From 366af644eef18464d6598c1771569dd083bf6003 Mon Sep 17 00:00:00 2001
From: Tyagiquamar <mohdquamartyagi@gmail.com>
Date: Sun, 6 Sep 2026 14:34:19 +0530
Subject: [PATCH] fix(api): guard against nil session pointer dereference in
 user update and recovery codes

---
 internal/api/recovery_codes.go | 4 ++--
 internal/api/user.go           | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/internal/api/recovery_codes.go b/internal/api/recovery_codes.go
index bd39ee9d93..f945685f79 100644
--- a/internal/api/recovery_codes.go
+++ b/internal/api/recovery_codes.go
@@ -116,7 +116,7 @@ func (a *API) RecoveryCodesGenerate(w http.ResponseWriter, r *http.Request) erro
 		}
 	}
 
-	if !session.IsAAL2() {
+	if session == nil || !session.IsAAL2() {
 		return apierrors.NewForbiddenError(apierrors.ErrorCodeInsufficientAAL, "AAL2 required to generate recovery codes")
 	}
 
@@ -201,7 +201,7 @@ func (a *API) RecoveryCodesRegenerate(w http.ResponseWriter, r *http.Request) er
 		return apierrors.NewUnprocessableEntityError(apierrors.ErrorCodeMFARecoveryCodesEnrollDisabled, "MFA enroll is disabled for recovery codes")
 	}
 
-	if !session.IsAAL2() {
+	if session == nil || !session.IsAAL2() {
 		return apierrors.NewForbiddenError(apierrors.ErrorCodeInsufficientAAL, "AAL2 required to regenerate recovery codes")
 	}
 
diff --git a/internal/api/user.go b/internal/api/user.go
index f96b174ef7..4215d92cfc 100644
--- a/internal/api/user.go
+++ b/internal/api/user.go
@@ -103,7 +103,7 @@ func (a *API) UserUpdate(w http.ResponseWriter, r *http.Request) error {
 		}
 	}
 
-	if user.HasMFAEnabled() && !session.IsAAL2() {
+	if user.HasMFAEnabled() && (session == nil || !session.IsAAL2()) {
 		if (params.Password != nil && *params.Password != "") || (params.Email != "" && user.GetEmail() != params.Email) || (params.Phone != "" && user.GetPhone() != params.Phone) {
 			return apierrors.NewHTTPError(http.StatusUnauthorized, apierrors.ErrorCodeInsufficientAAL, "AAL2 session is required to update email or password when MFA is enabled.")
 		}
@@ -172,7 +172,7 @@ func (a *API) UserUpdate(w http.ResponseWriter, r *http.Request) error {
 				// current password required when updating password
 				if config.Security.UpdatePasswordRequireCurrentPassword {
 					// ensure user is not in a password recovery flow
-					if !session.IsRecovery() {
+					if session == nil || !session.IsRecovery() {
 						if params.CurrentPassword == nil || *params.CurrentPassword == "" {
 							return apierrors.NewBadRequestError(apierrors.ErrorCodeCurrentPasswordRequired, "Current password required when setting new password.")
 						}