ids
     )
@@ -60,3 +64,52 @@ async def authenticate_chat(
 
     verification = passkey.instance.auth_verify(authcred, challenge, cred, origin)
     return cred, verification.new_sign_count
+
+
+async def authenticate_and_login(
+    ws: WebSocket,
+    auth: str | None = None,
+) -> SessionContext:
+    """Run WebAuthn authentication flow, create session, and return the session context.
+
+    If auth is provided, restrict authentication to credentials of that session's user.
+
+    Returns:
+        SessionContext for the authenticated session
+    """
+    origin = validate_origin(ws)
+    host = origin.split("://", 1)[1]
+    normalized_host = hostutil.normalize_host(host)
+    if not normalized_host:
+        raise ValueError("Host required for session creation")
+    hostname = normalized_host.split(":")[0]
+    rp_id = passkey.instance.rp_id
+    if not (hostname == rp_id or hostname.endswith(f".{rp_id}")):
+        raise ValueError(f"Host must be the same as or a subdomain of {rp_id}")
+    metadata = infodict(ws, "auth")
+
+    # Get credential IDs if restricting to a user's credentials
+    credential_ids = None
+    if auth:
+        existing_ctx = db.data().session_ctx(auth, host)
+        if existing_ctx:
+            credential_ids = db.get_user_credential_ids(existing_ctx.user.uuid) or None
+
+    cred, new_sign_count = await authenticate_chat(ws, credential_ids)
+
+    # Create session and update user/credential
+    token = db.login(
+        user_uuid=cred.user_uuid,
+        credential_uuid=cred.uuid,
+        sign_count=new_sign_count,
+        host=normalized_host,
+        ip=metadata["ip"],
+        user_agent=metadata["user_agent"],
+        expiry=expires(),
+    )
+
+    # Fetch and return the full session context
+    ctx = db.data().session_ctx(token, normalized_host)
+    if not ctx:
+        raise ValueError("Failed to create session context")
+    return ctx

paskia/fastapi/wsutil.py

@@ -21,12 +21,8 @@ def websocket_error_handler(func):
 
     @wraps(func)
     async def wrapper(ws: WebSocket, *args, **kwargs):
-        client = ws.client.host if ws.client else "-"
-        host = ws.headers.get("host", "-")
-        path = ws.url.path
-
         start = time.perf_counter()
-        ws_id = log_ws_open(client, host, path)
+        ws_id = log_ws_open(ws)
         close_code = None
 
         try:
@@ -47,8 +43,7 @@ def websocket_error_handler(func):
             logging.exception("Internal Server Error")
             await ws.send_json({"status": 500, "detail": "Internal Server Error"})
         finally:
-            duration_ms = (time.perf_counter() - start) * 1000
+            log_ws_close(ws_id, close_code, time.perf_counter() - start)
-            log_ws_close(client, ws_id, close_code, duration_ms)
 
     return wrapper
 

paskia/globals.py

@@ -42,7 +42,7 @@ async def init(
 
     Database configuration:
         Set PASKIA_DB environment variable to specify the JSONL database file path.
-        Default: paskia.jsonl
+        Default: {rp_id}.paskiadb
     """
 
     # Initialize passkey instance with provided parameters
@@ -53,7 +53,7 @@ async def init(
     )
 
     # Initialize database
-    await db.init()
+    await db.init(rp_id=rp_id)
 
     # Initialize remote auth manager
     await remoteauth.init()

paskia/migrate/__init__.py

@@ -1,281 +0,0 @@
-"""
-SQL to JSON migration module for Paskia.
-
-This module contains the legacy SQL database implementation and migration tools
-for converting from the old SQLite database to the new JSONL format.
-
-Usage:
-    python -m paskia.migrate --sql sqlite+aiosqlite:///paskia.sqlite --json paskia.jsonl
-
-Or via the CLI entry point (if installed):
-    paskia-migrate --sql sqlite+aiosqlite:///paskia.sqlite --json paskia.jsonl
-"""
-
-import argparse
-import asyncio
-import re
-from datetime import UTC, datetime
-from uuid import UUID
-
-import base64url
-import uuid7
-from sqlalchemy import select
-
-from paskia.authsession import EXPIRES
-from paskia.db.jsonl import JsonlStore
-from paskia.db.structs import (
-    DB,
-    Credential,
-    Org,
-    Permission,
-    ResetToken,
-    Role,
-    Session,
-    User,
-)
-
-from .sql import (
-    DB as SQLDB,
-)
-from .sql import (
-    CredentialModel,
-    ResetTokenModel,
-    SessionModel,
-    UserModel,
-)
-
-# Re-export for convenience
-__all__ = ["migrate_from_sql", "main", "SQLDB"]
-
-# Default paths
-SQL_DB_DEFAULT = "sqlite+aiosqlite:///paskia.sqlite"
-JSON_DB_DEFAULT = "paskia.jsonl"
-
-
-async def migrate_from_sql(
-    sql_db_path: str = SQL_DB_DEFAULT,
-    json_db_path: str = JSON_DB_DEFAULT,
-) -> None:
-    """Migrate data from SQL database to JSON format.
-
-    Args:
-        sql_db_path: SQLAlchemy connection string for the source SQL database
-        json_db_path: Path for the destination JSONL file
-    """
-    # Initialize source SQL database
-    sql_db = SQLDB(sql_db_path)
-    await sql_db.init_db()
-
-    # Initialize destination JSON database (fresh, don't load existing)
-    db = DB()
-    store = JsonlStore(db, json_db_path)
-    db._store = store
-
-    print(f"Migrating from {sql_db_path} to {json_db_path}...")
-
-    # Build all data directly without saving (we'll save once at the end)
-    # Track old permission ID -> new scope mapping for migration
-    # Also track org-specific admin permissions to consolidate
-    old_org_admin_pattern = re.compile(r"^auth:org:([0-9a-f-]+)$", re.IGNORECASE)
-    org_admin_uuids = set()  # org UUIDs that had org-specific admin permissions
-
-    # First pass: identify org-specific admin permissions
-    permissions = await sql_db.list_permissions()
-    for perm in permissions:
-        match = old_org_admin_pattern.match(perm.id)
-        if match:
-            org_admin_uuids.add(match.group(1).lower())
-
-    # Migrate permissions with UUID keys and scope field
-    # Always create exactly one common auth:org:admin permission for all org admin needs
-    org_admin_perm_uuid: UUID = uuid7.create()
-    org_admin_perm = Permission(
-        scope="auth:org:admin",
-        display_name="Org Admin",
-        orgs={},
-    )
-    org_admin_perm.uuid = org_admin_perm_uuid
-    db.permissions[org_admin_perm_uuid] = org_admin_perm
-
-    # Mapping from old permission ID to new permission UUID
-    perm_id_to_uuid: dict[str, UUID] = {}
-
-    for perm in permissions:
-        # Skip old org-specific admin permissions (auth:org:{uuid}) - they map to auth:org:admin
-        match = old_org_admin_pattern.match(perm.id)
-        if match:
-            perm_id_to_uuid[perm.id] = org_admin_perm_uuid
-            continue
-
-        # Skip if this is already auth:org:admin - we created one above
-        if perm.id == "auth:org:admin":
-            perm_id_to_uuid[perm.id] = org_admin_perm_uuid
-            continue
-
-        # Regular permission - create with UUID key
-        perm_uuid: UUID = uuid7.create()
-        new_perm = Permission(
-            scope=perm.id,  # Old ID becomes the scope
-            display_name=perm.display_name,
-            orgs={},
-        )
-        new_perm.uuid = perm_uuid
-        db.permissions[perm_uuid] = new_perm
-        perm_id_to_uuid[perm.id] = perm_uuid
-    print(
-        f"  Migrated {len(permissions)} permissions (with {len(org_admin_uuids)} org-specific admins consolidated to auth:org:admin)"
-    )
-
-    # Migrate organizations
-    orgs = await sql_db.list_organizations()
-    for org in orgs:
-        org_key: UUID = org.uuid
-        new_org = Org(display_name=org.display_name)
-        new_org.uuid = org_key
-        db.orgs[org_key] = new_org
-        # Update permissions to allow this org to grant them (by UUID)
-        for old_perm_id in org.permissions:
-            perm_uuid = perm_id_to_uuid.get(old_perm_id)
-            if perm_uuid and perm_uuid in db.permissions:
-                db.permissions[perm_uuid].orgs[org_key] = True
-        # Ensure every org can grant auth:org:admin
-        db.permissions[org_admin_perm_uuid].orgs[org_key] = True
-    print(f"  Migrated {len(orgs)} organizations")
-
-    # Migrate roles - convert old permission IDs to UUIDs
-    role_count = 0
-    for org in orgs:
-        for role in org.roles:
-            role_key: UUID = role.uuid
-            # Convert old permission IDs to UUIDs
-            new_permissions: dict[UUID, bool] = {}
-            for old_perm_id in role.permissions or []:
-                perm_uuid = perm_id_to_uuid.get(old_perm_id)
-                if perm_uuid:
-                    new_permissions[perm_uuid] = True
-            new_role = Role(
-                org_uuid=role.org_uuid,
-                display_name=role.display_name,
-                permissions=new_permissions,
-            )
-            new_role.uuid = role_key
-            db.roles[role_key] = new_role
-            role_count += 1
-    print(f"  Migrated {role_count} roles")
-
-    # Migrate users
-    async with sql_db.session() as session:
-        result = await session.execute(select(UserModel))
-        user_models = result.scalars().all()
-        for um in user_models:
-            legacy_user = um.as_dataclass()
-            user_key: UUID = legacy_user.uuid
-            new_user = User(
-                display_name=legacy_user.display_name,
-                role_uuid=legacy_user.role_uuid,
-                created_at=legacy_user.created_at or datetime.now(UTC),
-                last_seen=legacy_user.last_seen,
-                visits=legacy_user.visits,
-            )
-            new_user.uuid = user_key
-            db.users[user_key] = new_user
-        print(f"  Migrated {len(user_models)} users")
-
-    # Migrate credentials
-    async with sql_db.session() as session:
-        result = await session.execute(select(CredentialModel))
-        cred_models = result.scalars().all()
-        for cm in cred_models:
-            legacy_cred = cm.as_dataclass()
-            cred_key: UUID = legacy_cred.uuid
-            new_cred = Credential(
-                credential_id=legacy_cred.credential_id,
-                user_uuid=legacy_cred.user_uuid,
-                aaguid=legacy_cred.aaguid,
-                public_key=legacy_cred.public_key,
-                sign_count=legacy_cred.sign_count,
-                created_at=legacy_cred.created_at,
-                last_used=legacy_cred.last_used,
-                last_verified=legacy_cred.last_verified,
-            )
-            new_cred.uuid = cred_key
-            db.credentials[cred_key] = new_cred
-        print(f"  Migrated {len(cred_models)} credentials")
-
-    # Migrate sessions
-    # Old format: b"sess" + 12 bytes -> New format: base64url string (16 chars)
-    async with sql_db.session() as session:
-        result = await session.execute(select(SessionModel))
-        session_models = result.scalars().all()
-        for sm in session_models:
-            sess = sm.as_dataclass()
-            old_key: bytes = sess.key
-            # Strip b"sess" prefix and encode remaining 12 bytes as base64url
-            if old_key.startswith(b"sess"):
-                session_key = base64url.enc(old_key[4:])
-            else:
-                # Already in new format or unknown - try to use as-is
-                session_key = base64url.enc(old_key[:12])
-            db.sessions[session_key] = Session(
-                user_uuid=sess.user_uuid,
-                credential_uuid=sess.credential_uuid,
-                host=sess.host,
-                ip=sess.ip,
-                user_agent=sess.user_agent,
-                expiry=sess.renewed + EXPIRES,  # Convert renewed to expiry
-            )
-        print(f"  Migrated {len(session_models)} sessions")
-
-    # Migrate reset tokens
-    # Old format: b"rset" + 16 bytes hash -> New format: 9 bytes (truncated hash)
-    async with sql_db.session() as session:
-        result = await session.execute(select(ResetTokenModel))
-        token_models = result.scalars().all()
-        for tm in token_models:
-            token = tm.as_dataclass()
-            old_key: bytes = token.key
-            # Strip b"rset" prefix and take first 9 bytes of hash
-            if old_key.startswith(b"rset"):
-                token_key = old_key[4:13]  # 9 bytes after prefix
-            else:
-                # Already in new format or unknown - truncate to 9 bytes
-                token_key = old_key[:9]
-            db.reset_tokens[token_key] = ResetToken(
-                user_uuid=token.user_uuid,
-                expiry=token.expiry,
-                token_type=token.token_type,
-            )
-        print(f"  Migrated {len(token_models)} reset tokens")
-
-    # Queue and flush all changes using the transaction mechanism
-    with db.transaction("migrate:sql"):
-        pass  # All data already added to _data, transaction commits on exit
-
-    await store.flush()
-
-    print("Migration complete!")
-
-
-def main():
-    """CLI entry point for migration."""
-
-    parser = argparse.ArgumentParser(
-        description="Migrate Paskia database from SQL to JSON"
-    )
-    parser.add_argument(
-        "--sql",
-        default=SQL_DB_DEFAULT,
-        help=f"Source SQL database connection string (default: {SQL_DB_DEFAULT})",
-    )
-    parser.add_argument(
-        "--json",
-        default=JSON_DB_DEFAULT,
-        help=f"Destination JSONL file path (default: {JSON_DB_DEFAULT})",
-    )
-    args = parser.parse_args()
-
-    asyncio.run(migrate_from_sql(args.sql, args.json))
-
-
-if __name__ == "__main__":
-    main()

paskia/migrate/sql.py

@@ -1,438 +0,0 @@
-"""
-Legacy SQL database implementation for migration purposes.
-
-This module provides the async SQLAlchemy database layer that was used
-before the JSONL format. It is kept here for migration purposes only.
-
-DO NOT use this module for new code. Use paskia.db instead.
-"""
-
-from contextlib import asynccontextmanager
-from dataclasses import dataclass
-from datetime import UTC, datetime
-from uuid import UUID
-
-from sqlalchemy import (
-    DateTime,
-    ForeignKey,
-    Integer,
-    LargeBinary,
-    String,
-    event,
-    select,
-)
-from sqlalchemy.dialects.sqlite import BLOB
-from sqlalchemy.ext.asyncio import async_sessionmaker, create_async_engine
-from sqlalchemy.orm import DeclarativeBase, Mapped, mapped_column
-
-
-# Legacy User class for SQL schema (uses 'role_uuid' not 'role')
-@dataclass
-class _LegacyUser:
-    """User as stored in the old SQL schema with role_uuid field."""
-
-    uuid: UUID
-    display_name: str
-    role_uuid: UUID
-    created_at: datetime | None = None
-    last_seen: datetime | None = None
-    visits: int = 0
-
-
-# Legacy Credential class for SQL schema (uses 'user_uuid' not 'user')
-@dataclass
-class _LegacyCredential:
-    """Credential as stored in the old SQL schema with user_uuid field."""
-
-    uuid: UUID
-    credential_id: bytes
-    user_uuid: UUID
-    aaguid: UUID
-    public_key: bytes
-    sign_count: int
-    created_at: datetime
-    last_used: datetime | None = None
-    last_verified: datetime | None = None
-
-
-# Legacy Role class for SQL schema (uses 'org_uuid' not 'org')
-@dataclass
-class _LegacyRole:
-    """Role as stored in the old SQL schema with org_uuid field."""
-
-    uuid: UUID
-    org_uuid: UUID
-    display_name: str
-    permissions: list[str] | None = None
-
-
-# Legacy Org class for SQL schema (has mutable permissions/roles lists)
-@dataclass
-class _LegacyOrg:
-    """Org as stored in the old SQL schema with mutable permissions/roles."""
-
-    uuid: UUID
-    display_name: str
-    permissions: list[str] | None = None
-    roles: list[_LegacyRole] | None = None
-
-
-# Legacy Session class for SQL schema (uses 'key' as field, 'user_uuid', 'credential_uuid')
-@dataclass
-class _LegacySession:
-    """Session as stored in the old SQL schema."""
-
-    key: bytes
-    user_uuid: UUID
-    credential_uuid: UUID
-    host: str
-    ip: str
-    user_agent: str
-    renewed: datetime
-
-
-# Legacy ResetToken class for SQL schema (uses 'key' as field, 'user_uuid')
-@dataclass
-class _LegacyResetToken:
-    """ResetToken as stored in the old SQL schema."""
-
-    key: bytes
-    user_uuid: UUID
-    token_type: str
-    expiry: datetime
-
-
-# Local Permission class for SQL schema (uses 'id' not 'uuid' + 'scope')
-@dataclass
-class SqlPermission:
-    """Permission as stored in the old SQL schema with id field."""
-
-    id: str
-    display_name: str
-
-
-DB_PATH_DEFAULT = "sqlite+aiosqlite:///paskia.sqlite"
-
-
-def _normalize_dt(value: datetime | None) -> datetime | None:
-    if value is None:
-        return None
-    if value.tzinfo is None:
-        return value.replace(tzinfo=UTC)
-    return value.astimezone(UTC)
-
-
-class Base(DeclarativeBase):
-    pass
-
-
-class OrgModel(Base):
-    __tablename__ = "orgs"
-
-    uuid: Mapped[bytes] = mapped_column(LargeBinary(16), primary_key=True)
-    display_name: Mapped[str] = mapped_column(String, nullable=False)
-
-    def as_dataclass(self):
-        # Base Org without permissions/roles (filled by data accessors)
-        return _LegacyOrg(
-            uuid=UUID(bytes=self.uuid),
-            display_name=self.display_name,
-        )
-
-    @staticmethod
-    def from_dataclass(org: _LegacyOrg):
-        return OrgModel(uuid=org.uuid.bytes, display_name=org.display_name)
-
-
-class RoleModel(Base):
-    __tablename__ = "roles"
-
-    uuid: Mapped[bytes] = mapped_column(LargeBinary(16), primary_key=True)
-    org_uuid: Mapped[bytes] = mapped_column(
-        LargeBinary(16), ForeignKey("orgs.uuid", ondelete="CASCADE"), nullable=False
-    )
-    display_name: Mapped[str] = mapped_column(String, nullable=False)
-
-    def as_dataclass(self):
-        # Base Role without permissions (filled by data accessors)
-        return _LegacyRole(
-            uuid=UUID(bytes=self.uuid),
-            org_uuid=UUID(bytes=self.org_uuid),
-            display_name=self.display_name,
-        )
-
-    @staticmethod
-    def from_dataclass(role: _LegacyRole):
-        return RoleModel(
-            uuid=role.uuid.bytes,
-            org_uuid=role.org_uuid.bytes,
-            display_name=role.display_name,
-        )
-
-
-class UserModel(Base):
-    __tablename__ = "users"
-
-    uuid: Mapped[bytes] = mapped_column(LargeBinary(16), primary_key=True)
-    display_name: Mapped[str] = mapped_column(String, nullable=False)
-    role_uuid: Mapped[bytes] = mapped_column(
-        LargeBinary(16), ForeignKey("roles.uuid", ondelete="CASCADE"), nullable=False
-    )
-    created_at: Mapped[datetime] = mapped_column(
-        DateTime(timezone=True), default=lambda: datetime.now(UTC)
-    )
-    last_seen: Mapped[datetime | None] = mapped_column(
-        DateTime(timezone=True), nullable=True
-    )
-    visits: Mapped[int] = mapped_column(Integer, nullable=False, default=0)
-
-    def as_dataclass(self) -> "_LegacyUser":
-        return _LegacyUser(
-            uuid=UUID(bytes=self.uuid),
-            display_name=self.display_name,
-            role_uuid=UUID(bytes=self.role_uuid),
-            created_at=_normalize_dt(self.created_at) or self.created_at,
-            last_seen=_normalize_dt(self.last_seen) or self.last_seen,
-            visits=self.visits,
-        )
-
-    @staticmethod
-    def from_dataclass(user: "_LegacyUser"):
-        return UserModel(
-            uuid=user.uuid.bytes,
-            display_name=user.display_name,
-            role_uuid=user.role_uuid.bytes,
-            created_at=user.created_at or datetime.now(UTC),
-            last_seen=user.last_seen,
-            visits=user.visits,
-        )
-
-
-class CredentialModel(Base):
-    __tablename__ = "credentials"
-
-    uuid: Mapped[bytes] = mapped_column(LargeBinary(16), primary_key=True)
-    credential_id: Mapped[bytes] = mapped_column(
-        LargeBinary(64), unique=True, index=True
-    )
-    user_uuid: Mapped[bytes] = mapped_column(
-        LargeBinary(16), ForeignKey("users.uuid", ondelete="CASCADE")
-    )
-    aaguid: Mapped[bytes] = mapped_column(LargeBinary(16), nullable=False)
-    public_key: Mapped[bytes] = mapped_column(BLOB, nullable=False)
-    sign_count: Mapped[int] = mapped_column(Integer, nullable=False)
-    created_at: Mapped[datetime] = mapped_column(
-        DateTime(timezone=True), default=lambda: datetime.now(UTC)
-    )
-    last_used: Mapped[datetime | None] = mapped_column(
-        DateTime(timezone=True), nullable=True
-    )
-    last_verified: Mapped[datetime | None] = mapped_column(
-        DateTime(timezone=True), nullable=True
-    )
-
-    def as_dataclass(self):
-        return _LegacyCredential(
-            uuid=UUID(bytes=self.uuid),
-            credential_id=self.credential_id,
-            user_uuid=UUID(bytes=self.user_uuid),
-            aaguid=UUID(bytes=self.aaguid),
-            public_key=self.public_key,
-            sign_count=self.sign_count,
-            created_at=_normalize_dt(self.created_at) or self.created_at,
-            last_used=_normalize_dt(self.last_used) or self.last_used,
-            last_verified=_normalize_dt(self.last_verified) or self.last_verified,
-        )
-
-
-class SessionModel(Base):
-    __tablename__ = "sessions"
-
-    key: Mapped[bytes] = mapped_column(LargeBinary(16), primary_key=True)
-    user_uuid: Mapped[bytes] = mapped_column(
-        LargeBinary(16), ForeignKey("users.uuid", ondelete="CASCADE"), nullable=False
-    )
-    credential_uuid: Mapped[bytes] = mapped_column(
-        LargeBinary(16),
-        ForeignKey("credentials.uuid", ondelete="CASCADE"),
-        nullable=False,
-    )
-    host: Mapped[str] = mapped_column(String, nullable=False)
-    ip: Mapped[str] = mapped_column(String(64), nullable=False)
-    user_agent: Mapped[str] = mapped_column(String(512), nullable=False)
-    renewed: Mapped[datetime] = mapped_column(
-        DateTime(timezone=True),
-        default=lambda: datetime.now(UTC),
-        nullable=False,
-    )
-
-    def as_dataclass(self):
-        return _LegacySession(
-            key=self.key,
-            user_uuid=UUID(bytes=self.user_uuid),
-            credential_uuid=UUID(bytes=self.credential_uuid),
-            host=self.host,
-            ip=self.ip,
-            user_agent=self.user_agent,
-            renewed=_normalize_dt(self.renewed) or self.renewed,
-        )
-
-    @staticmethod
-    def from_dataclass(session: _LegacySession):
-        return SessionModel(
-            key=session.key,
-            user_uuid=session.user_uuid.bytes,
-            credential_uuid=session.credential_uuid.bytes,
-            host=session.host,
-            ip=session.ip,
-            user_agent=session.user_agent,
-            renewed=session.renewed,
-        )
-
-
-class ResetTokenModel(Base):
-    __tablename__ = "reset_tokens"
-
-    key: Mapped[bytes] = mapped_column(LargeBinary(16), primary_key=True)
-    user_uuid: Mapped[bytes] = mapped_column(
-        LargeBinary(16), ForeignKey("users.uuid", ondelete="CASCADE"), nullable=False
-    )
-    token_type: Mapped[str] = mapped_column(String, nullable=False)
-    expiry: Mapped[datetime] = mapped_column(DateTime(timezone=True), nullable=False)
-
-    def as_dataclass(self) -> _LegacyResetToken:
-        return _LegacyResetToken(
-            key=self.key,
-            user_uuid=UUID(bytes=self.user_uuid),
-            token_type=self.token_type,
-            expiry=_normalize_dt(self.expiry) or self.expiry,
-        )
-
-
-class PermissionModel(Base):
-    __tablename__ = "permissions"
-
-    id: Mapped[str] = mapped_column(String(64), primary_key=True)
-    display_name: Mapped[str] = mapped_column(String, nullable=False)
-
-    def as_dataclass(self):
-        return SqlPermission(self.id, self.display_name)
-
-    @staticmethod
-    def from_dataclass(permission: SqlPermission):
-        return PermissionModel(
-            id=permission.id,
-            display_name=permission.display_name,
-        )
-
-
-class OrgPermission(Base):
-    """Permissions each organization is allowed to grant to its roles."""
-
-    __tablename__ = "org_permissions"
-
-    id: Mapped[int] = mapped_column(Integer, primary_key=True)
-    org_uuid: Mapped[bytes] = mapped_column(
-        LargeBinary(16), ForeignKey("orgs.uuid", ondelete="CASCADE")
-    )
-    permission_id: Mapped[str] = mapped_column(
-        String(64), ForeignKey("permissions.id", ondelete="CASCADE")
-    )
-
-
-class RolePermission(Base):
-    """Permissions that each role grants to its members."""
-
-    __tablename__ = "role_permissions"
-
-    id: Mapped[int] = mapped_column(Integer, primary_key=True)
-    role_uuid: Mapped[bytes] = mapped_column(
-        LargeBinary(16), ForeignKey("roles.uuid", ondelete="CASCADE")
-    )
-    permission_id: Mapped[str] = mapped_column(
-        String(64), ForeignKey("permissions.id", ondelete="CASCADE")
-    )
-
-
-class DB:
-    """Legacy SQL database class for migration purposes only."""
-
-    def __init__(self, db_path: str = DB_PATH_DEFAULT):
-        """Initialize with database path."""
-        self.engine = create_async_engine(db_path, echo=False)
-        # Ensure SQLite foreign key enforcement is ON for every new connection
-        if db_path.startswith("sqlite"):
-
-            @event.listens_for(self.engine.sync_engine, "connect")
-            def _fk_on(dbapi_connection, connection_record):
-                try:
-                    cursor = dbapi_connection.cursor()
-                    cursor.execute("PRAGMA foreign_keys=ON;")
-                    cursor.close()
-                except Exception:
-                    pass
-
-        self.async_session_factory = async_sessionmaker(
-            self.engine, expire_on_commit=False
-        )
-
-    @asynccontextmanager
-    async def session(self):
-        """Async context manager that provides a database session with transaction."""
-        async with self.async_session_factory() as session:
-            async with session.begin():
-                yield session
-                await session.flush()
-            await session.commit()
-
-    async def init_db(self) -> None:
-        """Initialize database tables."""
-        async with self.engine.begin() as conn:
-            await conn.run_sync(Base.metadata.create_all)
-
-    async def list_permissions(self) -> list[SqlPermission]:
-        async with self.session() as session:
-            result = await session.execute(select(PermissionModel))
-            return [p.as_dataclass() for p in result.scalars().all()]
-
-    async def list_organizations(self) -> list[_LegacyOrg]:
-        async with self.session() as session:
-            # Load all orgs
-            orgs_result = await session.execute(select(OrgModel))
-            org_models = orgs_result.scalars().all()
-            if not org_models:
-                return []
-
-            # Preload org permissions mapping
-            org_perms_result = await session.execute(select(OrgPermission))
-            org_perms = org_perms_result.scalars().all()
-            perms_by_org: dict[bytes, list[str]] = {}
-            for op in org_perms:
-                perms_by_org.setdefault(op.org_uuid, []).append(op.permission_id)
-
-            # Preload roles
-            roles_result = await session.execute(select(RoleModel))
-            role_models = roles_result.scalars().all()
-
-            # Preload role permissions mapping
-            rp_result = await session.execute(select(RolePermission))
-            rps = rp_result.scalars().all()
-            perms_by_role: dict[bytes, list[str]] = {}
-            for rp in rps:
-                perms_by_role.setdefault(rp.role_uuid, []).append(rp.permission_id)
-
-            # Build org dataclasses with roles and permission IDs
-            roles_by_org: dict[bytes, list[_LegacyRole]] = {}
-            for rm in role_models:
-                r_dc = rm.as_dataclass()
-                r_dc.permissions = perms_by_role.get(rm.uuid, [])
-                roles_by_org.setdefault(rm.org_uuid, []).append(r_dc)
-
-            orgs: list[_LegacyOrg] = []
-            for om in org_models:
-                o_dc = om.as_dataclass()
-                o_dc.permissions = perms_by_org.get(om.uuid, [])
-                o_dc.roles = roles_by_org.get(om.uuid, [])
-                orgs.append(o_dc)
-
-            return orgs

paskia/sansio.py

@@ -8,6 +8,7 @@ This module provides a unified interface for WebAuthn operations including:
 """
 
 import json
+import re
 from urllib.parse import urlparse
 from uuid import UUID
 
@@ -62,6 +63,7 @@ class Passkey:
             ValueError: If any origin domain doesn't match or isn't a subdomain of rp_id.
         """
         self.rp_id = rp_id
+        self._validate_rp_id(rp_id)
         self.rp_name = rp_name or rp_id
         self.allowed_origins: set[str] | None = None
         if origins:
@@ -75,6 +77,21 @@ class Passkey:
             COSEAlgorithmIdentifier.RSASSA_PKCS1_v1_5_SHA_256,
         ]
 
+    def _validate_rp_id(self, rp_id: str) -> None:
+        """Validate that rp_id is a valid domain name."""
+        if not rp_id:
+            raise ValueError("rp_id cannot be empty")
+        # Allow localhost, or domain-like strings
+        if rp_id == "localhost":
+            return
+        # Regex for valid domain: letters, digits, hyphens, dots, but not starting/ending with hyphen, etc.
+        # Simplified: alphanumeric, dots, hyphens
+        if not re.match(
+            r"^[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$",
+            rp_id,
+        ):
+            raise ValueError(f"rp_id '{rp_id}' is not a valid domain name")
+
     def _validate_origin(self, origin: str, rp_id: str) -> None:
         """Validate an origin URL against the rp_id."""
         hostname = urlparse(origin).hostname

paskia/util/hostutil.py

@@ -56,7 +56,7 @@ def reload_config() -> None:
 
 
 def normalize_host(raw_host: str | None) -> str | None:
-    """Normalize a Host header preserving port (exact match required)."""
+    """Normalize a Host header, stripping port numbers for consistent matching."""
     if not raw_host:
         return None
     candidate = raw_host.strip()
@@ -65,11 +65,12 @@ def normalize_host(raw_host: str | None) -> str | None:
     # urlsplit to parse (add // for scheme-less); prefer netloc to retain port.
     parsed = urlsplit(candidate if "//" in candidate else f"//{candidate}")
     netloc = parsed.netloc or parsed.path or ""
-    # Strip IPv6 brackets around host part but retain port suffix.
+    # Handle IPv6 addresses: [ipv6]:port or [ipv6]
     if netloc.startswith("["):
-        # format: [ipv6]:port or [ipv6]
         if "]" in netloc:
-            host_part, _, rest = netloc.partition("]")
+            host_part, _, _ = netloc.partition("]")
-            port_part = rest.lstrip(":")
+            netloc = host_part.strip("[]")
-            netloc = host_part.strip("[]") + (f":{port_part}" if port_part else "")
+    else:
+        # Strip port from host:port
+        netloc = netloc.rsplit(":", 1)[0]
     return netloc.lower() or None

paskia/util/startupbox.py

@@ -1,6 +1,7 @@
 """Startup configuration box formatting utilities."""
 
 import os
+import re
 from sys import stderr
 from typing import TYPE_CHECKING
 
@@ -11,12 +12,26 @@ if TYPE_CHECKING:
 
 BOX_WIDTH = 60  # Inner width (excluding box chars)
 
+# ANSI color codes
+RESET = "\033[0m"
+YELLOW = "\033[33m"  # Dark yellow
+BRIGHT_YELLOW = "\033[93m"  # Bright yellow
+BRIGHT_WHITE = "\033[1;37m"  # Bold bright white
+
+
+def _visible_len(text: str) -> int:
+    """Calculate visible length of text, ignoring ANSI escape codes."""
+    return len(re.sub(r"\033\[[0-9;]*m", "", text))
+
 
 def line(text: str = "") -> str:
     """Format a line inside the box with proper padding, truncating if needed."""
-    if len(text) > BOX_WIDTH:
+    visible = _visible_len(text)
+    if visible > BOX_WIDTH:
         text = text[: BOX_WIDTH - 1] + "…"
-    return f"┃ {text:<{BOX_WIDTH}} ┃\n"
+        visible = BOX_WIDTH
+    padding = BOX_WIDTH - visible
+    return f"┃ {text}{' ' * padding} ┃\n"
 
 
 def top() -> str:
@@ -29,12 +44,25 @@ def bottom() -> str:
 
 def print_startup_config(config: "PaskiaConfig") -> None:
     """Print server configuration on startup."""
+    # Key graphic with yellow shading (bright for highlights, dark for body)
+    y = YELLOW  # Dark yellow for main body
+    b = BRIGHT_YELLOW  # Bright yellow for highlights/edges
+    w = BRIGHT_WHITE  # Bold white for URL
+    r = RESET
+
     lines = [top()]
-    lines.append(line(" ▄▄▄▄▄"))
+    lines.append(line(f" {b}▄▄▄▄▄{r}"))
-    lines.append(line("█     █ Paskia " + __version__))
+    lines.append(line(f"{b}█{y}     {b}█{r} Paskia " + __version__))
-    lines.append(line("█     █▄▄▄▄▄▄▄▄▄▄▄▄"))
+    lines.append(line(f"{b}█{y}     {b}█{y}▄▄▄▄▄▄▄▄▄▄▄▄{r}"))
-    lines.append(line("█     █▀▀▀▀█▀▀█▀▀█    " + config.site_url + config.site_path))
+    lines.append(
-    lines.append(line(" ▀▀▀▀▀"))
+        line(
+            f"{b}█{y}     {b}█{y}▀▀▀▀{b}█{y}▀▀{b}█{y}▀▀{b}█{r}    {w}"
+            + config.site_url
+            + config.site_path
+            + r
+        )
+    )
+    lines.append(line(f" {y}▀▀▀▀▀{r}"))
 
     # Format auth host section
     if config.auth_host:

paskia/util/useragent.py

@@ -1,10 +1,29 @@
-import user_agents
+from ua_parser import parse
 
 
 def compact_user_agent(ua: str | None) -> str:
-    if not ua:
+    """Format user agent string into a compact display format.
-        return "-"
+
-    u = user_agents.parse(ua)
+    Returns empty string for empty/missing user agents.
-    ver = u.browser.version_string.split(".")[0]
+    Returns original UA for unrecognized ones.
-    dev = u.device.family if u.device.family not in ["Other", "Mac"] else ""
+    """
-    return f"{u.browser.family}/{ver} {u.os.family} {dev}".strip()
+    if not ua or not ua.strip() or ua == "-":
+        return ""
+    r = parse(ua)
+    browser = r.user_agent.family if r.user_agent else None
+    ver = r.user_agent.major if r.user_agent else ""
+    os_name = r.os.family if r.os else None
+    dev = r.device.family if r.device else None
+    # If browser is unrecognized, return original UA
+    if browser in (None, "Other") and os_name in (None, "Other"):
+        return ua
+    # Filter out "Other" values
+    browser = browser if browser and browser != "Other" else ""
+    os_name = os_name if os_name and os_name != "Other" else ""
+    # Exclude device if it's "Other" or matches browser family (parser bug)
+    if dev in (None, "Other") or dev == browser:
+        dev = ""
+    # Build compact string, filtering empty parts
+    parts = [f"{browser}/{ver}" if browser else "", os_name, dev]
+    result = " ".join(p for p in parts if p).strip()
+    return result

paskia/util/userinfo.py

@@ -9,12 +9,15 @@ from paskia.util.apistructs import ApiSession
 
 def build_session_context(ctx: SessionContext) -> dict:
     """Build session context dict from SessionContext."""
-    return {
+    result = {
         "user": {"uuid": ctx.user.uuid, "display_name": ctx.user.display_name},
         "org": {"uuid": ctx.org.uuid, "display_name": ctx.org.display_name},
         "role": {"uuid": ctx.role.uuid, "display_name": ctx.role.display_name},
         "permissions": [p.scope for p in ctx.permissions],
     }
+    if ctx.user.theme:
+        result["user"]["theme"] = ctx.user.theme
+    return result
 
 
 async def build_user_info(

pyproject.toml

@@ -18,11 +18,11 @@ dependencies = [
     "base64url>=1.0.0",
     "uuid7-standard>=1.0.0",
     "pyjwt>=2.8.0",
-    "user-agents>=2.2.0",
     "jsondiff>=2.2.1",
     "msgspec>=0.20.0",
     "aiofiles>=25.1.0",
     "fastapi-vue>=0.3.0",
+    "ua-parser[regex]>=1.0.1",
 ]
 requires-python = ">=3.11"
 
@@ -44,10 +44,6 @@ dev = [
     "pytest-asyncio>=0.24.0",
     "httpx>=0.27.0",
 ]
-migrate = [
-    "sqlalchemy[asyncio]>=2.0.0",
-    "aiosqlite>=0.19.0",
-]
 
 [tool.coverage.run]
 source = ["paskia"]
@@ -91,7 +87,6 @@ dev = [
 
 [project.scripts]
 paskia = "paskia.fastapi.__main__:main"
-paskia-migrate = "paskia.migrate:main"
 
 [tool.hatch.build]
 artifacts = ["paskia/frontend-build"]

scripts/build-frontend.py

@@ -1,48 +1,18 @@
-import shutil
+"""Hatch build hook for building paskia-js and Vue frontend during package build."""
-import subprocess
+
+import sys
 from pathlib import Path
-from sys import stderr
 
-from hatchling.builders.hooks.plugin.interface import BuildHookInterface
+from hatchling.builders.hooks.plugin.interface import BuildHookInterface  # type: ignore
 
-
+sys.path.insert(0, str(Path(__file__).parent / "fastapi-vue"))
-def run(cmd, **kwargs):
+from buildutil import build  # noqa: E402
-    display_cmd = [Path(cmd[0]).name, *cmd[1:]]
-    stderr.write(f"### {' '.join(display_cmd)}\n")
-    subprocess.run(cmd, check=True, **kwargs)
-
-
-def find_build_tool():
-    install = [
-        ("deno", "install", "--allow-scripts=npm:vue-demi"),
-        ("npm", "install"),
-        ("bun", "--bun", "install"),
-    ]
-
-    build = [
-        ("deno", "task", "build"),
-        ("npm", "run", "build"),
-        ("bun", "--bun", "run", "build"),
-    ]
-
-    for i, b in zip(install, build, strict=False):
-        if tool := shutil.which(i[0]):
-            return [tool, *i[1:]], [tool, *b[1:]]
-
-    raise RuntimeError("Deno, npm or Bun is required for building but none was found")
 
 
 class CustomBuildHook(BuildHookInterface):
+    """Build hook that compiles paskia-js and Vue frontend before packaging."""
+
     def initialize(self, version, build_data):
         super().initialize(version, build_data)
-        stderr.write(">>> Building the frontend\n")
+        build("paskia-js")
-
+        build("frontend")
-        install_cmd, build_cmd = find_build_tool()
-
-        try:
-            run(install_cmd, cwd="frontend")
-            stderr.write("\n")
-            run(build_cmd, cwd="frontend")
-        except Exception as e:
-            stderr.write(f"Error occurred while building frontend: {e}\n")
-            raise

scripts/devserver.new.py

@@ -1,277 +0,0 @@
-#!/usr/bin/env -S uv run
-# auto-upgrade@fastapi-vue-setup - remove this if you modify this file
-"""Run Vite development server for frontend and FastAPI backend with auto-reload.
-
-Usage:
-    uv run scripts/devserver.py [host:port] [--backend host:port]
-
-The optional host:port argument sets where the Vite frontend listens.
-Supported forms: host[:port], :port (all interfaces), or just port.
-The --backend option sets where the FastAPI backend listens (default: localhost:5180).
-
-Environment:
-    JS_RUNTIME          Path or name of JS runtime to use (deno, npm/node or bun).
-    FASTAPI_VUE_FRONTEND_URL    Set by this script for the backend to know where Vite is.
-"""
-
-import argparse
-import asyncio
-import contextlib
-import os
-from pathlib import Path
-from sys import stderr
-
-import httpx
-from fastapi_vue.hostutil import parse_endpoint
-
-exec((Path(__file__).parent / "fastapi-vue/util.py").read_text("UTF-8"))  # noqa: S102
-
-DEFAULT_VITE_PORT = 5173
-DEFAULT_BACKEND_PORT = 5180
-FRONTEND_PATH = Path(__file__).parent.parent / "frontend"
-
-EPILOG = """
-  scripts/devserver.py                       # Default ports on localhost
-  scripts/devserver.py 3000                  # Vite on localhost:3000
-  scripts/devserver.py :3000 --backend 8000  # *:3000, localhost:8000
-"""
-
-BUN_BUG = """\
-┃ ⚠️  Bun cannot correctly proxy API requests to the backend.
-┃ Bug report: https://github.com/oven-sh/bun/issues/9882
-┃
-┃ Consider using deno or npm instead for development.
-"""
-
-
-def resolve_frontend_tools(
-    vite_port: int, all_ifaces: bool
-) -> tuple[list[str], list[str], str]:
-    """Resolve frontend install and dev commands.
-
-    Returns (install_cmd, dev_cmd, tool_name).
-    Raises SystemExit if tools are not available.
-    """
-    if not (FRONTEND_PATH / "package.json").exists():
-        stderr.write(f"┃ ⚠️  Frontend source not found at {FRONTEND_PATH}\n")
-        raise SystemExit(1)
-
-    result = find_js_runtime()  # noqa # type: ignore
-    if result is None:
-        if not os.environ.get("JS_RUNTIME"):
-            stderr.write("┃ ⚠️  deno, npm or bun needed to run the frontend server.\n")
-        raise SystemExit(1)
-
-    tool, name = result
-
-    install_args = {
-        "deno": ("install", "--quiet", "--allow-scripts=npm:vue-demi"),
-        "npm": ("install", "--silent"),
-        "bun": ("install", "--silent"),
-    }
-    dev_args = {
-        "deno": ("run", "dev", "--"),
-        "npm": ("--silent", "run", "dev", "--"),
-        "bun": ("run", "dev", "--"),
-    }
-
-    install_cmd = [tool, *install_args[name]]
-    dev_cmd = [
-        tool,
-        *dev_args[name],
-        "--clearScreen=false",
-        f"--port={vite_port}",
-    ]
-
-    if all_ifaces:
-        dev_cmd.append("--host")
-
-    if name == "bun":
-        stderr.write(BUN_BUG)
-
-    return install_cmd, dev_cmd, name
-
-
-async def wait_for_backend(host: str, port: int):
-    """Wait for the backend to be ready by polling the health endpoint."""
-    max_attempts = 50
-    url = f"http://{host}:{port}"
-
-    async with httpx.AsyncClient() as client:
-        for attempt in range(max_attempts):
-            try:
-                await client.get(url, timeout=1.0)
-                stderr.write("✓ Backend ready!\n")
-                return True
-            except httpx.RequestError:
-                if attempt == max_attempts - 1:
-                    stderr.write("┃ ⚠️  Backend didn't start in time\n")
-                    return False
-                await asyncio.sleep(0.1)
-    return False
-
-
-async def _terminate_process(proc: asyncio.subprocess.Process, name: str) -> None:
-    """Gracefully terminate a subprocess."""
-    if proc.returncode is not None:
-        return
-    try:
-        proc.terminate()
-    except ProcessLookupError:
-        return
-    try:
-        await asyncio.wait_for(proc.wait(), timeout=2)
-    except TimeoutError:
-        try:
-            proc.kill()
-        except ProcessLookupError:
-            return
-        await proc.wait()
-
-
-async def run_devserver(
-    vite_port: int,
-    all_ifaces: bool,
-    backend_host: str,
-    backend_port: int,
-) -> None:
-    """Run the development server with install, backend, and frontend."""
-    install_cmd, dev_cmd, tool_name = resolve_frontend_tools(vite_port, all_ifaces)
-
-    # Tell the backend where the Vite dev server is
-    os.environ["FASTAPI_VUE_FRONTEND_URL"] = f"http://localhost:{vite_port}"
-    # Tell Vite where the backend is (for proxying /api requests)
-    os.environ["FASTAPI_VUE_BACKEND_URL"] = f"http://{backend_host}:{backend_port}"
-
-    backend_cmd = [
-        "uvicorn",
-        "paskia.app:app",
-        "--host",
-        backend_host,
-        "--port",
-        str(backend_port),
-        "--reload",
-    ]
-
-    cwd = str(Path(__file__).parent.parent)
-    frontend_cwd = str(FRONTEND_PATH)
-
-    backend_proc: asyncio.subprocess.Process | None = None
-    install_proc: asyncio.subprocess.Process | None = None
-    frontend_proc: asyncio.subprocess.Process | None = None
-
-    try:
-        # Start install (concurrent with backend)
-        stderr.write(f">>> {tool_name} {' '.join(install_cmd[1:])}\n")
-        install_proc = await asyncio.create_subprocess_exec(
-            *install_cmd, cwd=frontend_cwd
-        )
-
-        await asyncio.sleep(0.1)
-
-        # Start backend (concurrent with install)
-        stderr.write(f">>> {' '.join(backend_cmd)}\n")
-        backend_proc = await asyncio.create_subprocess_exec(*backend_cmd, cwd=cwd)
-
-        # Wait for install to complete and backend to be ready
-        install_task = asyncio.create_task(install_proc.wait(), name="install")
-        backend_ready_task = asyncio.create_task(
-            wait_for_backend(backend_host, backend_port), name="backend_ready"
-        )
-
-        done, pending = await asyncio.wait(
-            {install_task, backend_ready_task},
-            return_when=asyncio.FIRST_COMPLETED,
-        )
-
-        for task in done:
-            if task.get_name() == "install":
-                if task.result() != 0:
-                    stderr.write("┃ ⚠️  Install failed\n")
-                    raise SystemExit(1)
-            elif task.get_name() == "backend_ready" and not task.result():
-                raise SystemExit(1)
-
-        if pending:
-            done2, _ = await asyncio.wait(pending)
-            for task in done2:
-                if task.get_name() == "install":
-                    if task.result() != 0:
-                        stderr.write("┃ ⚠️  Install failed\n")
-                        raise SystemExit(1)
-                elif task.get_name() == "backend_ready" and not task.result():
-                    raise SystemExit(1)
-
-        install_proc = None
-
-        # Start Vite dev server
-        stderr.write(f">>> {tool_name} {' '.join(dev_cmd[1:])}\n")
-        frontend_proc = await asyncio.create_subprocess_exec(*dev_cmd, cwd=frontend_cwd)
-
-        # Wait for either process to exit
-        done, pending = await asyncio.wait(
-            {
-                asyncio.create_task(backend_proc.wait(), name="backend"),
-                asyncio.create_task(frontend_proc.wait(), name="frontend"),
-            },
-            return_when=asyncio.FIRST_COMPLETED,
-        )
-        for t in done:
-            t.result()
-        for t in pending:
-            t.cancel()
-
-    except asyncio.CancelledError:
-        stderr.write("\n✓ Shutting down...\n")
-    finally:
-        if frontend_proc is not None:
-            await _terminate_process(frontend_proc, "frontend")
-        if install_proc is not None:
-            await _terminate_process(install_proc, "install")
-        if backend_proc is not None:
-            await _terminate_process(backend_proc, "backend")
-
-
-def main():
-    parser = argparse.ArgumentParser(
-        description="Run Vite and FastAPI development servers",
-        formatter_class=argparse.RawDescriptionHelpFormatter,
-        epilog=EPILOG,
-    )
-    parser.add_argument(
-        "frontend",
-        nargs="?",
-        metavar="host:port",
-        help="Vite frontend endpoint (default: localhost:5173)",
-    )
-    parser.add_argument(
-        "--backend",
-        metavar="host:port",
-        help="FastAPI backend endpoint (default: localhost:5180)",
-    )
-    args = parser.parse_args()
-
-    # parse_endpoint returns list of dicts with host/port or uds keys
-    # Multiple entries means bind all interfaces (IPv4 + IPv6)
-    vite_endpoints = parse_endpoint(args.frontend, DEFAULT_VITE_PORT)
-    backend_endpoints = parse_endpoint(args.backend, DEFAULT_BACKEND_PORT)
-
-    # Vite doesn't support unix sockets
-    if "uds" in vite_endpoints[0]:
-        stderr.write("┃ ⚠️  Unix sockets not supported for frontend\n")
-        raise SystemExit(1)
-    if "uds" in backend_endpoints[0]:
-        stderr.write("┃ ⚠️  Unix sockets not supported for backend\n")
-        raise SystemExit(1)
-
-    vite_port = vite_endpoints[0]["port"]
-    all_ifaces = len(vite_endpoints) > 1
-    backend_host = backend_endpoints[0]["host"]
-    backend_port = backend_endpoints[0]["port"]
-
-    with contextlib.suppress(KeyboardInterrupt):
-        asyncio.run(run_devserver(vite_port, all_ifaces, backend_host, backend_port))
-
-
-if __name__ == "__main__":
-    main()

scripts/devserver.py

@@ -1,21 +1,21 @@
 #!/usr/bin/env -S uv run
-"""Run Vite development server for frontend and FastAPI backend with auto-reload.
+"""Run Vite development server for frontend and Paskia backend with auto-reload.
 
 This script is only available when running from the git repository source,
 not from the installed package. It starts both the Vite frontend dev server
-and the FastAPI backend with auto-reload enabled.
+and the Paskia backend with auto-reload enabled.
 
 Usage:
-    uv run scripts/devserver.py [host:port] [options...]
+    uv run scripts/devserver.py [-l host:port] [options...]
 
-The optional host:port argument sets where the Vite frontend listens.
+The optional -l/--listen argument sets where the Vite frontend listens.
 All other options are forwarded to `paskia`.
 Backend always listens on localhost:4402.
 
 Environment:
-    FASTAPI_VUE_FRONTEND_URL    Set by this script for the backend to know where Vite is.
+    PASKIA_FRONTEND_URL    Set by this script for the backend to know where Vite is.
-    FASTAPI_VUE_BACKEND_URL     Set by this script for Vite to know where to proxy API calls.
+    PASKIA_BACKEND_URL     Set by this script for Vite to know where to proxy API calls.
-    PASKIA_SITE_URL             User-facing URL for reset links (Caddy HTTPS or Vite HTTP).
+    PASKIA_SITE_URL        User-facing URL for reset links (Caddy HTTPS or Vite HTTP).
 
 Options:
     --caddy         Run Caddy as HTTPS proxy on port 443 (requires sudo)
@@ -25,45 +25,30 @@ Options:
 """
 
 import argparse
-import atexit
+import asyncio
-import ipaddress
 import json
 import os
 import shutil
-import signal
+import sys
-import subprocess
+from contextlib import suppress
 from pathlib import Path
-from sys import stderr
-from threading import Thread
 from urllib.parse import urlparse
 
+# Import utilities from scripts/fastapi-vue (not a package, so we adjust sys.path)
+sys.path.insert(0, str(Path(__file__).with_name("fastapi-vue")))
+from devutil import (  # noqa: E402
+    ProcessGroup,
+    check_ports_free,
+    logger,
+    ready,
+    setup_cli,
+    setup_vite,
+)
+
 DEFAULT_VITE_PORT = 4403  # overrides by CLI option
 BACKEND_PORT = 4402  # hardcoded, also in vite.config.ts
 CADDY_PORT = 443  # HTTPS port for Caddy proxy
 CADDY_HTTP_PORT = 80  # HTTP port for ACME challenges
-DEFAULT_HOST = "localhost"
-
-NO_FRONTEND_TOOL = """\
-┃ ⚠️  deno, npm or bunx needed to run the frontend server.
-"""
-
-BUN_BUG = """\
-┃ ⚠️  Bun cannot correctly proxy API requests to the backend.
-┃ Bug report: https://github.com/oven-sh/bun/issues/9882
-┃
-┃ Options:
-┃   - sudo caddy run --config caddy/Caddyfile.dev
-┃   - Install deno or npm instead
-┃
-┃ Caddy will skip the Vite for API calls and serve everything at port 443.
-┃ Otherwise Vite serves at port 8077 and proxies to backend (broken with bun).
-"""
-
-NO_FRONTEND = """\
-┃
-┃ The backend will still try reaching Vite at {vite_url}
-┃ for various frontend assets, so make sure to start it manually.
-"""
 
 CADDYFILE_SITE_BLOCK = """\
 SITE_ADDR {
@@ -79,140 +64,14 @@ SITE_ADDR {
 """
 
 
-def parse_endpoint(
+def build_caddyfile(origins: list[str], vite_port: int) -> str:
-    value: str | None, default_port: int
+    """Build a Caddyfile for the given origins."""
-) -> tuple[str | None, int | None, str | None, bool]:
-    """Parse an endpoint for Vite (simplified version for dev.py).
-
-    Returns (host, port, uds_path, all_ifaces).
-    """
-    if not value:
-        return DEFAULT_HOST, default_port, None, False
-
-    # Port only (numeric) -> localhost:port
-    if value.isdigit():
-        return DEFAULT_HOST, int(value), None, False
-
-    # Leading colon :port -> bind all interfaces
-    if value.startswith(":") and value != ":":
-        port_part = value[1:]
-        if not port_part.isdigit():
-            raise SystemExit(f"Invalid port in '{value}'")
-        return None, int(port_part), None, True
-
-    # UNIX domain socket
-    if value.startswith("unix:"):
-        uds_path = value[5:] or None
-        if uds_path is None:
-            raise SystemExit("unix: path must not be empty")
-        return None, None, uds_path, False
-
-    # Unbracketed IPv6 (cannot safely contain a port)
-    if value.count(":") > 1 and not value.startswith("["):
-        try:
-            ipaddress.IPv6Address(value)
-        except ValueError as e:
-            raise SystemExit(f"Invalid IPv6 address '{value}': {e}")
-        return value, default_port, None, False
-
-    # Use urllib.parse for everything else
-    parsed = urlparse(f"//{value}")
-    host = parsed.hostname or DEFAULT_HOST
-    port = parsed.port or default_port
-
-    return host, port, None, False
-
-
-def run_vite(
-    vite_url: str,
-    vite_host: str | None,
-    vite_port: int,
-    env: dict,
-    auth_host: str | None = None,
-):
-    """Spawn the frontend dev server (deno, npm, or bunx) as a background process."""
-    devpath = Path(__file__).parent.parent / "frontend"
-    if not (devpath / "package.json").exists():
-        stderr.write(
-            f"┃ ⚠️  Frontend source not found at {devpath}\n"
-            + NO_FRONTEND.format(vite_url=vite_url)
-        )
-        return
-
-    options = [
-        ("deno", "run", "dev"),
-        ("npm", "--silent", "run", "dev", "--"),
-        ("bunx", "--bun", "vite"),
-    ]
-    cmd = None
-    tool_name = None
-    for option in options:
-        if tool := shutil.which(option[0]):
-            cmd = [tool, *option[1:]]
-            tool_name = option[0]
-            break
-
-    # Add Vite CLI args for host/port
-    vite_args = ["--port", str(vite_port), "--logLevel", "silent"]
-    if vite_host:
-        vite_args.extend(["--host", vite_host])
-
-    vite_process = None
-
-    def start_vite():
-        nonlocal vite_process
-        if cmd is None:
-            stderr.write(NO_FRONTEND_TOOL + NO_FRONTEND.format(vite_url=vite_url))
-            return
-        assert tool_name is not None
-        try:
-            if tool_name == "bunx":
-                stderr.write(BUN_BUG)
-
-            full_cmd = cmd + vite_args
-            stderr.write(f">>> {' '.join([tool_name, *full_cmd[1:]])}\n")
-            vite_env = env.copy()
-            if auth_host:
-                vite_env["PASKIA_AUTH_HOST"] = auth_host
-            vite_process = subprocess.Popen(
-                full_cmd, cwd=str(devpath), shell=False, env=vite_env
-            )
-        except Exception as e:
-            stderr.write(
-                f"┃ ⚠️  Vite couldn't start: {e}\n"
-                + NO_FRONTEND.format(vite_url=vite_url)
-            )
-
-    def cleanup():
-        if vite_process:
-            vite_process.terminate()
-            vite_process.wait()
-
-    # Start Vite in a separate thread
-    vite_thread = Thread(target=start_vite, daemon=True)
-    vite_thread.start()
-
-    atexit.register(cleanup)
-    signal.signal(signal.SIGTERM, lambda *_: cleanup())
-    signal.signal(signal.SIGINT, lambda *_: cleanup())
-
-
-def run_caddy(origins: list[str], vite_port: int) -> subprocess.Popen | None:
-    """Spawn Caddy as HTTPS reverse proxy for the given origins."""
-    caddy_path = shutil.which("caddy")
-    if not caddy_path:
-        stderr.write("┃ ⚠️  Caddy not found. Install it to use --caddy option.\n")
-        return None
-
-    # Build Caddyfile with a site block for each origin
     caddyfile_parts = []
     for origin in origins:
         parsed = urlparse(origin)
-        # Extract scheme://host:port from origin URL
         scheme = parsed.scheme or "https"
-        host = parsed.hostname or parsed.path  # handle case without scheme
+        host = parsed.hostname or parsed.path
         port = parsed.port or (CADDY_HTTP_PORT if scheme == "http" else CADDY_PORT)
-        # Use standard ports without explicit port in address (cleaner URLs)
         if port in (80, 443):
             site_addr = f"{scheme}://{host}"
         else:
@@ -223,162 +82,150 @@ def run_caddy(origins: list[str], vite_port: int) -> subprocess.Popen | None:
             .replace("VITE_PORT", str(vite_port))
         )
         caddyfile_parts.append(block)
+    return "\n".join(caddyfile_parts)
 
-    caddyfile = "\n".join(caddyfile_parts)
-    caddy_process = None
 
-    try:
+async def run_caddy(origins: list[str], vite_port: int) -> asyncio.subprocess.Process:
-        # Use sudo to bind to privileged ports (80/443) for ACME certificate fetching
+    """Start Caddy as HTTPS reverse proxy, wait for ready signal."""
-        cmd = ["sudo", caddy_path, "run", "--config", "-", "--adapter", "caddyfile"]
+    caddy_path = shutil.which("caddy")
-        caddy_process = subprocess.Popen(
+    if not caddy_path:
-            cmd,
+        logger.warning("Caddy not found. Install it to use --caddy option.")
-            stdin=subprocess.PIPE,
+        raise SystemExit(1)
-            stderr=subprocess.PIPE,
-        )
-        caddy_process.stdin.write(caddyfile.encode())
-        caddy_process.stdin.close()
-    except Exception as e:
-        stderr.write(f"┃ ⚠️  Caddy couldn't start: {e}\n")
-        return None
 
-    # Helper to parse Caddy log line (JSON or plain text) into (level, logger, msg)
+    caddyfile = build_caddyfile(origins, vite_port)
-    def parse_caddy_log(line: str) -> tuple[str, str, str] | None:
+    cmd = ["sudo", caddy_path, "run", "--config", "-", "--adapter", "caddyfile"]
-        """Parse a Caddy log line, return (level, logger, msg) or None if unparseable."""
-        line = line.rstrip("\n")
-        if not line:
-            return None
 
-        # Try JSON format first
+    logger.info(">>> sudo caddy @ %s", " ".join(origins))
-        try:
+    proc = await asyncio.create_subprocess_exec(
-            log = json.loads(line)
+        *cmd,
-            return (
+        stdin=asyncio.subprocess.PIPE,
-                log.get("level", ""),
+        stderr=asyncio.subprocess.PIPE,
-                log.get("logger", ""),
+    )
-                log.get("msg", ""),
+    proc.stdin.write(caddyfile.encode())
-            )
+    await proc.stdin.drain()
-        except json.JSONDecodeError:
+    proc.stdin.close()
-            pass
 
-        # Plain text format: "2025/12/06 22:59:41.390 INFO    logger    msg..."
+    # Wait for ready signal or failure
-        # or "2025/12/06 22:59:41.390 INFO    msg..." (no logger)
-        parts = line.split("\t")
-        if len(parts) >= 2:
-            # First part is "timestamp LEVEL", rest are logger and/or message
-            first = parts[0].rsplit(None, 1)  # split off the level from timestamp
-            if len(first) == 2:
-                level = first[1].lower()
-                if len(parts) == 2:
-                    return (level, "", parts[1])
-                else:
-                    return (level, parts[1], "\t".join(parts[2:]))
-
-        # Unparseable - return as-is with no level/logger
-        return ("", "", line)
-
-    def strip_caddy_verbose(msg: str) -> str:
-        """Remove verbose prefixes from Caddy error messages."""
-        return msg.replace("loading initial config: loading new config: ", "")
-
-    def format_caddy_log(level: str, logger: str, msg: str) -> str:
-        """Format a parsed Caddy log for display."""
-        msg = strip_caddy_verbose(msg)
-        if logger:
-            return f"┃ [{level.upper()}] {logger}: {msg}\n"
-        else:
-            return f"┃ [{level.upper()}] {msg}\n"
-
-    # Read stderr line by line until Caddy signals it's ready or exits
-    # Caddy outputs logs; "serving initial configuration" means it's ready
     while True:
-        exit_code = caddy_process.poll()
+        if proc.returncode is not None:
-        if exit_code is not None:
+            remaining = await proc.stderr.read()
-            # Process exited - read remaining stderr and report failure
+            for line in remaining.decode().splitlines():
-            remaining = (
+                if line:
-                caddy_process.stderr.read().decode() if caddy_process.stderr else ""
+                    logger.info("caddy: %s", line)
-            )
+            logger.warning("Caddy startup failed (exit code %d)", proc.returncode)
-            if remaining:
+            raise SystemExit(1)
-                for line in remaining.splitlines():
-                    if line:
-                        parsed = parse_caddy_log(line)
-                        if parsed:
-                            level, logger, msg = parsed
-                            if level:
-                                stderr.write(format_caddy_log(level, logger, msg))
-                            else:
-                                stderr.write(f"┃ {strip_caddy_verbose(msg)}\n")
-                        else:
-                            stderr.write(f"┃ {strip_caddy_verbose(line)}\n")
-            stderr.write(f"┃ ⚠️  Caddy startup failed (exit code {exit_code})\n")
-            return None
 
-        # Read one line from stderr (blocks until data available)
+        line = await proc.stderr.readline()
-        line = caddy_process.stderr.readline().decode()
         if not line:
             continue
 
-        # Check for ready signal
+        decoded = line.decode().rstrip()
-        if "serving initial configuration" in line:
+        if "serving initial configuration" in decoded:
             break
 
-        parsed = parse_caddy_log(line)
+        # Parse and show errors during startup
-        if not parsed:
+        if decoded:
-            continue
+            try:
+                log = json.loads(decoded)
+                level = log.get("level", "")
+                if level in ("error", "fatal", "warn"):
+                    logger.warning("caddy: %s", log.get("msg", decoded))
+            except json.JSONDecodeError:
+                if "error" in decoded.lower() or "fatal" in decoded.lower():
+                    logger.warning("caddy: %s", decoded)
 
-        level, logger, msg = parsed
+    # Start background task to drain stderr
-
+    async def drain_caddy_stderr():
-        # Filter out info-level and admin messages
-        if level == "info" or logger == "admin":
-            continue
-
-        # Show errors/fatal to user
-        if level in ("error", "fatal"):
-            stderr.write(format_caddy_log(level, logger, msg))
-        elif not level:
-            # Unparseable non-empty line (e.g., sudo prompt) - pass through with prefix
-            stderr.write(f"┃ {strip_caddy_verbose(msg)}\n")
-            stderr.flush()
-
-    # Start a background thread to drain stderr and show errors
-    def drain_stderr():
         while True:
-            line = caddy_process.stderr.readline().decode()
+            line = await proc.stderr.readline()
             if not line:
                 break
+            decoded = line.decode().rstrip()
+            if decoded:
+                try:
+                    log = json.loads(decoded)
+                    level = log.get("level", "")
+                    if level in ("error", "fatal", "warn"):
+                        logger.warning("caddy: %s", log.get("msg", decoded))
+                except json.JSONDecodeError:
+                    pass  # Ignore non-JSON output after startup
 
-            parsed = parse_caddy_log(line)
+    asyncio.create_task(drain_caddy_stderr())
-            if not parsed:
+    return proc
-                continue
 
-            level, logger, msg = parsed
 
-            # Filter out info-level and admin messages
+async def run_devserver(args: argparse.Namespace, remaining: list[str]) -> None:
-            if level == "info" or logger == "admin":
+    """Run the development server with all components."""
-                continue
+    reporoot = Path(__file__).parent.parent
+    frontend_path = reporoot / "frontend"
+    if not (frontend_path / "package.json").exists():
+        logger.warning("Frontend source not found at %s", frontend_path)
+        raise SystemExit(1)
 
-            # Show errors/warnings to user
+    viteurl, npm_install, vite = setup_vite(args.listen, DEFAULT_VITE_PORT)
-            if level in ("error", "fatal", "warn"):
+    backurl, paskia = setup_cli("paskia", f"localhost:{BACKEND_PORT}", BACKEND_PORT)
-                stderr.write(format_caddy_log(level, logger, msg))
-            elif not level:
-                # Unparseable line - pass through with prefix
-                stderr.write(f"┃ {strip_caddy_verbose(msg)}\n")
 
-    drain_thread = Thread(target=drain_stderr, daemon=True)
+    # Extract vite port for Caddy config
-    drain_thread.start()
+    vite_port = int(viteurl.rsplit(":", 1)[1])
 
-    def cleanup():
+    # Build paskia command with options
-        if caddy_process:
+    paskia.extend(["--rp-id", args.rp_id])
-            caddy_process.terminate()
+    if args.auth_host:
-            caddy_process.wait()
+        paskia.extend(["--auth-host", args.auth_host])
+    if args.origins:
+        for origin in args.origins:
+            paskia.extend(["--origin", origin])
+    paskia.extend(remaining)
 
-    atexit.register(cleanup)
+    # Compute origins for Caddy
+    caddy_origins = []
+    if args.auth_host:
+        auth_host = args.auth_host
+        if "://" not in auth_host:
+            auth_host = f"https://{auth_host}"
+        caddy_origins.append(auth_host)
+        caddy_origins.append(f"https://{args.rp_id}")
+    if args.origins:
+        for origin in args.origins:
+            if "://" not in origin:
+                origin = f"https://{origin}"
+            caddy_origins.append(origin)
+    if not args.auth_host and not args.origins:
+        caddy_origins.append(f"https://{args.rp_id}")
+    # Remove duplicates while preserving order
+    seen = set()
+    caddy_origins = [x for x in caddy_origins if not (x in seen or seen.add(x))]
 
-    return caddy_process
+    # Set environment for subprocesses
+    os.environ["PASKIA_FRONTEND_URL"] = viteurl
+    os.environ["PASKIA_BACKEND_URL"] = backurl
+    os.environ["PASKIA_SITE_URL"] = caddy_origins[0] if args.caddy else viteurl
+    if args.auth_host:
+        os.environ["PASKIA_AUTH_HOST"] = args.auth_host
+
+    async with ProcessGroup() as pg:
+        # Start Caddy first if requested (needs to bind ports)
+        if args.caddy:
+            caddy_proc = await run_caddy(caddy_origins, vite_port)
+            pg._procs.append(caddy_proc)
+            pg._cmds[caddy_proc.pid] = "caddy"
+
+        npm_proc = await pg.spawn(*npm_install, cwd=frontend_path)
+        await check_ports_free(viteurl, backurl)
+        await pg.spawn(*paskia)
+        await pg.wait(npm_proc, ready(backurl, path="/api/health?from=devserver.py"))
+        await pg.spawn(*vite, cwd=frontend_path)
 
 
 def main():
-    # Parse optional hostport argument for Vite frontend
     parser = argparse.ArgumentParser(add_help=False)
-    parser.add_argument("hostport", nargs="?", default=None)
+    parser.add_argument(
+        "-l",
+        "--listen",
+        metavar="ENDPOINT",
+        default=None,
+        help="Vite frontend endpoint (default: localhost:4403)",
+    )
     parser.add_argument("--caddy", action="store_true", help="Run Caddy as HTTPS proxy")
     parser.add_argument("--rp-id", default="localhost", help="Relying Party ID")
     parser.add_argument(
@@ -387,85 +234,8 @@ def main():
     parser.add_argument("--auth-host", help="Dedicated auth host")
     args, remaining = parser.parse_known_args()
 
-    # Parse Vite endpoint
+    with suppress(KeyboardInterrupt):
-    vite_host, vite_port, vite_uds, all_ifaces = parse_endpoint(
+        asyncio.run(run_devserver(args, remaining))
-        args.hostport, DEFAULT_VITE_PORT
-    )
-
-    if vite_uds:
-        raise SystemExit("┃ ⚠️  Unix sockets are not supported for Vite frontend")
-
-    # Handle all-interfaces case (:port syntax)
-    # Vite uses 0.0.0.0 to listen on all interfaces (IPv4 only, sufficient for dev)
-    if all_ifaces:
-        vite_host = "0.0.0.0"
-
-    # Build Vite URL for FASTAPI_VUE_FRONTEND_URL (always use localhost for URL)
-    vite_url = f"http://localhost:{vite_port}"
-
-    # Compute origins for Caddy (user-specified or auto-generated)
-    caddy_origins = []
-    if args.auth_host:
-        auth_host = args.auth_host
-        if "://" not in auth_host:
-            auth_host = f"https://{auth_host}"
-        caddy_origins.append(auth_host)
-        # Also run on rp-id when auth-host is specified
-        caddy_origins.append(f"https://{args.rp_id}")
-    if args.origins:
-        for origin in args.origins:
-            if "://" not in origin:
-                origin = f"https://{origin}"
-            caddy_origins.append(origin)
-    # If neither auth-host nor origins specified, run on rp-id
-    if not args.auth_host and not args.origins:
-        caddy_origins.append(f"https://{args.rp_id}")
-
-    # Remove duplicates while preserving order
-    seen = set()
-    caddy_origins = [x for x in caddy_origins if not (x in seen or seen.add(x))]
-
-    # Start Caddy if requested (after computing origins)
-    if args.caddy:
-        if not caddy_origins:
-            caddy_origins = [f"https://{args.rp_id}"]
-        stderr.write(f">>> sudo caddy @ {' '.join(caddy_origins)}\n")
-        if not run_caddy(caddy_origins, vite_port):
-            raise SystemExit(1)
-
-    # Set dev mode env vars for subprocesses (fastapi-vue convention)
-    env = os.environ.copy()
-    env["FASTAPI_VUE_FRONTEND_URL"] = vite_url
-    env["FASTAPI_VUE_BACKEND_URL"] = f"http://localhost:{BACKEND_PORT}"
-    # User-facing URL: Caddy HTTPS when running, else Vite HTTP
-    if args.caddy:
-        env["PASKIA_SITE_URL"] = caddy_origins[0]  # auth-host or https://{rp-id}
-    else:
-        env["PASKIA_SITE_URL"] = vite_url
-
-    # Start Vite dev server
-    run_vite(vite_url, vite_host, vite_port, env, args.auth_host)
-
-    # Build command with origin args (no serve subcommand, host:port is first arg)
-    cmd = ["paskia", f"localhost:{BACKEND_PORT}"]
-
-    # Pass through rp-id (always pass, has default)
-    cmd.extend(["--rp-id", args.rp_id])
-
-    # Pass through auth-host if specified
-    if args.auth_host:
-        cmd.extend(["--auth-host", args.auth_host])
-
-    # Pass through origins as specified
-    if args.origins:
-        for origin in args.origins:
-            cmd.extend(["--origin", origin])
-
-    # Add remaining args (ones we didn't parse)
-    cmd.extend(remaining)
-
-    stderr.write(f">>> (devmode) {' '.join(cmd)}\n")
-    subprocess.run(cmd, env=env)
 
 
 if __name__ == "__main__":

scripts/fastapi-vue/build-frontend.py

@@ -1,34 +1,15 @@
 """Hatch build hook for building Vue frontend during package build."""
 
-import subprocess
+import sys
 from pathlib import Path
-from sys import stderr
 
 from hatchling.builders.hooks.plugin.interface import BuildHookInterface  # type: ignore
 
-exec(Path(__file__).with_name("util.py").read_text("UTF-8"))  # noqa: S102
+sys.path.insert(0, str(Path(__file__).parent))
-
+from buildutil import build
-
-def run(cmd, **kwargs):
-    """Run a command and display it."""
-    display_cmd = [Path(cmd[0]).name, *cmd[1:]]
-    stderr.write(f"### {' '.join(display_cmd)}\n")
-    subprocess.run(cmd, check=True, **kwargs)
 
 
 class CustomBuildHook(BuildHookInterface):
-    """Build hook that compiles Vue frontend before packaging."""
-
     def initialize(self, version, build_data):
         super().initialize(version, build_data)
-        stderr.write(">>> Building the frontend\n")
+        build("frontend")
-
-        install_cmd, build_cmd = find_build_tool()  # noqa # type: ignore
-
-        try:
-            run(install_cmd, cwd="frontend")
-            stderr.write("\n")
-            run(build_cmd, cwd="frontend")
-        except Exception as e:
-            stderr.write(f"Error occurred while building frontend: {e}\n")
-            raise

scripts/fastapi-vue/buildutil.py

@@ -0,0 +1,191 @@
+"""Utilities used at build time and in devserver script. No dependencies."""
+
+import logging
+import os
+import re
+import shutil
+import subprocess
+from pathlib import Path
+
+
+class _PrefixFormatter(logging.Formatter):
+    """Formatter that adds prefix based on log level."""
+
+    def format(self, record: logging.LogRecord) -> str:
+        if record.levelno >= logging.WARNING:
+            return f"⚠️  {record.getMessage()}"
+        return record.getMessage()
+
+
+_handler = logging.StreamHandler()
+_handler.setFormatter(_PrefixFormatter())
+logger = logging.getLogger("fastapi-vue")
+logger.addHandler(_handler)
+logger.setLevel(logging.INFO)
+
+
+def _check_node_version(node_path: str) -> None:
+    """Check if Node.js version is >= 20.
+
+    Raises RuntimeError if version is too old or cannot be determined.
+    """
+    try:
+        result = subprocess.run(
+            [node_path, "--version"], capture_output=True, text=True, check=True
+        )
+        version_str = result.stdout.strip()
+        # Parse version like "v20.10.0" or "v18.17.1"
+        match = re.match(r"v(\d+)", version_str)
+        if match:
+            major_version = int(match.group(1))
+            if major_version >= 20:
+                return
+            raise RuntimeError(
+                f"Node.js {version_str} found, but v20+ required (install with nvm)"
+            )
+    except (subprocess.CalledProcessError, FileNotFoundError, ValueError):
+        pass
+    raise RuntimeError("Could not determine Node.js version")
+
+
+def find_js_runtime() -> tuple[str, str]:
+    """Find a JavaScript runtime from JS_RUNTIME env or auto-detect.
+
+    Returns (tool_path, tool_name) where tool_name is "deno", "npm", or "bun".
+    Raises JSRuntimeError if no suitable runtime is found.
+    """
+    options = ["npm", "deno", "bun"]
+    node_version_error: RuntimeError | None = None
+
+    # Check for JS_RUNTIME environment variable
+    if js_runtime_env := os.environ.get("JS_RUNTIME"):
+        js_runtime = js_runtime_env
+        js_path = Path(js_runtime)
+        runtime_name = js_path.name
+        # Map node to npm
+        if runtime_name == "node":
+            runtime_name = "npm"
+            js_runtime = str(js_path.parent / "npm") if js_path.parent.name else "npm"
+        for option in options:
+            if option == runtime_name or runtime_name.startswith(option):
+                tool = shutil.which(js_runtime)
+                if tool is None:
+                    raise RuntimeError(
+                        f"JS_RUNTIME={js_runtime_env}: {option} not found"
+                    )
+                # Check Node.js version if using npm
+                if option == "npm":
+                    node_path = shutil.which("node", path=str(Path(tool).parent))
+                    if node_path is None:
+                        raise RuntimeError(
+                            f"JS_RUNTIME={js_runtime_env}: node not found"
+                        )
+                    _check_node_version(node_path)  # Raises on failure
+                return tool, option
+        raise RuntimeError(f"JS_RUNTIME={js_runtime_env} not recognized")
+
+    # Auto-detect
+    for option in options:
+        if tool := shutil.which(option):
+            # Check Node.js version if using npm
+            if option == "npm":
+                node_path = shutil.which("node", path=str(Path(tool).parent))
+                if node_path is None:
+                    continue
+                try:
+                    _check_node_version(node_path)
+                except RuntimeError as e:
+                    node_version_error = e
+                    continue  # Try next runtime
+            return tool, option
+
+    # No runtime found - provide helpful error
+    if node_version_error:
+        raise node_version_error
+    raise RuntimeError("Node.js (v20+), Deno or Bun is required but none was found")
+
+
+def find_build_tool():
+    """Find JavaScript runtime and construct install/build commands.
+
+    Returns (install_cmd, build_cmd) tuples of command lists.
+    Raises RuntimeError if no runtime is found.
+    """
+    install = {
+        "deno": ("install", "--allow-scripts=npm:vue-demi"),
+        "npm": ("install",),
+        "bun": ("--bun", "install"),
+    }
+    # Run vite directly for deno to avoid npm-run-all2/run-p issues
+    build = {
+        "deno": ("run", "-A", "npm:vite", "build"),
+        "npm": ("run", "build"),
+        "bun": ("--bun", "run", "build"),
+    }
+
+    tool, name = find_js_runtime()
+    return [tool, *install[name]], [tool, *build[name]]
+
+
+def find_dev_tool() -> list[str]:
+    """Find JavaScript runtime and construct dev command.
+
+    Returns dev_cmd (without vite-specific args).
+    Raises RuntimeError if no runtime is found.
+    """
+    dev_args = {
+        "deno": ("run", "-A", "npm:vite"),
+        "npm": ("--silent", "run", "dev", "--"),
+        "bun": ("run", "dev", "--"),
+    }
+
+    tool, name = find_js_runtime()
+
+    if name == "bun":
+        logger.warning(
+            "Bun has a bug in WS proxying (https://github.com/oven-sh/bun/issues/9882). Consider using npm instead."
+        )
+
+    return [tool, *dev_args[name]]
+
+
+def find_install_tool() -> list[str]:
+    """Find JavaScript runtime and construct install command.
+
+    Returns install_cmd.
+    Raises RuntimeError if no runtime is found.
+    """
+    install_args = {
+        "deno": ("install", "--quiet", "--allow-scripts=npm:vue-demi"),
+        "npm": ("install", "--silent"),
+        "bun": ("install", "--silent"),
+    }
+
+    tool, name = find_js_runtime()
+    return [tool, *install_args[name]]
+
+
+def build(folder: str = "frontend") -> None:
+    """Build the frontend in the specified folder.
+
+    Raises SystemExit(1) on failure.
+    """
+    logger.info(">>> Building %s", folder)
+
+    try:
+        install_cmd, build_cmd = find_build_tool()
+    except RuntimeError as e:
+        logger.warning(e)
+        raise SystemExit(1)
+
+    def run(cmd):
+        display_cmd = [Path(cmd[0]).stem, *cmd[1:]]
+        logger.info("### %s", " ".join(display_cmd))
+        subprocess.run(cmd, check=True, cwd=folder)
+
+    try:
+        run(install_cmd)
+        logger.info("")
+        run(build_cmd)
+    except subprocess.CalledProcessError:
+        raise SystemExit(1)

scripts/fastapi-vue/devutil.py

@@ -0,0 +1,211 @@
+"""Utilities meant for devserver script, used only in source repository with dev deps."""
+
+import asyncio
+import subprocess
+import sys
+from collections.abc import Coroutine
+from contextlib import suppress
+from pathlib import Path
+from typing import Any
+
+import httpx
+from buildutil import find_dev_tool, find_install_tool, logger
+from fastapi_vue.hostutil import parse_endpoint
+
+
+class ProcessGroup:
+    """Manage async subprocesses with automatic cleanup, like TaskGroup for processes."""
+
+    def __init__(self):
+        self._procs: list[asyncio.subprocess.Process] = []
+        self._cmds: dict[int, str] = {}  # pid -> command name
+
+    async def spawn(
+        self, *cmd: str, cwd: str | None = None
+    ) -> asyncio.subprocess.Process:
+        """Spawn a subprocess and track it."""
+        cmd_name = Path(cmd[0]).stem
+        logger.info(">>> %s", " ".join([cmd_name, *cmd[1:]]))
+        proc = await asyncio.create_subprocess_exec(*cmd, cwd=cwd)
+        self._procs.append(proc)
+        self._cmds[proc.pid] = cmd_name
+        return proc
+
+    async def wait(
+        self, *waitables: "asyncio.subprocess.Process | Coroutine[Any, Any, Any]"
+    ) -> None:
+        """Wait for processes/coroutines to complete, raise SystemExit on failure."""
+
+        async def wait_proc(proc: asyncio.subprocess.Process) -> None:
+            returncode = await proc.wait()
+            if returncode != 0:
+                cmd_name = self._cmds.get(proc.pid, "unknown")
+                raise subprocess.CalledProcessError(returncode, cmd_name)
+
+        tasks = [
+            wait_proc(w) if isinstance(w, asyncio.subprocess.Process) else w
+            for w in waitables
+        ]
+        try:
+            await asyncio.gather(*tasks)
+        except subprocess.CalledProcessError as e:
+            logger.warning("%s failed with exit status %d", e.cmd, e.returncode)
+            raise SystemExit(1) from None
+
+    async def __aenter__(self):
+        return self
+
+    async def __aexit__(self, exc_type, *_):
+        """Wait for one process to exit, terminate others, then wait for all."""
+        await self._cleanup(immediate=exc_type is not None)
+
+    async def _cleanup(self, immediate: bool = False):
+        running = [p for p in self._procs if p.returncode is None]
+        if not running:
+            return
+
+        if not immediate:
+            # Wait for any one process to exit
+            with suppress(asyncio.CancelledError):
+                await asyncio.wait(
+                    [asyncio.create_task(p.wait()) for p in running],
+                    return_when=asyncio.FIRST_COMPLETED,
+                )
+
+        # Terminate remaining processes
+        for p in self._procs:
+            if p.returncode is None:
+                with suppress(ProcessLookupError):
+                    p.terminate()
+
+        # Wait for all to finish (with overall timeout), shielded from cancellation
+        still_running = [p for p in self._procs if p.returncode is None]
+        if still_running:
+            with suppress(asyncio.CancelledError):
+                try:
+                    await asyncio.shield(
+                        asyncio.wait_for(
+                            asyncio.gather(*[p.wait() for p in still_running]),
+                            timeout=10,
+                        )
+                    )
+                except TimeoutError:
+                    for p in self._procs:
+                        if p.returncode is None:
+                            with suppress(ProcessLookupError):
+                                p.kill()
+                            await p.wait()
+
+
+async def check_ports_free(*urls: str) -> None:
+    """Verify URLs are not responding (ports are free). Raise SystemExit if any respond."""
+
+    async def check(client: httpx.AsyncClient, url: str) -> None:
+        with suppress(httpx.RequestError):
+            res = await client.get(url, timeout=0.1)
+            server = res.headers.get("server", "server")
+            logger.warning("Conflicting %s already running at %s", server, url)
+            raise SystemExit(1)
+
+    async with httpx.AsyncClient() as client:
+        await asyncio.gather(*[check(client, url) for url in urls])
+
+
+async def ready(url: str, path: str = "") -> None:
+    """Wait for the server to be ready by polling an endpoint.
+
+    Raises SystemExit(1) if server doesn't start in time.
+    """
+    max_attempts = 50
+    full_url = f"{url}{path}"
+
+    async with httpx.AsyncClient() as client:
+        for attempt in range(max_attempts):
+            try:
+                await client.get(full_url, timeout=1.0)
+                logger.info("✓ Backend ready!")
+                return
+            except httpx.RequestError:
+                if attempt == max_attempts - 1:
+                    logger.warning("Backend didn't start in time")
+                    raise SystemExit(1)
+                await asyncio.sleep(0.1)
+
+
+def setup_vite(
+    endpoint: str, default_port: int = 5173
+) -> tuple[str, list[str], list[str]]:
+    """Parse frontend endpoint and build commands.
+
+    Returns (url, install_cmd, dev_cmd).
+    Raises SystemExit(1) on invalid config.
+    """
+    endpoints = parse_endpoint(endpoint, default_port)
+
+    if "uds" in endpoints[0]:
+        logger.warning("Unix sockets not supported with vite devserver")
+        raise SystemExit(1)
+
+    port = endpoints[0]["port"]
+    host = endpoints[0]["host"]
+
+    install_cmd = find_install_tool()
+    dev_cmd = find_dev_tool()
+    if host != "localhost":
+        dev_cmd.append("--host" if len(endpoints) > 1 else f"--host={host}")
+    dev_cmd.append(f"--port={port}")
+
+    return f"http://{host}:{port}", install_cmd, dev_cmd
+
+
+def setup_fastapi(
+    endpoint: str, module: str, default_port: int = 8000
+) -> tuple[str, list[str]]:
+    """Parse backend endpoint and build uvicorn command.
+
+    Returns (url, uvicorn_cmd).
+    Raises SystemExit(1) on invalid config.
+    """
+    endpoints = parse_endpoint(endpoint, default_port)
+
+    if "uds" in endpoints[0]:
+        logger.warning("Unix sockets not supported with vite devserver")
+        raise SystemExit(1)
+
+    host = endpoints[0]["host"]
+    port = endpoints[0]["port"]
+    reload_dir = module.split(".")[0]  # Don't reload on frontend changes
+
+    cmd = [
+        sys.executable,
+        "-m",
+        "uvicorn",
+        module,
+        f"--host={host}",
+        f"--port={port}",
+        "--reload",
+        f"--reload-dir={reload_dir}",
+        "--forwarded-allow-ips=*",
+    ]
+    return f"http://{host}:{port}", cmd
+
+
+def setup_cli(
+    cli: str, endpoint: str, default_port: int = 8000
+) -> tuple[str, list[str]]:
+    """Parse backend endpoint and build CLI command.
+
+    Returns (url, cli_cmd).
+    Raises SystemExit(1) on invalid config.
+    """
+    endpoints = parse_endpoint(endpoint, default_port)
+
+    if "uds" in endpoints[0]:
+        logger.warning("Unix sockets not supported with vite devserver")
+        raise SystemExit(1)
+
+    host = endpoints[0]["host"]
+    port = endpoints[0]["port"]
+
+    cmd = [cli, f"--listen={host}:{port}"]
+    return f"http://{host}:{port}", cmd

scripts/fastapi-vue/util.py

@@ -1,87 +0,0 @@
-"""Shared utilities for build and dev scripts."""
-
-import os
-import shutil
-from pathlib import Path
-from sys import stderr
-
-
-def find_js_runtime() -> tuple[str, str] | None:
-    """Find a JavaScript runtime from JS_RUNTIME env or auto-detect.
-
-    Returns (tool_path, tool_name) where tool_name is "deno", "npm", or "bun".
-    Returns None if no runtime is found.
-    """
-    options = ["deno", "npm", "bun"]
-
-    # Check for JS_RUNTIME environment variable
-    if js_runtime_env := os.environ.get("JS_RUNTIME"):
-        js_runtime = js_runtime_env
-        js_path = Path(js_runtime)
-        runtime_name = js_path.name
-        # Map node to npm
-        if runtime_name == "node":
-            runtime_name = "npm"
-            js_runtime = str(js_path.parent / "npm") if js_path.parent.name else "npm"
-        for option in options:
-            if option == runtime_name or runtime_name.startswith(option):
-                tool = shutil.which(js_runtime)
-                if tool is None:
-                    stderr.write(f"┃ ⚠️  JS_RUNTIME={js_runtime_env} not found\n")
-                    return None
-                return tool, option
-        stderr.write(f"┃ ⚠️  JS_RUNTIME={js_runtime_env} not recognized\n")
-        return None
-
-    # Auto-detect
-    for option in options:
-        if tool := shutil.which(option):
-            return tool, option
-    return None
-
-
-def find_build_tool():
-    """Find JavaScript runtime and construct install/build commands.
-
-    Returns (install_cmd, build_cmd) tuples of command lists.
-    Raises RuntimeError if no runtime is found.
-    """
-    install = {
-        "deno": ("install", "--allow-scripts=npm:vue-demi"),
-        "npm": ("install",),
-        "bun": ("--bun", "install"),
-    }
-    # Run vite directly for deno to avoid npm-run-all2/run-p issues
-    build = {
-        "deno": ("run", "-A", "npm:vite", "build"),
-        "npm": ("run", "build"),
-        "bun": ("--bun", "run", "build"),
-    }
-
-    result = find_js_runtime()
-    if result is None:
-        raise RuntimeError(
-            "Deno, npm or Bun is required for building but none was found"
-        )
-
-    tool, name = result
-    return [tool, *install[name]], [tool, *build[name]]
-
-
-def find_dev_tool():
-    """Find JavaScript runtime and construct dev command.
-
-    Returns (dev_cmd, tool_name) or (None, None) if not found.
-    """
-    dev_args = {
-        "deno": ("run", "dev", "--"),
-        "npm": ("--silent", "run", "dev", "--"),
-        "bun": ("run", "dev", "--"),
-    }
-
-    result = find_js_runtime()
-    if result is None:
-        return None, None
-
-    tool, name = result
-    return [tool, *dev_args[name]], name

tests/conftest.py

@@ -39,7 +39,6 @@ from paskia.db.operations import DB
 from paskia.fastapi.mainapp import app
 from paskia.fastapi.session import AUTH_COOKIE_NAME
 from paskia.sansio import Passkey
-from paskia.util.passphrase import generate
 
 
 @pytest.fixture(scope="session")
@@ -181,7 +180,7 @@ async def session_token(
     return create_session(
         user_uuid=test_user.uuid,
         credential_uuid=test_credential.uuid,
-        host="localhost:4401",
+        host="localhost",
         ip="127.0.0.1",
         user_agent="pytest",
         expiry=expires(),
@@ -196,7 +195,7 @@ async def regular_session_token(
     return create_session(
         user_uuid=regular_user.uuid,
         credential_uuid=regular_credential.uuid,
-        host="localhost:4401",
+        host="localhost",
         ip="127.0.0.1",
         user_agent="pytest",
         expiry=expires(),
@@ -206,15 +205,11 @@ async def regular_session_token(
 @pytest_asyncio.fixture(scope="function")
 async def reset_token(test_db: DB, test_user: User, test_credential: Credential) -> str:
     """Create a reset token for the test user."""
-
+    return create_reset_token(
-    token = generate()
-    create_reset_token(
         user_uuid=test_user.uuid,
-        passphrase=token,
         expiry=reset_expires(),
         token_type="reset",
     )
-    return token
 
 
 @pytest_asyncio.fixture(scope="function")

tests/test_admin.py

@@ -101,7 +101,7 @@ async def second_org_session_token(
     return create_session(
         user_uuid=second_org_user.uuid,
         credential_uuid=second_org_credential.uuid,
-        host="localhost:4401",
+        host="localhost",
         ip="127.0.0.1",
         user_agent="pytest",
         expiry=expires(),
@@ -158,7 +158,7 @@ async def org_admin_session_token(
     return create_session(
         user_uuid=org_admin_user.uuid,
         credential_uuid=org_admin_credential.uuid,
-        host="localhost:4401",
+        host="localhost",
         ip="127.0.0.1",
         user_agent="pytest",
         expiry=expires(),
@@ -604,7 +604,7 @@ class TestAdminRoles:
     ):
         """Admin should be able to update a role."""
         response = await client.patch(
-            f"/auth/api/admin/orgs/{test_org.uuid}/roles/{test_role.uuid}",
+            f"/auth/api/admin/roles/{test_role.uuid}",
             json={"display_name": "Updated Role Name"},
             headers={**auth_headers(session_token), "Host": "localhost:4401"},
         )
@@ -614,17 +614,19 @@ class TestAdminRoles:
 
     @pytest.mark.asyncio
     async def test_update_role_wrong_org(
-        self, client: httpx.AsyncClient, session_token: str, test_org, second_org_role
+        self,
+        client: httpx.AsyncClient,
+        org_admin_session_token: str,
+        test_org,
+        second_org_role,
     ):
-        """Cannot update role from another org."""
+        """Org admin cannot update role from another org."""
         response = await client.patch(
-            f"/auth/api/admin/orgs/{test_org.uuid}/roles/{second_org_role.uuid}",
+            f"/auth/api/admin/roles/{second_org_role.uuid}",
             json={"display_name": "Try Update Wrong Org"},
-            headers={**auth_headers(session_token), "Host": "localhost:4401"},
+            headers={**auth_headers(org_admin_session_token), "Host": "localhost:4401"},
         )
-        assert response.status_code == 404
+        assert response.status_code == 403
-        data = response.json()
-        assert "Role not found" in data["detail"]
 
     @pytest.mark.asyncio
     async def test_update_role_add_grantable_permission(
@@ -637,7 +639,7 @@ class TestAdminRoles:
     ):
         """Admin should be able to add grantable permissions to role."""
         response = await client.post(
-            f"/auth/api/admin/orgs/{test_org.uuid}/roles/{user_role.uuid}/permissions/{grantable_permission.uuid}",
+            f"/auth/api/admin/roles/{user_role.uuid}/permissions/{grantable_permission.uuid}",
             headers={**auth_headers(session_token), "Host": "localhost:4401"},
         )
         assert response.status_code == 200
@@ -659,7 +661,7 @@ class TestAdminRoles:
         create_permission(perm)
 
         response = await client.post(
-            f"/auth/api/admin/orgs/{test_org.uuid}/roles/{user_role.uuid}/permissions/{perm.uuid}",
+            f"/auth/api/admin/roles/{user_role.uuid}/permissions/{perm.uuid}",
             headers={**auth_headers(session_token), "Host": "localhost:4401"},
         )
         assert response.status_code == 400
@@ -680,14 +682,14 @@ class TestAdminRoles:
         # test_role has both auth:admin and auth:org:admin
         # Remove auth:admin first (should succeed since org:admin remains)
         response = await client.delete(
-            f"/auth/api/admin/orgs/{test_org.uuid}/roles/{test_role.uuid}/permissions/{admin_permission.uuid}",
+            f"/auth/api/admin/roles/{test_role.uuid}/permissions/{admin_permission.uuid}",
             headers={**auth_headers(session_token), "Host": "localhost:4401"},
         )
         assert response.status_code == 200
 
         # Now try to remove auth:org:admin (should fail - would leave no admin access)
         response = await client.delete(
-            f"/auth/api/admin/orgs/{test_org.uuid}/roles/{test_role.uuid}/permissions/{org_admin_permission.uuid}",
+            f"/auth/api/admin/roles/{test_role.uuid}/permissions/{org_admin_permission.uuid}",
             headers={**auth_headers(session_token), "Host": "localhost:4401"},
         )
         assert response.status_code == 400
@@ -700,7 +702,7 @@ class TestAdminRoles:
     ):
         """Admin should be able to delete a role."""
         response = await client.delete(
-            f"/auth/api/admin/orgs/{test_org.uuid}/roles/{user_role.uuid}",
+            f"/auth/api/admin/roles/{user_role.uuid}",
             headers={**auth_headers(session_token), "Host": "localhost:4401"},
         )
         assert response.status_code == 200
@@ -709,16 +711,18 @@ class TestAdminRoles:
 
     @pytest.mark.asyncio
     async def test_delete_role_wrong_org(
-        self, client: httpx.AsyncClient, session_token: str, test_org, second_org_role
+        self,
+        client: httpx.AsyncClient,
+        org_admin_session_token: str,
+        test_org,
+        second_org_role,
     ):
-        """Cannot delete role from another org."""
+        """Org admin cannot delete role from another org."""
         response = await client.delete(
-            f"/auth/api/admin/orgs/{test_org.uuid}/roles/{second_org_role.uuid}",
+            f"/auth/api/admin/roles/{second_org_role.uuid}",
-            headers={**auth_headers(session_token), "Host": "localhost:4401"},
+            headers={**auth_headers(org_admin_session_token), "Host": "localhost:4401"},
         )
-        assert response.status_code == 404
+        assert response.status_code == 403
-        data = response.json()
-        assert "Role not found" in data["detail"]
 
     @pytest.mark.asyncio
     async def test_delete_own_role_fails(
@@ -726,7 +730,7 @@ class TestAdminRoles:
     ):
         """Admin cannot delete their own role."""
         response = await client.delete(
-            f"/auth/api/admin/orgs/{test_org.uuid}/roles/{test_role.uuid}",
+            f"/auth/api/admin/roles/{test_role.uuid}",
             headers={**auth_headers(session_token), "Host": "localhost:4401"},
         )
         assert response.status_code == 400
@@ -788,7 +792,7 @@ class TestAdminUsersInOrg:
     ):
         """Admin should be able to get user details within an org."""
         response = await client.get(
-            f"/auth/api/admin/orgs/{test_org.uuid}/users/{test_user.uuid}",
+            f"/auth/api/admin/users/{test_user.uuid}",
             headers={**auth_headers(session_token), "Host": "localhost:4401"},
         )
         assert response.status_code == 200
@@ -807,7 +811,7 @@ class TestAdminUsersInOrg:
         """Getting non-existent user should return 404."""
         fake_uuid = uuid7.create()
         response = await client.get(
-            f"/auth/api/admin/orgs/{test_org.uuid}/users/{fake_uuid}",
+            f"/auth/api/admin/users/{fake_uuid}",
             headers={**auth_headers(session_token), "Host": "localhost:4401"},
         )
         assert response.status_code == 404
@@ -816,16 +820,18 @@ class TestAdminUsersInOrg:
 
     @pytest.mark.asyncio
     async def test_get_user_wrong_org(
-        self, client: httpx.AsyncClient, session_token: str, test_org, second_org_user
+        self,
+        client: httpx.AsyncClient,
+        org_admin_session_token: str,
+        test_org,
+        second_org_user,
     ):
-        """Getting user from another org should return 404."""
+        """Org admin cannot get user from another org."""
         response = await client.get(
-            f"/auth/api/admin/orgs/{test_org.uuid}/users/{second_org_user.uuid}",
+            f"/auth/api/admin/users/{second_org_user.uuid}",
-            headers={**auth_headers(session_token), "Host": "localhost:4401"},
+            headers={**auth_headers(org_admin_session_token), "Host": "localhost:4401"},
         )
-        assert response.status_code == 404
+        assert response.status_code == 403
-        data = response.json()
-        assert "User not found" in data["detail"]
 
     @pytest.mark.asyncio
     async def test_get_user_with_org_admin(
@@ -837,7 +843,7 @@ class TestAdminUsersInOrg:
     ):
         """Org admin should be able to get user details."""
         response = await client.get(
-            f"/auth/api/admin/orgs/{test_org.uuid}/users/{org_admin_user.uuid}",
+            f"/auth/api/admin/users/{org_admin_user.uuid}",
             headers={**auth_headers(org_admin_session_token), "Host": "localhost:4401"},
         )
         assert response.status_code == 200
@@ -850,7 +856,7 @@ class TestAdminUsersInOrg:
     ):
         """Admin should be able to update user display name."""
         response = await client.patch(
-            f"/auth/api/admin/orgs/{test_org.uuid}/users/{test_user.uuid}/display-name",
+            f"/auth/api/admin/users/{test_user.uuid}/display-name",
             json={"display_name": "Updated Admin Name"},
             headers={**auth_headers(session_token), "Host": "localhost:4401"},
         )
@@ -863,7 +869,7 @@ class TestAdminUsersInOrg:
         """Updating non-existent user should return 404."""
         fake_uuid = uuid7.create()
         response = await client.patch(
-            f"/auth/api/admin/orgs/{test_org.uuid}/users/{fake_uuid}/display-name",
+            f"/auth/api/admin/users/{fake_uuid}/display-name",
             json={"display_name": "New Name"},
             headers={**auth_headers(session_token), "Host": "localhost:4401"},
         )
@@ -873,15 +879,19 @@ class TestAdminUsersInOrg:
 
     @pytest.mark.asyncio
     async def test_update_user_display_name_wrong_org(
-        self, client: httpx.AsyncClient, session_token: str, test_org, second_org_user
+        self,
+        client: httpx.AsyncClient,
+        org_admin_session_token: str,
+        test_org,
+        second_org_user,
     ):
-        """Updating user from another org should return 404."""
+        """Org admin cannot update user from another org."""
         response = await client.patch(
-            f"/auth/api/admin/orgs/{test_org.uuid}/users/{second_org_user.uuid}/display-name",
+            f"/auth/api/admin/users/{second_org_user.uuid}/display-name",
             json={"display_name": "New Name"},
-            headers={**auth_headers(session_token), "Host": "localhost:4401"},
+            headers={**auth_headers(org_admin_session_token), "Host": "localhost:4401"},
         )
-        assert response.status_code == 404
+        assert response.status_code == 403
 
     @pytest.mark.asyncio
     async def test_update_user_display_name_empty(
@@ -889,7 +899,7 @@ class TestAdminUsersInOrg:
     ):
         """Updating user with empty display name should fail."""
         response = await client.patch(
-            f"/auth/api/admin/orgs/{test_org.uuid}/users/{test_user.uuid}/display-name",
+            f"/auth/api/admin/users/{test_user.uuid}/display-name",
             json={"display_name": "   "},
             headers={**auth_headers(session_token), "Host": "localhost:4401"},
         )
@@ -903,7 +913,7 @@ class TestAdminUsersInOrg:
     ):
         """Updating user with too long display name should fail."""
         response = await client.patch(
-            f"/auth/api/admin/orgs/{test_org.uuid}/users/{test_user.uuid}/display-name",
+            f"/auth/api/admin/users/{test_user.uuid}/display-name",
             json={"display_name": "x" * 100},
             headers={**auth_headers(session_token), "Host": "localhost:4401"},
         )
@@ -923,8 +933,8 @@ class TestAdminUsersInOrg:
         """Admin should be able to change user's role within org."""
         # Use regular_user who is in the same org but not the session owner
         response = await client.patch(
-            f"/auth/api/admin/orgs/{test_org.uuid}/users/{regular_user.uuid}/role",
+            f"/auth/api/admin/users/{regular_user.uuid}/role",
-            json={"role": user_role.display_name},
+            json={"role_uuid": str(user_role.uuid)},
             headers={**auth_headers(session_token), "Host": "localhost:4401"},
         )
         assert response.status_code == 200
@@ -935,13 +945,13 @@ class TestAdminUsersInOrg:
     ):
         """Updating user role without specifying role should fail."""
         response = await client.patch(
-            f"/auth/api/admin/orgs/{test_org.uuid}/users/{test_user.uuid}/role",
+            f"/auth/api/admin/users/{test_user.uuid}/role",
             json={},
             headers={**auth_headers(session_token), "Host": "localhost:4401"},
         )
         assert response.status_code == 400
         data = response.json()
-        assert "role is required" in data["detail"]
+        assert "role_uuid is required" in data["detail"]
 
     @pytest.mark.asyncio
     async def test_update_user_role_user_not_found(
@@ -950,27 +960,29 @@ class TestAdminUsersInOrg:
         """Updating role for non-existent user should fail."""
         fake_uuid = uuid7.create()
         response = await client.patch(
-            f"/auth/api/admin/orgs/{test_org.uuid}/users/{fake_uuid}/role",
+            f"/auth/api/admin/users/{fake_uuid}/role",
-            json={"role": "User Role"},
+            json={"role_uuid": str(uuid7.create())},
             headers={**auth_headers(session_token), "Host": "localhost:4401"},
         )
-        assert response.status_code == 400
+        assert response.status_code == 404
         data = response.json()
         assert "User not found" in data["detail"]
 
     @pytest.mark.asyncio
     async def test_update_user_role_wrong_org(
-        self, client: httpx.AsyncClient, session_token: str, test_org, second_org_user
+        self,
+        client: httpx.AsyncClient,
+        org_admin_session_token: str,
+        test_org,
+        second_org_user,
     ):
-        """Updating role for user in another org should fail."""
+        """Org admin cannot update role for user in another org."""
         response = await client.patch(
-            f"/auth/api/admin/orgs/{test_org.uuid}/users/{second_org_user.uuid}/role",
+            f"/auth/api/admin/users/{second_org_user.uuid}/role",
-            json={"role": "User Role"},
+            json={"role_uuid": str(uuid7.create())},
-            headers={**auth_headers(session_token), "Host": "localhost:4401"},
+            headers={**auth_headers(org_admin_session_token), "Host": "localhost:4401"},
         )
-        assert response.status_code == 400
+        assert response.status_code == 403
-        data = response.json()
-        assert "does not belong" in data["detail"]
 
     @pytest.mark.asyncio
     async def test_update_user_role_invalid_role(
@@ -978,8 +990,8 @@ class TestAdminUsersInOrg:
     ):
         """Updating user to non-existent role should fail."""
         response = await client.patch(
-            f"/auth/api/admin/orgs/{test_org.uuid}/users/{test_user.uuid}/role",
+            f"/auth/api/admin/users/{test_user.uuid}/role",
-            json={"role": "Nonexistent Role"},
+            json={"role_uuid": str(uuid7.create())},
             headers={**auth_headers(session_token), "Host": "localhost:4401"},
         )
         assert response.status_code == 400
@@ -997,8 +1009,8 @@ class TestAdminUsersInOrg:
     ):
         """Admin cannot change their own role to non-admin role."""
         response = await client.patch(
-            f"/auth/api/admin/orgs/{test_org.uuid}/users/{org_admin_user.uuid}/role",
+            f"/auth/api/admin/users/{org_admin_user.uuid}/role",
-            json={"role": user_role.display_name},
+            json={"role_uuid": str(user_role.uuid)},
             headers={**auth_headers(org_admin_session_token), "Host": "localhost:4401"},
         )
         assert response.status_code == 400
@@ -1018,8 +1030,8 @@ class TestAdminUsersInOrg:
         # test_user is already on test_role which has auth:admin
         # Changing to the same role should succeed (no permission loss)
         response = await client.patch(
-            f"/auth/api/admin/orgs/{test_org.uuid}/users/{test_user.uuid}/role",
+            f"/auth/api/admin/users/{test_user.uuid}/role",
-            json={"role": test_role.display_name},
+            json={"role_uuid": str(test_role.uuid)},
             headers={**auth_headers(session_token), "Host": "localhost:4401"},
         )
         assert response.status_code == 200
@@ -1030,7 +1042,7 @@ class TestAdminUsersInOrg:
     ):
         """Admin should be able to create reset links for users."""
         response = await client.post(
-            f"/auth/api/admin/orgs/{test_org.uuid}/users/{test_user.uuid}/create-link",
+            f"/auth/api/admin/users/{test_user.uuid}/create-link",
             headers={**auth_headers(session_token), "Host": "localhost:4401"},
         )
         assert response.status_code == 200
@@ -1045,7 +1057,7 @@ class TestAdminUsersInOrg:
         """Creating reset link for non-existent user should fail."""
         fake_uuid = uuid7.create()
         response = await client.post(
-            f"/auth/api/admin/orgs/{test_org.uuid}/users/{fake_uuid}/create-link",
+            f"/auth/api/admin/users/{fake_uuid}/create-link",
             headers={**auth_headers(session_token), "Host": "localhost:4401"},
         )
         assert response.status_code == 404
@@ -1054,16 +1066,18 @@ class TestAdminUsersInOrg:
 
     @pytest.mark.asyncio
     async def test_create_user_reset_link_wrong_org(
-        self, client: httpx.AsyncClient, session_token: str, test_org, second_org_user
+        self,
+        client: httpx.AsyncClient,
+        org_admin_session_token: str,
+        test_org,
+        second_org_user,
     ):
-        """Creating reset link for user in another org should fail."""
+        """Org admin cannot create reset link for user in another org."""
         response = await client.post(
-            f"/auth/api/admin/orgs/{test_org.uuid}/users/{second_org_user.uuid}/create-link",
+            f"/auth/api/admin/users/{second_org_user.uuid}/create-link",
-            headers={**auth_headers(session_token), "Host": "localhost:4401"},
+            headers={**auth_headers(org_admin_session_token), "Host": "localhost:4401"},
         )
-        assert response.status_code == 404
+        assert response.status_code == 403
-        data = response.json()
-        assert "not found in organization" in data["detail"]
 
     @pytest.mark.asyncio
     async def test_create_user_registration_link_without_credentials(
@@ -1083,7 +1097,7 @@ class TestAdminUsersInOrg:
         create_user(user_no_cred)
 
         response = await client.post(
-            f"/auth/api/admin/orgs/{test_org.uuid}/users/{user_no_cred.uuid}/create-link",
+            f"/auth/api/admin/users/{user_no_cred.uuid}/create-link",
             headers={**auth_headers(session_token), "Host": "localhost:4401"},
         )
         assert response.status_code == 200
@@ -1091,6 +1105,120 @@ class TestAdminUsersInOrg:
         assert "url" in data
 
 
+# -------------------- User Deletion Tests --------------------
+
+
+class TestAdminUserDeletion:
+    """Tests for admin user deletion"""
+
+    @pytest.mark.asyncio
+    async def test_delete_user_success(
+        self,
+        client: httpx.AsyncClient,
+        session_token: str,
+        test_org,
+        user_role,
+        test_db: DB,
+    ):
+        """Admin should be able to delete a user."""
+        # Create a user to delete
+        user_to_delete = User.create(
+            display_name="User To Delete",
+            role=user_role.uuid,
+        )
+        create_user(user_to_delete)
+
+        response = await client.delete(
+            f"/auth/api/admin/users/{user_to_delete.uuid}",
+            headers={**auth_headers(session_token), "Host": "localhost:4401"},
+        )
+        assert response.status_code == 200
+        data = response.json()
+        assert data["status"] == "ok"
+        # Verify user is actually deleted
+        assert user_to_delete.uuid not in db.data().users
+
+    @pytest.mark.asyncio
+    async def test_delete_user_not_found(
+        self, client: httpx.AsyncClient, session_token: str
+    ):
+        """Deleting non-existent user should return 404."""
+        fake_uuid = uuid7.create()
+        response = await client.delete(
+            f"/auth/api/admin/users/{fake_uuid}",
+            headers={**auth_headers(session_token), "Host": "localhost:4401"},
+        )
+        assert response.status_code == 404
+        data = response.json()
+        assert "User not found" in data["detail"]
+
+    @pytest.mark.asyncio
+    async def test_delete_own_user_fails(
+        self, client: httpx.AsyncClient, session_token: str, test_user
+    ):
+        """Admin cannot delete their own account."""
+        response = await client.delete(
+            f"/auth/api/admin/users/{test_user.uuid}",
+            headers={**auth_headers(session_token), "Host": "localhost:4401"},
+        )
+        assert response.status_code == 400
+        data = response.json()
+        assert "Cannot delete your own account" in data["detail"]
+
+    @pytest.mark.asyncio
+    async def test_delete_user_wrong_org(
+        self,
+        client: httpx.AsyncClient,
+        org_admin_session_token: str,
+        second_org_user,
+    ):
+        """Org admin cannot delete user from another org."""
+        response = await client.delete(
+            f"/auth/api/admin/users/{second_org_user.uuid}",
+            headers={**auth_headers(org_admin_session_token), "Host": "localhost:4401"},
+        )
+        assert response.status_code == 403
+
+    @pytest.mark.asyncio
+    async def test_delete_user_org_admin_success(
+        self,
+        client: httpx.AsyncClient,
+        org_admin_session_token: str,
+        test_org,
+        user_role,
+        test_db: DB,
+    ):
+        """Org admin should be able to delete users in their org."""
+        # Create a user in the same org to delete
+        user_to_delete = User.create(
+            display_name="Org User To Delete",
+            role=user_role.uuid,
+        )
+        create_user(user_to_delete)
+
+        response = await client.delete(
+            f"/auth/api/admin/users/{user_to_delete.uuid}",
+            headers={**auth_headers(org_admin_session_token), "Host": "localhost:4401"},
+        )
+        assert response.status_code == 200
+        data = response.json()
+        assert data["status"] == "ok"
+
+    @pytest.mark.asyncio
+    async def test_delete_user_regular_user_forbidden(
+        self,
+        client: httpx.AsyncClient,
+        regular_session_token: str,
+        test_user,
+    ):
+        """Regular user trying to delete user should get 403."""
+        response = await client.delete(
+            f"/auth/api/admin/users/{test_user.uuid}",
+            headers={**auth_headers(regular_session_token), "Host": "localhost:4401"},
+        )
+        assert response.status_code == 403
+
+
 # -------------------- Credential Tests --------------------
 
 
@@ -1108,7 +1236,7 @@ class TestAdminCredentials:
     ):
         """Admin should be able to delete a user's credential."""
         response = await client.delete(
-            f"/auth/api/admin/orgs/{test_org.uuid}/users/{test_user.uuid}/credentials/{test_credential.uuid}",
+            f"/auth/api/admin/users/{test_user.uuid}/credentials/{test_credential.uuid}",
             headers={**auth_headers(session_token), "Host": "localhost:4401"},
         )
         assert response.status_code == 200
@@ -1123,7 +1251,7 @@ class TestAdminCredentials:
         fake_user_uuid = uuid7.create()
         fake_cred_uuid = uuid7.create()
         response = await client.delete(
-            f"/auth/api/admin/orgs/{test_org.uuid}/users/{fake_user_uuid}/credentials/{fake_cred_uuid}",
+            f"/auth/api/admin/users/{fake_user_uuid}/credentials/{fake_cred_uuid}",
             headers={**auth_headers(session_token), "Host": "localhost:4401"},
         )
         assert response.status_code == 404
@@ -1134,17 +1262,17 @@ class TestAdminCredentials:
     async def test_delete_credential_wrong_org(
         self,
         client: httpx.AsyncClient,
-        session_token: str,
+        org_admin_session_token: str,
         test_org,
         second_org_user,
         second_org_credential,
     ):
-        """Deleting credential for user in another org should fail."""
+        """Org admin cannot delete credential for user in another org."""
         response = await client.delete(
-            f"/auth/api/admin/orgs/{test_org.uuid}/users/{second_org_user.uuid}/credentials/{second_org_credential.uuid}",
+            f"/auth/api/admin/users/{second_org_user.uuid}/credentials/{second_org_credential.uuid}",
-            headers={**auth_headers(session_token), "Host": "localhost:4401"},
+            headers={**auth_headers(org_admin_session_token), "Host": "localhost:4401"},
         )
-        assert response.status_code == 404
+        assert response.status_code == 403
 
 
 # -------------------- Session Tests --------------------
@@ -1175,7 +1303,7 @@ class TestAdminSessions:
         )
 
         response = await client.delete(
-            f"/auth/api/admin/orgs/{test_org.uuid}/users/{test_user.uuid}/sessions/{extra_token}",
+            f"/auth/api/admin/users/{test_user.uuid}/sessions/{extra_token}",
             headers={**auth_headers(session_token), "Host": "localhost:4401"},
         )
         assert response.status_code == 200
@@ -1193,7 +1321,7 @@ class TestAdminSessions:
     ):
         """Admin can delete their own current session."""
         response = await client.delete(
-            f"/auth/api/admin/orgs/{test_org.uuid}/users/{test_user.uuid}/sessions/{session_token}",
+            f"/auth/api/admin/users/{test_user.uuid}/sessions/{session_token}",
             headers={**auth_headers(session_token), "Host": "localhost:4401"},
         )
         assert response.status_code == 200
@@ -1207,7 +1335,7 @@ class TestAdminSessions:
         """Deleting session for non-existent user should fail."""
         fake_uuid = uuid7.create()
         response = await client.delete(
-            f"/auth/api/admin/orgs/{test_org.uuid}/users/{fake_uuid}/sessions/fake-session-id",
+            f"/auth/api/admin/users/{fake_uuid}/sessions/fake-session-id",
             headers={**auth_headers(session_token), "Host": "localhost:4401"},
         )
         assert response.status_code == 404
@@ -1218,16 +1346,16 @@ class TestAdminSessions:
     async def test_delete_session_wrong_org(
         self,
         client: httpx.AsyncClient,
-        session_token: str,
+        org_admin_session_token: str,
         test_org,
         second_org_user,
     ):
-        """Deleting session for user in another org should fail."""
+        """Org admin cannot delete session for user in another org."""
         response = await client.delete(
-            f"/auth/api/admin/orgs/{test_org.uuid}/users/{second_org_user.uuid}/sessions/fake-session",
+            f"/auth/api/admin/users/{second_org_user.uuid}/sessions/fake-session",
-            headers={**auth_headers(session_token), "Host": "localhost:4401"},
+            headers={**auth_headers(org_admin_session_token), "Host": "localhost:4401"},
         )
-        assert response.status_code == 404
+        assert response.status_code == 403
 
     @pytest.mark.asyncio
     async def test_delete_session_invalid_id(
@@ -1235,7 +1363,7 @@ class TestAdminSessions:
     ):
         """Deleting session with invalid/non-existent ID should fail."""
         response = await client.delete(
-            f"/auth/api/admin/orgs/{test_org.uuid}/users/{test_user.uuid}/sessions/invalid!!id",
+            f"/auth/api/admin/users/{test_user.uuid}/sessions/invalid!!id",
             headers={**auth_headers(session_token), "Host": "localhost:4401"},
         )
         assert response.status_code == 404
@@ -1250,7 +1378,7 @@ class TestAdminSessions:
         # Use a valid format but non-existent key
         fake_token = secrets.token_urlsafe(12)
         response = await client.delete(
-            f"/auth/api/admin/orgs/{test_org.uuid}/users/{test_user.uuid}/sessions/{fake_token}",
+            f"/auth/api/admin/users/{test_user.uuid}/sessions/{fake_token}",
             headers={**auth_headers(session_token), "Host": "localhost:4401"},
         )
         assert response.status_code == 404
@@ -1550,7 +1678,7 @@ class TestOrgAdminAuthExceptions:
     ):
         """Regular user (not org admin) trying to create reset link should get 403."""
         response = await client.post(
-            f"/auth/api/admin/orgs/{test_org.uuid}/users/{test_user.uuid}/create-link",
+            f"/auth/api/admin/users/{test_user.uuid}/create-link",
             headers={**auth_headers(regular_session_token), "Host": "localhost:4401"},
         )
         assert response.status_code == 403
@@ -1565,7 +1693,7 @@ class TestOrgAdminAuthExceptions:
     ):
         """Regular user trying to get user details should get 403."""
         response = await client.get(
-            f"/auth/api/admin/orgs/{test_org.uuid}/users/{test_user.uuid}",
+            f"/auth/api/admin/users/{test_user.uuid}",
             headers={**auth_headers(regular_session_token), "Host": "localhost:4401"},
         )
         assert response.status_code == 403
@@ -1580,7 +1708,7 @@ class TestOrgAdminAuthExceptions:
     ):
         """Regular user trying to update display name should get 403."""
         response = await client.patch(
-            f"/auth/api/admin/orgs/{test_org.uuid}/users/{test_user.uuid}/display-name",
+            f"/auth/api/admin/users/{test_user.uuid}/display-name",
             json={"display_name": "New Name"},
             headers={**auth_headers(regular_session_token), "Host": "localhost:4401"},
         )
@@ -1597,7 +1725,7 @@ class TestOrgAdminAuthExceptions:
     ):
         """Regular user trying to delete credential should get 403."""
         response = await client.delete(
-            f"/auth/api/admin/orgs/{test_org.uuid}/users/{test_user.uuid}/credentials/{test_credential.uuid}",
+            f"/auth/api/admin/users/{test_user.uuid}/credentials/{test_credential.uuid}",
             headers={**auth_headers(regular_session_token), "Host": "localhost:4401"},
         )
         assert response.status_code == 403
@@ -1612,7 +1740,7 @@ class TestOrgAdminAuthExceptions:
     ):
         """Regular user trying to delete session should get 403."""
         response = await client.delete(
-            f"/auth/api/admin/orgs/{test_org.uuid}/users/{test_user.uuid}/sessions/some-session",
+            f"/auth/api/admin/users/{test_user.uuid}/sessions/some-session",
             headers={**auth_headers(regular_session_token), "Host": "localhost:4401"},
         )
         assert response.status_code == 403

tests/test_api.py

@@ -526,7 +526,7 @@ class TestValidateSessionRefresh:
         token = create_session(
             user_uuid=test_user.uuid,
             credential_uuid=test_credential.uuid,
-            host="localhost:4401",
+            host="localhost",
             ip="127.0.0.1",
             user_agent="pytest",
             expiry=old_expiry,