diff --git a/eslint-rules/require-security-check.js b/eslint-rules/require-security-check.js
new file mode 100644
index 0000000000..d6462eecf8
--- /dev/null
+++ b/eslint-rules/require-security-check.js
@@ -0,0 +1,208 @@
+import { ESLintUtils } from '@typescript-eslint/utils';
+// Walk the AST to find a node that matches the callback, up to maxDepth levels deep
+// This is a depth-first search and could be improved
+function walkFind(node, callback, maxDepth = 10) {
+    if (maxDepth <= 0)
+        return null;
+    if (node && typeof node !== 'object')
+        return null;
+    if (callback(node))
+        return node;
+    for (const key in node) {
+        if (key === 'parent')
+            continue;
+        const val = node[key];
+        if (Array.isArray(val)) {
+            for (const child of val) {
+                const result = walkFind(child, callback, maxDepth - 1);
+                if (result)
+                    return result;
+            }
+        }
+        else {
+            const result = walkFind(val, callback, maxDepth - 1);
+            if (result)
+                return result;
+        }
+    }
+    return null;
+}
+function blockStatementIncludesSecurityCall(block) {
+    const nodeIsSecurityCall = (node) => {
+        // Valid check if the node is a CallExpression of the form:
+        // *.locals.security.require*()
+        // or locals.security.require*()
+        if (node?.type === 'CallExpression' && node.callee.type === 'MemberExpression') {
+            const obj = node.callee.object;
+            const prop = node.callee.property;
+            if (obj.type === 'MemberExpression' &&
+                // object is either *.locals or just locals
+                ((obj.object.type === 'MemberExpression' &&
+                    obj.object.property.type === 'Identifier' &&
+                    obj.object.property.name === 'locals') ||
+                    (obj.object.type === 'Identifier' && obj.object.name === 'locals')) &&
+                // locals.security
+                obj.property.type === 'Identifier' &&
+                obj.property.name === 'security' &&
+                prop.type === 'Identifier' &&
+                prop.name.startsWith('require') // ex. requireAuthenticated, requireRole, etc.
+            ) {
+                return true;
+            }
+        }
+        return false;
+    };
+    return !!block.body.find((n) => !!walkFind(n, nodeIsSecurityCall, 6));
+}
+export default ESLintUtils.RuleCreator(() => '')({
+    name: 'require-security-check',
+    meta: {
+        type: 'problem',
+        hasSuggestions: true,
+        docs: {
+            description: 'Require calling event.locals.security.* in every server load/action'
+        },
+        schema: [],
+        messages: {
+            missingSecurityCheck: 'Missing call to requireAuthenticated() or similar security check. This must be of the form locals.security.require*()',
+            unexpectedFunction: 'Unexpected export function type {{type}}. Expected ArrowFunctionExpression, FunctionExpression, TSSatisfiesExpression or ObjectExpression.',
+            suggestAuthCall: 'Require authentication by adding "event.locals.security.requireAuthenticated();" to the start of the function body.',
+            suggestNoAuthCall: 'Mark this function as not requiring any auth by adding "event.locals.security.requireNothing();" to the start of the function body.'
+        }
+    },
+    defaultOptions: [],
+    create(context) {
+        return {
+            ExportNamedDeclaration(node) {
+                // Application of this rule is limited to:
+                // export const load = async (event) => { ... }
+                // export const actions = { default: async (event) => { ... } }
+                // export function load(event) { ... }
+                // export POST/GET/PUT/etc. function for endpoints in +server.ts files
+                // Only check .server.ts and +server.ts files
+                if (!context.filename.endsWith('.server.ts') && !context.filename.endsWith('+server.ts'))
+                    return;
+                // Find the function we are interested in
+                let functionExport;
+                // load or actions in .server.ts files
+                if (context.filename.endsWith('.server.ts') && node.declaration) {
+                    if (node.declaration.type === 'FunctionDeclaration') {
+                        if (node.declaration.id?.name === 'load') {
+                            functionExport = node.declaration;
+                        }
+                    }
+                    else {
+                        functionExport = node.declaration.declarations?.find((decl) => {
+                            return (decl.id.type === 'Identifier' &&
+                                (decl.id.name === 'load' || decl.id.name === 'actions'));
+                        });
+                    }
+                    // endpoint functions in +server.ts files
+                }
+                else if (context.filename.endsWith('+server.ts') && node.declaration) {
+                    if (node.declaration.type === 'FunctionDeclaration') {
+                        // export function POST/GET/PUT/etc. ...
+                        if (node.declaration.id &&
+                            ['POST', 'GET', 'PUT', 'DELETE', 'PATCH'].includes(node.declaration.id.name)) {
+                            functionExport = node.declaration;
+                        }
+                    }
+                    else {
+                        functionExport = node.declaration.declarations?.find((decl) => {
+                            return (decl.id.type === 'Identifier' &&
+                                ['POST', 'GET', 'PUT', 'DELETE', 'PATCH'].includes(decl.id.name));
+                        });
+                    }
+                }
+                // This export is not a load, actions, or endpoint function
+                if (!functionExport)
+                    return;
+                const blockStatements = [];
+                if (functionExport.id.name === 'actions') {
+                    // This is the actions object, so find all the functions in its properties
+                    const objectExpression = functionExport.type === 'VariableDeclarator'
+                        ? walkFind(functionExport.init, (n) => n.type === 'ObjectExpression', 4)
+                        : null;
+                    if (functionExport.type !== 'VariableDeclarator' || !objectExpression) {
+                        context.report({
+                            node: node.declaration,
+                            data: { type: functionExport.type },
+                            messageId: 'unexpectedFunction'
+                        });
+                        return;
+                    }
+                    const properties = objectExpression.properties.filter((p) => p.type === 'Property');
+                    for (const prop of properties) {
+                        if (prop.value.type === 'ArrowFunctionExpression' ||
+                            prop.value.type === 'FunctionExpression') {
+                            // There should be a block statement (function body) within a couple levels
+                            const block = walkFind(prop.value, (n) => n.type === 'BlockStatement', 4);
+                            if (block)
+                                blockStatements.push(block);
+                        }
+                        else {
+                            context.report({
+                                node: prop,
+                                data: { type: prop.value.type },
+                                messageId: 'unexpectedFunction'
+                            });
+                        }
+                    }
+                }
+                else if ((!functionExport?.init ||
+                    !['ArrowFunctionExpression', 'FunctionExpression', 'TSSatisfiesExpression'].includes(functionExport.init.type)) &&
+                    node.declaration.type !== 'FunctionDeclaration') {
+                    // Unexpected type of export
+                    context.report({
+                        node: node.declaration,
+                        data: { type: functionExport.init?.type },
+                        messageId: 'unexpectedFunction'
+                    });
+                    return;
+                }
+                else {
+                    // This is a single function (load or endpoint), so find its body
+                    // There should be a block statement (function body) within a couple levels
+                    const blockStatement = walkFind(functionExport.init ||
+                        functionExport, (n) => n.type === 'BlockStatement', 4);
+                    if (blockStatement)
+                        blockStatements.push(blockStatement);
+                    else {
+                        context.report({
+                            node: node.declaration,
+                            data: { type: functionExport.type },
+                            messageId: 'unexpectedFunction'
+                        });
+                        return;
+                    }
+                }
+                blockStatements.forEach((bs) => {
+                    if (!blockStatementIncludesSecurityCall(bs)) {
+                        // No security check found in this function's block statement
+                        // Flag an error on the parent node of the block statement (the whole function)
+                        context.report({
+                            node: bs.parent,
+                            messageId: 'missingSecurityCheck',
+                            suggest: [
+                                {
+                                    messageId: 'suggestAuthCall',
+                                    fix: (fixer) => fixer.insertTextBefore(bs.body[0] || bs, 'event.locals.security.requireAuthenticated();\n' +
+                                        (functionExport.id.name === 'actions'
+                                            ? '    '
+                                            : '  '))
+                                },
+                                {
+                                    messageId: 'suggestNoAuthCall',
+                                    fix: (fixer) => fixer.insertTextBefore(bs.body[0] || bs, 'event.locals.security.requireNothing();\n' +
+                                        (functionExport.id.name === 'actions'
+                                            ? '    '
+                                            : '  '))
+                                }
+                            ]
+                        });
+                    }
+                });
+            }
+        };
+    }
+});
diff --git a/eslint-rules/require-security-check.ts b/eslint-rules/require-security-check.ts
new file mode 100644
index 0000000000..8b13033100
--- /dev/null
+++ b/eslint-rules/require-security-check.ts
@@ -0,0 +1,266 @@
+/**
+ * ESLint rule to require a security check in every server load/action or
+ * endpoint function. This is a sanity check to avoid forgetting to add a
+ * security check on endpoints that return data or perform actions. It
+ * looks for calls to locals.security.require*() in the function body of
+ * exported load and actions in +page.server.ts/+layout.server.ts files,
+ * or POST/GET/PUT/etc. functions in +server.ts files.
+ *
+ * IT IS NOT FOOLPROOF.
+ * IT IS POSSIBLE TO BYPASS THIS CHECK (but hopefully not accidentally).
+ *
+ * After updating this file, run `tsc` from the `eslint-rules` directory to
+ * compile it to JavaScript (which is checked in).
+ */
+import type { TSESTree } from '@typescript-eslint/utils';
+import { ESLintUtils } from '@typescript-eslint/utils';
+
+// Walk the AST to find a node that matches the callback, up to maxDepth levels deep
+// This is a depth-first search and could be improved
+function walkFind(
+  node: TSESTree.Node | undefined | null,
+  callback: (node: TSESTree.Node) => boolean,
+  maxDepth = 10
+): TSESTree.Node | null {
+  if (maxDepth <= 0) return null;
+  if (node && typeof node !== 'object') return null;
+  if (callback(node)) return node;
+  for (const key in node) {
+    if (key === 'parent') continue;
+    const val = node[key];
+    if (Array.isArray(val)) {
+      for (const child of val) {
+        const result = walkFind(child, callback, maxDepth - 1);
+        if (result) return result;
+      }
+    } else {
+      const result = walkFind(val, callback, maxDepth - 1);
+      if (result) return result;
+    }
+  }
+  return null;
+}
+
+function blockStatementIncludesSecurityCall(block: TSESTree.BlockStatement): boolean {
+  const nodeIsSecurityCall = (node: TSESTree.Node) => {
+    // Valid check if the node is a CallExpression of the form:
+    // *.locals.security.require*()
+    // or locals.security.require*()
+    if (node?.type === 'CallExpression' && node.callee.type === 'MemberExpression') {
+      const obj = node.callee.object;
+      const prop = node.callee.property;
+      if (
+        obj.type === 'MemberExpression' &&
+        // object is either *.locals or just locals
+        ((obj.object.type === 'MemberExpression' &&
+          obj.object.property.type === 'Identifier' &&
+          obj.object.property.name === 'locals') ||
+          (obj.object.type === 'Identifier' && obj.object.name === 'locals')) &&
+        // locals.security
+        obj.property.type === 'Identifier' &&
+        obj.property.name === 'security' &&
+        prop.type === 'Identifier' &&
+        prop.name.startsWith('require') // ex. requireAuthenticated, requireRole, etc.
+      ) {
+        return true;
+      }
+    }
+    return false;
+  };
+
+  return !!block.body.find((n) => !!walkFind(n, nodeIsSecurityCall, 6));
+}
+
+export default ESLintUtils.RuleCreator(() => '')({
+  name: 'require-security-check',
+  meta: {
+    type: 'problem',
+    hasSuggestions: true,
+    docs: {
+      description: 'Require calling event.locals.security.* in every server load/action'
+    },
+    schema: [],
+    messages: {
+      missingSecurityCheck:
+        'Missing call to requireAuthenticated() or similar security check. This must be of the form locals.security.require*()',
+      unexpectedFunction:
+        'Unexpected export function type {{type}}. Expected ArrowFunctionExpression, FunctionExpression, TSSatisfiesExpression or ObjectExpression.',
+      suggestAuthCall:
+        'Require authentication by adding "event.locals.security.requireAuthenticated();" to the start of the function body.',
+      suggestNoAuthCall:
+        'Mark this function as not requiring any auth by adding "event.locals.security.requireNothing();" to the start of the function body.'
+    }
+  },
+  defaultOptions: [],
+  create(context) {
+    return {
+      ExportNamedDeclaration(node) {
+        // Application of this rule is limited to:
+        // export const load = async (event) => { ... }
+        // export const actions = { default: async (event) => { ... } }
+        // export function load(event) { ... }
+        // export POST/GET/PUT/etc. function for endpoints in +server.ts files
+
+        // Only check .server.ts and +server.ts files
+        if (!context.filename.endsWith('.server.ts') && !context.filename.endsWith('+server.ts'))
+          return;
+
+        // Find the function we are interested in
+        let functionExport:
+          | TSESTree.VariableDeclaratorMaybeInit
+          | TSESTree.VariableDeclaratorDefiniteAssignment
+          | TSESTree.FunctionDeclaration;
+
+        // load or actions in .server.ts files
+        if (context.filename.endsWith('.server.ts') && node.declaration) {
+          if (node.declaration.type === 'FunctionDeclaration') {
+            if (node.declaration.id?.name === 'load') {
+              functionExport = node.declaration;
+            }
+          } else {
+            functionExport = (node.declaration as TSESTree.VariableDeclaration).declarations?.find(
+              (decl) => {
+                return (
+                  decl.id.type === 'Identifier' &&
+                  (decl.id.name === 'load' || decl.id.name === 'actions')
+                );
+              }
+            );
+          }
+          // endpoint functions in +server.ts files
+        } else if (context.filename.endsWith('+server.ts') && node.declaration) {
+          if (node.declaration.type === 'FunctionDeclaration') {
+            // export function POST/GET/PUT/etc. ...
+            if (
+              node.declaration.id &&
+              ['POST', 'GET', 'PUT', 'DELETE', 'PATCH'].includes(node.declaration.id.name)
+            ) {
+              functionExport = node.declaration;
+            }
+          } else {
+            functionExport = (node.declaration as TSESTree.VariableDeclaration).declarations?.find(
+              (decl) => {
+                return (
+                  decl.id.type === 'Identifier' &&
+                  ['POST', 'GET', 'PUT', 'DELETE', 'PATCH'].includes(decl.id.name)
+                );
+              }
+            );
+          }
+        }
+        // This export is not a load, actions, or endpoint function
+        if (!functionExport) return;
+
+        const blockStatements: TSESTree.BlockStatement[] = [];
+        if ((functionExport.id as TSESTree.Identifier).name === 'actions') {
+          // This is the actions object, so find all the functions in its properties
+          const objectExpression: TSESTree.ObjectExpression =
+            functionExport.type === 'VariableDeclarator'
+              ? (walkFind(
+                  functionExport.init,
+                  (n) => n.type === 'ObjectExpression',
+                  4
+                ) as TSESTree.ObjectExpression)
+              : null;
+          if (functionExport.type !== 'VariableDeclarator' || !objectExpression) {
+            context.report({
+              node: node.declaration,
+              data: { type: functionExport.type },
+              messageId: 'unexpectedFunction'
+            });
+            return;
+          }
+          const properties = objectExpression.properties.filter(
+            (p): p is TSESTree.Property => p.type === 'Property'
+          );
+          for (const prop of properties) {
+            if (
+              prop.value.type === 'ArrowFunctionExpression' ||
+              prop.value.type === 'FunctionExpression'
+            ) {
+              // There should be a block statement (function body) within a couple levels
+              const block = walkFind(
+                prop.value,
+                (n) => n.type === 'BlockStatement',
+                4
+              ) as TSESTree.BlockStatement | null;
+              if (block) blockStatements.push(block);
+            } else {
+              context.report({
+                node: prop,
+                data: { type: prop.value.type },
+                messageId: 'unexpectedFunction'
+              });
+            }
+          }
+        } else if (
+          (!(functionExport as TSESTree.VariableDeclaratorMaybeInit)?.init ||
+            !['ArrowFunctionExpression', 'FunctionExpression', 'TSSatisfiesExpression'].includes(
+              (functionExport as TSESTree.VariableDeclaratorMaybeInit).init.type
+            )) &&
+          node.declaration.type !== 'FunctionDeclaration'
+        ) {
+          // Unexpected type of export
+          context.report({
+            node: node.declaration,
+            data: { type: (functionExport as TSESTree.VariableDeclaratorMaybeInit).init?.type },
+            messageId: 'unexpectedFunction'
+          });
+          return;
+        } else {
+          // This is a single function (load or endpoint), so find its body
+          // There should be a block statement (function body) within a couple levels
+          const blockStatement = walkFind(
+            (functionExport as TSESTree.VariableDeclaratorMaybeInit).init ||
+              (functionExport as TSESTree.FunctionDeclaration),
+            (n) => n.type === 'BlockStatement',
+            4
+          ) as TSESTree.BlockStatement;
+          if (blockStatement) blockStatements.push(blockStatement);
+          else {
+            context.report({
+              node: node.declaration,
+              data: { type: functionExport.type },
+              messageId: 'unexpectedFunction'
+            });
+            return;
+          }
+        }
+        blockStatements.forEach((bs) => {
+          if (!blockStatementIncludesSecurityCall(bs)) {
+            // No security check found in this function's block statement
+            // Flag an error on the parent node of the block statement (the whole function)
+            context.report({
+              node: bs.parent,
+              messageId: 'missingSecurityCheck',
+              suggest: [
+                {
+                  messageId: 'suggestAuthCall',
+                  fix: (fixer) =>
+                    fixer.insertTextBefore(
+                      bs.body[0] || bs,
+                      'event.locals.security.requireAuthenticated();\n' +
+                        ((functionExport.id as TSESTree.Identifier).name === 'actions'
+                          ? '    '
+                          : '  ')
+                    )
+                },
+                {
+                  messageId: 'suggestNoAuthCall',
+                  fix: (fixer) =>
+                    fixer.insertTextBefore(
+                      bs.body[0] || bs,
+                      'event.locals.security.requireNothing();\n' +
+                        ((functionExport.id as TSESTree.Identifier).name === 'actions'
+                          ? '    '
+                          : '  ')
+                    )
+                }
+              ]
+            });
+          }
+        });
+      }
+    };
+  }
+});
diff --git a/eslint-rules/tsconfig.json b/eslint-rules/tsconfig.json
new file mode 100644
index 0000000000..7789009940
--- /dev/null
+++ b/eslint-rules/tsconfig.json
@@ -0,0 +1,8 @@
+{
+"compilerOptions": {
+    "target": "esnext",
+    "module": "esnext",
+    "moduleResolution": "node",
+    "skipLibCheck": true
+}
+}
\ No newline at end of file
diff --git a/eslint.config.js b/eslint.config.js
index 13b669f4f6..0e5a6692d5 100644
--- a/eslint.config.js
+++ b/eslint.config.js
@@ -7,6 +7,7 @@ import svelte from 'eslint-plugin-svelte';
 import globals from 'globals';
 import ts from 'typescript-eslint';
 import svelteConfig from './svelte.config.js';
+import requireSecurityCheck from './eslint-rules/require-security-check.js';
 
 export default ts.config(
   js.configs.recommended,
@@ -22,6 +23,13 @@ export default ts.config(
         ...globals.browser,
         ...globals.node
       }
+    },
+    plugins: {
+      'sveltekit-sec': {
+        rules: {
+          "require-security-check": requireSecurityCheck
+        }
+      }
     }
   },
   {
@@ -60,6 +68,7 @@ export default ts.config(
         }
       ],
       'import/no-unresolved': 'off',
+      'sveltekit-sec/require-security-check': 'error'
     }
   },
   globalIgnores([
diff --git a/package-lock.json b/package-lock.json
index f8fcb55467..53de3e2d34 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -43,8 +43,9 @@
         "@types/express": "^5.0.0",
         "@types/node": "^22.10.10",
         "@types/nodemailer": "^7.0.1",
-        "@typescript-eslint/eslint-plugin": "^8.21.0",
-        "@typescript-eslint/parser": "^8.21.0",
+        "@typescript-eslint/eslint-plugin": "^8.44.0",
+        "@typescript-eslint/parser": "^8.44.0",
+        "@typescript-eslint/utils": "^8.44.0",
         "@vvo/tzdb": "^6.159.0",
         "@zerodevx/svelte-toast": "^0.9.6",
         "bullmq": "^5.52.0",
@@ -78,7 +79,7 @@
         "ts-node": "^10.9.2",
         "tslib": "^2.8.1",
         "typescript": "^5.7.3",
-        "typescript-eslint": "^8.37.0",
+        "typescript-eslint": "^8.44.0",
         "valibot": "^1.0.0-beta.14",
         "vite": "^6.0.11",
         "vitest": "^3.0.4",
@@ -4663,17 +4664,17 @@
       }
     },
     "node_modules/@typescript-eslint/eslint-plugin": {
-      "version": "8.37.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.37.0.tgz",
-      "integrity": "sha512-jsuVWeIkb6ggzB+wPCsR4e6loj+rM72ohW6IBn2C+5NCvfUVY8s33iFPySSVXqtm5Hu29Ne/9bnA0JmyLmgenA==",
+      "version": "8.44.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.44.0.tgz",
+      "integrity": "sha512-EGDAOGX+uwwekcS0iyxVDmRV9HX6FLSM5kzrAToLTsr9OWCIKG/y3lQheCq18yZ5Xh78rRKJiEpP0ZaCs4ryOQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@eslint-community/regexpp": "^4.10.0",
-        "@typescript-eslint/scope-manager": "8.37.0",
-        "@typescript-eslint/type-utils": "8.37.0",
-        "@typescript-eslint/utils": "8.37.0",
-        "@typescript-eslint/visitor-keys": "8.37.0",
+        "@typescript-eslint/scope-manager": "8.44.0",
+        "@typescript-eslint/type-utils": "8.44.0",
+        "@typescript-eslint/utils": "8.44.0",
+        "@typescript-eslint/visitor-keys": "8.44.0",
         "graphemer": "^1.4.0",
         "ignore": "^7.0.0",
         "natural-compare": "^1.4.0",
@@ -4687,9 +4688,9 @@
         "url": "https://opencollective.com/typescript-eslint"
       },
       "peerDependencies": {
-        "@typescript-eslint/parser": "^8.37.0",
+        "@typescript-eslint/parser": "^8.44.0",
         "eslint": "^8.57.0 || ^9.0.0",
-        "typescript": ">=4.8.4 <5.9.0"
+        "typescript": ">=4.8.4 <6.0.0"
       }
     },
     "node_modules/@typescript-eslint/eslint-plugin/node_modules/ignore": {
@@ -4703,16 +4704,16 @@
       }
     },
     "node_modules/@typescript-eslint/parser": {
-      "version": "8.37.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.37.0.tgz",
-      "integrity": "sha512-kVIaQE9vrN9RLCQMQ3iyRlVJpTiDUY6woHGb30JDkfJErqrQEmtdWH3gV0PBAfGZgQXoqzXOO0T3K6ioApbbAA==",
+      "version": "8.44.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.44.0.tgz",
+      "integrity": "sha512-VGMpFQGUQWYT9LfnPcX8ouFojyrZ/2w3K5BucvxL/spdNehccKhB4jUyB1yBCXpr2XFm0jkECxgrpXBW2ipoAw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/scope-manager": "8.37.0",
-        "@typescript-eslint/types": "8.37.0",
-        "@typescript-eslint/typescript-estree": "8.37.0",
-        "@typescript-eslint/visitor-keys": "8.37.0",
+        "@typescript-eslint/scope-manager": "8.44.0",
+        "@typescript-eslint/types": "8.44.0",
+        "@typescript-eslint/typescript-estree": "8.44.0",
+        "@typescript-eslint/visitor-keys": "8.44.0",
         "debug": "^4.3.4"
       },
       "engines": {
@@ -4724,18 +4725,18 @@
       },
       "peerDependencies": {
         "eslint": "^8.57.0 || ^9.0.0",
-        "typescript": ">=4.8.4 <5.9.0"
+        "typescript": ">=4.8.4 <6.0.0"
       }
     },
     "node_modules/@typescript-eslint/project-service": {
-      "version": "8.37.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.37.0.tgz",
-      "integrity": "sha512-BIUXYsbkl5A1aJDdYJCBAo8rCEbAvdquQ8AnLb6z5Lp1u3x5PNgSSx9A/zqYc++Xnr/0DVpls8iQ2cJs/izTXA==",
+      "version": "8.44.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.44.0.tgz",
+      "integrity": "sha512-ZeaGNraRsq10GuEohKTo4295Z/SuGcSq2LzfGlqiuEvfArzo/VRrT0ZaJsVPuKZ55lVbNk8U6FcL+ZMH8CoyVA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/tsconfig-utils": "^8.37.0",
-        "@typescript-eslint/types": "^8.37.0",
+        "@typescript-eslint/tsconfig-utils": "^8.44.0",
+        "@typescript-eslint/types": "^8.44.0",
         "debug": "^4.3.4"
       },
       "engines": {
@@ -4746,18 +4747,18 @@
         "url": "https://opencollective.com/typescript-eslint"
       },
       "peerDependencies": {
-        "typescript": ">=4.8.4 <5.9.0"
+        "typescript": ">=4.8.4 <6.0.0"
       }
     },
     "node_modules/@typescript-eslint/scope-manager": {
-      "version": "8.37.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.37.0.tgz",
-      "integrity": "sha512-0vGq0yiU1gbjKob2q691ybTg9JX6ShiVXAAfm2jGf3q0hdP6/BruaFjL/ManAR/lj05AvYCH+5bbVo0VtzmjOA==",
+      "version": "8.44.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.44.0.tgz",
+      "integrity": "sha512-87Jv3E+al8wpD+rIdVJm/ItDBe/Im09zXIjFoipOjr5gHUhJmTzfFLuTJ/nPTMc2Srsroy4IBXwcTCHyRR7KzA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.37.0",
-        "@typescript-eslint/visitor-keys": "8.37.0"
+        "@typescript-eslint/types": "8.44.0",
+        "@typescript-eslint/visitor-keys": "8.44.0"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -4768,9 +4769,9 @@
       }
     },
     "node_modules/@typescript-eslint/tsconfig-utils": {
-      "version": "8.37.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.37.0.tgz",
-      "integrity": "sha512-1/YHvAVTimMM9mmlPvTec9NP4bobA1RkDbMydxG8omqwJJLEW/Iy2C4adsAESIXU3WGLXFHSZUU+C9EoFWl4Zg==",
+      "version": "8.44.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.44.0.tgz",
+      "integrity": "sha512-x5Y0+AuEPqAInc6yd0n5DAcvtoQ/vyaGwuX5HE9n6qAefk1GaedqrLQF8kQGylLUb9pnZyLf+iEiL9fr8APDtQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -4781,19 +4782,19 @@
         "url": "https://opencollective.com/typescript-eslint"
       },
       "peerDependencies": {
-        "typescript": ">=4.8.4 <5.9.0"
+        "typescript": ">=4.8.4 <6.0.0"
       }
     },
     "node_modules/@typescript-eslint/type-utils": {
-      "version": "8.37.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.37.0.tgz",
-      "integrity": "sha512-SPkXWIkVZxhgwSwVq9rqj/4VFo7MnWwVaRNznfQDc/xPYHjXnPfLWn+4L6FF1cAz6e7dsqBeMawgl7QjUMj4Ow==",
+      "version": "8.44.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.44.0.tgz",
+      "integrity": "sha512-9cwsoSxJ8Sak67Be/hD2RNt/fsqmWnNE1iHohG8lxqLSNY8xNfyY7wloo5zpW3Nu9hxVgURevqfcH6vvKCt6yg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.37.0",
-        "@typescript-eslint/typescript-estree": "8.37.0",
-        "@typescript-eslint/utils": "8.37.0",
+        "@typescript-eslint/types": "8.44.0",
+        "@typescript-eslint/typescript-estree": "8.44.0",
+        "@typescript-eslint/utils": "8.44.0",
         "debug": "^4.3.4",
         "ts-api-utils": "^2.1.0"
       },
@@ -4806,13 +4807,13 @@
       },
       "peerDependencies": {
         "eslint": "^8.57.0 || ^9.0.0",
-        "typescript": ">=4.8.4 <5.9.0"
+        "typescript": ">=4.8.4 <6.0.0"
       }
     },
     "node_modules/@typescript-eslint/types": {
-      "version": "8.37.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.37.0.tgz",
-      "integrity": "sha512-ax0nv7PUF9NOVPs+lmQ7yIE7IQmAf8LGcXbMvHX5Gm+YJUYNAl340XkGnrimxZ0elXyoQJuN5sbg6C4evKA4SQ==",
+      "version": "8.44.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.44.0.tgz",
+      "integrity": "sha512-ZSl2efn44VsYM0MfDQe68RKzBz75NPgLQXuGypmym6QVOWL5kegTZuZ02xRAT9T+onqvM6T8CdQk0OwYMB6ZvA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -4824,16 +4825,16 @@
       }
     },
     "node_modules/@typescript-eslint/typescript-estree": {
-      "version": "8.37.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.37.0.tgz",
-      "integrity": "sha512-zuWDMDuzMRbQOM+bHyU4/slw27bAUEcKSKKs3hcv2aNnc/tvE/h7w60dwVw8vnal2Pub6RT1T7BI8tFZ1fE+yg==",
+      "version": "8.44.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.44.0.tgz",
+      "integrity": "sha512-lqNj6SgnGcQZwL4/SBJ3xdPEfcBuhCG8zdcwCPgYcmiPLgokiNDKlbPzCwEwu7m279J/lBYWtDYL+87OEfn8Jw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/project-service": "8.37.0",
-        "@typescript-eslint/tsconfig-utils": "8.37.0",
-        "@typescript-eslint/types": "8.37.0",
-        "@typescript-eslint/visitor-keys": "8.37.0",
+        "@typescript-eslint/project-service": "8.44.0",
+        "@typescript-eslint/tsconfig-utils": "8.44.0",
+        "@typescript-eslint/types": "8.44.0",
+        "@typescript-eslint/visitor-keys": "8.44.0",
         "debug": "^4.3.4",
         "fast-glob": "^3.3.2",
         "is-glob": "^4.0.3",
@@ -4849,20 +4850,20 @@
         "url": "https://opencollective.com/typescript-eslint"
       },
       "peerDependencies": {
-        "typescript": ">=4.8.4 <5.9.0"
+        "typescript": ">=4.8.4 <6.0.0"
       }
     },
     "node_modules/@typescript-eslint/utils": {
-      "version": "8.37.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.37.0.tgz",
-      "integrity": "sha512-TSFvkIW6gGjN2p6zbXo20FzCABbyUAuq6tBvNRGsKdsSQ6a7rnV6ADfZ7f4iI3lIiXc4F4WWvtUfDw9CJ9pO5A==",
+      "version": "8.44.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.44.0.tgz",
+      "integrity": "sha512-nktOlVcg3ALo0mYlV+L7sWUD58KG4CMj1rb2HUVOO4aL3K/6wcD+NERqd0rrA5Vg06b42YhF6cFxeixsp9Riqg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@eslint-community/eslint-utils": "^4.7.0",
-        "@typescript-eslint/scope-manager": "8.37.0",
-        "@typescript-eslint/types": "8.37.0",
-        "@typescript-eslint/typescript-estree": "8.37.0"
+        "@typescript-eslint/scope-manager": "8.44.0",
+        "@typescript-eslint/types": "8.44.0",
+        "@typescript-eslint/typescript-estree": "8.44.0"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -4873,17 +4874,17 @@
       },
       "peerDependencies": {
         "eslint": "^8.57.0 || ^9.0.0",
-        "typescript": ">=4.8.4 <5.9.0"
+        "typescript": ">=4.8.4 <6.0.0"
       }
     },
     "node_modules/@typescript-eslint/visitor-keys": {
-      "version": "8.37.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.37.0.tgz",
-      "integrity": "sha512-YzfhzcTnZVPiLfP/oeKtDp2evwvHLMe0LOy7oe+hb9KKIumLNohYS9Hgp1ifwpu42YWxhZE8yieggz6JpqO/1w==",
+      "version": "8.44.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.44.0.tgz",
+      "integrity": "sha512-zaz9u8EJ4GBmnehlrpoKvj/E3dNbuQ7q0ucyZImm3cLqJ8INTc970B1qEqDX/Rzq65r3TvVTN7kHWPBoyW7DWw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.37.0",
+        "@typescript-eslint/types": "8.44.0",
         "eslint-visitor-keys": "^4.2.1"
       },
       "engines": {
@@ -12222,16 +12223,16 @@
       }
     },
     "node_modules/typescript-eslint": {
-      "version": "8.37.0",
-      "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.37.0.tgz",
-      "integrity": "sha512-TnbEjzkE9EmcO0Q2zM+GE8NQLItNAJpMmED1BdgoBMYNdqMhzlbqfdSwiRlAzEK2pA9UzVW0gzaaIzXWg2BjfA==",
+      "version": "8.44.0",
+      "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.44.0.tgz",
+      "integrity": "sha512-ib7mCkYuIzYonCq9XWF5XNw+fkj2zg629PSa9KNIQ47RXFF763S5BIX4wqz1+FLPogTZoiw8KmCiRPRa8bL3qw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/eslint-plugin": "8.37.0",
-        "@typescript-eslint/parser": "8.37.0",
-        "@typescript-eslint/typescript-estree": "8.37.0",
-        "@typescript-eslint/utils": "8.37.0"
+        "@typescript-eslint/eslint-plugin": "8.44.0",
+        "@typescript-eslint/parser": "8.44.0",
+        "@typescript-eslint/typescript-estree": "8.44.0",
+        "@typescript-eslint/utils": "8.44.0"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -12242,7 +12243,7 @@
       },
       "peerDependencies": {
         "eslint": "^8.57.0 || ^9.0.0",
-        "typescript": ">=4.8.4 <5.9.0"
+        "typescript": ">=4.8.4 <6.0.0"
       }
     },
     "node_modules/unbox-primitive": {
diff --git a/package.json b/package.json
index 3c9e1214cd..51a247d904 100644
--- a/package.json
+++ b/package.json
@@ -55,8 +55,9 @@
     "@types/express": "^5.0.0",
     "@types/node": "^22.10.10",
     "@types/nodemailer": "^7.0.1",
-    "@typescript-eslint/eslint-plugin": "^8.21.0",
-    "@typescript-eslint/parser": "^8.21.0",
+    "@typescript-eslint/eslint-plugin": "^8.44.0",
+    "@typescript-eslint/parser": "^8.44.0",
+    "@typescript-eslint/utils": "^8.44.0",
     "@vvo/tzdb": "^6.159.0",
     "@zerodevx/svelte-toast": "^0.9.6",
     "bullmq": "^5.52.0",
@@ -90,7 +91,7 @@
     "ts-node": "^10.9.2",
     "tslib": "^2.8.1",
     "typescript": "^5.7.3",
-    "typescript-eslint": "^8.37.0",
+    "typescript-eslint": "^8.44.0",
     "valibot": "^1.0.0-beta.14",
     "vite": "^6.0.11",
     "vitest": "^3.0.4",
diff --git a/src/app.d.ts b/src/app.d.ts
index 4e6667e94d..0c934c5d33 100644
--- a/src/app.d.ts
+++ b/src/app.d.ts
@@ -1,13 +1,54 @@
-import type { ParaglideLocals } from '@inlang/paraglide-sveltekit';
-import type { AvailableLanguageTag } from '../../lib/paraglide/runtime';
 // See https://kit.svelte.dev/docs/types#app
 // for information about these interfaces
+
+// Security class type because this file cannot import anything
 declare global {
+  interface SecurityLike {
+    userId: number;
+    roles: Map<number, number[]>;
+  }
+  class Security implements SecurityLike {
+    public readonly isSuperAdmin: boolean;
+    public readonly userId: number;
+    public readonly organizationMemberships: number[];
+    public readonly roles: Map<number, number[]>;
+    public readonly sessionForm: Session['user'];
+    requireAuthenticated(): void | never;
+    requireSuperAdmin(): this | never;
+    requireAdminOfOrg(organizationId: number): this | never;
+    requireAdminOfOrgIn(organizationIds: number[]): this | never;
+    requireAdminOfAny(): this | never;
+    requireHasRole(organizationId: number, roleId: number, orOrgAdmin?: boolean): this | never;
+    requireMemberOfOrg(organizationId: number): this | never;
+    requireMemberOfOrgOrSuperAdmin(organizationId: number): this | never;
+    requireProjectWriteAccess(
+      project?: { OwnerId: number; OrganizationId: number } | null
+    ): this | never;
+    requireProjectReadAccess(
+      userGroups: { GroupId: number }[],
+      project?: {
+        OwnerId: number;
+        OrganizationId: number;
+        GroupId: number;
+      } | null
+    ): this | never;
+    requireProjectClaimable(
+      userGroups: { GroupId: number }[],
+      project?: {
+        OwnerId: number;
+        OrganizationId: number;
+        GroupId: number;
+      }
+    ): this | never;
+    requireMemberOfAnyOrg(): this | never;
+    requireNothing(): this | never;
+  }
   namespace App {
     // interface Error {}
     interface Locals {
+      // This typing doesn't work, but we never use it
       paraglide: ParaglideLocals<AvailableLanguageTag>;
-      error?: number;
+      security: Security;
     }
     // interface PageData {}
     // interface Platform {}
diff --git a/src/auth.ts b/src/auth.ts
index eb629ced80..f390b64fd9 100644
--- a/src/auth.ts
+++ b/src/auth.ts
@@ -6,27 +6,21 @@ import {
 } from '@auth/sveltekit';
 import Auth0Provider from '@auth/sveltekit/providers/auth0';
 import { trace } from '@opentelemetry/api';
-import { type Handle, redirect } from '@sveltejs/kit';
+import { type Handle, error, redirect } from '@sveltejs/kit';
 import { env } from '$env/dynamic/private';
 import { checkInviteErrors } from '$lib/organizationInvites';
 import { localizeHref } from '$lib/paraglide/runtime';
-import type { RoleId } from '$lib/prisma';
-import { verifyCanEdit, verifyCanView } from '$lib/projects/server';
+import { RoleId } from '$lib/prisma';
 import { DatabaseReads, DatabaseWrites } from '$lib/server/database';
-import { adminOrgs } from '$lib/users/server';
-import { ServerStatus } from '$lib/utils';
-import { isAdmin, isAdminForOrg, isSuperAdmin } from '$lib/utils/roles';
 
 declare module '@auth/sveltekit' {
   interface Session {
-    user: {
+    user: DefaultSession['user'] & {
       userId: number;
-      /** [organizationId, RoleId][]*/
       roles: [number, RoleId][];
-    } & DefaultSession['user'];
+    };
   }
 }
-
 // Stupidly hacky way to get access to the request data from the auth callbacks
 // This is a global variable that is set in a separate hook handle
 let currentInviteToken: string | null = null;
@@ -90,6 +84,8 @@ const config: SvelteKitAuthConfig = {
         }
         throw new Error('Invalid state');
       } finally {
+        tokenStatus = null;
+        currentInviteToken = null;
         trace.getActiveSpan()?.addEvent('signIn callback completed', {
           'auth.signIn.profile': profile ? profile.email + ' - ' + profile.sub : 'unknown',
           'auth.signIn.tokenStatus': tokenStatus ?? 'null',
@@ -129,7 +125,7 @@ const config: SvelteKitAuthConfig = {
           UserId: token.userId as number
         }
       });
-      session.user.roles = userRoles.map((role) => [role.OrganizationId, role.RoleId]);
+      session.user.roles = userRoles.map(({ OrganizationId, RoleId }) => [OrganizationId, RoleId]);
       trace.getActiveSpan()?.addEvent('session callback completed', {
         'auth.session.userId': session.user.userId,
         'auth.session.roles': JSON.stringify(session.user.roles)
@@ -138,47 +134,214 @@ const config: SvelteKitAuthConfig = {
     }
   }
 };
-// Handles the /auth route, which is used to handle external auth0 authentication
-export const { handle: authRouteHandle, signIn, signOut } = SvelteKitAuth(config);
 
-export const checkUserExistsHandle: Handle = async ({ event, resolve }) => {
-  // If the user does not exist in the database, invalidate the login and redirect to prevent unauthorized access
-  // This can happen when the user is deleted from the database but still has a valid session.
-  // This should only happen when a superadmin manually deletes a user but is particularly annoying in development
-  // The user should also be redirected if they are not a member of any organizations
-  // Finally, the user should be redirected if they are locked
-  const userId = (await event.locals.auth())?.user.userId;
-  if (!userId) {
-    // User has no session at all; allow normal events
-    return resolve(event);
+export class Security {
+  public readonly isSuperAdmin;
+  public securityHandled = false;
+  public readonly sessionForm: Session['user'];
+  constructor(
+    public readonly event: Parameters<Handle>[0]['event'],
+    // Note these three CAN be null if the user is not authenticated
+    public readonly userId: number,
+    public readonly organizationMemberships: number[],
+    public readonly roles: Map<number, RoleId[]>
+  ) {
+    this.isSuperAdmin = roles?.values().some((r) => r.includes(RoleId.SuperAdmin)) ?? false;
+    this.sessionForm = {
+      userId: this.userId,
+      roles: [
+        ...(roles
+          ?.entries()
+          .map(([orgId, roleIds]) => roleIds.map((r) => [orgId, r]) as [number, RoleId][]) ?? [])
+      ].flat(1)
+    };
   }
-  const user = await DatabaseReads.users.findUnique({
-    where: {
-      Id: userId
-    },
-    include: {
-      OrganizationMemberships: true
+
+  requireAuthenticated() {
+    this.securityHandled = true;
+    if (!this.userId || !this.organizationMemberships || !this.roles) {
+      // Redirect to login
+      const originalUrl = this.event.url;
+      const returnTo = originalUrl.pathname + originalUrl.search;
+      throw redirect(302, localizeHref('/login?returnTo=' + encodeURIComponent(returnTo)));
     }
-  });
-  trace.getActiveSpan()?.addEvent('checkUserExistsHandle completed', {
-    'auth.checkUserExists.userId': userId,
-    'auth.checkUserExists.user': user ? user.Email + ' - ' + user.Id : 'null',
-    'auth.checkUserExists.user.OrganizationMemberships': user
-      ? JSON.stringify(user.OrganizationMemberships.map((m) => m.OrganizationId))
-      : 'null',
-    'auth.checkUserExists.user.IsLocked': user ? user.IsLocked.toString() : 'null'
-  });
-  if (!user || (user.OrganizationMemberships.length === 0 && !event.cookies.get('inviteToken'))) {
-    event.cookies.set('authjs.session-token', '', { path: '/' });
-    return redirect(302, localizeHref('/login/no-organization'));
   }
-  if (user.IsLocked) {
-    event.cookies.set('authjs.session-token', '', { path: '/' });
-    return redirect(302, localizeHref('/login/locked'));
+
+  requireSuperAdmin() {
+    this.requireAuthenticated();
+    if (!this.isSuperAdmin) error(403, 'User is not a super admin');
+    return this;
+  }
+
+  requireAdminOfOrgIn(organizationIds: number[]) {
+    this.requireAuthenticated();
+    if (
+      !this.isSuperAdmin &&
+      !organizationIds.some((id) => this.roles.get(id)?.includes(RoleId.OrgAdmin))
+    ) {
+      error(403, 'User is not an admin for the organization');
+    }
+    return this;
+  }
+
+  requireAdminOfOrg(organizationId: number) {
+    this.requireAuthenticated();
+    this.requireAdminOfOrgIn([organizationId]);
+    return this;
+  }
+
+  requireAdminOfAny() {
+    this.requireAuthenticated();
+    if (!this.isSuperAdmin && !this.roles.values().some((r) => r.includes(RoleId.OrgAdmin)))
+      error(403, 'User is not an admin of any organization');
+    return this;
+  }
+
+  requireHasRole(organizationId: number, roleId: RoleId, orOrgAdmin = true) {
+    this.requireAuthenticated();
+    if (
+      !this.isSuperAdmin &&
+      !this.roles.get(organizationId)?.includes(roleId) &&
+      !(orOrgAdmin && this.roles.get(organizationId)?.includes(RoleId.OrgAdmin))
+    )
+      error(403, 'User does not have the required role ' + roleId);
+    return this;
+  }
+
+  requireMemberOfOrg(organizationId: number) {
+    this.requireAuthenticated();
+    if (!this.organizationMemberships.includes(organizationId))
+      error(403, 'User is not a member of the organization');
+    return this;
+  }
+
+  requireMemberOfOrgOrSuperAdmin(organizationId: number) {
+    this.requireAuthenticated();
+    if (!this.isSuperAdmin) this.requireMemberOfOrg(organizationId);
+    return this;
+  }
+
+  requireProjectWriteAccess(project?: { OwnerId: number; OrganizationId: number } | null) {
+    this.requireAuthenticated();
+    if (!project) {
+      error(404, 'Project not found');
+    }
+    if (!this.isSuperAdmin && project.OwnerId !== this.userId) {
+      this.requireAdminOfOrg(project.OrganizationId);
+    }
+    return this;
+  }
+
+  requireProjectReadAccess(
+    userGroups: { GroupId: number }[],
+    project?: { OwnerId: number; OrganizationId: number; GroupId: number } | null
+  ) {
+    this.requireAuthenticated();
+    if (!project) {
+      error(404, 'Project not found');
+    }
+    if (!userGroups.find((ug) => ug.GroupId === project.GroupId)) {
+      this.requireProjectWriteAccess(project);
+    }
+    return this;
+  }
+
+  requireProjectClaimable(
+    userGroups: { GroupId: number }[],
+    project?: { OwnerId: number; OrganizationId: number; GroupId: number } | null
+  ) {
+    this.requireAuthenticated();
+    if (!project) {
+      error(404, 'Project not found');
+    }
+    if (this.userId === project.OwnerId) {
+      error(400, 'Project owner cannot claim own project');
+    }
+    if (!this.isSuperAdmin && !userGroups.some((ug) => ug.GroupId === project.GroupId)) {
+      error(400, 'User must share a group with the project in order to claim it!');
+    }
+    return this.requireHasRole(
+      project.OrganizationId,
+      RoleId.AppBuilder,
+      true
+    ).requireProjectReadAccess(userGroups, project);
+  }
+
+  requireMemberOfAnyOrg() {
+    this.requireAuthenticated();
+    if (this.organizationMemberships.length === 0)
+      error(403, 'User is not a member of any organization');
+    return this;
+  }
+
+  requireNothing() {
+    this.securityHandled = true;
+    return this;
+  }
+}
+
+export const populateSecurityInfo: Handle = async ({ event, resolve }) => {
+  const security = (await event.locals.auth())?.user;
+  try {
+    if (security) {
+      // If the user does not exist in the database, invalidate the login and redirect to prevent unauthorized access
+      // This can happen when the user is deleted from the database but still has a valid session.
+      // This should only happen when a superadmin manually deletes a user but is particularly annoying in development
+      // The user should also be redirected if they are not a member of any organizations
+      // Finally, the user should be redirected if they are locked
+      const user = await DatabaseReads.users.findUnique({
+        where: {
+          Id: security.userId
+        },
+        include: {
+          OrganizationMemberships: true
+        }
+      });
+
+      trace.getActiveSpan()?.addEvent('checkUserExistsHandle completed', {
+        'auth.userId': security?.userId,
+        'auth.user': user ? user.Email + ' - ' + user.Id : 'null',
+        'auth.user.OrganizationMemberships':
+          user?.OrganizationMemberships.map((o) => o.OrganizationId).join(', ') ?? 'null',
+        'auth.user.roles': user ? JSON.stringify([...security.roles.entries()]) : 'null',
+        'auth.user.IsLocked': user ? user.IsLocked + '' : 'null'
+      });
+
+      if (
+        !user ||
+        (user.OrganizationMemberships.length === 0 && !event.cookies.get('inviteToken'))
+      ) {
+        event.cookies.set('authjs.session-token', '', { path: '/' });
+        return redirect(302, localizeHref('/login/no-organization'));
+      }
+      if (user.IsLocked) {
+        event.cookies.set('authjs.session-token', '', { path: '/' });
+        return redirect(302, localizeHref('/login/locked'));
+      }
+      const roleMap = new Map<number, RoleId[]>();
+      for (const [orgId, roleId] of security.roles) {
+        if (!roleMap.has(orgId)) roleMap.set(orgId, []);
+        roleMap.get(orgId)!.push(roleId);
+      }
+      event.locals.security = new Security(
+        event,
+        security.userId,
+        user.OrganizationMemberships.map((o) => o.OrganizationId),
+        roleMap
+      );
+    }
+  } finally {
+    if (!event.locals.security) {
+      // @ts-expect-error Not typed as null but null is allowed
+      event.locals.security = new Security(event, null, null, null);
+    }
   }
-  return resolve(event);
+  return await resolve(event);
 };
 
+// Handles the /auth route, which is used to handle external auth0 authentication
+export const { handle: authRouteHandle, signIn, signOut } = SvelteKitAuth(config);
+
 // Handle organization invites
 export const organizationInviteHandle: Handle = async ({ event, resolve }) => {
   // Hacky solution to get the request object in the auth callbacks
@@ -204,124 +367,3 @@ export const organizationInviteHandle: Handle = async ({ event, resolve }) => {
   tokenStatus = null;
   return result;
 };
-
-// Locks down the authenticated routes by redirecting to /login
-// This guarantees a logged in user under (authenticated) but does not guarantee
-// authorization to the route. Each page must manually check in +page.server.ts or here
-export const localRouteHandle: Handle = async ({ event, resolve }) => {
-  if (
-    !event.route.id?.startsWith('/(unauthenticated)') &&
-    event.route.id !== '/' &&
-    event.route.id !== null
-  ) {
-    const session = await event.locals.auth();
-    if (!session) return redirect(302, localizeHref('/login'));
-    const status = await validateRouteForAuthenticatedUser(
-      session,
-      event.route.id,
-      event.params,
-      event.request.method
-    );
-    trace.getActiveSpan()?.addEvent('localRouteHandle completed', {
-      'auth.localRouteHandle.routeId': event.route.id ?? 'null',
-      'auth.localRouteHandle.params': JSON.stringify(event.params),
-      'auth.localRouteHandle.session.userId': session.user.userId,
-      'auth.localRouteHandle.session.roles': JSON.stringify(session.user.roles),
-      'auth.localRouteHandle.status': status
-    });
-    if (status !== ServerStatus.Ok) {
-      // error.html is extremely ugly, so we use a manual error throw
-      event.locals.error = status;
-    }
-  }
-  return resolve(event);
-};
-
-async function validateRouteForAuthenticatedUser(
-  session: Session,
-  route: string,
-  params: Partial<Record<string, string>>,
-  method: string
-): Promise<ServerStatus> {
-  const path = route.split('/').filter((r) => !!r);
-  // Only guarding authenticated routes
-  if (path[0] === '(authenticated)') {
-    if (path[1] === 'admin' || path[1] === 'workflow-instances')
-      return isSuperAdmin(session?.user?.roles) ? ServerStatus.Ok : ServerStatus.Forbidden;
-    else if (path[1] === 'directory' || path[1] === 'open-source')
-      // Always allowed. Open pages
-      return ServerStatus.Ok;
-    else if (path[1] === 'organizations') {
-      // Must be org admin for some organization (or a super admin)
-      if (!isAdmin(session?.user?.roles)) return ServerStatus.Forbidden;
-      if (params.id) {
-        // Must be org admin for specified organization (or a super admin)
-        const Id = parseInt(params.id);
-        if (isNaN(Id) || !(await DatabaseReads.organizations.findFirst({ where: { Id } }))) {
-          return ServerStatus.NotFound;
-        }
-        return isAdminForOrg(Id, session?.user?.roles) ? ServerStatus.Ok : ServerStatus.Forbidden;
-      }
-      return ServerStatus.Ok;
-    } else if (path[1] === 'products') {
-      try {
-        const product = await DatabaseReads.products.findFirst({
-          where: {
-            Id: params.id
-          }
-        });
-        if (!product) return ServerStatus.NotFound;
-        // Must be allowed to view associated project
-        // (this route was originally part of the project page but was moved elsewhere to improve load time)
-        return await verifyCanView(session, product.ProjectId);
-      } catch {
-        return ServerStatus.NotFound;
-      }
-    } else if (path[1] === 'projects') {
-      if (path[2] === '[filter=projectSelector]') return ServerStatus.Ok;
-      else if (path[2] === '[id=idNumber]') {
-        // prevent edits and actions without breaking SSE
-        if (path[3] === 'edit' || (method !== 'GET' && path[3] !== 'sse')) {
-          return await verifyCanEdit(session, parseInt(params.id!));
-        }
-        // A project can be viewed if the user is an admin or in the project's group
-        return await verifyCanView(session, parseInt(params.id!));
-      }
-      return ServerStatus.Ok;
-    } else if (path[1] === 'tasks') {
-      // Own task list always allowed, and specific products checked manually
-      return ServerStatus.Ok;
-    } else if (path[1] === 'users') {
-      // /(invite): admin
-      if (path.length === 2 || path[2] === 'invite') {
-        return isAdmin(session?.user?.roles) ? ServerStatus.Ok : ServerStatus.Forbidden;
-      } else if (path[2] === '[id=idNumber]') {
-        // /id: not implemented yet (ISSUE #1142)
-        const subjectId = parseInt(params.id!);
-        if (!(await DatabaseReads.users.findFirst({ where: { Id: subjectId } })))
-          return ServerStatus.NotFound;
-        const admin = !!(await DatabaseReads.organizations.findFirst({
-          where: adminOrgs(subjectId, session.user.userId, isSuperAdmin(session.user.roles)),
-          select: {
-            Id: true
-          }
-        }));
-        // /id/settings/(profile): self and admin
-        if (!path.at(4) || path[4] === 'profile') {
-          return subjectId === session.user.userId || admin
-            ? ServerStatus.Ok
-            : ServerStatus.Forbidden;
-        } else {
-          // /id/settings/*: admin
-          return admin ? ServerStatus.Ok : ServerStatus.Forbidden;
-        }
-      }
-      return ServerStatus.Ok;
-    } else {
-      // Unknown route. We'll assume it's a legal route
-      return ServerStatus.Ok;
-    }
-  } else {
-    return ServerStatus.Ok;
-  }
-}
diff --git a/src/hooks.server.ts b/src/hooks.server.ts
index e23b377086..487befbb57 100644
--- a/src/hooks.server.ts
+++ b/src/hooks.server.ts
@@ -3,14 +3,9 @@
 // when code is bundled, we cannot keep the file separate to import it first.
 
 import { SpanStatusCode, trace } from '@opentelemetry/api';
-import { type Handle, type HandleServerError } from '@sveltejs/kit';
+import { type Handle, type HandleServerError, error } from '@sveltejs/kit';
 import { sequence } from '@sveltejs/kit/hooks';
-import {
-  authRouteHandle,
-  checkUserExistsHandle,
-  localRouteHandle,
-  organizationInviteHandle
-} from './auth';
+import { authRouteHandle, organizationInviteHandle, populateSecurityInfo } from './auth';
 import { building } from '$app/environment';
 import OTEL from '$lib/otel';
 
@@ -62,8 +57,7 @@ const heartbeat: Handle = async ({ event, resolve }) => {
         'Connected to Valkey:',
         QueueConnected()
       );
-      // HTTP 503 *should* be the correct semantics here?
-      event.locals.error = 503;
+      throw error(503, 'Database connection error');
     }
   }
   return resolve(event);
@@ -71,7 +65,7 @@ const heartbeat: Handle = async ({ event, resolve }) => {
 
 const tracer = trace.getTracer('IncomingRequest');
 
-const authSequence = sequence(authRouteHandle, checkUserExistsHandle, localRouteHandle);
+const authSequence = sequence(authRouteHandle, populateSecurityInfo);
 
 export const handle: Handle = async ({ event, resolve }) => {
   if (event.url.pathname.startsWith('/.well-known/appspecific/')) {
@@ -96,31 +90,74 @@ export const handle: Handle = async ({ event, resolve }) => {
       'http.x-forwarded-for': event.request.headers.get('x-forwarded-for') ?? '',
       'svelte.route_id': event.route.id ?? ''
     });
-    const response = await sequence(
-      paraglideHandle,
-      heartbeat,
-      organizationInviteHandle,
-      // Handle auth hooks in a separate OTEL span
-      async function hookTelementry({ event, resolve }) {
-        return tracer.startActiveSpan('Auth Hooks', async (span) => {
-          // Call the auth sequence
-          const ret = await authSequence({
-            event,
-            resolve: (...args) => {
-              span.end();
-              return resolve(...args);
+    try {
+      const response = await sequence(
+        paraglideHandle,
+        heartbeat,
+        organizationInviteHandle,
+        // Handle auth hooks in a separate OTEL span
+        async function hookTelementry({ event, resolve }) {
+          return tracer.startActiveSpan('Auth Hooks', async (span) => {
+            // Call the auth sequence
+            let spanEnded = false;
+            try {
+              const ret = await authSequence({
+                event,
+                resolve: (...args) => {
+                  if (!spanEnded) {
+                    span.end();
+                    spanEnded = true;
+                  }
+                  return resolve(...args);
+                }
+              });
+              return ret;
+            } finally {
+              if (!spanEnded) {
+                span.end();
+                spanEnded = true;
+              }
             }
           });
-          return ret;
+        },
+        bullboardHandle
+      )({ event, resolve });
+      // Note: if an error is thrown by the route the following is skipped
+      // handleError is called instead and logging occurs there
+      if (
+        // Don't enforce security checks on auth routes (handled by authRouteHandle before populateSecurityInfo)
+        !event.url.pathname.startsWith('/auth/') &&
+        // @ts-expect-error securityHandled is not in the type definition
+        !event.locals.security.securityHandled
+      ) {
+        OTEL.instance.logger.error(
+          `Security checks were not performed for route ${event.url.pathname}`,
+          {
+            route: event.route.id,
+            method: event.request.method,
+            url: event.url.href,
+            userId: event.locals.security.userId ?? 'unauthenticated',
+            http_status_for_response: response.status
+          }
+        );
+        span.recordException(new Error('Security checks were not performed'));
+        span.setStatus({
+          code: SpanStatusCode.ERROR,
+          message: 'Security checks were not performed'
         });
-      },
-      bullboardHandle
-    )({ event, resolve });
-    span.setAttributes({
-      'http.status_code': response.status
-    });
-    span.end();
-    return response;
+        span.setAttributes({
+          'http.status_code': 500
+        });
+        // This is a server error because a developer misconfigured the route
+        return new Response('Authorization misconfigured', { status: 500 });
+      }
+      span.setAttributes({
+        'http.status_code': response.status
+      });
+      return response;
+    } finally {
+      span.end();
+    }
   });
 };
 
diff --git a/src/lib/projects/components/ProjectActionMenu.svelte b/src/lib/projects/components/ProjectActionMenu.svelte
index 48e004fd41..f1c7ed3825 100644
--- a/src/lib/projects/components/ProjectActionMenu.svelte
+++ b/src/lib/projects/components/ProjectActionMenu.svelte
@@ -68,7 +68,7 @@
     <form method="POST" action="?/{endpoint}" use:enhance>
       <input type="hidden" name="projectId" value={project.Id} />
       <ul class="menu menu-compact overflow-hidden rounded-md">
-        {#if allowActions && canArchive(project, page.data.session, parseInt(page.params.id))}
+        {#if allowActions && canArchive(project, page.data.session!.user, orgId)}
           <li class="w-full rounded-none">
             <BlockIfJobsUnavailable className="text-nowrap">
               {#snippet altContent()}
@@ -81,7 +81,7 @@
             </BlockIfJobsUnavailable>
           </li>
         {/if}
-        {#if allowReactivate && canReactivate(project, page.data.session, parseInt(page.params.id))}
+        {#if allowReactivate && canReactivate(project, page.data.session!.user, orgId)}
           <li class="w-full rounded-none">
             <BlockIfJobsUnavailable className="text-nowrap">
               {#snippet altContent()}
@@ -99,7 +99,7 @@
             </BlockIfJobsUnavailable>
           </li>
         {/if}
-        {#if canClaimProject(page.data.session, project.OwnerId, orgId, project.GroupId, userGroups)}
+        {#if canClaimProject(page.data.session!.user, project.OwnerId, orgId, project.GroupId, userGroups)}
           <li class="w-full rounded-none">
             <BlockIfJobsUnavailable className="text-nowrap">
               {#snippet altContent()}
diff --git a/src/lib/projects/components/ProjectFilterSelector.svelte b/src/lib/projects/components/ProjectFilterSelector.svelte
index f8c8db0068..ed605195dd 100644
--- a/src/lib/projects/components/ProjectFilterSelector.svelte
+++ b/src/lib/projects/components/ProjectFilterSelector.svelte
@@ -35,7 +35,9 @@
     <div class="px-4">
       {#each textsForPaths as route}
         <a
-          href={localizeHref(`/projects/${route[0]}${page.params.id ? '/' + page.params.id : ''}`)}
+          href={localizeHref(
+            `/projects/${route[0]}${page.params.orgId ? '/' + page.params.orgId : ''}`
+          )}
           class:font-extrabold={page.params.filter === route[0]}
           class="p-1 text-nowrap block"
         >
diff --git a/src/lib/projects/index.ts b/src/lib/projects/index.ts
index d08db961ae..c59ca46aa4 100644
--- a/src/lib/projects/index.ts
+++ b/src/lib/projects/index.ts
@@ -2,7 +2,7 @@ import type { Session } from '@auth/sveltekit';
 import type { Prisma } from '@prisma/client';
 import * as v from 'valibot';
 import { RoleId } from '$lib/prisma';
-import { hasRoleForOrg, isAdminForOrg, isSuperAdmin } from '$lib/utils/roles';
+import { isAdminForOrg } from '$lib/utils/roles';
 import { idSchema, langtagRegex, paginateSchema } from '$lib/valibot';
 
 export function pruneProjects(
@@ -163,20 +163,18 @@ export type ProjectForAction = Prisma.ProjectsGetPayload<{
   };
 }>;
 
-export type MaybeSession = Pick<Session, 'user'> | null | undefined;
-
 /**
  * User can modify a project (excluding ownership) iff:
  * The user is the owner or is an admin for the org
  */
 export function canModifyProject(
-  user: MaybeSession,
+  security: Session['user'],
   projectOwnerId: number,
   organizationId: number
 ): boolean {
   return (
-    !!user &&
-    (projectOwnerId === user?.user.userId || isAdminForOrg(organizationId, user?.user.roles))
+    !!security &&
+    (projectOwnerId === security.userId || isAdminForOrg(organizationId, security.roles))
   );
 }
 
@@ -185,33 +183,32 @@ export function canModifyProject(
  * They are not the owner and are in the same group and have the AppBuilder or OrgAdmin roles (ignored if superAdmin)
  */
 export function canClaimProject(
-  session: MaybeSession,
+  security: Session['user'],
   projectOwnerId: number,
   organizationId: number,
   projectGroupId: number,
   userGroupIds: number[]
 ) {
+  if (security.userId === projectOwnerId) return false;
+  if (security.roles.some(([_, r]) => r === RoleId.SuperAdmin)) return true;
   return (
-    session?.user.userId !== projectOwnerId && // user is not the owner AND
-    (isSuperAdmin(session?.user.roles) || // short circuit if superadmin
-      ((isAdminForOrg(organizationId, session?.user.roles) || // (user is admin OR
-        hasRoleForOrg(RoleId.AppBuilder, organizationId, session?.user.roles)) && // user is AppBuilder) AND
-        userGroupIds.includes(projectGroupId))) // user is in the group
+    canModifyProject(security, projectOwnerId, organizationId) &&
+    userGroupIds.includes(projectGroupId)
   );
 }
 
 export function canArchive(
   project: Pick<ProjectForAction, 'OwnerId' | 'DateArchived'>,
-  session: MaybeSession,
+  security: Session['user'],
   orgId: number
 ): boolean {
-  return !project.DateArchived && canModifyProject(session, project.OwnerId, orgId);
+  return !project.DateArchived && canModifyProject(security, project.OwnerId, orgId);
 }
 
 export function canReactivate(
   project: Pick<ProjectForAction, 'OwnerId' | 'DateArchived'>,
-  session: MaybeSession,
+  security: Session['user'],
   orgId: number
 ): boolean {
-  return !!project.DateArchived && canModifyProject(session, project.OwnerId, orgId);
+  return !!project.DateArchived && canModifyProject(security, project.OwnerId, orgId);
 }
diff --git a/src/lib/projects/server.ts b/src/lib/projects/server.ts
index fb9cd82f99..97b988ce10 100644
--- a/src/lib/projects/server.ts
+++ b/src/lib/projects/server.ts
@@ -1,55 +1,9 @@
-import type { Session } from '@auth/sveltekit';
 import type { Prisma } from '@prisma/client';
 import { RoleId } from '$lib/prisma';
-import { type ProjectForAction, canClaimProject, canModifyProject } from '$lib/projects';
+import { type ProjectForAction, canClaimProject } from '$lib/projects';
 import { BullMQ, getQueues } from '$lib/server/bullmq';
 import { DatabaseReads, DatabaseWrites } from '$lib/server/database';
-import { ServerStatus } from '$lib/utils';
-import { hasRoleForOrg, isAdminForOrg } from '$lib/utils/roles';
-
-export async function verifyCanView(user: Session, projectId: number): Promise<ServerStatus> {
-  // Viewing is allowed if the user is an admin or is in the project's group
-  // Note: being in the project's group is a prerequisite for owning it
-  if (isNaN(projectId)) return ServerStatus.NotFound;
-  const project = await DatabaseReads.projects.findUnique({
-    where: {
-      Id: projectId
-    },
-    select: {
-      Id: true,
-      OwnerId: true,
-      GroupId: true,
-      OrganizationId: true
-    }
-  });
-  if (!project) return ServerStatus.NotFound;
-  return isAdminForOrg(project.OrganizationId, user.user.roles) ||
-    (await DatabaseReads.groupMemberships.findFirst({
-      where: { UserId: user.user.userId, GroupId: project.GroupId }
-    }))
-    ? ServerStatus.Ok
-    : ServerStatus.Forbidden;
-}
-
-export async function verifyCanEdit(user: Session, projectId: number): Promise<ServerStatus> {
-  // Editing is allowed if the user owns the project, or if the user is an organization
-  // admin for the project's organization, or if the user is a super admin
-  if (isNaN(projectId)) return ServerStatus.NotFound;
-  const project = await DatabaseReads.projects.findUnique({
-    where: {
-      Id: projectId
-    },
-    select: {
-      Id: true,
-      OwnerId: true,
-      OrganizationId: true
-    }
-  });
-  if (!project) return ServerStatus.NotFound;
-  return canModifyProject(user, project.OwnerId, project.OrganizationId)
-    ? ServerStatus.Ok
-    : ServerStatus.Forbidden;
-}
+import { isAdminForOrg } from '$lib/utils/roles';
 
 export function projectFilter(args: {
   organizationId: number | null;
@@ -144,11 +98,12 @@ export function projectFilter(args: {
     ]
   };
 }
-export function verifyCanCreateProject(user: Session, orgId: number): boolean {
+
+export function verifyCanCreateProject(user: Security, orgId: number): boolean {
   // Creating a project is allowed if the user is an OrgAdmin or AppBuilder for the organization or a SuperAdmin
   return (
-    isAdminForOrg(orgId, user.user.roles) ||
-    hasRoleForOrg(RoleId.AppBuilder, orgId, user.user.roles)
+    isAdminForOrg(orgId, user.sessionForm.roles) ||
+    !!user.roles.get(orgId)?.includes(RoleId.AppBuilder)
   );
 }
 
@@ -171,7 +126,7 @@ export async function userGroupsForOrg(userId: number, orgId: number) {
 export async function doProjectAction(
   operation: string | null,
   project: Omit<ProjectForAction, 'Name'>,
-  session: Session,
+  security: Security,
   orgId: number,
   groups: number[]
 ) {
@@ -201,10 +156,10 @@ export async function doProjectAction(
     });
   } else if (
     operation === 'claim' &&
-    canClaimProject(session, project?.OwnerId, orgId, project?.GroupId, groups)
+    canClaimProject(security.sessionForm, project?.OwnerId, orgId, project?.GroupId, groups)
   ) {
     await DatabaseWrites.projects.update(project.Id, {
-      OwnerId: session.user.userId
+      OwnerId: security.userId
     });
   }
 }
diff --git a/src/lib/projects/sse.ts b/src/lib/projects/sse.ts
index c457ca8103..36d0b30c13 100644
--- a/src/lib/projects/sse.ts
+++ b/src/lib/projects/sse.ts
@@ -1,3 +1,4 @@
+import type { Session } from '@auth/sveltekit';
 import { SpanStatusCode, trace } from '@opentelemetry/api';
 import { RoleId } from '$lib/prisma';
 import { getProductActions } from '$lib/products';
@@ -7,12 +8,12 @@ import { DatabaseReads } from '$lib/server/database';
 
 const tracer = trace.getTracer('ProjectSSE');
 export type ProjectDataSSE = Awaited<ReturnType<typeof getProjectDetails>>;
-export async function getProjectDetails(id: number, userId: number) {
+export async function getProjectDetails(id: number, userSession: Session['user']) {
   // permissions checked in auth
   return tracer.startActiveSpan('getProjectDetails', async (span) => {
     span.setAttributes({
       'project.id': id,
-      'project.userId': userId
+      'project.userId': userSession.userId
     });
     try {
       const project = await DatabaseReads.projects.findUniqueOrThrow({
@@ -197,26 +198,7 @@ export async function getProjectDetails(id: number, userId: number) {
       const projectProductDefinitionIds = project.Products.map((p) => p.ProductDefinition.Id);
       span.addEvent('Product definitions fetched');
 
-      const canEdit = canModifyProject(
-        {
-          user: {
-            userId,
-            roles: (
-              await DatabaseReads.userRoles.findMany({
-                where: {
-                  UserId: userId,
-                  OR: [
-                    { RoleId: RoleId.SuperAdmin },
-                    { RoleId: RoleId.OrgAdmin, OrganizationId: project.Organization.Id }
-                  ]
-                }
-              })
-            ).map(({ OrganizationId, RoleId }) => [OrganizationId, RoleId])
-          }
-        },
-        project.Owner.Id,
-        project.Organization.Id
-      );
+      const canEdit = canModifyProject(userSession, project.Owner.Id, project.Organization.Id);
 
       return {
         project: {
@@ -232,7 +214,7 @@ export async function getProjectDetails(id: number, userId: number) {
             ActiveTransition: strippedTransitions.find(
               (t) => (t[0] ?? t[1])?.ProductId === product.Id
             )?.[1],
-            actions: canEdit ? getProductActions(product, project.Owner.Id, userId) : []
+            actions: canEdit ? getProductActions(product, project.Owner.Id, userSession.userId) : []
           }))
         },
         productsToAdd: productDefinitions.filter(
@@ -286,7 +268,9 @@ export async function getProjectDetails(id: number, userId: number) {
             }
           }
         }),
-        userGroups: (await userGroupsForOrg(userId, project.Organization.Id)).map((g) => g.GroupId)
+        userGroups: (await userGroupsForOrg(userSession.userId, project.Organization.Id)).map(
+          (g) => g.GroupId
+        )
       };
     } catch (e) {
       span.recordException(e as Error);
diff --git a/src/lib/server/bullmq/BullBoard.ts b/src/lib/server/bullmq/BullBoard.ts
index 48f8cb047c..dda1d15886 100644
--- a/src/lib/server/bullmq/BullBoard.ts
+++ b/src/lib/server/bullmq/BullBoard.ts
@@ -37,7 +37,7 @@ const bullboard = (() => {
 })();
 
 export const bullboardHandle: Handle = async ({ event, resolve }) => {
-  if (event.url.pathname.match(/^\/admin\/jobs($|\/)/) && !event.locals.error) {
+  if (event.url.pathname.match(/^\/admin\/jobs($|\/)/) && event.locals.security.isSuperAdmin) {
     return bullboard!.fetch(event.request);
   }
   return resolve(event);
diff --git a/src/lib/utils/roles.ts b/src/lib/utils/roles.ts
index 4a0809d2b0..8c8d3b7a50 100644
--- a/src/lib/utils/roles.ts
+++ b/src/lib/utils/roles.ts
@@ -1,49 +1,35 @@
 import type { Session } from '@auth/sveltekit';
 import { RoleId } from '$lib/prisma';
 
-type RolesMap = Session['user']['roles'];
+type ClientRolesArray = Session['user']['roles'];
 
 /** returns true if user is a SuperAdmin, or is an OrgAdmin for the specified organization
  * @param roles [OrganizationId, RoleId][]
  */
-export function isAdminForOrg(orgId: number, roles?: RolesMap): boolean {
-  return !!roles?.find(
-    ([org, role]) => role === RoleId.SuperAdmin || (role === RoleId.OrgAdmin && org === orgId)
+export function isAdminForOrg(orgId: number, roles: ClientRolesArray): boolean {
+  const orgRoles = roles.filter(([oId]) => oId === orgId).map(([, r]) => r);
+  return (
+    !!orgRoles &&
+    (roles.some(([_, r]) => r === RoleId.SuperAdmin) || orgRoles.includes(RoleId.OrgAdmin))
   );
 }
-/** returns true if user is a SuperAdmin, or is an OrgAdmin for any of the provided orgs
+/** returns a list of organizations where the user has the specified role
+ *
+ * IS NOT SHORT-CIRCUITED by SuperAdmin
  * @param roles [OrganizationId, RoleId][]
  */
-export function isAdminForOrgs(orgs: number[], roles?: RolesMap): boolean {
-  return !!roles?.find(
-    ([org, role]) => role === RoleId.SuperAdmin || (role === RoleId.OrgAdmin && orgs.includes(org))
-  );
+export function orgsForRole(role: RoleId, roles: ClientRolesArray): number[] {
+  return roles.filter(([, r]) => r === role).map(([orgId]) => orgId);
 }
 /** returns true if user is a SuperAdmin, or is an OrgAdmin for any organization
  * @param roles [OrganizationId, RoleId][]
  */
-export function isAdmin(roles?: RolesMap): boolean {
-  return !!roles?.find(([_, role]) => role === RoleId.SuperAdmin || role === RoleId.OrgAdmin);
+export function isAdminForAny(roles: ClientRolesArray): boolean {
+  return roles.some(([_, r]) => r === RoleId.SuperAdmin || r === RoleId.OrgAdmin);
 }
 /** returns true if user is a SuperAdmin
  * @param roles [OrganizationId, RoleId][]
  */
-export function isSuperAdmin(roles?: RolesMap): boolean {
-  return !!roles?.find(([_, role]) => role === RoleId.SuperAdmin);
-}
-/** returns true if user has specified role in specified org
- *
- * IS NOT SHORT-CIRCUITED by SuperAdmin
- * @param roles [OrganizationId, RoleId][]
- */
-export function hasRoleForOrg(role: RoleId, orgId: number, roles?: RolesMap): boolean {
-  return !!roles?.find(([org, roleId]) => roleId === role && org === orgId);
-}
-/** returns a list of organizations where the user has the specified role
- *
- * IS NOT SHORT-CIRCUITED by SuperAdmin
- * @param roles [OrganizationId, RoleId][]
- */
-export function orgsForRole(role: RoleId, roles?: RolesMap): number[] {
-  return roles?.filter(([_, roleId]) => roleId === role).map(([org, _]) => org) ?? [];
+export function isSuperAdmin(roles: ClientRolesArray): boolean {
+  return roles.some(([, r]) => r === RoleId.SuperAdmin);
 }
diff --git a/src/routes/(authenticated)/+layout.server.ts b/src/routes/(authenticated)/+layout.server.ts
index 0d8d83a903..1c8badb4dd 100644
--- a/src/routes/(authenticated)/+layout.server.ts
+++ b/src/routes/(authenticated)/+layout.server.ts
@@ -1,4 +1,3 @@
-import { error } from '@sveltejs/kit';
 import { existsSync } from 'fs';
 import { readFile } from 'fs/promises';
 import { join } from 'path';
@@ -10,23 +9,15 @@ import { getUserTasks } from '$lib/projects/sse';
 import { QueueConnected } from '$lib/server/bullmq/queues';
 import { DatabaseReads } from '$lib/server/database';
 import type { Entries } from '$lib/utils';
-import { isSuperAdmin } from '$lib/utils/roles';
 
 export const load: LayoutServerLoad = async (event) => {
-  if (event.locals.error) {
-    // If there is an error, we throw it to be handled by the error page
-    error(event.locals.error);
-  }
-  const user = (await event.locals.auth())!.user;
+  event.locals.security.requireAuthenticated();
+  const sec = event.locals.security;
   const organizations = await DatabaseReads.organizations.findMany({
-    where: isSuperAdmin(user.roles)
+    where: sec.isSuperAdmin
       ? undefined
       : {
-          OrganizationMemberships: {
-            some: {
-              UserId: user.userId
-            }
-          }
+          Id: { in: sec.organizationMemberships }
         },
     select: {
       Id: true,
@@ -40,7 +31,7 @@ export const load: LayoutServerLoad = async (event) => {
 
   return {
     organizations,
-    userTasks: await getUserTasks(user.userId),
+    userTasks: await getUserTasks(sec.userId),
     // streaming promise
     langtags: await readFile(join(localDir, 'langtags.json'))
       .then((j) => {
diff --git a/src/routes/(authenticated)/+layout.svelte b/src/routes/(authenticated)/+layout.svelte
index 17ab4447c5..9471c16994 100644
--- a/src/routes/(authenticated)/+layout.svelte
+++ b/src/routes/(authenticated)/+layout.svelte
@@ -14,7 +14,7 @@
   import { m } from '$lib/paraglide/messages';
   import { deLocalizeUrl, localizeHref } from '$lib/paraglide/runtime';
   import { orgActive, userTasksSSE } from '$lib/stores';
-  import { isAdmin, isSuperAdmin } from '$lib/utils/roles';
+  import { isAdminForAny, isSuperAdmin } from '$lib/utils/roles';
 
   interface Props {
     data: LayoutData;
@@ -151,7 +151,7 @@
               {m.sidebar_orgProjects()}
             </a>
           </li>
-          {#if isAdmin(page.data.session?.user.roles)}
+          {#if isAdminForAny(data.session.user.roles)}
             <li>
               <a
                 class="rounded-none"
@@ -183,7 +183,7 @@
               </a>
             </li>
           {/if}
-          {#if isSuperAdmin(page.data.session?.user.roles)}
+          {#if isSuperAdmin(data.session.user.roles)}
             <li>
               <a
                 class="rounded-none"
diff --git a/src/routes/(authenticated)/admin/jobs/[...path]/+page.server.ts b/src/routes/(authenticated)/admin/jobs/[...path]/+page.server.ts
new file mode 100644
index 0000000000..a41b00a8de
--- /dev/null
+++ b/src/routes/(authenticated)/admin/jobs/[...path]/+page.server.ts
@@ -0,0 +1,6 @@
+import type { PageServerLoad } from './$types';
+
+export const load: PageServerLoad = async (event) => {
+  event.locals.security.requireSuperAdmin();
+  return {};
+};
diff --git a/src/routes/(authenticated)/admin/settings/build-engines/+page.server.ts b/src/routes/(authenticated)/admin/settings/build-engines/+page.server.ts
index 51ade608f5..f05cc1a4c0 100644
--- a/src/routes/(authenticated)/admin/settings/build-engines/+page.server.ts
+++ b/src/routes/(authenticated)/admin/settings/build-engines/+page.server.ts
@@ -3,7 +3,8 @@
 import type { PageServerLoad } from './$types';
 import { DatabaseReads } from '$lib/server/database';
 
-export const load = (async () => {
+export const load = (async (event) => {
+  event.locals.security.requireSuperAdmin();
   const buildEngines = await DatabaseReads.systemStatuses.findMany();
 
   return { buildEngines };
diff --git a/src/routes/(authenticated)/admin/settings/organizations/+page.server.ts b/src/routes/(authenticated)/admin/settings/organizations/+page.server.ts
index 81d0755c7e..7c1007251e 100644
--- a/src/routes/(authenticated)/admin/settings/organizations/+page.server.ts
+++ b/src/routes/(authenticated)/admin/settings/organizations/+page.server.ts
@@ -3,6 +3,9 @@
 import type { PageServerLoad } from './$types';
 import { DatabaseReads } from '$lib/server/database';
 
-export const load = (async () => {
-  return { organizations: await DatabaseReads.organizations.findMany() };
+export const load = (async (event) => {
+  event.locals.security.requireSuperAdmin();
+  const organizations = await DatabaseReads.organizations.findMany();
+
+  return { organizations };
 }) satisfies PageServerLoad;
diff --git a/src/routes/(authenticated)/admin/settings/organizations/edit/+page.server.ts b/src/routes/(authenticated)/admin/settings/organizations/edit/+page.server.ts
index 4d8619f85e..22335fabe2 100644
--- a/src/routes/(authenticated)/admin/settings/organizations/edit/+page.server.ts
+++ b/src/routes/(authenticated)/admin/settings/organizations/edit/+page.server.ts
@@ -12,7 +12,8 @@ const editSchema = v.object({
   id: idSchema,
   ...organizationBaseSchema.entries
 });
-export const load = (async ({ url }) => {
+export const load = (async ({ url, locals }) => {
+  locals.security.requireSuperAdmin();
   const id = parseInt(url.searchParams.get('id') ?? '');
   if (isNaN(id)) {
     return redirect(302, localizeHref('/admin/settings/organizations'));
@@ -41,7 +42,8 @@ export const load = (async ({ url }) => {
 }) satisfies PageServerLoad;
 
 export const actions = {
-  async edit({ request }) {
+  async edit({ request, locals }) {
+    locals.security.requireSuperAdmin();
     const form = await superValidate(request, valibot(editSchema));
     if (!form.valid) {
       return fail(400, { form, ok: false });
diff --git a/src/routes/(authenticated)/admin/settings/organizations/new/+page.server.ts b/src/routes/(authenticated)/admin/settings/organizations/new/+page.server.ts
index 08a3ef01fa..b95f28ff60 100644
--- a/src/routes/(authenticated)/admin/settings/organizations/new/+page.server.ts
+++ b/src/routes/(authenticated)/admin/settings/organizations/new/+page.server.ts
@@ -7,12 +7,14 @@ import { DatabaseWrites } from '$lib/server/database';
 
 const createSchema = organizationBaseSchema;
 
-export const load = (async () => {
+export const load = (async ({ url, locals }) => {
+  locals.security.requireSuperAdmin();
   return { form: await superValidate(valibot(createSchema)) };
 }) satisfies PageServerLoad;
 
 export const actions = {
-  async new({ request }) {
+  async new({ cookies, request, locals }) {
+    locals.security.requireSuperAdmin();
     const form = await superValidate(request, valibot(createSchema));
     if (!form.valid) {
       return fail(400, { form, ok: false });
diff --git a/src/routes/(authenticated)/admin/settings/product-definitions/+page.server.ts b/src/routes/(authenticated)/admin/settings/product-definitions/+page.server.ts
index 5c8bfdfa2b..a4104bd921 100644
--- a/src/routes/(authenticated)/admin/settings/product-definitions/+page.server.ts
+++ b/src/routes/(authenticated)/admin/settings/product-definitions/+page.server.ts
@@ -3,7 +3,8 @@
 import type { PageServerLoad } from './$types';
 import { DatabaseReads } from '$lib/server/database';
 
-export const load = (async () => {
+export const load = (async (event) => {
+  event.locals.security.requireSuperAdmin();
   const productDefinitions = await DatabaseReads.productDefinitions.findMany({
     include: {
       ApplicationTypes: true,
diff --git a/src/routes/(authenticated)/admin/settings/product-definitions/edit/+page.server.ts b/src/routes/(authenticated)/admin/settings/product-definitions/edit/+page.server.ts
index d1a6642a80..5eb8cbd14f 100644
--- a/src/routes/(authenticated)/admin/settings/product-definitions/edit/+page.server.ts
+++ b/src/routes/(authenticated)/admin/settings/product-definitions/edit/+page.server.ts
@@ -17,7 +17,8 @@ const editSchema = v.object({
   description: v.nullable(v.string()),
   properties: propertiesSchema
 });
-export const load = (async ({ url }) => {
+export const load = (async ({ url, locals }) => {
+  locals.security.requireSuperAdmin();
   const id = parseInt(url.searchParams.get('id') ?? '');
   if (isNaN(id)) {
     return redirect(302, localizeHref('/admin/settings/product-definitions'));
@@ -49,7 +50,8 @@ export const load = (async ({ url }) => {
 }) satisfies PageServerLoad;
 
 export const actions = {
-  async edit({ request }) {
+  async edit({ request, locals }) {
+    locals.security.requireSuperAdmin();
     const form = await superValidate(request, valibot(editSchema));
     if (!form.valid) {
       return fail(400, { form, ok: false });
diff --git a/src/routes/(authenticated)/admin/settings/product-definitions/new/+page.server.ts b/src/routes/(authenticated)/admin/settings/product-definitions/new/+page.server.ts
index d814d00a14..3e5927a2d1 100644
--- a/src/routes/(authenticated)/admin/settings/product-definitions/new/+page.server.ts
+++ b/src/routes/(authenticated)/admin/settings/product-definitions/new/+page.server.ts
@@ -16,7 +16,8 @@ const createSchema = v.object({
   properties: propertiesSchema
 });
 
-export const load = (async ({ url }) => {
+export const load = (async ({ url, locals }) => {
+  locals.security.requireSuperAdmin();
   const form = await superValidate(valibot(createSchema));
   const options = {
     applicationTypes: await DatabaseReads.applicationTypes.findMany(),
@@ -26,7 +27,8 @@ export const load = (async ({ url }) => {
 }) satisfies PageServerLoad;
 
 export const actions = {
-  async new({ cookies, request }) {
+  async new({ cookies, request, locals }) {
+    locals.security.requireSuperAdmin();
     const form = await superValidate(request, valibot(createSchema));
     if (!form.valid) {
       return fail(400, { form, ok: false });
diff --git a/src/routes/(authenticated)/admin/settings/store-types/+page.server.ts b/src/routes/(authenticated)/admin/settings/store-types/+page.server.ts
index 6d7d1be11b..fbe0ceaa08 100644
--- a/src/routes/(authenticated)/admin/settings/store-types/+page.server.ts
+++ b/src/routes/(authenticated)/admin/settings/store-types/+page.server.ts
@@ -3,7 +3,8 @@
 import type { PageServerLoad } from './$types';
 import { DatabaseReads } from '$lib/server/database';
 
-export const load = (async () => {
+export const load = (async (event) => {
+  event.locals.security.requireSuperAdmin();
   const storeTypes = await DatabaseReads.storeTypes.findMany();
 
   return { storeTypes };
diff --git a/src/routes/(authenticated)/admin/settings/store-types/edit/+page.server.ts b/src/routes/(authenticated)/admin/settings/store-types/edit/+page.server.ts
index d1b1eca2e4..facbf9ac83 100644
--- a/src/routes/(authenticated)/admin/settings/store-types/edit/+page.server.ts
+++ b/src/routes/(authenticated)/admin/settings/store-types/edit/+page.server.ts
@@ -12,7 +12,8 @@ const editSchema = v.object({
   name: v.nullable(v.string()),
   description: v.nullable(v.string())
 });
-export const load = (async ({ url }) => {
+export const load = (async ({ url, locals }) => {
+  locals.security.requireSuperAdmin();
   const id = parseInt(url.searchParams.get('id') ?? '');
   if (isNaN(id)) {
     return redirect(302, localizeHref('/admin/settings/store-types'));
@@ -35,7 +36,8 @@ export const load = (async ({ url }) => {
 }) satisfies PageServerLoad;
 
 export const actions = {
-  async edit({ request }) {
+  async edit({ request, locals }) {
+    locals.security.requireSuperAdmin();
     const form = await superValidate(request, valibot(editSchema));
     if (!form.valid) {
       return fail(400, { form, ok: false });
diff --git a/src/routes/(authenticated)/admin/settings/store-types/new/+page.server.ts b/src/routes/(authenticated)/admin/settings/store-types/new/+page.server.ts
index 4e50abe8c1..a258ee8469 100644
--- a/src/routes/(authenticated)/admin/settings/store-types/new/+page.server.ts
+++ b/src/routes/(authenticated)/admin/settings/store-types/new/+page.server.ts
@@ -10,13 +10,15 @@ const createSchema = v.object({
   description: v.nullable(v.string())
 });
 
-export const load = (async ({ url }) => {
+export const load = (async ({ locals }) => {
+  locals.security.requireSuperAdmin();
   const form = await superValidate(valibot(createSchema));
   return { form };
 }) satisfies PageServerLoad;
 
 export const actions = {
-  async new({ request }) {
+  async new({ request, locals }) {
+    locals.security.requireSuperAdmin();
     const form = await superValidate(request, valibot(createSchema));
     if (!form.valid) {
       return fail(400, { form, ok: false });
diff --git a/src/routes/(authenticated)/admin/settings/stores/+page.server.ts b/src/routes/(authenticated)/admin/settings/stores/+page.server.ts
index efaae270c5..6b28282c53 100644
--- a/src/routes/(authenticated)/admin/settings/stores/+page.server.ts
+++ b/src/routes/(authenticated)/admin/settings/stores/+page.server.ts
@@ -3,7 +3,8 @@
 import type { PageServerLoad } from './$types';
 import { DatabaseReads } from '$lib/server/database';
 
-export const load = (async () => {
+export const load = (async (event) => {
+  event.locals.security.requireSuperAdmin();
   const stores = await DatabaseReads.stores.findMany({
     include: { StoreType: true }
   });
diff --git a/src/routes/(authenticated)/admin/settings/stores/edit/+page.server.ts b/src/routes/(authenticated)/admin/settings/stores/edit/+page.server.ts
index ed42089bfe..9325c2a089 100644
--- a/src/routes/(authenticated)/admin/settings/stores/edit/+page.server.ts
+++ b/src/routes/(authenticated)/admin/settings/stores/edit/+page.server.ts
@@ -13,7 +13,8 @@ const editSchema = v.object({
   description: v.nullable(v.string()),
   storeType: idSchema
 });
-export const load = (async ({ url }) => {
+export const load = (async ({ url, locals }) => {
+  locals.security.requireSuperAdmin();
   const id = parseInt(url.searchParams.get('id') ?? '');
   if (isNaN(id)) {
     return redirect(302, localizeHref('/admin/settings/stores'));
@@ -38,7 +39,8 @@ export const load = (async ({ url }) => {
 }) satisfies PageServerLoad;
 
 export const actions = {
-  async edit({ request }) {
+  async edit({ request, locals }) {
+    locals.security.requireSuperAdmin();
     const form = await superValidate(request, valibot(editSchema));
     if (!form.valid) {
       return fail(400, { form, ok: false });
diff --git a/src/routes/(authenticated)/admin/settings/stores/new/+page.server.ts b/src/routes/(authenticated)/admin/settings/stores/new/+page.server.ts
index b175156602..adc5db8699 100644
--- a/src/routes/(authenticated)/admin/settings/stores/new/+page.server.ts
+++ b/src/routes/(authenticated)/admin/settings/stores/new/+page.server.ts
@@ -11,7 +11,8 @@ const createSchema = v.object({
   description: v.nullable(v.string())
 });
 
-export const load = (async ({ url }) => {
+export const load = (async ({ url, locals }) => {
+  locals.security.requireSuperAdmin();
   const form = await superValidate(valibot(createSchema));
   const options = {
     storeType: await DatabaseReads.storeTypes.findMany()
@@ -20,7 +21,8 @@ export const load = (async ({ url }) => {
 }) satisfies PageServerLoad;
 
 export const actions = {
-  async new({ request }) {
+  async new({ request, locals }) {
+    locals.security.requireSuperAdmin();
     const form = await superValidate(request, valibot(createSchema));
     if (!form.valid) {
       return fail(400, { form, ok: false });
diff --git a/src/routes/(authenticated)/admin/settings/workflow-definitions/+page.server.ts b/src/routes/(authenticated)/admin/settings/workflow-definitions/+page.server.ts
index f49bb56f39..27c698c4c1 100644
--- a/src/routes/(authenticated)/admin/settings/workflow-definitions/+page.server.ts
+++ b/src/routes/(authenticated)/admin/settings/workflow-definitions/+page.server.ts
@@ -3,7 +3,8 @@
 import type { PageServerLoad } from './$types';
 import { DatabaseReads } from '$lib/server/database';
 
-export const load = (async () => {
+export const load = (async (event) => {
+  event.locals.security.requireSuperAdmin();
   const workflowDefinitions = await DatabaseReads.workflowDefinitions.findMany({
     include: { StoreType: true }
   });
diff --git a/src/routes/(authenticated)/admin/settings/workflow-definitions/edit/+page.server.ts b/src/routes/(authenticated)/admin/settings/workflow-definitions/edit/+page.server.ts
index 7b9863d0ac..3a1e6b547b 100644
--- a/src/routes/(authenticated)/admin/settings/workflow-definitions/edit/+page.server.ts
+++ b/src/routes/(authenticated)/admin/settings/workflow-definitions/edit/+page.server.ts
@@ -12,7 +12,8 @@ const editSchema = v.object({
   id: idSchema,
   ...workflowDefinitionSchemaBase.entries
 });
-export const load = (async ({ url }) => {
+export const load = (async ({ url, locals }) => {
+  locals.security.requireSuperAdmin();
   const id = parseInt(url.searchParams.get('id') ?? '');
   if (isNaN(id)) {
     return redirect(302, localizeHref('/admin/settings/workflow-definitions'));
@@ -45,7 +46,8 @@ export const load = (async ({ url }) => {
 }) satisfies PageServerLoad;
 
 export const actions = {
-  async edit({ request }) {
+  async edit({ request, locals }) {
+    locals.security.requireSuperAdmin();
     const form = await superValidate(request, valibot(editSchema));
     if (!form.valid) {
       return fail(400, { form, ok: false });
diff --git a/src/routes/(authenticated)/admin/settings/workflow-definitions/new/+page.server.ts b/src/routes/(authenticated)/admin/settings/workflow-definitions/new/+page.server.ts
index 7b37aba1c0..945bb2ac69 100644
--- a/src/routes/(authenticated)/admin/settings/workflow-definitions/new/+page.server.ts
+++ b/src/routes/(authenticated)/admin/settings/workflow-definitions/new/+page.server.ts
@@ -7,7 +7,8 @@ import { DatabaseReads, DatabaseWrites } from '$lib/server/database';
 
 const createSchema = workflowDefinitionSchemaBase;
 
-export const load = (async ({ url }) => {
+export const load = (async ({ url, locals }) => {
+  locals.security.requireSuperAdmin();
   const form = await superValidate(valibot(createSchema));
   const options = {
     storeType: await DatabaseReads.storeTypes.findMany(),
@@ -18,7 +19,8 @@ export const load = (async ({ url }) => {
 }) satisfies PageServerLoad;
 
 export const actions = {
-  async new({ request }) {
+  async new({ request, locals }) {
+    locals.security.requireSuperAdmin();
     const form = await superValidate(request, valibot(createSchema));
     if (!form.valid) {
       return fail(400, { form, ok: false });
diff --git a/src/routes/(authenticated)/directory/+page.server.ts b/src/routes/(authenticated)/directory/+page.server.ts
index 3193ccc34f..c4ea18ff98 100644
--- a/src/routes/(authenticated)/directory/+page.server.ts
+++ b/src/routes/(authenticated)/directory/+page.server.ts
@@ -7,8 +7,8 @@ import { projectSearchSchema, pruneProjects } from '$lib/projects';
 import { projectFilter } from '$lib/projects/server';
 import { DatabaseReads } from '$lib/server/database';
 
-export const load = (async () => {
-  // auth handled by hooks
+export const load = (async (event) => {
+  event.locals.security.requireAuthenticated();
   const projects = await DatabaseReads.projects.findMany({
     where: {
       IsPublic: true
@@ -60,8 +60,8 @@ export const load = (async () => {
 }) satisfies PageServerLoad;
 
 export const actions: Actions = {
-  page: async function ({ request }) {
-    // auth handled by hooks
+  page: async function ({ request, locals }) {
+    locals.security.requireAuthenticated();
     const form = await superValidate(request, valibot(projectSearchSchema));
     if (!form.valid) return fail(400, { form, ok: false });
 
diff --git a/src/routes/(authenticated)/directory/[id=idNumber]/+page.server.ts b/src/routes/(authenticated)/directory/[id=idNumber]/+page.server.ts
new file mode 100644
index 0000000000..95dae6fbe1
--- /dev/null
+++ b/src/routes/(authenticated)/directory/[id=idNumber]/+page.server.ts
@@ -0,0 +1,116 @@
+import { error } from '@sveltejs/kit';
+import type { PageServerLoad } from './$types';
+import { DatabaseReads } from '$lib/server/database';
+
+export const load = (async ({ params, locals }) => {
+  locals.security.requireAuthenticated();
+  // Anyone can view a public project, even if not an org member
+  // But we need to check for org membership if downloads are allowed
+  const projectId = Number(params.id);
+  const project = await DatabaseReads.projects.findUnique({
+    where: {
+      Id: projectId
+    },
+    select: {
+      Id: true,
+      GroupId: true,
+      Name: true,
+      Description: true,
+      DateCreated: true,
+      DateArchived: true,
+      Language: true,
+      AllowDownloads: true,
+      IsPublic: true,
+      ApplicationType: {
+        select: {
+          Description: true
+        }
+      },
+      Organization: {
+        select: {
+          Id: true,
+          LogoUrl: true,
+          Name: true,
+          ContactEmail: true
+        }
+      },
+      Products: {
+        select: {
+          Id: true,
+          ProductDefinition: {
+            select: {
+              Name: true
+            }
+          },
+          ProductPublications: {
+            where: {
+              Success: true
+            },
+            orderBy: {
+              DateUpdated: 'desc'
+            },
+            take: 1,
+            select: {
+              ProductBuild: {
+                select: {
+                  Id: true,
+                  Version: true,
+                  BuildId: true,
+                  Success: true,
+                  ProductArtifacts: {
+                    select: {
+                      ArtifactType: true,
+                      FileSize: true,
+                      Url: true,
+                      DateUpdated: true
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      },
+      Owner: {
+        select: {
+          Id: true,
+          Name: true
+        }
+      }
+    }
+  });
+  if (!project) return error(404);
+  // Is this the right error? Should 404 be returned instead?
+  if (!project.IsPublic) return error(403);
+
+  // This assumes that a null value is meant as false
+  const allowDownloads = !!(
+    project.AllowDownloads ||
+    (await DatabaseReads.organizationMemberships.findFirst({
+      where: { OrganizationId: project.Organization.Id, UserId: locals.security.userId }
+    }))
+  );
+
+  if (!allowDownloads) {
+    project.Products.forEach((p) => {
+      p.ProductPublications.forEach((pp) => {
+        pp.ProductBuild.ProductArtifacts.forEach((pa) => {
+          pa.Url = null;
+        });
+      });
+    });
+  }
+
+  return {
+    project,
+    allowDownloads,
+    sessionGroups: (
+      await DatabaseReads.groupMemberships.findMany({
+        where: { UserId: locals.security.userId },
+        select: {
+          GroupId: true
+        }
+      })
+    ).map((gm) => gm.GroupId)
+  };
+}) satisfies PageServerLoad;
diff --git a/src/routes/(authenticated)/directory/[id]/+page.svelte b/src/routes/(authenticated)/directory/[id=idNumber]/+page.svelte
similarity index 89%
rename from src/routes/(authenticated)/directory/[id]/+page.svelte
rename to src/routes/(authenticated)/directory/[id=idNumber]/+page.svelte
index 5392fba74d..a8a39b1bae 100644
--- a/src/routes/(authenticated)/directory/[id]/+page.svelte
+++ b/src/routes/(authenticated)/directory/[id=idNumber]/+page.svelte
@@ -5,8 +5,8 @@
   import { getIcon } from '$lib/icons/productDefinitionIcon';
   import { m } from '$lib/paraglide/messages';
   import { getLocale, localizeHref } from '$lib/paraglide/runtime';
+  import { RoleId } from '$lib/prisma';
   import BuildArtifacts from '$lib/products/components/BuildArtifacts.svelte';
-  import { canModifyProject } from '$lib/projects';
   import { byName } from '$lib/utils/sorting';
   import { getRelativeTime, getTimeDateString } from '$lib/utils/time';
 
@@ -16,12 +16,22 @@
 
   let { data }: Props = $props();
   const time = $derived(getRelativeTime(data.project.DateCreated));
+
+  function canViewProject(project: typeof data.project) {
+    return (
+      data.session.user.roles.some(
+        ([org, role]) =>
+          (org === project.Organization.Id && role === RoleId.OrgAdmin) ||
+          role === RoleId.SuperAdmin
+      ) || data.sessionGroups.includes(project.GroupId)
+    );
+  }
 </script>
 
 <div class="w-full max-w-6xl mx-auto relative">
   <div class="flex flex-col p-6">
     <div>
-      {#if canModifyProject(data.session, data.project.Owner.Id, data.project.Organization.Id)}
+      {#if canViewProject(data.project)}
         <a class="link" href={localizeHref(`/projects/${data.project.Id}`)}>
           <h1 class="p-0">
             {data.project?.Name} ({data.project.Language ?? ''})
diff --git a/src/routes/(authenticated)/directory/[id]/+page.server.ts b/src/routes/(authenticated)/directory/[id]/+page.server.ts
deleted file mode 100644
index 1b1ba82054..0000000000
--- a/src/routes/(authenticated)/directory/[id]/+page.server.ts
+++ /dev/null
@@ -1,104 +0,0 @@
-import { error } from '@sveltejs/kit';
-import type { PageServerLoad } from './$types';
-import { DatabaseReads } from '$lib/server/database';
-
-export const load = (async ({ params, locals }) => {
-  // need this for org membership check
-  const user = (await locals.auth())!.user;
-  if (isNaN(parseInt(params.id))) return error(400);
-  const projectCheck = await DatabaseReads.projects.findUnique({
-    where: {
-      Id: parseInt(params.id)
-    },
-    select: {
-      AllowDownloads: true,
-      IsPublic: true,
-      OrganizationId: true
-    }
-  });
-  if (!projectCheck) return error(404);
-  // Is this the right error? Should 404 be returned instead?
-  if (!projectCheck.IsPublic) return error(403);
-
-  // This assumes that a null value is meant as false
-  const allowDownloads = !!(
-    projectCheck.AllowDownloads ||
-    (await DatabaseReads.organizationMemberships.findFirst({
-      where: { OrganizationId: projectCheck.OrganizationId, UserId: user.userId }
-    }))
-  );
-
-  return {
-    project: await DatabaseReads.projects.findUniqueOrThrow({
-      where: {
-        Id: parseInt(params.id)
-      },
-      select: {
-        Id: true,
-        Name: true,
-        Description: true,
-        DateCreated: true,
-        DateArchived: true,
-        Language: true,
-        AllowDownloads: true,
-        ApplicationType: {
-          select: {
-            Description: true
-          }
-        },
-        Organization: {
-          select: {
-            Id: true,
-            LogoUrl: true,
-            Name: true,
-            ContactEmail: true
-          }
-        },
-        Products: {
-          select: {
-            Id: true,
-            ProductDefinition: {
-              select: {
-                Name: true
-              }
-            },
-            ProductPublications: {
-              where: {
-                Success: true
-              },
-              orderBy: {
-                DateUpdated: 'desc'
-              },
-              take: 1,
-              select: {
-                ProductBuild: {
-                  select: {
-                    Id: true,
-                    Version: true,
-                    BuildId: true,
-                    Success: true,
-                    ProductArtifacts: {
-                      select: {
-                        ArtifactType: true,
-                        FileSize: true,
-                        Url: allowDownloads,
-                        DateUpdated: true
-                      }
-                    }
-                  }
-                }
-              }
-            }
-          }
-        },
-        Owner: {
-          select: {
-            Id: true,
-            Name: true
-          }
-        }
-      }
-    }),
-    allowDownloads
-  };
-}) satisfies PageServerLoad;
diff --git a/src/routes/(authenticated)/organizations/+page.server.ts b/src/routes/(authenticated)/organizations/+page.server.ts
index f9f74cfd92..7998f87ded 100644
--- a/src/routes/(authenticated)/organizations/+page.server.ts
+++ b/src/routes/(authenticated)/organizations/+page.server.ts
@@ -2,17 +2,17 @@ import { redirect } from '@sveltejs/kit';
 import type { PageServerLoad } from './$types';
 import { localizeHref } from '$lib/paraglide/runtime';
 import { DatabaseReads } from '$lib/server/database';
-import { isSuperAdmin } from '$lib/utils/roles';
 
 export const load = (async (event) => {
-  const user = (await event.locals.auth())!.user;
+  event.locals.security.requireAdminOfAny();
+
   const organizations = await DatabaseReads.organizations.findMany({
-    where: isSuperAdmin(user.roles)
-      ? undefined
+    where: event.locals.security.isSuperAdmin
+      ? {}
       : {
           OrganizationMemberships: {
             some: {
-              UserId: user.userId
+              UserId: event.locals.security.userId
             }
           }
         },
diff --git a/src/routes/(authenticated)/organizations/[id]/+layout.server.ts b/src/routes/(authenticated)/organizations/[id=idNumber]/+layout.server.ts
similarity index 83%
rename from src/routes/(authenticated)/organizations/[id]/+layout.server.ts
rename to src/routes/(authenticated)/organizations/[id=idNumber]/+layout.server.ts
index 51f3b3e25d..2be3968597 100644
--- a/src/routes/(authenticated)/organizations/[id]/+layout.server.ts
+++ b/src/routes/(authenticated)/organizations/[id=idNumber]/+layout.server.ts
@@ -5,8 +5,7 @@ import { DatabaseReads } from '$lib/server/database';
 
 export const load = (async (event) => {
   const id = parseInt(event.params.id);
-  // perms checked in auth.ts
-  if (isNaN(id)) return redirect(302, localizeHref('/organizations'));
+  event.locals.security.requireAdminOfOrg(id);
   const organization = await DatabaseReads.organizations.findUnique({
     where: {
       Id: id
diff --git a/src/routes/(authenticated)/organizations/[id]/settings/+page.server.ts b/src/routes/(authenticated)/organizations/[id=idNumber]/+page.server.ts
similarity index 89%
rename from src/routes/(authenticated)/organizations/[id]/settings/+page.server.ts
rename to src/routes/(authenticated)/organizations/[id=idNumber]/+page.server.ts
index 0adef9fea1..aac6279238 100644
--- a/src/routes/(authenticated)/organizations/[id]/settings/+page.server.ts
+++ b/src/routes/(authenticated)/organizations/[id=idNumber]/+page.server.ts
@@ -4,5 +4,6 @@ import { localizeHref } from '$lib/paraglide/runtime';
 
 // We don't have anything on this page currently, so just redirect to the basic info page
 export const load = (async (event) => {
+  event.locals.security.requireAuthenticated();
   return redirect(308, localizeHref(`/organizations/${event.params.id}/settings/info`));
 }) satisfies PageServerLoad;
diff --git a/src/routes/(authenticated)/organizations/[id]/+page.svelte b/src/routes/(authenticated)/organizations/[id=idNumber]/+page.svelte
similarity index 100%
rename from src/routes/(authenticated)/organizations/[id]/+page.svelte
rename to src/routes/(authenticated)/organizations/[id=idNumber]/+page.svelte
diff --git a/src/routes/(authenticated)/organizations/[id]/settings/+layout.svelte b/src/routes/(authenticated)/organizations/[id=idNumber]/settings/+layout.svelte
similarity index 100%
rename from src/routes/(authenticated)/organizations/[id]/settings/+layout.svelte
rename to src/routes/(authenticated)/organizations/[id=idNumber]/settings/+layout.svelte
diff --git a/src/routes/(authenticated)/organizations/[id]/+page.server.ts b/src/routes/(authenticated)/organizations/[id=idNumber]/settings/+page.server.ts
similarity index 89%
rename from src/routes/(authenticated)/organizations/[id]/+page.server.ts
rename to src/routes/(authenticated)/organizations/[id=idNumber]/settings/+page.server.ts
index 0adef9fea1..aac6279238 100644
--- a/src/routes/(authenticated)/organizations/[id]/+page.server.ts
+++ b/src/routes/(authenticated)/organizations/[id=idNumber]/settings/+page.server.ts
@@ -4,5 +4,6 @@ import { localizeHref } from '$lib/paraglide/runtime';
 
 // We don't have anything on this page currently, so just redirect to the basic info page
 export const load = (async (event) => {
+  event.locals.security.requireAuthenticated();
   return redirect(308, localizeHref(`/organizations/${event.params.id}/settings/info`));
 }) satisfies PageServerLoad;
diff --git a/src/routes/(authenticated)/organizations/[id]/settings/+page.svelte b/src/routes/(authenticated)/organizations/[id=idNumber]/settings/+page.svelte
similarity index 100%
rename from src/routes/(authenticated)/organizations/[id]/settings/+page.svelte
rename to src/routes/(authenticated)/organizations/[id=idNumber]/settings/+page.svelte
diff --git a/src/routes/(authenticated)/organizations/[id]/settings/groups/+page.server.ts b/src/routes/(authenticated)/organizations/[id=idNumber]/settings/groups/+page.server.ts
similarity index 88%
rename from src/routes/(authenticated)/organizations/[id]/settings/groups/+page.server.ts
rename to src/routes/(authenticated)/organizations/[id=idNumber]/settings/groups/+page.server.ts
index a92835512b..aa4b79c894 100644
--- a/src/routes/(authenticated)/organizations/[id]/settings/groups/+page.server.ts
+++ b/src/routes/(authenticated)/organizations/[id=idNumber]/settings/groups/+page.server.ts
@@ -11,6 +11,7 @@ const addGroupSchema = v.object({
 });
 
 export const load = (async (event) => {
+  event.locals.security.requireAdminOfOrg(parseInt(event.params.id));
   const { organization } = await event.parent();
   return {
     groups: await DatabaseReads.groups.findMany({ where: { OwnerId: organization.Id } }),
@@ -20,6 +21,7 @@ export const load = (async (event) => {
 
 export const actions = {
   async addGroup(event) {
+    event.locals.security.requireAdminOfOrg(parseInt(event.params.id));
     const form = await superValidate(event.request, valibot(addGroupSchema));
     if (!form.valid) return fail(400, { form, ok: false });
     const group = await DatabaseWrites.groups.createGroup(
@@ -30,6 +32,7 @@ export const actions = {
     return { form, ok: true, createdId: group.Id };
   },
   async deleteGroup(event) {
+    event.locals.security.requireAdminOfOrg(parseInt(event.params.id));
     const form = await superValidate(event.request, valibot(deleteSchema));
     if (!form.valid) return fail(400, { form, ok: false });
     if (
diff --git a/src/routes/(authenticated)/organizations/[id]/settings/groups/+page.svelte b/src/routes/(authenticated)/organizations/[id=idNumber]/settings/groups/+page.svelte
similarity index 100%
rename from src/routes/(authenticated)/organizations/[id]/settings/groups/+page.svelte
rename to src/routes/(authenticated)/organizations/[id=idNumber]/settings/groups/+page.svelte
diff --git a/src/routes/(authenticated)/organizations/[id]/settings/info/+page.server.ts b/src/routes/(authenticated)/organizations/[id=idNumber]/settings/info/+page.server.ts
similarity index 88%
rename from src/routes/(authenticated)/organizations/[id]/settings/info/+page.server.ts
rename to src/routes/(authenticated)/organizations/[id=idNumber]/settings/info/+page.server.ts
index f433cbeed6..a79c0ef304 100644
--- a/src/routes/(authenticated)/organizations/[id]/settings/info/+page.server.ts
+++ b/src/routes/(authenticated)/organizations/[id=idNumber]/settings/info/+page.server.ts
@@ -5,6 +5,7 @@ import { infoSchema } from '$lib/organizations';
 import { DatabaseWrites } from '$lib/server/database';
 
 export const load = (async (event) => {
+  event.locals.security.requireAdminOfOrg(parseInt(event.params.id));
   const { organization } = await event.parent();
   const form = await superValidate(
     {
@@ -19,6 +20,7 @@ export const load = (async (event) => {
 
 export const actions = {
   async default(event) {
+    event.locals.security.requireAdminOfOrg(parseInt(event.params.id));
     const form = await superValidate(event.request, valibot(infoSchema));
     if (!form.valid) return fail(400, { form, ok: false });
     await DatabaseWrites.organizations.update({
diff --git a/src/routes/(authenticated)/organizations/[id]/settings/info/+page.svelte b/src/routes/(authenticated)/organizations/[id=idNumber]/settings/info/+page.svelte
similarity index 100%
rename from src/routes/(authenticated)/organizations/[id]/settings/info/+page.svelte
rename to src/routes/(authenticated)/organizations/[id=idNumber]/settings/info/+page.svelte
diff --git a/src/routes/(authenticated)/organizations/[id]/settings/infrastructure/+page.server.ts b/src/routes/(authenticated)/organizations/[id=idNumber]/settings/infrastructure/+page.server.ts
similarity index 90%
rename from src/routes/(authenticated)/organizations/[id]/settings/infrastructure/+page.server.ts
rename to src/routes/(authenticated)/organizations/[id=idNumber]/settings/infrastructure/+page.server.ts
index a17f9323c4..ef0e464281 100644
--- a/src/routes/(authenticated)/organizations/[id]/settings/infrastructure/+page.server.ts
+++ b/src/routes/(authenticated)/organizations/[id=idNumber]/settings/infrastructure/+page.server.ts
@@ -5,6 +5,7 @@ import { infrastructureSchema } from '$lib/organizations';
 import { DatabaseWrites } from '$lib/server/database';
 
 export const load = (async (event) => {
+  event.locals.security.requireAdminOfOrg(parseInt(event.params.id));
   const { organization } = await event.parent();
   const form = await superValidate(
     {
@@ -19,6 +20,7 @@ export const load = (async (event) => {
 
 export const actions = {
   async default(event) {
+    event.locals.security.requireAdminOfOrg(parseInt(event.params.id));
     const form = await superValidate(event.request, valibot(infrastructureSchema));
     if (!form.valid) return fail(400, { form, ok: false });
     await DatabaseWrites.organizations.update({
diff --git a/src/routes/(authenticated)/organizations/[id]/settings/infrastructure/+page.svelte b/src/routes/(authenticated)/organizations/[id=idNumber]/settings/infrastructure/+page.svelte
similarity index 100%
rename from src/routes/(authenticated)/organizations/[id]/settings/infrastructure/+page.svelte
rename to src/routes/(authenticated)/organizations/[id=idNumber]/settings/infrastructure/+page.svelte
diff --git a/src/routes/(authenticated)/organizations/[id]/settings/products/+page.server.ts b/src/routes/(authenticated)/organizations/[id=idNumber]/settings/products/+page.server.ts
similarity index 89%
rename from src/routes/(authenticated)/organizations/[id]/settings/products/+page.server.ts
rename to src/routes/(authenticated)/organizations/[id=idNumber]/settings/products/+page.server.ts
index aca37edbbb..2b61a9774b 100644
--- a/src/routes/(authenticated)/organizations/[id]/settings/products/+page.server.ts
+++ b/src/routes/(authenticated)/organizations/[id=idNumber]/settings/products/+page.server.ts
@@ -15,6 +15,7 @@ const toggleProductSchema = v.object({
 });
 
 export const load = (async (event) => {
+  event.locals.security.requireAdminOfOrg(parseInt(event.params.id));
   const { organization } = await event.parent();
   const setOrgProductDefs = new Set(
     (
@@ -35,6 +36,7 @@ export const load = (async (event) => {
 
 export const actions = {
   async togglePublic(event) {
+    event.locals.security.requireAdminOfOrg(parseInt(event.params.id));
     const form = await superValidate(event.request, valibot(togglePublicSchema));
     if (!form.valid) return fail(400, { form, ok: false });
     await DatabaseWrites.organizations.update({
@@ -48,6 +50,7 @@ export const actions = {
     return { form, ok: true };
   },
   async toggleProduct(event) {
+    event.locals.security.requireAdminOfOrg(parseInt(event.params.id));
     const form = await superValidate(event.request, valibot(toggleProductSchema));
     if (!form.valid) return fail(400, { form, ok: false });
     await DatabaseWrites.organizationProductDefinitions.toggleForOrg(
diff --git a/src/routes/(authenticated)/organizations/[id]/settings/products/+page.svelte b/src/routes/(authenticated)/organizations/[id=idNumber]/settings/products/+page.svelte
similarity index 100%
rename from src/routes/(authenticated)/organizations/[id]/settings/products/+page.svelte
rename to src/routes/(authenticated)/organizations/[id=idNumber]/settings/products/+page.svelte
diff --git a/src/routes/(authenticated)/organizations/[id]/settings/stores/+page.server.ts b/src/routes/(authenticated)/organizations/[id=idNumber]/settings/stores/+page.server.ts
similarity index 89%
rename from src/routes/(authenticated)/organizations/[id]/settings/stores/+page.server.ts
rename to src/routes/(authenticated)/organizations/[id=idNumber]/settings/stores/+page.server.ts
index 9df7989e9d..fbb0712b20 100644
--- a/src/routes/(authenticated)/organizations/[id]/settings/stores/+page.server.ts
+++ b/src/routes/(authenticated)/organizations/[id=idNumber]/settings/stores/+page.server.ts
@@ -11,6 +11,7 @@ const toggleStoreSchema = v.object({
 });
 
 export const load = (async (event) => {
+  event.locals.security.requireAdminOfOrg(parseInt(event.params.id));
   const { organization } = await event.parent();
   const orgStores = await DatabaseReads.organizationStores.findMany({
     where: {
@@ -28,6 +29,7 @@ export const load = (async (event) => {
 
 export const actions = {
   async default(event) {
+    event.locals.security.requireAdminOfOrg(parseInt(event.params.id));
     const form = await superValidate(event.request, valibot(toggleStoreSchema));
     if (!form.valid) return fail(400, { form, ok: false });
     await DatabaseWrites.organizationStores.toggleForOrg(
diff --git a/src/routes/(authenticated)/organizations/[id]/settings/stores/+page.svelte b/src/routes/(authenticated)/organizations/[id=idNumber]/settings/stores/+page.svelte
similarity index 100%
rename from src/routes/(authenticated)/organizations/[id]/settings/stores/+page.svelte
rename to src/routes/(authenticated)/organizations/[id=idNumber]/settings/stores/+page.svelte
diff --git a/src/routes/(authenticated)/products/[id]/files/+page.server.ts b/src/routes/(authenticated)/products/[id]/files/+page.server.ts
index feff3bdaea..2507c851ac 100644
--- a/src/routes/(authenticated)/products/[id]/files/+page.server.ts
+++ b/src/routes/(authenticated)/products/[id]/files/+page.server.ts
@@ -1,12 +1,27 @@
-import { fail } from '@sveltejs/kit';
+import { error, fail } from '@sveltejs/kit';
 import { superValidate } from 'sveltekit-superforms';
 import { valibot } from 'sveltekit-superforms/adapters';
 import type { Actions, PageServerLoad } from './$types';
 import { DatabaseReads } from '$lib/server/database';
 import { paginateSchema } from '$lib/valibot';
 
-export const load = (async ({ params }) => {
-  // auth handled by hooks
+export const load = (async ({ params, locals }) => {
+  const project = (
+    await DatabaseReads.products.findUnique({
+      where: { Id: params.id },
+      select: {
+        Project: { select: { OwnerId: true, OrganizationId: true, GroupId: true } },
+        Id: true
+      }
+    })
+  )?.Project;
+  if (!project) error(404);
+  locals.security.requireProjectReadAccess(
+    await DatabaseReads.groupMemberships.findMany({
+      where: { UserId: locals.security.userId, GroupId: project.GroupId }
+    }),
+    project
+  );
   const builds = await DatabaseReads.productBuilds.findMany({
     orderBy: [
       {
@@ -72,8 +87,21 @@ export const load = (async ({ params }) => {
 }) satisfies PageServerLoad;
 
 export const actions = {
-  page: async ({ request, params }) => {
-    // auth handled by hooks
+  page: async ({ request, params, locals }) => {
+    const project = (
+      await DatabaseReads.products.findUnique({
+        where: { Id: params.id },
+        select: {
+          Project: { select: { OwnerId: true, OrganizationId: true, GroupId: true } }
+        }
+      })
+    )?.Project;
+    if (!project) error(404);
+    locals.security.requireProjectReadAccess(
+      await DatabaseReads.groupMemberships.findMany({
+        where: { UserId: locals.security.userId, GroupId: project.GroupId }
+      })
+    );
     const form = await superValidate(request, valibot(paginateSchema));
     if (!form.valid) return fail(400, { form, ok: false });
 
diff --git a/src/routes/(authenticated)/projects/[filter=projectSelector]/+page.server.ts b/src/routes/(authenticated)/projects/[filter=projectSelector]/+page.server.ts
index 5115bc7e1f..c7d2652e48 100644
--- a/src/routes/(authenticated)/projects/[filter=projectSelector]/+page.server.ts
+++ b/src/routes/(authenticated)/projects/[filter=projectSelector]/+page.server.ts
@@ -3,8 +3,8 @@ import type { PageServerLoad } from './$types';
 import { localizeHref } from '$lib/paraglide/runtime';
 
 export const load = (async (event) => {
-  const data = await event.parent();
-  let orgDefault = data.organizations[0]?.Id;
+  event.locals.security.requireAuthenticated();
+  let orgRedirect = event.locals.security.organizationMemberships[0];
 
   // Try to get orgLastSelected from cookie
   const cookieHeader = event.request.headers.get('cookie');
@@ -13,14 +13,17 @@ export const load = (async (event) => {
     if (match) {
       const orgLastSelected = decodeURIComponent(match[1]);
       // Only use if it matches an org in the list
-      if (data.organizations.some((org) => String(org.Id) === orgLastSelected)) {
-        orgDefault = Number(orgLastSelected);
+      if (
+        !isNaN(Number(orgLastSelected)) &&
+        event.locals.security.organizationMemberships.includes(Number(orgLastSelected))
+      ) {
+        orgRedirect = Number(orgLastSelected);
       }
     }
   }
 
-  if (data.organizations.length >= 1) {
-    return redirect(302, localizeHref(`/projects/${event.params.filter}/${orgDefault}`));
+  if (orgRedirect) {
+    return redirect(302, localizeHref(`/projects/${event.params.filter}/${orgRedirect}`));
   }
   return {};
 }) satisfies PageServerLoad;
diff --git a/src/routes/(authenticated)/projects/[filter=projectSelector]/[id]/+page.server.ts b/src/routes/(authenticated)/projects/[filter=projectSelector]/[orgId=idNumber]/+page.server.ts
similarity index 69%
rename from src/routes/(authenticated)/projects/[filter=projectSelector]/[id]/+page.server.ts
rename to src/routes/(authenticated)/projects/[filter=projectSelector]/[orgId=idNumber]/+page.server.ts
index 73ba29bbe7..a1cbaca5f7 100644
--- a/src/routes/(authenticated)/projects/[filter=projectSelector]/[id]/+page.server.ts
+++ b/src/routes/(authenticated)/projects/[filter=projectSelector]/[orgId=idNumber]/+page.server.ts
@@ -5,19 +5,13 @@ import { valibot } from 'sveltekit-superforms/adapters';
 import * as v from 'valibot';
 import type { PageServerLoad } from './$types';
 import { localizeHref } from '$lib/paraglide/runtime';
+import { RoleId } from '$lib/prisma';
 import { ProductActionType } from '$lib/products';
 import { doProductAction } from '$lib/products/server';
-import {
-  type MaybeSession,
-  bulkProjectActionSchema,
-  canModifyProject,
-  projectSearchSchema,
-  pruneProjects
-} from '$lib/projects';
+import { bulkProjectActionSchema, projectSearchSchema, pruneProjects } from '$lib/projects';
 import { doProjectAction, projectFilter, userGroupsForOrg } from '$lib/projects/server';
 import { QueueConnected } from '$lib/server/bullmq/queues';
 import { DatabaseReads } from '$lib/server/database';
-import { isAdminForOrg } from '$lib/utils/roles';
 import { stringIdSchema } from '$lib/valibot';
 
 const bulkProductActionSchema = v.object({
@@ -28,20 +22,20 @@ const bulkProductActionSchema = v.object({
 function whereStatements(
   paramFilter: string,
   orgId: number,
-  user: MaybeSession
+  user: Security
 ): Prisma.ProjectsWhereInput {
-  if (isAdminForOrg(orgId, user?.user.roles)) {
-    return filter(paramFilter, orgId, user?.user.userId);
+  if (user.isSuperAdmin || user.roles.get(orgId)?.includes(RoleId.OrgAdmin)) {
+    return filter(paramFilter, orgId, user.userId);
   } else {
     return {
       Group: {
         GroupMemberships: {
           some: {
-            UserId: user?.user.userId
+            UserId: user.userId
           }
         }
       },
-      ...filter(paramFilter, orgId, user?.user.userId)
+      ...filter(paramFilter, orgId, user.userId)
     };
   }
 }
@@ -83,18 +77,14 @@ function filter(filter: string, orgId: number, userId?: number): Prisma.Projects
 }
 
 export const load = (async ({ params, locals }) => {
-  const session = (await locals.auth())!;
-  const orgId = parseInt(params.id);
-  if (
-    isNaN(orgId) ||
-    !(orgId + '' === params.id) ||
-    !(await DatabaseReads.organizations.findFirst({ where: { Id: orgId } }))
-  ) {
+  locals.security.requireMemberOfOrgOrSuperAdmin(parseInt(params.orgId));
+  const orgId = parseInt(params.orgId);
+  if (!(await DatabaseReads.organizations.findFirst({ where: { Id: orgId } }))) {
     return redirect(302, localizeHref(`/projects/${params.filter}`));
   }
 
   const projects = await DatabaseReads.projects.findMany({
-    where: whereStatements(params.filter, orgId, session),
+    where: whereStatements(params.filter, orgId, locals.security),
     include: {
       Products: {
         include: {
@@ -126,7 +116,7 @@ export const load = (async ({ params, locals }) => {
       valibot(projectSearchSchema)
     ),
     count: await DatabaseReads.projects.count({
-      where: whereStatements(params.filter, orgId, session)
+      where: whereStatements(params.filter, orgId, locals.security)
     }),
     actionForm: await superValidate(valibot(bulkProjectActionSchema)),
     productForm: await superValidate(valibot(bulkProductActionSchema)),
@@ -134,23 +124,22 @@ export const load = (async ({ params, locals }) => {
     /** allow actions other than reactivation */
     allowActions: params.filter !== 'archived',
     allowReactivate: params.filter === 'all' || params.filter === 'archived',
-    userGroups: (await userGroupsForOrg(session.user.userId, orgId)).map((g) => g.GroupId),
+    userGroups: (await userGroupsForOrg(locals.security.userId, orgId)).map((g) => g.GroupId),
     jobsAvailable: QueueConnected()
   };
 }) satisfies PageServerLoad;
 
 export const actions: Actions = {
   page: async function ({ params, request, locals }) {
-    const user = (await locals.auth())!;
-
+    locals.security.requireMemberOfOrgOrSuperAdmin(parseInt(params.orgId!));
     const form = await superValidate(request, valibot(projectSearchSchema));
     if (!form.valid) return fail(400, { form, ok: false });
 
-    const organizationId = parseInt(params.id!);
+    const organizationId = parseInt(params.orgId!);
 
     const where: Prisma.ProjectsWhereInput = {
       ...projectFilter({ ...form.data, organizationId }),
-      ...whereStatements(params.filter!, organizationId, user)
+      ...whereStatements(params.filter!, organizationId, locals.security)
     };
 
     const projects = await DatabaseReads.projects.findMany({
@@ -181,16 +170,8 @@ export const actions: Actions = {
     return { form, ok: true, query: { data: pruneProjects(projects), count } };
   },
   projectAction: async (event) => {
-    const session = await event.locals.auth();
-    if (!session) return fail(403);
-    const orgId = parseInt(event.params.id!);
-    if (
-      isNaN(orgId) ||
-      !(orgId + '' === event.params.id) ||
-      !(await DatabaseReads.organizations.findFirst({ where: { Id: orgId } }))
-    ) {
-      return fail(404);
-    }
+    const orgId = parseInt(event.params.orgId!);
+    event.locals.security.requireMemberOfOrgOrSuperAdmin(parseInt(event.params.orgId!));
 
     if (!QueueConnected()) return error(503);
 
@@ -211,29 +192,37 @@ export const actions: Actions = {
         Id: true,
         DateArchived: true,
         OwnerId: true,
-        GroupId: true
+        GroupId: true,
+        OrganizationId: true
       }
     });
-    if (!projects.every((p) => canModifyProject(session, p.OwnerId, orgId))) {
-      return fail(403);
-    }
 
-    const groups =
+    const groups = await userGroupsForOrg(event.locals.security.userId, orgId);
+
+    projects.forEach(
       form.data.operation === 'claim'
-        ? (await userGroupsForOrg(session.user.userId, orgId)).map((g) => g.GroupId)
-        : [];
+        ? (p: (typeof projects)[0]) => event.locals.security.requireProjectClaimable(groups, p)
+        : (p: (typeof projects)[0]) => event.locals.security.requireProjectWriteAccess(p)
+    );
+
     await Promise.all(
       projects.map(async (project) => {
-        await doProjectAction(form.data.operation, project, session, orgId, groups);
+        await doProjectAction(
+          form.data.operation,
+          project,
+          event.locals.security,
+          orgId,
+          groups.map((g) => g.GroupId)
+        );
       })
     );
 
     return { form, ok: true };
   },
   productAction: async (event) => {
-    const session = await event.locals.auth();
-    const orgId = parseInt(event.params.id!);
-    if (isNaN(orgId) || !(orgId + '' === event.params.id)) return fail(404);
+    event.locals.security.requireMemberOfOrgOrSuperAdmin(parseInt(event.params.orgId!));
+    const orgId = parseInt(event.params.orgId!);
+    if (isNaN(orgId) || !(orgId + '' === event.params.orgId)) return fail(404);
 
     if (!QueueConnected()) return error(503);
 
@@ -243,27 +232,26 @@ export const actions: Actions = {
     // if any associated project is inaccessible, 403
     // if user modified hidden values
     if (
-      !(
-        (await DatabaseReads.products.count({ where: { Id: { in: form.data.products } } })) ===
-          form.data.products.length &&
-        (
-          await DatabaseReads.projects.findMany({
-            where: {
-              Products: {
-                some: {
-                  Id: { in: form.data.products }
-                }
-              }
-            },
-            select: {
-              OwnerId: true
-            }
-          })
-        ).every((p) => canModifyProject(session, p.OwnerId, orgId))
-      )
+      (await DatabaseReads.products.count({ where: { Id: { in: form.data.products } } })) !==
+      form.data.products.length
     ) {
-      return fail(403);
+      throw error(403);
     }
+    (
+      await DatabaseReads.projects.findMany({
+        where: {
+          Products: {
+            some: {
+              Id: { in: form.data.products }
+            }
+          }
+        },
+        select: {
+          OwnerId: true,
+          OrganizationId: true
+        }
+      })
+    ).forEach((p) => event.locals.security.requireProjectWriteAccess(p));
 
     await Promise.all(form.data.products.map((p) => doProductAction(p, form.data.operation!)));
 
diff --git a/src/routes/(authenticated)/projects/[filter=projectSelector]/[id]/+page.svelte b/src/routes/(authenticated)/projects/[filter=projectSelector]/[orgId=idNumber]/+page.svelte
similarity index 97%
rename from src/routes/(authenticated)/projects/[filter=projectSelector]/[id]/+page.svelte
rename to src/routes/(authenticated)/projects/[filter=projectSelector]/[orgId=idNumber]/+page.svelte
index a01441511d..433340493c 100644
--- a/src/routes/(authenticated)/projects/[filter=projectSelector]/[id]/+page.svelte
+++ b/src/routes/(authenticated)/projects/[filter=projectSelector]/[orgId=idNumber]/+page.svelte
@@ -21,7 +21,7 @@
   import ProjectFilterSelector from '$lib/projects/components/ProjectFilterSelector.svelte';
   import { orgActive } from '$lib/stores';
   import { toast } from '$lib/utils';
-  import { hasRoleForOrg, isAdminForOrg } from '$lib/utils/roles';
+  import { isAdminForOrg } from '$lib/utils/roles';
   import { byName, byString } from '$lib/utils/sorting';
 
   interface Props {
@@ -116,10 +116,10 @@
   });
 
   let canArchiveSelected = $derived(
-    selectedProjects.every((p) => canArchive(p, page.data.session, $orgActive))
+    selectedProjects.every((p) => canArchive(p, data.session.user, $orgActive))
   );
   let canReactivateSelected = $derived(
-    selectedProjects.every((p) => canReactivate(p, page.data.session, $orgActive))
+    selectedProjects.every((p) => canReactivate(p, data.session.user, $orgActive))
   );
 
   const {
@@ -150,7 +150,7 @@
 
   const canModifyProjects = $derived(
     isAdminForOrg($orgActive, data.session?.user.roles) ||
-      hasRoleForOrg(RoleId.AppBuilder, $orgActive, data.session?.user.roles)
+      data.session?.user.roles.some(([o, r]) => r === RoleId.AppBuilder && o === $orgActive)
   );
 </script>
 
@@ -412,7 +412,7 @@
             {/if}
           {/snippet}
           {#snippet actions()}
-            {#if canModifyProjects || canClaimProject(data.session, project.OwnerId, $orgActive, project.GroupId, data.userGroups)}
+            {#if canModifyProjects || canClaimProject(data.session.user, project.OwnerId, $orgActive, project.GroupId, data.userGroups)}
               <ProjectActionMenu
                 data={data.actionForm}
                 {project}
diff --git a/src/routes/(authenticated)/projects/[id=idNumber]/+page.server.ts b/src/routes/(authenticated)/projects/[id=idNumber]/+page.server.ts
index 054c11f0cd..8bd18f6e63 100644
--- a/src/routes/(authenticated)/projects/[id=idNumber]/+page.server.ts
+++ b/src/routes/(authenticated)/projects/[id=idNumber]/+page.server.ts
@@ -34,9 +34,20 @@ const productActionSchema = v.object({
 });
 
 export const load = (async ({ locals, params }) => {
-  // permissions checked in auth
+  const projectId = Number(params.id);
+  if (isNaN(projectId)) throw error(404, 'Not Found');
+  locals.security.requireProjectReadAccess(
+    await DatabaseReads.groupMemberships.findMany({
+      where: { UserId: locals.security.userId },
+      select: { GroupId: true }
+    }),
+    await DatabaseReads.projects.findUnique({
+      where: { Id: projectId },
+      select: { OwnerId: true, OrganizationId: true, GroupId: true }
+    })
+  );
   return {
-    projectData: await getProjectDetails(parseInt(params.id), (await locals.auth())!.user.userId),
+    projectData: await getProjectDetails(projectId, locals.security.sessionForm),
     authorForm: await superValidate(valibot(addAuthorSchema)),
     reviewerForm: await superValidate({ language: baseLocale }, valibot(addReviewerSchema)),
     actionForm: await superValidate(valibot(projectActionSchema)),
@@ -52,7 +63,12 @@ async function verifyProduct(event: RequestEvent, Id: string) {
 
 export const actions = {
   async deleteProduct(event) {
-    // permissions checked in auth
+    event.locals.security.requireProjectWriteAccess(
+      await DatabaseReads.projects.findUnique({
+        where: { Id: parseInt(event.params.id) },
+        select: { OwnerId: true, OrganizationId: true }
+      })
+    );
     if (!QueueConnected()) return error(503);
     const form = await superValidate(event.request, valibot(productActionSchema));
     if (!form.valid) return fail(400, { form, ok: false });
@@ -64,7 +80,12 @@ export const actions = {
     return { form, ok: true };
   },
   async deleteAuthor(event) {
-    // permissions checked in auth
+    event.locals.security.requireProjectWriteAccess(
+      await DatabaseReads.projects.findUnique({
+        where: { Id: parseInt(event.params.id) },
+        select: { OwnerId: true, OrganizationId: true }
+      })
+    );
     if (!QueueConnected()) return error(503);
     const form = await superValidate(event.request, valibot(deleteSchema));
     if (!form.valid) return fail(400, { form, ok: false });
@@ -91,7 +112,13 @@ export const actions = {
     return { form, ok: true };
   },
   async deleteReviewer(event) {
-    // permissions checked in auth
+    event.locals.security.requireProjectWriteAccess(
+      await DatabaseReads.projects.findUnique({
+        where: { Id: parseInt(event.params.id) },
+        select: { OwnerId: true, OrganizationId: true }
+      })
+    );
+    if (!QueueConnected()) return error(503);
     const form = await superValidate(event.request, valibot(deleteSchema));
     if (!form.valid) return fail(400, { form, ok: false });
     if (
@@ -106,7 +133,12 @@ export const actions = {
     return { form, ok: true };
   },
   async addProduct(event) {
-    // permissions checked in auth
+    event.locals.security.requireProjectWriteAccess(
+      await DatabaseReads.projects.findUnique({
+        where: { Id: parseInt(event.params.id) },
+        select: { OwnerId: true, OrganizationId: true }
+      })
+    );
     if (!QueueConnected()) return error(503);
     const form = await superValidate(event.request, valibot(addProductSchema));
     if (!form.valid) return fail(400, { form, ok: false });
@@ -131,7 +163,12 @@ export const actions = {
     return { form, ok: true };
   },
   async productAction(event) {
-    // permissions checked in auth
+    event.locals.security.requireProjectWriteAccess(
+      await DatabaseReads.projects.findUnique({
+        where: { Id: parseInt(event.params.id) },
+        select: { OwnerId: true, OrganizationId: true }
+      })
+    );
     if (!QueueConnected()) return error(503);
     const form = await superValidate(event.request, valibot(productActionSchema));
     if (!form.valid) return fail(400, { form, ok: false });
@@ -144,7 +181,12 @@ export const actions = {
     return { form, ok: true };
   },
   async updateProduct(event) {
-    // permissions checked in auth
+    event.locals.security.requireProjectWriteAccess(
+      await DatabaseReads.projects.findUnique({
+        where: { Id: parseInt(event.params.id) },
+        select: { OwnerId: true, OrganizationId: true }
+      })
+    );
     const form = await superValidate(event.request, valibot(updateProductPropertiesSchema));
     if (!form.valid) return fail(400, { form, ok: false });
     // if user modified hidden values
@@ -158,25 +200,45 @@ export const actions = {
     return { form, ok: !!productId };
   },
   async addAuthor(event) {
-    // permissions checked in auth
+    event.locals.security.requireProjectWriteAccess(
+      await DatabaseReads.projects.findUnique({
+        where: { Id: parseInt(event.params.id) },
+        select: { OwnerId: true, OrganizationId: true }
+      })
+    );
     if (!QueueConnected()) return error(503);
     const form = await superValidate(event.request, valibot(addAuthorSchema));
     if (!form.valid) return fail(400, { form, ok: false });
     const projectId = parseInt(event.params.id);
     if (
       // if user modified hidden values
-      !(await DatabaseReads.organizationMemberships.findFirst({
+      !(await DatabaseReads.groupMemberships.findFirst({
         where: {
           UserId: form.data.author,
-          Organization: {
-            Projects: {
-              some: { Id: projectId }
+          Group: {
+            Owner: {
+              Projects: {
+                some: { Id: projectId }
+              }
             }
           }
         }
       }))
     ) {
-      return fail(403, { form, ok: false });
+      return fail(400, { form, ok: false });
+    }
+    if (
+      (await DatabaseReads.userRoles.count({
+        where: {
+          UserId: form.data.author,
+          RoleId: RoleId.Author,
+          Organization: {
+            Projects: { some: { Id: projectId } }
+          }
+        }
+      })) === 0
+    ) {
+      return fail(400, { form, ok: false });
     }
     // ISSUE: #1101 Appears that CanUpdate is not used
     const author = await DatabaseWrites.authors.create({
@@ -196,7 +258,12 @@ export const actions = {
     return { form, ok: true };
   },
   async addReviewer(event) {
-    // permissions checked in auth
+    event.locals.security.requireProjectWriteAccess(
+      await DatabaseReads.projects.findUnique({
+        where: { Id: parseInt(event.params.id) },
+        select: { OwnerId: true, OrganizationId: true }
+      })
+    );
     const form = await superValidate(event.request, valibot(addReviewerSchema));
     if (!form.valid) return fail(400, { form, ok: false });
     await DatabaseWrites.reviewers.create({
@@ -208,7 +275,12 @@ export const actions = {
     return { form, ok: true };
   },
   async toggleVisibility(event) {
-    // permissions checked in auth
+    event.locals.security.requireProjectWriteAccess(
+      await DatabaseReads.projects.findUnique({
+        where: { Id: parseInt(event.params.id) },
+        select: { OwnerId: true, OrganizationId: true }
+      })
+    );
     const form = await superValidate(
       event.request,
       valibot(
@@ -224,7 +296,12 @@ export const actions = {
     return { form, ok: true };
   },
   async toggleDownload(event) {
-    // permissions checked in auth
+    event.locals.security.requireProjectWriteAccess(
+      await DatabaseReads.projects.findUnique({
+        where: { Id: parseInt(event.params.id) },
+        select: { OwnerId: true, OrganizationId: true }
+      })
+    );
     const form = await superValidate(
       event.request,
       valibot(
@@ -240,16 +317,27 @@ export const actions = {
     return { form, ok: true };
   },
   async editOwnerGroup(event) {
-    // permissions checked in auth
+    event.locals.security.requireAuthenticated(); // check this first, so unauthenticated can't dos db
     const form = await superValidate(event.request, valibot(updateOwnerGroupSchema));
     if (!form.valid) return fail(400, { form, ok: false });
     const projectId = parseInt(event.params.id);
-    const project = await DatabaseReads.projects.findUniqueOrThrow({
+    const project = await DatabaseReads.projects.findUnique({
       where: { Id: projectId },
-      select: { OwnerId: true }
+      select: { OwnerId: true, OrganizationId: true, GroupId: true }
     });
-    // block if changing owner
-    if (project.OwnerId !== form.data.owner && !QueueConnected()) return error(503);
+    if (!project) return fail(404, { form, ok: false });
+    // changing ownership
+    if (project.OwnerId !== form.data.owner) {
+      event.locals.security.requireProjectClaimable(
+        await userGroupsForOrg(form.data.owner, project.OrganizationId),
+        project
+      );
+      if (!QueueConnected()) return error(503);
+    }
+    // changing group
+    if (project.GroupId !== form.data.group) {
+      event.locals.security.requireProjectWriteAccess(project);
+    }
     const success = await DatabaseWrites.projects.update(projectId, {
       GroupId: form.data.group,
       OwnerId: form.data.owner
@@ -257,12 +345,12 @@ export const actions = {
     return { form, ok: success };
   },
   async projectAction(event) {
-    // permissions checked in auth
+    event.locals.security.requireAuthenticated(); // check this first, so unauthenticated can't dos db
     if (!QueueConnected()) return error(503);
     const form = await superValidate(event.request, valibot(projectActionSchema));
     if (!form.valid || !form.data.operation) return fail(400, { form, ok: false });
     // prefer single project over array
-    const project = await DatabaseReads.projects.findUniqueOrThrow({
+    const project = await DatabaseReads.projects.findUnique({
       where: { Id: parseInt(event.params.id) },
       select: {
         Id: true,
@@ -273,19 +361,22 @@ export const actions = {
         OrganizationId: true
       }
     });
+    if (!project) return fail(404, { form, ok: false });
+    let groups: { GroupId: number }[] = [];
 
-    const session = (await event.locals.auth())!;
+    if (form.data.operation === 'claim') {
+      groups = await userGroupsForOrg(event.locals.security.userId, project.OrganizationId);
+      event.locals.security.requireProjectClaimable(groups, project);
+    } else {
+      event.locals.security.requireProjectWriteAccess(project);
+    }
 
     await doProjectAction(
       form.data.operation,
       project,
-      session,
+      event.locals.security,
       project.OrganizationId,
-      form.data.operation === 'claim'
-        ? (await userGroupsForOrg(session.user.userId, project.OrganizationId)).map(
-            (g) => g.GroupId
-          )
-        : []
+      groups.map((g) => g.GroupId)
     );
 
     return { form, ok: true };
diff --git a/src/routes/(authenticated)/projects/[id=idNumber]/+page.svelte b/src/routes/(authenticated)/projects/[id=idNumber]/+page.svelte
index 3d08f240d3..e11678600d 100644
--- a/src/routes/(authenticated)/projects/[id=idNumber]/+page.svelte
+++ b/src/routes/(authenticated)/projects/[id=idNumber]/+page.svelte
@@ -47,14 +47,14 @@
 
   const canEdit = $derived(
     canModifyProject(
-      data.session,
+      data.session.user,
       projectData?.project.OwnerId ?? -1,
       projectData?.project.Organization.Id ?? -1
     )
   );
   const canClaim = $derived(
     canClaimProject(
-      data.session,
+      data.session.user,
       projectData?.project.OwnerId ?? -1,
       projectData?.project.Organization.Id ?? -1,
       projectData?.project.GroupId ?? -1,
diff --git a/src/routes/(authenticated)/projects/[id=idNumber]/ProductCard.svelte b/src/routes/(authenticated)/projects/[id=idNumber]/ProductCard.svelte
index f498672ba3..e46f0117fd 100644
--- a/src/routes/(authenticated)/projects/[id=idNumber]/ProductCard.svelte
+++ b/src/routes/(authenticated)/projects/[id=idNumber]/ProductCard.svelte
@@ -208,14 +208,14 @@
               {m.project_productFiles()}
             </a>
           </li>
-          {#if isAdminForOrg(project.Organization.Id, page.data.session?.user.roles)}
+          {#if isAdminForOrg(project.Organization.Id, page.data.session!.user.roles)}
             <li class="w-full rounded-none">
               <button class="text-nowrap" onclick={() => updateProductModal?.showModal()}>
                 {m.products_properties_title()}
               </button>
             </li>
           {/if}
-          {#if isSuperAdmin(page.data.session?.user.roles) && !!product.WorkflowInstance}
+          {#if isSuperAdmin(page.data.session!.user.roles) && !!product.WorkflowInstance}
             <li class="w-full rounded-none">
               <a href={localizeHref(`/workflow-instances/${product.Id}`)}>
                 {m.common_workflow()}
diff --git a/src/routes/(authenticated)/projects/[id=idNumber]/edit/+page.server.ts b/src/routes/(authenticated)/projects/[id=idNumber]/edit/+page.server.ts
index 374fe040fd..246fffb83c 100644
--- a/src/routes/(authenticated)/projects/[id=idNumber]/edit/+page.server.ts
+++ b/src/routes/(authenticated)/projects/[id=idNumber]/edit/+page.server.ts
@@ -15,10 +15,8 @@ const projectPropertyEditSchema = v.object({
   description: v.nullable(v.string())
 });
 
-export const load = (async ({ params }) => {
-  // permissions checked in auth
-  // verifyCanViewAndEdit already checks if project exists
-  const project = await DatabaseReads.projects.findUniqueOrThrow({
+export const load = (async ({ params, locals }) => {
+  const project = (await DatabaseReads.projects.findUnique({
     where: {
       Id: parseInt(params.id)
     },
@@ -30,7 +28,8 @@ export const load = (async ({ params }) => {
       Description: true,
       OrganizationId: true
     }
-  });
+  }))!;
+  locals.security.requireProjectWriteAccess(project);
   return {
     project,
     form: await superValidate(
@@ -71,17 +70,18 @@ export const load = (async ({ params }) => {
 
 export const actions: Actions = {
   default: async function (event) {
-    // permissions checked in auth
-    const form = await superValidate(event.request, valibot(projectPropertyEditSchema));
-    if (!form.valid) return fail(400, { form, ok: false });
     const projectId = parseInt(event.params.id);
-    const project = await DatabaseReads.projects.findUniqueOrThrow({
+    const project = await DatabaseReads.projects.findUnique({
       where: { Id: projectId },
-      select: { OwnerId: true }
+      select: { OwnerId: true, OrganizationId: true }
     });
+    event.locals.security.requireProjectWriteAccess(project);
+    if (!QueueConnected()) return error(503);
+    const form = await superValidate(event.request, valibot(projectPropertyEditSchema));
+    if (!form.valid) return fail(400, { form, ok: false });
     // block if changing owner
-    if (project.OwnerId !== form.data.owner && !QueueConnected()) return error(503);
-    const success = await DatabaseWrites.projects.update(parseInt(event.params.id), {
+    if (project!.OwnerId !== form.data.owner && !QueueConnected()) return error(503);
+    const success = await DatabaseWrites.projects.update(projectId, {
       Name: form.data.name,
       GroupId: form.data.group,
       OwnerId: form.data.owner,
diff --git a/src/routes/(authenticated)/projects/[id=idNumber]/sse/+server.ts b/src/routes/(authenticated)/projects/[id=idNumber]/sse/+server.ts
index 962c753870..79cbde369f 100644
--- a/src/routes/(authenticated)/projects/[id=idNumber]/sse/+server.ts
+++ b/src/routes/(authenticated)/projects/[id=idNumber]/sse/+server.ts
@@ -2,15 +2,27 @@ import { stringify } from 'devalue';
 import { produce } from 'sveltekit-sse';
 import { SSEPageUpdates } from '$lib/projects/listener';
 import { getProjectDetails } from '$lib/projects/sse';
+import { DatabaseReads } from '$lib/server/database';
 
 export async function POST(request) {
-  const userId = (await request.locals.auth())!.user.userId;
+  request.locals.security.requireProjectReadAccess(
+    await DatabaseReads.groupMemberships.findMany({
+      where: { UserId: request.locals.security.userId },
+      select: { GroupId: true }
+    }),
+    await DatabaseReads.projects.findUnique({
+      where: { Id: parseInt(request.params.id) }
+    })
+  );
   const { id: strId } = request.params;
   return produce(async function start({ emit, lock }) {
     const id = parseInt(strId);
     // User will be allowed to see project updates until they reload
     // even if their permission is revoked during the SSE connection.
-    const { error } = emit('projectData', stringify(await getProjectDetails(id, userId)));
+    const { error } = emit(
+      'projectData',
+      stringify(await getProjectDetails(id, request.locals.security.sessionForm))
+    );
     if (error) {
       return;
     }
@@ -19,7 +31,7 @@ export async function POST(request) {
       // multiple times if multiple users are connected to the same project page.
       if (updateId.includes(id)) {
         // console.log(`Project page SSE update for project ${id}`);
-        const projectData = await getProjectDetails(id, userId);
+        const projectData = await getProjectDetails(id, request.locals.security.sessionForm);
         const { error } = emit('projectData', stringify(projectData));
         if (error) {
           SSEPageUpdates.off('projectPage', updateCb);
diff --git a/src/routes/(authenticated)/projects/import/[id=idNumber]/+page.server.ts b/src/routes/(authenticated)/projects/import/[id=idNumber]/+page.server.ts
index 6e07de6540..e34171e407 100644
--- a/src/routes/(authenticated)/projects/import/[id=idNumber]/+page.server.ts
+++ b/src/routes/(authenticated)/projects/import/[id=idNumber]/+page.server.ts
@@ -4,6 +4,7 @@ import { valibot } from 'sveltekit-superforms/adapters';
 import * as v from 'valibot';
 import type { Actions, PageServerLoad } from './$types';
 import { localizeHref } from '$lib/paraglide/runtime';
+import { RoleId } from '$lib/prisma';
 import { importJSONSchema } from '$lib/projects';
 import { verifyCanCreateProject } from '$lib/projects/server';
 import { BullMQ, QueueConnected, getQueues } from '$lib/server/bullmq';
@@ -21,8 +22,7 @@ const projectsImportSchema = v.object({
 });
 
 export const load = (async ({ locals, params }) => {
-  if (!verifyCanCreateProject((await locals.auth())!, parseInt(params.id))) return error(403);
-
+  locals.security.requireHasRole(parseInt(params.id), RoleId.AppBuilder, true);
   const organization = await DatabaseReads.organizations.findUnique({
     where: {
       Id: parseInt(params.id)
@@ -74,13 +74,13 @@ export const load = (async ({ locals, params }) => {
 
 export const actions: Actions = {
   default: async function (event) {
-    const session = (await event.locals.auth())!;
+    event.locals.security.requireHasRole(parseInt(event.params.id), RoleId.AppBuilder, true);
 
     const organizationId = parseInt(event.params.id);
 
     if (isNaN(organizationId)) return error(404);
 
-    if (!verifyCanCreateProject(session, organizationId)) return error(403);
+    if (!verifyCanCreateProject(event.locals.security, organizationId)) return error(403);
 
     if (!QueueConnected()) return error(503);
 
@@ -199,7 +199,7 @@ export const actions: Actions = {
         data: {
           ImportData: form.data.json,
           TypeId: form.data.type,
-          OwnerId: session.user.userId,
+          OwnerId: event.locals.security.userId,
           GroupId: form.data.group,
           OrganizationId: organizationId
         },
@@ -213,7 +213,7 @@ export const actions: Actions = {
             OrganizationId: organizationId,
             Name: pj.Name,
             GroupId: form.data.group,
-            OwnerId: session.user.userId,
+            OwnerId: event.locals.security.userId,
             Language: pj.Language,
             TypeId: form.data.type,
             Description: pj.Description ?? '',
diff --git a/src/routes/(authenticated)/projects/new/[id=idNumber]/+page.server.ts b/src/routes/(authenticated)/projects/new/[id=idNumber]/+page.server.ts
index 6d3deb0b2c..f2f0431c64 100644
--- a/src/routes/(authenticated)/projects/new/[id=idNumber]/+page.server.ts
+++ b/src/routes/(authenticated)/projects/new/[id=idNumber]/+page.server.ts
@@ -3,13 +3,14 @@ import { fail, superValidate } from 'sveltekit-superforms';
 import { valibot } from 'sveltekit-superforms/adapters';
 import type { Actions, PageServerLoad } from './$types';
 import { localizeHref } from '$lib/paraglide/runtime';
+import { RoleId } from '$lib/prisma';
 import { projectCreateSchema } from '$lib/projects';
 import { verifyCanCreateProject } from '$lib/projects/server';
 import { BullMQ, QueueConnected, getQueues } from '$lib/server/bullmq';
 import { DatabaseReads, DatabaseWrites } from '$lib/server/database';
 
 export const load = (async ({ locals, params }) => {
-  if (!verifyCanCreateProject((await locals.auth())!, parseInt(params.id))) return error(403);
+  locals.security.requireHasRole(parseInt(params.id), RoleId.AppBuilder, true);
 
   if (!QueueConnected()) error(503);
   const organization = await DatabaseReads.organizations.findUnique({
@@ -51,11 +52,11 @@ export const load = (async ({ locals, params }) => {
 
 export const actions: Actions = {
   default: async function (event) {
-    const session = (await event.locals.auth())!;
+    event.locals.security.requireHasRole(parseInt(event.params.id), RoleId.AppBuilder, true);
     const organizationId = parseInt(event.params.id);
     const form = await superValidate(event.request, valibot(projectCreateSchema));
     if (isNaN(organizationId)) return error(404);
-    if (!verifyCanCreateProject(session, organizationId)) return error(403);
+    if (!verifyCanCreateProject(event.locals.security, organizationId)) return error(403);
     if (!form.valid) {
       return fail(400, { form, ok: false });
     }
@@ -63,7 +64,7 @@ export const actions: Actions = {
       OrganizationId: organizationId,
       Name: form.data.Name,
       GroupId: form.data.group,
-      OwnerId: session.user.userId,
+      OwnerId: event.locals.security.userId,
       Language: form.data.Language,
       TypeId: form.data.type,
       Description: form.data.Description ?? '',
diff --git a/src/routes/(authenticated)/tasks/+page.server.ts b/src/routes/(authenticated)/tasks/+page.server.ts
new file mode 100644
index 0000000000..cd2c43619e
--- /dev/null
+++ b/src/routes/(authenticated)/tasks/+page.server.ts
@@ -0,0 +1,8 @@
+import type { PageServerLoad } from './$types';
+import { getUserTasks } from '$lib/projects/sse';
+
+export const load = (async (event) => {
+  event.locals.security.requireAuthenticated();
+  const userTasks = await getUserTasks((await event.locals.auth())!.user.userId);
+  return { userTasks };
+}) satisfies PageServerLoad;
diff --git a/src/routes/(authenticated)/tasks/[product_id]/+page.server.ts b/src/routes/(authenticated)/tasks/[product_id]/+page.server.ts
index e04db2cd9f..7ce83af77c 100644
--- a/src/routes/(authenticated)/tasks/[product_id]/+page.server.ts
+++ b/src/routes/(authenticated)/tasks/[product_id]/+page.server.ts
@@ -1,4 +1,3 @@
-import type { Session } from '@auth/sveltekit';
 import { error } from '@sveltejs/kit';
 import { fail, superValidate } from 'sveltekit-superforms';
 import { valibot } from 'sveltekit-superforms/adapters';
@@ -8,7 +7,6 @@ import { RoleId } from '$lib/prisma';
 import { QueueConnected } from '$lib/server/bullmq';
 import { DatabaseReads } from '$lib/server/database';
 import { Workflow } from '$lib/server/workflow';
-import { isSuperAdmin } from '$lib/utils/roles';
 import { WorkflowAction, WorkflowState, artifactLists } from '$lib/workflowTypes';
 
 const sendActionSchema = v.object({
@@ -32,8 +30,9 @@ type Fields = {
 
 export const load = (async ({ params, locals, depends }) => {
   depends('task:id:load');
-  const session = await locals.auth();
-  if (!(await verifyCanViewTask(session!, params.product_id))) return error(403);
+  // Auth handled in verifyCanViewTask
+  locals.security.requireAuthenticated();
+  if (!(await verifyCanViewTask(locals.security, params.product_id))) return error(403);
   const snap = await Workflow.getSnapshot(params.product_id);
   if (!snap) return error(404);
 
@@ -138,7 +137,7 @@ export const load = (async ({ params, locals, depends }) => {
       .filter((a) =>
         filterAvailableActions(
           a,
-          session?.user.userId,
+          locals.security.userId,
           product.Project.Owner.Id,
           authorIds,
           orgAdminIds
@@ -192,8 +191,9 @@ export const load = (async ({ params, locals, depends }) => {
 
 export const actions = {
   default: async ({ request, params, locals }) => {
-    const session = (await locals.auth())!;
-    if (!(await verifyCanViewTask(session, params.product_id))) return error(403);
+    // Auth handled in verifyCanViewTask
+    locals.security.requireAuthenticated();
+    if (!(await verifyCanViewTask(locals.security, params.product_id))) return error(403);
     if (!QueueConnected()) return error(503);
     const form = await superValidate(request, valibot(sendActionSchema));
     if (!form.valid) return fail(400, { form, ok: false });
@@ -249,7 +249,7 @@ export const actions = {
       .filter((a) =>
         filterAvailableActions(
           a,
-          session?.user.userId,
+          locals.security.userId,
           product.Project.Owner.Id,
           authorIds,
           orgAdminIds
@@ -261,7 +261,7 @@ export const actions = {
       flow.send({
         type: form.data.flowAction,
         comment: form.data.comment,
-        userId: session.user.userId
+        userId: locals.security.userId
       });
 
       const targetState = transition.target;
@@ -270,7 +270,7 @@ export const actions = {
         ? Workflow.availableTransitionsFromNode(targetState[0], snap.input).filter((a) =>
             filterAvailableActions(
               a,
-              session?.user.userId,
+              locals.security.userId,
               product.Project.Owner.Id,
               authorIds,
               orgAdminIds
@@ -294,15 +294,15 @@ export const actions = {
 } satisfies Actions;
 
 // allowed if SuperAdmin, or the user has a UserTask for the Product
-async function verifyCanViewTask(session: Session | null, productId: string): Promise<boolean> {
-  if (!session) return false;
+async function verifyCanViewTask(security: Security, productId: string): Promise<boolean> {
+  if (!security) return false;
 
   return (
-    isSuperAdmin(session.user.roles) ||
+    security.isSuperAdmin ||
     !!(await DatabaseReads.userTasks.findFirst({
       where: {
         ProductId: productId,
-        UserId: session.user.userId
+        UserId: security.userId
       },
       select: {
         Id: true
diff --git a/src/routes/(authenticated)/tasks/sse/+server.ts b/src/routes/(authenticated)/tasks/sse/+server.ts
index 79cb3f5a31..5c749dff05 100644
--- a/src/routes/(authenticated)/tasks/sse/+server.ts
+++ b/src/routes/(authenticated)/tasks/sse/+server.ts
@@ -4,7 +4,8 @@ import { SSEPageUpdates } from '$lib/projects/listener';
 import { getUserTasks } from '$lib/projects/sse';
 
 export async function POST(request) {
-  const userId = (await request.locals.auth())!.user.userId;
+  request.locals.security.requireAuthenticated();
+  const userId = request.locals.security.userId;
   return produce(async function start({ emit, lock }) {
     const { error } = emit('userTasks', stringify(await getUserTasks(userId)));
     if (error) {
diff --git a/src/routes/(authenticated)/users/+page.server.ts b/src/routes/(authenticated)/users/+page.server.ts
index 0a7ef84b74..a02fde589a 100644
--- a/src/routes/(authenticated)/users/+page.server.ts
+++ b/src/routes/(authenticated)/users/+page.server.ts
@@ -1,16 +1,13 @@
 import { trace } from '@opentelemetry/api';
 import type { Prisma } from '@prisma/client';
-import { error, redirect } from '@sveltejs/kit';
 import { superValidate } from 'sveltekit-superforms';
 import { valibot } from 'sveltekit-superforms/adapters';
 import * as v from 'valibot';
 import type { Actions, PageServerLoad } from './$types';
 import { minifyUser } from './common';
-import { localizeHref } from '$lib/paraglide/runtime';
 import { RoleId } from '$lib/prisma';
 import { QueueConnected } from '$lib/server/bullmq';
 import { DatabaseReads, DatabaseWrites } from '$lib/server/database';
-import { isAdminForOrgs, isSuperAdmin } from '$lib/utils/roles';
 import { idSchema, paginateSchema } from '$lib/valibot';
 
 const lockSchema = v.object({
@@ -85,23 +82,22 @@ function adminOrDefaultWhere(isSuper: boolean, orgIds: number[]) {
       };
 }
 
-export const load = (async (event) => {
-  const userInfo = (await event.locals.auth())?.user;
-  const userId = userInfo?.userId;
-  if (!userId) return redirect(302, localizeHref('/'));
+export const load = (async ({ locals }) => {
+  locals.security.requireAdminOfAny();
   return await tracer.startActiveSpan('load', async (span) => {
     try {
-      const isSuper = isSuperAdmin(userInfo.roles);
-
+      const isSuper = locals.security.isSuperAdmin;
       const organizations = await DatabaseReads.organizations.findMany({
-        where: isSuper
+        where: locals.security.isSuperAdmin
           ? undefined
           : {
-              UserRoles: {
-                some: {
-                  RoleId: RoleId.OrgAdmin,
-                  UserId: userId
-                }
+              Id: {
+                in: [
+                  ...locals.security.roles
+                    .entries()
+                    .filter(([_, role]) => role.includes(RoleId.OrgAdmin))
+                    .map(([orgId]) => orgId)
+                ]
               }
             },
         select: {
@@ -110,7 +106,7 @@ export const load = (async (event) => {
         }
       });
 
-      const orgIds = organizations.map((o) => o.Id);
+      const orgIds = locals.security.organizationMemberships;
 
       const users = await DatabaseReads.users.findMany({
         orderBy: {
@@ -121,8 +117,8 @@ export const load = (async (event) => {
         take: 50
       });
       span.setAttributes({
-        'auth.load.userId': userId,
-        'auth.load.user.roles': JSON.stringify(userInfo?.roles),
+        'auth.load.userId': locals.security.userId!,
+        'auth.load.user.roles': JSON.stringify(Array.from(locals.security.roles.entries())),
         'auth.load.user.isSuper': isSuper,
         'auth.load.user.orgIds': JSON.stringify(orgIds)
       });
@@ -168,25 +164,17 @@ export const load = (async (event) => {
 
 export const actions: Actions = {
   async lock(event) {
-    const session = await event.locals.auth();
-    if (!session) return error(403);
+    event.locals.security.requireAdminOfAny();
     const form = await superValidate(event, valibot(lockSchema));
-    if (!form.valid || session.user.userId === form.data.user) return { form, ok: false };
-    // if user modified hidden values
-    if (
-      !isSuperAdmin(session.user.roles) ||
-      !isAdminForOrgs(
-        (
-          await DatabaseReads.organizationMemberships.findMany({
-            where: { UserId: form.data.user },
-            distinct: 'OrganizationId'
-          })
-        ).map(({ OrganizationId }) => OrganizationId),
-        session.user.roles
-      )
-    ) {
-      return error(403);
-    }
+    if (!form.valid || event.locals.security.userId === form.data.user) return { form, ok: false };
+    event.locals.security.requireAdminOfOrgIn(
+      (
+        await DatabaseReads.organizationMemberships.findMany({
+          where: { UserId: form.data.user },
+          distinct: 'OrganizationId'
+        })
+      ).map(({ OrganizationId }) => OrganizationId)
+    );
     await DatabaseWrites.users.update({
       where: {
         Id: form.data.user
@@ -199,13 +187,12 @@ export const actions: Actions = {
   },
 
   async page(event) {
-    const session = await event.locals.auth();
-    if (!session) return error(403);
+    event.locals.security.requireAdminOfAny();
     const form = await superValidate(event, valibot(searchFilterSchema));
     if (!form.valid) return { form, ok: false };
 
     return await tracer.startActiveSpan('page action', async (span) => {
-      const isSuper = isSuperAdmin(session.user.roles);
+      const isSuper = event.locals.security.isSuperAdmin;
 
       const organizations = await DatabaseReads.organizations.findMany({
         where:
@@ -217,7 +204,7 @@ export const actions: Actions = {
                   UserRoles: {
                     some: {
                       RoleId: RoleId.OrgAdmin,
-                      UserId: session.user.userId
+                      UserId: event.locals.security.userId
                     }
                   }
                 },
@@ -229,8 +216,8 @@ export const actions: Actions = {
       const orgIds = organizations.map((o) => o.Id);
 
       span.setAttributes({
-        'auth.load.userId': session.user.userId,
-        'auth.load.user.roles': JSON.stringify(session.user.roles),
+        'auth.load.userId': event.locals.security.userId,
+        'auth.load.user.roles': JSON.stringify(event.locals.security.roles),
         'auth.load.user.isSuper': isSuper,
         'auth.load.user.orgIds': JSON.stringify(orgIds)
       });
diff --git a/src/routes/(authenticated)/users/+page.svelte b/src/routes/(authenticated)/users/+page.svelte
index b1d8a0bb09..f4af11c056 100644
--- a/src/routes/(authenticated)/users/+page.svelte
+++ b/src/routes/(authenticated)/users/+page.svelte
@@ -11,7 +11,7 @@
   import { m } from '$lib/paraglide/messages';
   import { getLocale, localizeHref } from '$lib/paraglide/runtime';
   import { toast } from '$lib/utils';
-  import { isAdmin } from '$lib/utils/roles';
+  import { isAdminForAny } from '$lib/utils/roles';
   import { byName, byString } from '$lib/utils/sorting';
 
   interface Props {
@@ -65,7 +65,7 @@
   <div class="flex flex-row place-content-between w-full flex-wrap items-center">
     <div class="flex flex-row items-center">
       <h1>{m.users_title()}</h1>
-      {#if isAdmin(data.session?.user.roles)}
+      {#if isAdminForAny(data.session?.user.roles)}
         <BlockIfJobsUnavailable className="btn btn-outline">
           {#snippet altContent()}
             <IconContainer icon="mdi:user-add" width="20" />
diff --git a/src/routes/(authenticated)/users/[id=idNumber]/+page.server.ts b/src/routes/(authenticated)/users/[id=idNumber]/+page.server.ts
index 84c3c61e7c..ae17ab95e2 100644
--- a/src/routes/(authenticated)/users/[id=idNumber]/+page.server.ts
+++ b/src/routes/(authenticated)/users/[id=idNumber]/+page.server.ts
@@ -2,6 +2,7 @@ import { redirect } from '@sveltejs/kit';
 import type { PageServerLoad } from './$types';
 import { localizeHref } from '$lib/paraglide/runtime';
 
-export const load = (async ({ params: { id } }) => {
+export const load = (async ({ params: { id }, locals }) => {
+  locals.security.requireAuthenticated();
   return redirect(302, localizeHref(`/users/${id}/settings/profile`));
 }) satisfies PageServerLoad;
diff --git a/src/routes/(authenticated)/users/[id=idNumber]/settings/+layout.server.ts b/src/routes/(authenticated)/users/[id=idNumber]/settings/+layout.server.ts
index 61b1d431c3..bcf59c36ea 100644
--- a/src/routes/(authenticated)/users/[id=idNumber]/settings/+layout.server.ts
+++ b/src/routes/(authenticated)/users/[id=idNumber]/settings/+layout.server.ts
@@ -1,12 +1,23 @@
 import type { LayoutServerLoad } from './$types';
 import { DatabaseReads } from '$lib/server/database';
 import { adminOrgs } from '$lib/users/server';
-import { isSuperAdmin } from '$lib/utils/roles';
 
 export const load = (async ({ params, locals }) => {
+  locals.security.requireAuthenticated();
+  const userId = Number(params.id);
+  if (locals.security.userId !== userId) {
+    locals.security.requireAdminOfOrgIn(
+      await DatabaseReads.organizationMemberships
+        .findMany({
+          where: { UserId: userId },
+          select: { OrganizationId: true }
+        })
+        .then((orgs) => orgs.map((o) => o.OrganizationId))
+    );
+  }
   const subject = await DatabaseReads.users.findUniqueOrThrow({
     where: {
-      Id: parseInt(params.id!)
+      Id: userId
     },
     select: {
       Id: true,
@@ -14,10 +25,8 @@ export const load = (async ({ params, locals }) => {
     }
   });
 
-  const user = (await locals.auth())!.user;
-
   // return only orgs containing the subject that the current user is also an admin for
-  const filter = adminOrgs(subject.Id, user.userId, isSuperAdmin(user.roles));
+  const filter = adminOrgs(subject.Id, locals.security.userId, locals.security.isSuperAdmin);
 
   const canEdit = !!(await DatabaseReads.organizations.findFirst({ where: filter }));
 
diff --git a/src/routes/(authenticated)/users/[id=idNumber]/settings/+page.server.ts b/src/routes/(authenticated)/users/[id=idNumber]/settings/+page.server.ts
index 84c3c61e7c..ae17ab95e2 100644
--- a/src/routes/(authenticated)/users/[id=idNumber]/settings/+page.server.ts
+++ b/src/routes/(authenticated)/users/[id=idNumber]/settings/+page.server.ts
@@ -2,6 +2,7 @@ import { redirect } from '@sveltejs/kit';
 import type { PageServerLoad } from './$types';
 import { localizeHref } from '$lib/paraglide/runtime';
 
-export const load = (async ({ params: { id } }) => {
+export const load = (async ({ params: { id }, locals }) => {
+  locals.security.requireAuthenticated();
   return redirect(302, localizeHref(`/users/${id}/settings/profile`));
 }) satisfies PageServerLoad;
diff --git a/src/routes/(authenticated)/users/[id=idNumber]/settings/groups/+page.server.ts b/src/routes/(authenticated)/users/[id=idNumber]/settings/groups/+page.server.ts
index f1dd142a7d..fa66738c65 100644
--- a/src/routes/(authenticated)/users/[id=idNumber]/settings/groups/+page.server.ts
+++ b/src/routes/(authenticated)/users/[id=idNumber]/settings/groups/+page.server.ts
@@ -5,7 +5,6 @@ import * as v from 'valibot';
 import type { Actions, PageServerLoad } from './$types';
 import { DatabaseReads, DatabaseWrites } from '$lib/server/database';
 import { adminOrgs } from '$lib/users/server';
-import { isSuperAdmin } from '$lib/utils/roles';
 import { idSchema } from '$lib/valibot';
 
 const toggleGroupSchema = v.object({
@@ -16,11 +15,16 @@ const toggleGroupSchema = v.object({
 
 export const load = (async ({ params, locals }) => {
   const subjectId = parseInt(params.id);
-  const user = (await locals.auth())!.user;
+  const user = await DatabaseReads.users.findUnique({
+    where: { Id: subjectId },
+    include: { OrganizationMemberships: { select: { OrganizationId: true } } }
+  });
+  if (!user) return error(404);
+  locals.security.requireAdminOfOrgIn(user.OrganizationMemberships.map((o) => o.OrganizationId));
 
   return {
     groupsByOrg: await DatabaseReads.organizations.findMany({
-      where: adminOrgs(subjectId, user.userId, isSuperAdmin(user.roles)),
+      where: adminOrgs(subjectId, locals.security.userId, locals.security.isSuperAdmin),
       select: {
         Id: true,
         Groups: {
@@ -50,18 +54,31 @@ export const actions = {
     // This way they can be added and removed in constant time and in a single command
     // https://www.prisma.io/docs/orm/prisma-schema/data-model/relations/many-to-many-relations
 
+    const subjectId = parseInt(event.params.id);
+    const user = await DatabaseReads.users.findUnique({
+      where: { Id: subjectId },
+      include: { OrganizationMemberships: { select: { OrganizationId: true } } }
+    });
+    if (!user) return error(404);
+    event.locals.security.requireAdminOfOrgIn(
+      user.OrganizationMemberships.map((o) => o.OrganizationId)
+    );
+
     const form = await superValidate(event, valibot(toggleGroupSchema));
 
     if (!form.valid) return fail(400, { form, ok: false });
 
-    const user = (await event.locals.auth())!.user;
-    const subjectId = parseInt(event.params.id);
     // if user modified hidden values
     if (
       !(await DatabaseReads.organizations.findFirst({
         where: {
           AND: [
-            adminOrgs(subjectId, user.userId, isSuperAdmin(user.roles), form.data.orgId),
+            adminOrgs(
+              subjectId,
+              event.locals.security.userId,
+              event.locals.security.isSuperAdmin,
+              form.data.orgId
+            ),
             { Groups: { some: { Id: form.data.groupId } } }
           ]
         }
diff --git a/src/routes/(authenticated)/users/[id=idNumber]/settings/profile/+page.server.ts b/src/routes/(authenticated)/users/[id=idNumber]/settings/profile/+page.server.ts
index 0ad1ae73bc..c682abb663 100644
--- a/src/routes/(authenticated)/users/[id=idNumber]/settings/profile/+page.server.ts
+++ b/src/routes/(authenticated)/users/[id=idNumber]/settings/profile/+page.server.ts
@@ -1,3 +1,4 @@
+import { error } from '@sveltejs/kit';
 import { fail, superValidate } from 'sveltekit-superforms';
 import { valibot } from 'sveltekit-superforms/adapters';
 import * as v from 'valibot';
@@ -18,21 +19,29 @@ const profileSchema = v.object({
 });
 
 export const load = (async (event) => {
-  const subData = await DatabaseReads.users.findUniqueOrThrow({
-    where: { Id: parseInt(event.params.id) }
+  event.locals.security.requireAuthenticated();
+  const user = await DatabaseReads.users.findUnique({
+    where: { Id: parseInt(event.params.id) },
+    include: { OrganizationMemberships: { select: { OrganizationId: true } } }
   });
+  if (!user) return error(404);
+  if (event.locals.security.userId !== parseInt(event.params.id)) {
+    event.locals.security.requireAdminOfOrgIn(
+      user.OrganizationMemberships.map((o) => o.OrganizationId)
+    );
+  }
   return {
     form: await superValidate(
       {
-        firstName: subData.GivenName,
-        lastName: subData.FamilyName,
-        displayName: subData.Name,
-        email: subData.Email,
-        phone: subData.Phone,
-        timezone: subData.Timezone,
-        notifications: subData.EmailNotification ?? false,
-        visible: !!subData.ProfileVisibility,
-        active: !subData.IsLocked
+        firstName: user.GivenName,
+        lastName: user.FamilyName,
+        displayName: user.Name,
+        email: user.Email,
+        phone: user.Phone,
+        timezone: user.Timezone,
+        notifications: user.EmailNotification ?? false,
+        visible: !!user.ProfileVisibility,
+        active: !user.IsLocked
       },
       valibot(profileSchema)
     )
@@ -41,15 +50,23 @@ export const load = (async (event) => {
 
 export const actions = {
   async default(event) {
+    event.locals.security.requireAuthenticated();
+    const user = await DatabaseReads.users.findUnique({
+      where: { Id: parseInt(event.params.id) },
+      include: { OrganizationMemberships: { select: { OrganizationId: true } } }
+    });
+    if (!user) return fail(404, { form: null, ok: false });
+    if (event.locals.security.userId !== parseInt(event.params.id)) {
+      event.locals.security.requireAdminOfOrgIn(
+        user.OrganizationMemberships.map((o) => o.OrganizationId)
+      );
+    }
     const form = await superValidate(event, valibot(profileSchema));
     if (!form.valid) return fail(400, { form, ok: false });
 
-    const user = (await event.locals.auth())!.user;
-    const subjectId = parseInt(event.params.id);
-
     await DatabaseWrites.users.update({
       where: {
-        Id: subjectId
+        Id: user.Id
       },
       data: {
         GivenName: form.data.firstName,
@@ -61,7 +78,7 @@ export const actions = {
         EmailNotification: form.data.notifications,
         ProfileVisibility: form.data.visible ? 1 : 0,
         // You cannot change lock state of yourself, and if you are editing someone else, you are either org admin or superadmin
-        IsLocked: subjectId === user.userId ? undefined : !form.data.active
+        IsLocked: user.Id === event.locals.security.userId ? undefined : !form.data.active
       }
     });
     return { form, ok: true };
diff --git a/src/routes/(authenticated)/users/[id=idNumber]/settings/roles/+page.server.ts b/src/routes/(authenticated)/users/[id=idNumber]/settings/roles/+page.server.ts
index 1716754013..e8cb134641 100644
--- a/src/routes/(authenticated)/users/[id=idNumber]/settings/roles/+page.server.ts
+++ b/src/routes/(authenticated)/users/[id=idNumber]/settings/roles/+page.server.ts
@@ -6,7 +6,6 @@ import type { Actions, PageServerLoad } from './$types';
 import { RoleId } from '$lib/prisma';
 import { DatabaseReads, DatabaseWrites } from '$lib/server/database';
 import { adminOrgs } from '$lib/users/server';
-import { isSuperAdmin } from '$lib/utils/roles';
 import { idSchema } from '$lib/valibot';
 
 const toggleRoleSchema = v.object({
@@ -18,11 +17,16 @@ const toggleRoleSchema = v.object({
 
 export const load = (async ({ params, locals }) => {
   const subjectId = parseInt(params.id);
-  const user = (await locals.auth())!.user;
+  const user = await DatabaseReads.users.findUnique({
+    where: { Id: subjectId },
+    include: { OrganizationMemberships: { select: { OrganizationId: true } } }
+  });
+  if (!user) return error(404);
+  locals.security.requireAdminOfOrgIn(user.OrganizationMemberships.map((o) => o.OrganizationId));
 
   return {
     rolesByOrg: await DatabaseReads.organizations.findMany({
-      where: adminOrgs(subjectId, user.userId, isSuperAdmin(user.roles)),
+      where: adminOrgs(subjectId, locals.security.userId, locals.security.isSuperAdmin),
       select: {
         Id: true,
         UserRoles: {
@@ -40,17 +44,30 @@ export const load = (async ({ params, locals }) => {
 
 export const actions = {
   async default(event) {
+    const user = await DatabaseReads.users.findUnique({
+      where: { Id: parseInt(event.params.id) },
+      include: { OrganizationMemberships: { select: { OrganizationId: true } } }
+    });
+    if (!user) return error(404);
+    event.locals.security.requireAdminOfOrgIn(
+      user.OrganizationMemberships.map((o) => o.OrganizationId)
+    );
+
     const form = await superValidate(event, valibot(toggleRoleSchema));
 
     if (!form.valid) return fail(400, { form, ok: false });
 
-    const user = (await event.locals.auth())!.user;
     // if user modified hidden values
     if (
       !(
         form.data.userId === parseInt(event.params.id) ||
         (await DatabaseReads.organizations.findFirst({
-          where: adminOrgs(form.data.userId, user.userId, isSuperAdmin(user.roles), form.data.orgId)
+          where: adminOrgs(
+            form.data.userId,
+            event.locals.security.userId,
+            event.locals.security.isSuperAdmin,
+            form.data.orgId
+          )
         }))
       )
     ) {
diff --git a/src/routes/(authenticated)/users/invite/+page.server.ts b/src/routes/(authenticated)/users/invite/+page.server.ts
index 6da092f04a..00208a42bf 100644
--- a/src/routes/(authenticated)/users/invite/+page.server.ts
+++ b/src/routes/(authenticated)/users/invite/+page.server.ts
@@ -6,7 +6,6 @@ import type { Actions, PageServerLoad } from './$types';
 import { RoleId } from '$lib/prisma';
 import { BullMQ, QueueConnected, getQueues } from '$lib/server/bullmq';
 import { DatabaseReads, DatabaseWrites } from '$lib/server/database';
-import { isAdmin, isAdminForOrg, isSuperAdmin } from '$lib/utils/roles';
 import { idSchema } from '$lib/valibot';
 
 const createSchema = v.object({
@@ -17,18 +16,17 @@ const createSchema = v.object({
 });
 
 export const load = (async ({ locals }) => {
+  locals.security.requireAdminOfAny();
   const form = await superValidate(valibot(createSchema));
 
-  const user = await locals.auth();
-  if (!isAdmin(user?.user.roles)) return error(403);
   const groupsByOrg = await DatabaseReads.organizations.findMany({
     where: {
       // Only send a list of groups for orgs that the current user has access to
-      UserRoles: isSuperAdmin(user?.user.roles)
+      UserRoles: locals.security.isSuperAdmin
         ? undefined
         : {
             some: {
-              UserId: user?.user.userId,
+              UserId: locals.security.userId,
               RoleId: RoleId.OrgAdmin
             }
           }
@@ -48,17 +46,15 @@ export const actions = {
     if (!form.valid) {
       return fail(400, { form, ok: false });
     }
+    locals.security.requireAdminOfOrg(form.data.organizationId);
 
     if (!QueueConnected()) return error(503);
 
-    const user = (await locals.auth())!.user;
-    // if user modified hidden values
-    if (!isAdminForOrg(form.data.organizationId, user.roles)) return fail(403);
     const { email, organizationId, roles, groups } = form.data;
     const inviteToken = await DatabaseWrites.organizationMemberships.createOrganizationInvite(
       email,
       organizationId,
-      user.userId,
+      locals.security.userId,
       roles,
       groups
     );
diff --git a/src/routes/(authenticated)/workflow-instances/+page.server.ts b/src/routes/(authenticated)/workflow-instances/+page.server.ts
index e90691d027..27b2fa149a 100644
--- a/src/routes/(authenticated)/workflow-instances/+page.server.ts
+++ b/src/routes/(authenticated)/workflow-instances/+page.server.ts
@@ -1,11 +1,9 @@
 import type { Prisma } from '@prisma/client';
-import { error } from '@sveltejs/kit';
 import { fail, superValidate } from 'sveltekit-superforms';
 import { valibot } from 'sveltekit-superforms/adapters';
 import * as v from 'valibot';
 import type { Actions, PageServerLoad } from './$types';
 import { DatabaseReads } from '$lib/server/database';
-import { isSuperAdmin } from '$lib/utils/roles';
 import { idSchema, paginateSchema } from '$lib/valibot';
 
 const tableSchema = v.object({
@@ -23,6 +21,7 @@ const tableSchema = v.object({
 });
 
 export const load: PageServerLoad = async (event) => {
+  event.locals.security.requireSuperAdmin();
   const instances = await DatabaseReads.workflowInstances.findMany({
     select: {
       State: true,
@@ -76,8 +75,7 @@ export const load: PageServerLoad = async (event) => {
 
 export const actions: Actions = {
   page: async function ({ request, locals }) {
-    const session = await locals.auth();
-    if (!isSuperAdmin(session?.user.roles)) return error(403);
+    locals.security.requireSuperAdmin();
     const form = await superValidate(request, valibot(tableSchema));
     if (!form.valid) return fail(400, { form, ok: false });
 
diff --git a/src/routes/(authenticated)/workflow-instances/[product_id]/+page.server.ts b/src/routes/(authenticated)/workflow-instances/[product_id]/+page.server.ts
index dff331f3a8..4f90dab191 100644
--- a/src/routes/(authenticated)/workflow-instances/[product_id]/+page.server.ts
+++ b/src/routes/(authenticated)/workflow-instances/[product_id]/+page.server.ts
@@ -6,15 +6,14 @@ import type { Actions, PageServerLoad } from './$types';
 import { QueueConnected } from '$lib/server/bullmq';
 import { DatabaseReads } from '$lib/server/database';
 import { Workflow } from '$lib/server/workflow';
-import { isSuperAdmin } from '$lib/utils/roles';
 import { WorkflowAction, type WorkflowState } from '$lib/workflowTypes';
 
 const jumpStateSchema = v.object({
   state: v.string()
 });
 
-export const load: PageServerLoad = async ({ params }) => {
-  // route already protected by hooks.server.ts
+export const load: PageServerLoad = async ({ params, locals }) => {
+  locals.security.requireSuperAdmin();
   const product = await DatabaseReads.products.findUnique({
     where: {
       Id: params.product_id
@@ -105,10 +104,7 @@ export const load: PageServerLoad = async ({ params }) => {
 
 export const actions = {
   default: async ({ request, params, locals }) => {
-    if (!isSuperAdmin((await locals.auth())?.user.roles)) {
-      return error(403);
-    }
-
+    locals.security.requireSuperAdmin();
     const form = await superValidate(request, valibot(jumpStateSchema));
     if (!form.valid) return fail(400, { form, ok: false });
 
diff --git a/src/routes/(unauthenticated)/(auth)/login/+page.server.ts b/src/routes/(unauthenticated)/(auth)/login/+page.server.ts
index 28220d9e79..3e0d6751f9 100644
--- a/src/routes/(unauthenticated)/(auth)/login/+page.server.ts
+++ b/src/routes/(unauthenticated)/(auth)/login/+page.server.ts
@@ -5,15 +5,29 @@ import { localizeHref } from '$lib/paraglide/runtime';
 import { QueueConnected } from '$lib/server/bullmq';
 
 export const load: PageServerLoad = async (event) => {
-  if ((await event.locals.auth())?.user && QueueConnected()) {
+  event.locals.security.requireNothing();
+  if (event.locals.security.userId && QueueConnected()) {
     if (event.cookies.get('inviteToken')) {
       const inviteToken = event.cookies.get('inviteToken')!;
       return redirect(302, localizeHref('/invitations/organization-membership?t=' + inviteToken));
     }
-    return redirect(302, localizeHref('/tasks'));
+    const redirectUrl = event.url.searchParams.get('returnTo');
+    return redirect(
+      302,
+      localizeHref(
+        redirectUrl && redirectUrl.startsWith('/') && !redirectUrl.startsWith('//')
+          ? redirectUrl
+          : '/tasks'
+      )
+    );
   }
   return {
     serviceAvailable: QueueConnected()
   };
 };
-export const actions: Actions = { default: signIn };
+export const actions: Actions = {
+  async default(event) {
+    event.locals.security.requireNothing();
+    return await signIn(event);
+  }
+};
diff --git a/src/routes/(unauthenticated)/(auth)/login/LoginScreen.svelte b/src/routes/(unauthenticated)/(auth)/login/LoginScreen.svelte
index 6fad510be7..a9266eaaf7 100644
--- a/src/routes/(unauthenticated)/(auth)/login/LoginScreen.svelte
+++ b/src/routes/(unauthenticated)/(auth)/login/LoginScreen.svelte
@@ -1,14 +1,35 @@
 <script lang="ts">
   import { SignIn } from '@auth/sveltekit/components';
+  import { onDestroy } from 'svelte';
+  import { browser } from '$app/environment';
   import ScriptoriaIcon from '$lib/icons/ScriptoriaIcon.svelte';
   import * as m from '$lib/paraglide/messages';
 
+  let timeout: ReturnType<typeof setInterval> | null = null;
+
   // Add a boolean param
   let {
     serviceAvailable
   }: {
     serviceAvailable: boolean;
   } = $props();
+  if (!serviceAvailable && browser) {
+    timeout = setInterval(() => {
+      // Reload every 2 seconds to check if the service is back up
+      if (serviceAvailable) {
+        if (timeout !== null) clearInterval(timeout);
+      } else {
+        location.reload();
+      }
+    }, 2000);
+  }
+
+  onDestroy(() => {
+    if (timeout !== null) {
+      clearInterval(timeout);
+      timeout = null;
+    }
+  });
 </script>
 
 <div class="card shadow-xl bg-white border p-4">
diff --git a/src/routes/(unauthenticated)/(auth)/signout/+page.server.ts b/src/routes/(unauthenticated)/(auth)/signout/+page.server.ts
index 91a0fb1af4..92001d46ba 100644
--- a/src/routes/(unauthenticated)/(auth)/signout/+page.server.ts
+++ b/src/routes/(unauthenticated)/(auth)/signout/+page.server.ts
@@ -4,6 +4,12 @@ import type { Actions, PageServerLoad } from './$types';
 import { localizeHref } from '$lib/paraglide/runtime';
 
 export const load: PageServerLoad = async (event) => {
-  if (!(await event.locals.auth())?.user) return redirect(302, localizeHref('/'));
+  event.locals.security.requireNothing();
+  if (!event.locals.security.userId) return redirect(302, localizeHref('/'));
+};
+export const actions: Actions = {
+  async default(event) {
+    event.locals.security.requireNothing();
+    return await signOut(event);
+  }
 };
-export const actions: Actions = { default: signOut };
diff --git a/src/routes/(unauthenticated)/+layout.server.ts b/src/routes/(unauthenticated)/+layout.server.ts
deleted file mode 100644
index 24ef0e616c..0000000000
--- a/src/routes/(unauthenticated)/+layout.server.ts
+++ /dev/null
@@ -1,10 +0,0 @@
-import { error } from '@sveltejs/kit';
-import type { LayoutServerLoad } from './$types';
-
-export const load = (async (event) => {
-  if (event.locals.error) {
-    // If there is an error, we throw it to be handled by the error page
-    error(event.locals.error);
-  }
-  return {};
-}) satisfies LayoutServerLoad;
diff --git a/src/routes/(unauthenticated)/api/products/[package]/published/+server.ts b/src/routes/(unauthenticated)/api/products/[package]/published/+server.ts
index 1220bdbe66..256b3a3492 100644
--- a/src/routes/(unauthenticated)/api/products/[package]/published/+server.ts
+++ b/src/routes/(unauthenticated)/api/products/[package]/published/+server.ts
@@ -12,7 +12,8 @@ type ManifestResponse = {
   files: string[];
 };
 
-export async function GET({ params }) {
+export async function GET({ params, locals }) {
+  locals.security.requireNothing();
   const res = await _getManifest(params.package);
   return res
     ? new Response(JSON.stringify(res), { status: 200 })
diff --git a/src/routes/(unauthenticated)/api/products/[product_id]/files/published/[type]/+server.ts b/src/routes/(unauthenticated)/api/products/[product_id]/files/published/[type]/+server.ts
index 9fae6b171f..c96a2117df 100644
--- a/src/routes/(unauthenticated)/api/products/[product_id]/files/published/[type]/+server.ts
+++ b/src/routes/(unauthenticated)/api/products/[product_id]/files/published/[type]/+server.ts
@@ -2,7 +2,8 @@ import { error, redirect } from '@sveltejs/kit';
 import { getFileInfo } from '$lib/products';
 import { getPublishedFile } from '$lib/products/server';
 
-export async function GET({ params }) {
+export async function GET({ params, locals }) {
+  locals.security.requireNothing();
   const productArtifact = await getPublishedFile(params.product_id, params.type);
   if (!productArtifact?.Url) {
     return error(404);
diff --git a/src/routes/(unauthenticated)/api/projects/[id=idNumber]/token/+server.ts b/src/routes/(unauthenticated)/api/projects/[id=idNumber]/token/+server.ts
index 21d814709a..75d9a9b6fb 100644
--- a/src/routes/(unauthenticated)/api/projects/[id=idNumber]/token/+server.ts
+++ b/src/routes/(unauthenticated)/api/projects/[id=idNumber]/token/+server.ts
@@ -4,17 +4,17 @@ import type { KeyObject } from 'node:crypto';
 import { createPublicKey } from 'node:crypto';
 import { building } from '$app/environment';
 import { env } from '$env/dynamic/private';
-import { ProductTransitionType } from '$lib/prisma';
+import { ProductTransitionType, RoleId } from '$lib/prisma';
 import { BuildEngine } from '$lib/server/build-engine-api';
 import { DatabaseReads, DatabaseWrites } from '$lib/server/database';
-import { isAdmin } from '$lib/utils/roles';
 
 const TOKEN_USE_HEADER = 'Use';
 const TOKEN_USE_UPLOAD = 'Upload';
 // eslint-disable-next-line @typescript-eslint/no-unused-vars
 const TOKEN_USE_DOWNLOAD = 'Download';
 
-export async function POST({ params, request, fetch }) {
+export async function POST({ params, locals, request, fetch }) {
+  locals.security.requireNothing();
   if (!request.headers.get('Authorization')) {
     return error(401, `Unauthorized`);
   }
@@ -102,8 +102,14 @@ export async function POST({ params, request, fetch }) {
 
   // Check roles
   if (readOnly === null) {
-    if (isAdmin(user[0].UserRoles.map((ur) => [ur.OrganizationId, ur.RoleId]))) {
-      readOnly = true;
+    if (
+      user[0].UserRoles.some(
+        (role) =>
+          (role.OrganizationId === project.OrganizationId && role.RoleId === RoleId.OrgAdmin) ||
+          role.RoleId === RoleId.SuperAdmin
+      )
+    ) {
+      readOnly = false;
     }
   }
 
diff --git a/src/routes/(unauthenticated)/downloads/apk/[package]/published/+page.server.ts b/src/routes/(unauthenticated)/downloads/apk/[package]/published/+page.server.ts
index 34b2e9d89b..620fa6b0a5 100644
--- a/src/routes/(unauthenticated)/downloads/apk/[package]/published/+page.server.ts
+++ b/src/routes/(unauthenticated)/downloads/apk/[package]/published/+page.server.ts
@@ -2,7 +2,8 @@ import { error } from '@sveltejs/kit';
 import { _getManifest } from '../../../../api/products/[package]/published/+server';
 import type { PageServerLoad } from './$types';
 
-export const load: PageServerLoad = async ({ params }) => {
+export const load: PageServerLoad = async ({ params, locals }) => {
+  locals.security.requireNothing();
   const manifest = await _getManifest(params.package);
   if (!manifest) return error(404);
   return { manifest };
diff --git a/src/routes/(unauthenticated)/downloads/products/[id]/files/published/[type]/+page.server.ts b/src/routes/(unauthenticated)/downloads/products/[id]/files/published/[type]/+page.server.ts
index f12538ef14..82aa9b9862 100644
--- a/src/routes/(unauthenticated)/downloads/products/[id]/files/published/[type]/+page.server.ts
+++ b/src/routes/(unauthenticated)/downloads/products/[id]/files/published/[type]/+page.server.ts
@@ -2,7 +2,8 @@ import { error } from '@sveltejs/kit';
 import { _getHeaders } from '../../../../../../api/products/[product_id]/files/published/[type]/+server';
 import type { PageServerLoad } from './$types';
 
-export const load: PageServerLoad = async ({ params }) => {
+export const load: PageServerLoad = async ({ params, locals }) => {
+  locals.security.requireNothing();
   const file = await _getHeaders(params.id, params.type);
   if (!file) return error(404);
   return file;
diff --git a/src/routes/(unauthenticated)/invitations/organization-membership/+page.server.ts b/src/routes/(unauthenticated)/invitations/organization-membership/+page.server.ts
index 95170b532d..448768b85a 100644
--- a/src/routes/(unauthenticated)/invitations/organization-membership/+page.server.ts
+++ b/src/routes/(unauthenticated)/invitations/organization-membership/+page.server.ts
@@ -4,6 +4,7 @@ import { acceptOrganizationInvite, checkInviteErrors } from '$lib/organizationIn
 import { localizeHref } from '$lib/paraglide/runtime';
 
 export const load = (async (event) => {
+  event.locals.security.requireNothing();
   const inviteToken = event.url.searchParams.get('t')!;
   // Clear the inviteToken cookie if it exists
   if (event.cookies.get('inviteToken')) {
@@ -19,6 +20,7 @@ export const load = (async (event) => {
     event.cookies.set('inviteToken', inviteToken, {
       path: '/'
     });
+    // When there is an inviteToken, returnTo is unnecessary
     return redirect(302, localizeHref('/login'));
   }
 }) satisfies PageServerLoad;
diff --git a/src/routes/(unauthenticated)/request-access-for-organization/+page.server.ts b/src/routes/(unauthenticated)/request-access-for-organization/+page.server.ts
index b8bf218b55..25b8b1a557 100644
--- a/src/routes/(unauthenticated)/request-access-for-organization/+page.server.ts
+++ b/src/routes/(unauthenticated)/request-access-for-organization/+page.server.ts
@@ -1,7 +1,7 @@
 import { fail, superValidate } from 'sveltekit-superforms';
 import { valibot } from 'sveltekit-superforms/adapters';
 import * as v from 'valibot';
-import type { Actions, PageServerLoad } from './$types';
+import type { Actions } from './$types';
 import { BullMQ, getQueues } from '$lib/server/bullmq';
 
 const requestSchema = v.object({
@@ -10,12 +10,9 @@ const requestSchema = v.object({
   url: v.pipe(v.string(), v.nonEmpty())
 });
 
-export const load = (async () => {
-  return {};
-}) satisfies PageServerLoad;
-
 export const actions = {
   async request(event) {
+    event.locals.security.requireNothing();
     const form = await superValidate(event.request, valibot(requestSchema));
     if (!form.valid) return fail(400, { form, ok: false });
     await getQueues().Emails.add('Email SuperAdmins about new org ' + form.data.organizationName, {
diff --git a/src/routes/+layout.server.ts b/src/routes/+layout.server.ts
index 5bdece65b9..17b05e4bbd 100644
--- a/src/routes/+layout.server.ts
+++ b/src/routes/+layout.server.ts
@@ -1,6 +1,7 @@
 import type { LayoutServerLoad } from './$types';
 
 export const load: LayoutServerLoad = async (event) => {
+  event.locals.security.requireNothing();
   const uData = await event.locals.auth();
-  return { session: uData };
+  return { session: uData! };
 };
diff --git a/src/routes/+page.server.ts b/src/routes/+page.server.ts
index 1812a6d48b..3293c13ffc 100644
--- a/src/routes/+page.server.ts
+++ b/src/routes/+page.server.ts
@@ -4,7 +4,8 @@ import { localizeHref } from '$lib/paraglide/runtime';
 import { DatabaseConnected } from '$lib/server/database';
 
 export const load: PageServerLoad = async (event) => {
-  if (await event.locals.auth()) return redirect(302, localizeHref('/tasks'));
+  event.locals.security.requireNothing();
+  if (event.locals.security.userId) redirect(302, localizeHref('/tasks'));
   return {
     serviceAvailable: DatabaseConnected()
   };