diff --git a/.claude/settings.local.json b/.claude/settings.local.json
index 2695a35..90c513f 100644
--- a/.claude/settings.local.json
+++ b/.claude/settings.local.json
@@ -80,7 +80,12 @@
       "Bash(pnpm remove:*)",
       "Bash(pnpm db:generate:*)",
       "Bash(pnpm tsx:*)",
-      "Bash(node test-roleswitcher-keyboard.mjs:*)"
+      "Bash(node test-roleswitcher-keyboard.mjs:*)",
+      "Bash(tmux capture-pane:*)",
+      "Bash(tmux list-sessions:*)",
+      "Bash(tmux send-keys:*)",
+      "Bash(tmux new-session:*)",
+      "Bash(tmux kill-session:*)"
     ],
     "deny": [],
     "ask": []
diff --git a/app/components/UserMenu.vue b/app/components/UserMenu.vue
index ab9b23f..847d944 100644
--- a/app/components/UserMenu.vue
+++ b/app/components/UserMenu.vue
@@ -74,7 +74,6 @@ async function handleLogout() {
         <!-- Avatar with status ring (logged in indicator) -->
         <Avatar
           class="h-10 w-10 md:h-12 md:w-12 border-3 border-experimenta-purple shadow-lg bg-experimenta-accent ring-2 ring-experimenta-accent ring-offset-2 ring-offset-white dark:ring-offset-zinc-950">
-          <AvatarImage :src="undefined" :alt="extendedUser?.firstName || ''" />
           <AvatarFallback
             class="bg-experimenta-accent text-white font-bold text-sm md:text-base flex items-center justify-center w-full h-full">
             {{ userInitials }}
diff --git a/app/components/navigation/RoleSwitcher.vue b/app/components/navigation/RoleSwitcher.vue
index e288d6f..264c1b2 100644
--- a/app/components/navigation/RoleSwitcher.vue
+++ b/app/components/navigation/RoleSwitcher.vue
@@ -1,6 +1,7 @@
 <script setup lang="ts">
-import { User, GraduationCap, Building2, Check } from 'lucide-vue-next'
+import { User, GraduationCap, Building2, Check, AlertCircle, ChevronDown } from 'lucide-vue-next'
 import { Badge } from '@/components/ui/badge'
+import { Alert, AlertDescription } from '@/components/ui/alert'
 import {
   DropdownMenu,
   DropdownMenuContent,
@@ -11,110 +12,103 @@ import {
 } from '@/components/ui/dropdown-menu'
 import { Button } from '@/components/ui/button'
 
-// User role types matching our database schema
-type UserRole = 'private' | 'educator' | 'company'
-
-interface RoleOption {
-  value: UserRole
-  label: string
-  description: string
-  icon: any
-  color: string
-  enabled: boolean
-  badge?: string
+// Role management composable
+const { activeRole, roles, roleChangedByAdmin, switchRole, fetchRoleStatus, loading } =
+  useActiveRole()
+
+// Icon mapping for each role
+const roleIcons: Record<string, any> = {
+  private: User,
+  educator: GraduationCap,
+  company: Building2,
+}
+
+// Color mapping for each role
+const roleColors: Record<string, string> = {
+  private: 'text-purple-600',
+  educator: 'text-orange-500',
+  company: 'text-blue-600',
 }
 
-const roles: RoleOption[] = [
-  {
-    value: 'private',
-    label: 'Privatperson',
-    description: 'Private Nutzung',
-    icon: User,
-    color: 'text-purple-600',
-    enabled: true,
-  },
-  {
-    value: 'educator',
-    label: 'Pädagoge',
-    description: 'Lehrkräfte und Schulen',
-    icon: GraduationCap,
-    color: 'text-orange-500',
-    enabled: true,
-    // badge: 'Demnächst',
-  },
-  {
-    value: 'company',
-    label: 'Firma',
-    description: 'Geschäftskunden',
-    icon: Building2,
-    color: 'text-blue-600',
-    enabled: true,
-    // badge: 'Demnächst',
-  },
-]
-
-// Current role - will come from user session later
-const currentRole = ref<UserRole>('private')
-
-const currentRoleData = computed(() => {
-  return roles.find((r) => r.value === currentRole.value) || roles[0]
+// Dropdown open/close state
+const dropdownOpen = ref(false)
+
+// Fetch role status when dropdown opens
+watch(dropdownOpen, async (isOpen) => {
+  if (isOpen && !loading.value) {
+    await fetchRoleStatus()
+  }
 })
 
-function switchRole(role: UserRole) {
-  if (roles.find((r) => r.value === role)?.enabled) {
-    currentRole.value = role
-    // TODO: Update user session/store with new role
+// Current role data (for button display)
+const currentRoleData = computed(() => roles.value.find((r) => r.code === activeRole.value))
+
+// Handle role switch with error handling
+async function handleRoleSwitch(roleCode: string, hasRole: boolean) {
+  if (!hasRole || loading.value) return
+
+  try {
+    await switchRole(roleCode)
+    dropdownOpen.value = false // Close dropdown after successful switch
+  } catch (error) {
+    console.error('Role switch failed:', error)
+    // Error is already set in composable, will be displayed if needed
   }
 }
 </script>
 
 <template>
-  <DropdownMenu>
-    <dropdownMenuTrigger as-child>
+  <DropdownMenu v-model:open="dropdownOpen">
+    <DropdownMenuTrigger as-child>
       <Button variant="outline"
         class="gap-2 border-2 border-white/30 bg-white/5 text-white hover:bg-white/10 hover:border-white/50 transition-all duration-200 group"
         title="Rolle wechseln">
         <!-- Context label + role -->
         <span class="text-xs text-white/70 font-normal hidden md:inline">Du kaufst als:</span>
-        <component :is="currentRoleData.icon" class="h-4 w-4 text-white" />
-        <span class="font-medium text-white">{{ currentRoleData.label }}</span>
-        <svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 24 24" fill="none"
-          stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"
-          class="ml-1 opacity-70 text-white group-hover:opacity-100 transition-opacity">
-          <polyline points="6 9 12 15 18 9" />
-        </svg>
+        <component :is="roleIcons[activeRole] || User" class="h-4 w-4 text-white" />
+        <span class="font-medium text-white">{{
+          currentRoleData?.displayName || 'Privatperson'
+        }}</span>
+        <ChevronDown class="h-4 w-4 text-white/70 group-hover:text-white transition-colors" />
       </Button>
-    </dropdownMenuTrigger>
+    </DropdownMenuTrigger>
+
     <DropdownMenuContent align="start" class="w-[312px]">
+      <!-- Admin Notice (if role was changed by admin) -->
+      <Alert v-if="roleChangedByAdmin" variant="warning" class="m-2 mb-3">
+        <AlertCircle class="h-4 w-4" />
+        <AlertDescription class="text-sm">
+          Deine Rolle wurde von einem Administrator geändert.
+        </AlertDescription>
+      </Alert>
+
       <DropdownMenuLabel class="text-sm font-normal text-muted-foreground py-3">
         Ich kaufe als...
       </DropdownMenuLabel>
       <DropdownMenuSeparator />
 
-      <DropdownMenuItem v-for="role in roles" :key="role.value" :disabled="!role.enabled" :class="[
+      <!-- All roles (approved + not-approved) -->
+      <DropdownMenuItem v-for="role in roles" :key="role.code" :disabled="!role.hasRole || loading" :class="[
         'gap-3 py-3 cursor-pointer group',
-        !role.enabled && 'opacity-60 cursor-not-allowed',
-        currentRole === role.value && 'bg-purple-50 dark:bg-purple-950',
-      ]" @click="switchRole(role.value)">
-        <component :is="role.icon" :class="['h-5 w-5', role.color]" />
+        !role.hasRole && 'opacity-60 cursor-not-allowed',
+        activeRole === role.code && 'bg-purple-50 dark:bg-purple-950',
+      ]" @click="handleRoleSwitch(role.code, role.hasRole)">
+        <component :is="roleIcons[role.code]" :class="['h-5 w-5', roleColors[role.code]]" />
 
         <div class="flex-1 flex flex-col gap-1">
-          <span class="text-sm font-semibold">{{ role.label }}</span>
+          <span class="text-sm font-semibold">{{ role.displayName }}</span>
           <span
-            class="text-sm text-muted-foreground group-hover:text-foreground group-data-[highlighted]:text-accent-foreground transition-colors">{{
-              role.description }}</span>
+            class="text-sm text-muted-foreground group-hover:text-foreground group-data-[highlighted]:text-accent-foreground transition-colors">
+            {{ role.description }}
+          </span>
         </div>
 
-        <!-- High-contrast checkmark for colorblind accessibility -->
-        <div v-if="currentRole === role.value" class="relative flex-shrink-0">
-          <!-- Background circle for contrast -->
-          <div class="absolute inset-0 bg-white dark:bg-gray-900 rounded-full opacity-90"></div>
-          <!-- Checkmark icon with high contrast -->
-          <Check class="h-5 w-5 text-gray-900 dark:text-white relative z-10" />
-        </div>
+        <!-- Checkmark if active -->
+        <Check v-if="activeRole === role.code && role.hasRole" class="h-5 w-5 text-success flex-shrink-0" />
 
-        <Badge v-if="role.badge" variant="secondary" class="text-xs px-2 py-0.5 flex-shrink-0">
-          {{ role.badge }}
+        <!-- Badge if not approved -->
+        <Badge v-if="!role.hasRole" variant="secondary" class="text-xs px-2 py-0.5 flex-shrink-0">
+          {{ role.requiresApproval ? 'Demnächst' : 'Gesperrt' }}
         </Badge>
       </DropdownMenuItem>
 
diff --git a/app/composables/useActiveRole.ts b/app/composables/useActiveRole.ts
new file mode 100644
index 0000000..9d9caaf
--- /dev/null
+++ b/app/composables/useActiveRole.ts
@@ -0,0 +1,142 @@
+/**
+ * useActiveRole Composable
+ *
+ * Client-side state management for user's active role (RoleSwitcher)
+ *
+ * Features:
+ * - Reactive active role state
+ * - List of all roles with approval status
+ * - Switch role function with server validation
+ * - Admin change notification flag
+ *
+ * Usage:
+ * ```vue
+ * const { activeRole, roles, roleChangedByAdmin, switchRole, fetchRoleStatus } = useActiveRole()
+ *
+ * // Fetch current status (validates server-side)
+ * await fetchRoleStatus()
+ *
+ * // Switch role
+ * await switchRole('educator')
+ * ```
+ */
+
+export interface RoleWithStatus {
+  code: string
+  displayName: string
+  description: string
+  hasRole: boolean
+  requiresApproval: boolean
+}
+
+export function useActiveRole() {
+  // Use useState for shared state across the app
+  const activeRole = useState<string>('activeRole', () => 'private')
+  const roles = useState<RoleWithStatus[]>('roles', () => [])
+  const roleChangedByAdmin = useState<boolean>('roleChangedByAdmin', () => false)
+  const loading = useState<boolean>('roleLoading', () => false)
+  const error = useState<string | null>('roleError', () => null)
+  const initialized = useState<boolean>('roleInitialized', () => false)
+
+  /**
+   * Fetch current role status from server
+   * - Validates active role (TTL-based)
+   * - Fetches all roles with approval status
+   * - Detects if admin changed user's roles
+   */
+  async function fetchRoleStatus() {
+    loading.value = true
+    error.value = null
+
+    try {
+      const data = await $fetch('/api/user/role-status')
+
+      activeRole.value = data.activeRoleCode
+      roles.value = data.roles
+      roleChangedByAdmin.value = data.roleChangedByAdmin
+
+      return data
+    } catch (err: any) {
+      console.error('Failed to fetch role status:', err)
+      error.value = 'Fehler beim Laden der Rollen'
+      throw err
+    } finally {
+      loading.value = false
+    }
+  }
+
+  /**
+   * Switch to a different role
+   * - Validates server-side that user has the role
+   * - Updates session + database
+   * - Refreshes products list if on products page
+   *
+   * @param roleCode - Role to switch to ('private', 'educator', 'company')
+   * @throws Error if user doesn't have the role or if switch fails
+   */
+  async function switchRole(roleCode: string) {
+    loading.value = true
+    error.value = null
+
+    try {
+      await $fetch('/api/user/active-role', {
+        method: 'PATCH',
+        body: { roleCode },
+      })
+
+      // Update local state
+      activeRole.value = roleCode
+      roleChangedByAdmin.value = false
+
+      // Refresh products if on products page
+      await refreshNuxtData('products')
+
+      return true
+    } catch (err: any) {
+      console.error('Failed to switch role:', err)
+      error.value = err.data?.message || 'Fehler beim Wechseln der Rolle'
+      throw err
+    } finally {
+      loading.value = false
+    }
+  }
+
+  /**
+   * Get roles that user actually has (approved only)
+   */
+  const approvedRoles = computed(() => roles.value.filter((r) => r.hasRole))
+
+  /**
+   * Check if user has multiple roles
+   */
+  const hasMultipleRoles = computed(() => approvedRoles.value.length > 1)
+
+  /**
+   * Auto-initialize on first use (fetch role status from server)
+   * This ensures the role is correct immediately after login
+   */
+  const { loggedIn } = useUserSession()
+  if (!initialized.value && loggedIn.value) {
+    initialized.value = true
+    // Fetch initial role status (don't await to avoid blocking)
+    fetchRoleStatus().catch((err) => {
+      // Silent fail - user can still use the app with default role
+      console.warn('Failed to initialize role status:', err)
+    })
+  }
+
+  return {
+    // State (useState already returns writable refs)
+    activeRole,
+    roles,
+    approvedRoles,
+    hasMultipleRoles,
+    roleChangedByAdmin,
+    loading,
+    error,
+
+    // Actions
+    fetchRoleStatus,
+    switchRole,
+  }
+}
diff --git a/app/pages/checkout.vue b/app/pages/checkout.vue
index b7ff5b8..6219eaa 100644
--- a/app/pages/checkout.vue
+++ b/app/pages/checkout.vue
@@ -100,9 +100,9 @@ async function handleCheckout(checkoutData: CheckoutData) {
 
     <div class="container mx-auto px-4 py-8 max-w-7xl">
       <!-- Page Header -->
-      <div class="mb-8">
-        <h1 class="text-4xl font-bold text-white mb-2">Zur Kasse</h1>
-        <p class="text-white/70">
+      <div class="mb-12 text-center">
+        <h1 class="text-4xl font-bold text-white mb-4 md:text-5xl">Zur Kasse</h1>
+        <p class="mx-auto max-w-2xl text-lg text-white/80">
           Bitte gib deine Rechnungsadresse ein, um die Bestellung abzuschließen.
         </p>
       </div>
diff --git a/server/api/auth/login.post.ts b/server/api/auth/login.post.ts
index 35e3682..2dfb49e 100644
--- a/server/api/auth/login.post.ts
+++ b/server/api/auth/login.post.ts
@@ -86,7 +86,16 @@ export default defineEventHandler(async (event) => {
       }
     }
 
-    // 6. Create encrypted session
+    // 6. Determine initial active role
+    const approvedRoles = await getUserApprovedRoleCodes(user.id)
+
+    // Use last active role if user had one and still has that role
+    const initialRole =
+      user.lastActiveRoleCode && approvedRoles.includes(user.lastActiveRoleCode)
+        ? user.lastActiveRoleCode
+        : approvedRoles[0] || 'private'
+
+    // 7. Create encrypted session
     await setUserSession(event, {
       user: {
         id: user.id,
@@ -103,9 +112,14 @@ export default defineEventHandler(async (event) => {
       },
       accessToken: tokens.access_token, // Store for logout
       loggedInAt: new Date().toISOString(),
+      // Role state management
+      activeRoleCode: initialRole,
+      userApprovedRoles: approvedRoles,
+      rolesLastValidated: new Date().toISOString(),
+      roleChangedByAdmin: false,
     })
 
-    // 7. Return success
+    // 8. Return success
     return {
       success: true,
     }
diff --git a/server/api/products/index.get.ts b/server/api/products/index.get.ts
index 5cf9b12..b4a54b9 100644
--- a/server/api/products/index.get.ts
+++ b/server/api/products/index.get.ts
@@ -1,11 +1,11 @@
 /**
  * GET /api/products
  *
- * Returns a list of products visible to the current user based on their roles.
+ * Returns a list of products visible to the current user based on their active role.
  *
  * Role-based Visibility (MVP):
  * - Unauthenticated users: See NO products (empty array)
- * - Authenticated users: See products assigned to their approved roles
+ * - Authenticated users: See products assigned to their ACTIVE role only
  * - Products WITHOUT role assignments: NOT visible (opt-in visibility)
  *
  * Query Parameters:
@@ -16,7 +16,8 @@
 
 import { eq, and, inArray } from 'drizzle-orm'
 import { products } from '../../database/schema'
-import { getVisibleProductIdsForUser } from '../../utils/roles'
+import { getVisibleProductIdsForRole } from '../../utils/roles'
+import { getUserActiveRole } from '../../utils/role-session'
 
 export default defineEventHandler(async (event) => {
   const db = useDatabase()
@@ -32,10 +33,13 @@ export default defineEventHandler(async (event) => {
       return []
     }
 
-    // Get product IDs visible to this user (based on approved roles)
-    const visibleProductIds = await getVisibleProductIdsForUser(user.id)
+    // Get user's active role (validates with TTL, auto-fallback if revoked)
+    const activeRole = await getUserActiveRole(event)
 
-    // If user has no approved roles or no products are assigned to their roles
+    // Get product IDs visible for the active role only
+    const visibleProductIds = await getVisibleProductIdsForRole(user.id, activeRole)
+
+    // If user has no access to products in their active role
     if (visibleProductIds.length === 0) {
       return []
     }
diff --git a/server/api/user/active-role.patch.ts b/server/api/user/active-role.patch.ts
new file mode 100644
index 0000000..de22147
--- /dev/null
+++ b/server/api/user/active-role.patch.ts
@@ -0,0 +1,64 @@
+/**
+ * PATCH /api/user/active-role
+ *
+ * Switch user's active role (used by RoleSwitcher component)
+ *
+ * Request body:
+ * {
+ *   "roleCode": "educator"
+ * }
+ *
+ * Response:
+ * {
+ *   "success": true,
+ *   "activeRoleCode": "educator"
+ * }
+ *
+ * Validates that user has the requested role before switching
+ * Updates both session (immediate) and database (preference)
+ */
+
+import { z } from 'zod'
+import { setUserActiveRole } from '../../utils/role-session'
+
+const switchRoleSchema = z.object({
+  roleCode: z.enum(['private', 'educator', 'company'], {
+    errorMap: () => ({ message: 'Ungültige Rolle' }),
+  }),
+})
+
+export default defineEventHandler(async (event) => {
+  // Require authentication
+  await requireUserSession(event)
+
+  // Validate request body
+  const body = await readBody(event)
+  const { roleCode } = switchRoleSchema.parse(body)
+
+  try {
+    // Set active role (validates + updates session + saves to DB)
+    await setUserActiveRole(event, roleCode)
+
+    return {
+      success: true,
+      activeRoleCode: roleCode,
+    }
+  } catch (error: any) {
+    // setUserActiveRole throws 403 if user doesn't have role
+    if (error.statusCode === 403) {
+      setResponseStatus(event, 403)
+      return {
+        success: false,
+        message: error.message || 'Du hast diese Rolle nicht',
+      }
+    }
+
+    // Other errors
+    console.error('Role switch error:', error)
+    setResponseStatus(event, 500)
+    return {
+      success: false,
+      message: 'Fehler beim Wechseln der Rolle',
+    }
+  }
+})
diff --git a/server/api/user/role-status.get.ts b/server/api/user/role-status.get.ts
new file mode 100644
index 0000000..1ac9157
--- /dev/null
+++ b/server/api/user/role-status.get.ts
@@ -0,0 +1,69 @@
+/**
+ * GET /api/user/role-status
+ *
+ * Get user's active role and all available roles (for RoleSwitcher dropdown)
+ *
+ * Response:
+ * {
+ *   "activeRoleCode": "private",
+ *   "roles": [
+ *     {
+ *       "code": "private",
+ *       "displayName": "Privatperson",
+ *       "description": "Private Nutzung",
+ *       "hasRole": true,
+ *       "requiresApproval": false
+ *     },
+ *     {
+ *       "code": "educator",
+ *       "displayName": "Pädagoge",
+ *       "description": "Lehrkräfte und Schulen",
+ *       "hasRole": false,
+ *       "requiresApproval": true
+ *     },
+ *     ...
+ *   ],
+ *   "roleChangedByAdmin": false
+ * }
+ *
+ * - Validates active role with TTL (re-checks DB every 5min)
+ * - Returns ALL roles (approved + not-approved) for dropdown
+ * - Includes "hasRole" flag to show which roles user actually has
+ */
+
+import { asc, eq } from 'drizzle-orm'
+import { roles } from '../../database/schema'
+import { getUserActiveRole } from '../../utils/role-session'
+import { getUserApprovedRoleCodes } from '../../utils/roles'
+
+export default defineEventHandler(async (event) => {
+  const session = await requireUserSession(event)
+
+  // Get active role (validates with TTL, auto-fallback if revoked)
+  const activeRole = await getUserActiveRole(event)
+
+  // Get user's approved role codes
+  const approvedRoleCodes = await getUserApprovedRoleCodes(session.user.id)
+
+  // Get ALL roles from database (for dropdown: show all, disabled if not approved)
+  const db = useDatabase()
+  const allRoles = await db.query.roles.findMany({
+    where: eq(roles.active, true),
+    orderBy: asc(roles.sortOrder),
+  })
+
+  // Map roles with "hasRole" status
+  const rolesWithStatus = allRoles.map((role) => ({
+    code: role.code,
+    displayName: role.displayName,
+    description: role.description,
+    hasRole: approvedRoleCodes.includes(role.code),
+    requiresApproval: role.requiresApproval,
+  }))
+
+  return {
+    activeRoleCode: activeRole,
+    roles: rolesWithStatus,
+    roleChangedByAdmin: session.roleChangedByAdmin || false,
+  }
+})
diff --git a/server/database/migrations/0003_charming_zzzax.sql b/server/database/migrations/0003_charming_zzzax.sql
new file mode 100644
index 0000000..3eb9229
--- /dev/null
+++ b/server/database/migrations/0003_charming_zzzax.sql
@@ -0,0 +1 @@
+ALTER TABLE "users" ADD COLUMN "last_active_role_code" "role_code";
\ No newline at end of file
diff --git a/server/database/migrations/meta/0003_snapshot.json b/server/database/migrations/meta/0003_snapshot.json
new file mode 100644
index 0000000..b3a89ef
--- /dev/null
+++ b/server/database/migrations/meta/0003_snapshot.json
@@ -0,0 +1,1030 @@
+{
+  "id": "32e722c5-1727-4e1b-b63b-77dd1e765af6",
+  "prevId": "bb113291-d5b3-4e90-954a-074c2ef6c5e4",
+  "version": "7",
+  "dialect": "postgresql",
+  "tables": {
+    "public.cart_items": {
+      "name": "cart_items",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "cart_id": {
+          "name": "cart_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "product_id": {
+          "name": "product_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "quantity": {
+          "name": "quantity",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "added_at": {
+          "name": "added_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "cart_items_cart_id_carts_id_fk": {
+          "name": "cart_items_cart_id_carts_id_fk",
+          "tableFrom": "cart_items",
+          "tableTo": "carts",
+          "columnsFrom": [
+            "cart_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "cart_items_product_id_products_id_fk": {
+          "name": "cart_items_product_id_products_id_fk",
+          "tableFrom": "cart_items",
+          "tableTo": "products",
+          "columnsFrom": [
+            "product_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.carts": {
+      "name": "carts",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "session_id": {
+          "name": "session_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "carts_user_id_users_id_fk": {
+          "name": "carts_user_id_users_id_fk",
+          "tableFrom": "carts",
+          "tableTo": "users",
+          "columnsFrom": [
+            "user_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.order_items": {
+      "name": "order_items",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "order_id": {
+          "name": "order_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "product_id": {
+          "name": "product_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "product_snapshot": {
+          "name": "product_snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "quantity": {
+          "name": "quantity",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "price_snapshot": {
+          "name": "price_snapshot",
+          "type": "numeric(10, 2)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "order_items_order_id_orders_id_fk": {
+          "name": "order_items_order_id_orders_id_fk",
+          "tableFrom": "order_items",
+          "tableTo": "orders",
+          "columnsFrom": [
+            "order_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "order_items_product_id_products_id_fk": {
+          "name": "order_items_product_id_products_id_fk",
+          "tableFrom": "order_items",
+          "tableTo": "products",
+          "columnsFrom": [
+            "product_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.orders": {
+      "name": "orders",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "order_number": {
+          "name": "order_number",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "total_amount": {
+          "name": "total_amount",
+          "type": "numeric(10, 2)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "order_status",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "billing_address": {
+          "name": "billing_address",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "payment_id": {
+          "name": "payment_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "payment_completed_at": {
+          "name": "payment_completed_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "orders_order_number_idx": {
+          "name": "orders_order_number_idx",
+          "columns": [
+            {
+              "expression": "order_number",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "orders_user_id_idx": {
+          "name": "orders_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "orders_status_idx": {
+          "name": "orders_status_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "orders_user_id_users_id_fk": {
+          "name": "orders_user_id_users_id_fk",
+          "tableFrom": "orders",
+          "tableTo": "users",
+          "columnsFrom": [
+            "user_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "orders_order_number_unique": {
+          "name": "orders_order_number_unique",
+          "nullsNotDistinct": false,
+          "columns": [
+            "order_number"
+          ]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.product_role_visibility": {
+      "name": "product_role_visibility",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "product_id": {
+          "name": "product_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "role_code": {
+          "name": "role_code",
+          "type": "role_code",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "product_role_visibility_product_id_role_code_unique": {
+          "name": "product_role_visibility_product_id_role_code_unique",
+          "columns": [
+            {
+              "expression": "product_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "role_code",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "product_role_visibility_product_id_idx": {
+          "name": "product_role_visibility_product_id_idx",
+          "columns": [
+            {
+              "expression": "product_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "product_role_visibility_role_code_idx": {
+          "name": "product_role_visibility_role_code_idx",
+          "columns": [
+            {
+              "expression": "role_code",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "product_role_visibility_product_id_products_id_fk": {
+          "name": "product_role_visibility_product_id_products_id_fk",
+          "tableFrom": "product_role_visibility",
+          "tableTo": "products",
+          "columnsFrom": [
+            "product_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "product_role_visibility_role_code_roles_code_fk": {
+          "name": "product_role_visibility_role_code_roles_code_fk",
+          "tableFrom": "product_role_visibility",
+          "tableTo": "roles",
+          "columnsFrom": [
+            "role_code"
+          ],
+          "columnsTo": [
+            "code"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.products": {
+      "name": "products",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "nav_product_id": {
+          "name": "nav_product_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "price": {
+          "name": "price",
+          "type": "numeric(10, 2)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "stock_quantity": {
+          "name": "stock_quantity",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "category": {
+          "name": "category",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "image_url": {
+          "name": "image_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "active": {
+          "name": "active",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "products_nav_product_id_idx": {
+          "name": "products_nav_product_id_idx",
+          "columns": [
+            {
+              "expression": "nav_product_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "products_active_idx": {
+          "name": "products_active_idx",
+          "columns": [
+            {
+              "expression": "active",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "products_category_idx": {
+          "name": "products_category_idx",
+          "columns": [
+            {
+              "expression": "category",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "products_nav_product_id_unique": {
+          "name": "products_nav_product_id_unique",
+          "nullsNotDistinct": false,
+          "columns": [
+            "nav_product_id"
+          ]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.roles": {
+      "name": "roles",
+      "schema": "",
+      "columns": {
+        "code": {
+          "name": "code",
+          "type": "role_code",
+          "typeSchema": "public",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "display_name": {
+          "name": "display_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "requires_approval": {
+          "name": "requires_approval",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "sort_order": {
+          "name": "sort_order",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "active": {
+          "name": "active",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.user_roles": {
+      "name": "user_roles",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "role_code": {
+          "name": "role_code",
+          "type": "role_code",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "role_request_status",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "organization_name": {
+          "name": "organization_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "admin_notes": {
+          "name": "admin_notes",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status_history": {
+          "name": "status_history",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "user_roles_user_id_role_code_unique": {
+          "name": "user_roles_user_id_role_code_unique",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "role_code",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_roles_user_id_idx": {
+          "name": "user_roles_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_roles_role_code_idx": {
+          "name": "user_roles_role_code_idx",
+          "columns": [
+            {
+              "expression": "role_code",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_roles_status_idx": {
+          "name": "user_roles_status_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "user_roles_user_id_users_id_fk": {
+          "name": "user_roles_user_id_users_id_fk",
+          "tableFrom": "user_roles",
+          "tableTo": "users",
+          "columnsFrom": [
+            "user_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "user_roles_role_code_roles_code_fk": {
+          "name": "user_roles_role_code_roles_code_fk",
+          "tableFrom": "user_roles",
+          "tableTo": "roles",
+          "columnsFrom": [
+            "role_code"
+          ],
+          "columnsTo": [
+            "code"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.users": {
+      "name": "users",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "experimenta_id": {
+          "name": "experimenta_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "email": {
+          "name": "email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "first_name": {
+          "name": "first_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "last_name": {
+          "name": "last_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "salutation": {
+          "name": "salutation",
+          "type": "salutation",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "date_of_birth": {
+          "name": "date_of_birth",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "phone": {
+          "name": "phone",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "street": {
+          "name": "street",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "post_code": {
+          "name": "post_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "city": {
+          "name": "city",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "country_code": {
+          "name": "country_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_active_role_code": {
+          "name": "last_active_role_code",
+          "type": "role_code",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "users_experimenta_id_unique": {
+          "name": "users_experimenta_id_unique",
+          "nullsNotDistinct": false,
+          "columns": [
+            "experimenta_id"
+          ]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    }
+  },
+  "enums": {
+    "public.order_status": {
+      "name": "order_status",
+      "schema": "public",
+      "values": [
+        "pending",
+        "paid",
+        "processing",
+        "completed",
+        "failed"
+      ]
+    },
+    "public.role_code": {
+      "name": "role_code",
+      "schema": "public",
+      "values": [
+        "private",
+        "educator",
+        "company"
+      ]
+    },
+    "public.role_request_status": {
+      "name": "role_request_status",
+      "schema": "public",
+      "values": [
+        "pending",
+        "approved",
+        "rejected"
+      ]
+    },
+    "public.salutation": {
+      "name": "salutation",
+      "schema": "public",
+      "values": [
+        "male",
+        "female",
+        "other"
+      ]
+    }
+  },
+  "schemas": {},
+  "sequences": {},
+  "roles": {},
+  "policies": {},
+  "views": {},
+  "_meta": {
+    "columns": {},
+    "schemas": {},
+    "tables": {}
+  }
+}
\ No newline at end of file
diff --git a/server/database/migrations/meta/_journal.json b/server/database/migrations/meta/_journal.json
index 5318b9d..56670cb 100644
--- a/server/database/migrations/meta/_journal.json
+++ b/server/database/migrations/meta/_journal.json
@@ -22,6 +22,13 @@
       "when": 1762176703220,
       "tag": "0002_heavy_namora",
       "breakpoints": true
+    },
+    {
+      "idx": 3,
+      "version": "7",
+      "when": 1762266703780,
+      "tag": "0003_charming_zzzax",
+      "breakpoints": true
     }
   ]
 }
\ No newline at end of file
diff --git a/server/database/schema.ts b/server/database/schema.ts
index 90cfd94..87b8108 100644
--- a/server/database/schema.ts
+++ b/server/database/schema.ts
@@ -127,6 +127,9 @@ export const users = pgTable('users', {
   city: text('city'),
   countryCode: text('country_code'), // ISO 3166-1 alpha-2 (e.g., 'DE', 'AT')
 
+  // Role preference (last selected role, used as default after login)
+  lastActiveRoleCode: roleCodeEnum('last_active_role_code'),
+
   createdAt: timestamp('created_at').defaultNow().notNull(),
   updatedAt: timestamp('updated_at').defaultNow().notNull(),
 })
diff --git a/server/database/seed.ts b/server/database/seed.ts
index 58326d5..c5c88aa 100644
--- a/server/database/seed.ts
+++ b/server/database/seed.ts
@@ -88,7 +88,7 @@ const mockProducts: Array<{
     stockQuantity: 99999,
     category: 'educator-annual-pass',
     active: true,
-    roles: ['private', 'educator'],
+    roles: ['educator'],
   },
 ]
 
diff --git a/server/utils/role-session.ts b/server/utils/role-session.ts
new file mode 100644
index 0000000..cbdbb10
--- /dev/null
+++ b/server/utils/role-session.ts
@@ -0,0 +1,111 @@
+import type { H3Event } from 'h3'
+import { eq } from 'drizzle-orm'
+import { users } from '../database/schema'
+import { getUserApprovedRoleCodes } from './roles'
+
+/**
+ * Role validation cache TTL (Time To Live)
+ * Roles are re-validated against DB after this period
+ */
+const ROLE_VALIDATION_TTL = 5 * 60 * 1000 // 5 minutes in milliseconds
+
+/**
+ * Get user's active role with automatic validation
+ *
+ * Features:
+ * - Returns cached role from session if TTL hasn't expired
+ * - Re-validates against DB after TTL expires (every 5 minutes)
+ * - Auto-fallback if active role was revoked by admin
+ * - Updates session automatically with validated data
+ *
+ * @param event - H3 Event from API handler
+ * @returns Active role code (e.g., 'private', 'educator', 'company')
+ * @throws 401 if user is not authenticated
+ */
+export async function getUserActiveRole(event: H3Event): Promise<string> {
+  const session = await getUserSession(event)
+
+  if (!session?.user) {
+    throw createError({
+      statusCode: 401,
+      message: 'Not authenticated',
+    })
+  }
+
+  const now = Date.now()
+  const lastValidated = session.rolesLastValidated
+    ? new Date(session.rolesLastValidated).getTime()
+    : 0
+  const needsRevalidation = now - lastValidated > ROLE_VALIDATION_TTL
+
+  if (needsRevalidation) {
+    // TTL expired → Re-validate against database
+    const currentRoles = await getUserApprovedRoleCodes(session.user.id)
+    const activeRole = session.activeRoleCode || 'private'
+
+    // Check: Was active role revoked by admin?
+    if (!currentRoles.includes(activeRole)) {
+      // Auto-fallback to first available role
+      const newActiveRole = currentRoles[0] || 'private'
+
+      await replaceUserSession(event, {
+        activeRoleCode: newActiveRole,
+        userApprovedRoles: currentRoles,
+        rolesLastValidated: new Date().toISOString(),
+        roleChangedByAdmin: true, // Flag for client notification
+      })
+
+      return newActiveRole
+    }
+
+    // Role still valid, just update cache + timestamp
+    await replaceUserSession(event, {
+      userApprovedRoles: currentRoles,
+      rolesLastValidated: new Date().toISOString(),
+    })
+  }
+
+  return session.activeRoleCode || 'private'
+}
+
+/**
+ * Set user's active role with validation
+ *
+ * Validates that user has the requested role before switching.
+ * Updates both session (immediate) and database (preference for next login).
+ *
+ * @param event - H3 Event from API handler
+ * @param roleCode - Role to switch to (must be in user's approved roles)
+ * @throws 401 if not authenticated
+ * @throws 403 if user doesn't have the requested role
+ */
+export async function setUserActiveRole(
+  event: H3Event,
+  roleCode: string
+): Promise<void> {
+  const session = await requireUserSession(event)
+
+  // Validate that user has this role
+  const approvedRoles = await getUserApprovedRoleCodes(session.user.id)
+
+  if (!approvedRoles.includes(roleCode)) {
+    throw createError({
+      statusCode: 403,
+      message: 'Du hast diese Rolle nicht',
+    })
+  }
+
+  // Update session with new active role
+  await replaceUserSession(event, {
+    activeRoleCode: roleCode,
+    roleChangedByAdmin: false, // User switched manually
+    rolesLastValidated: new Date().toISOString(), // Reset TTL
+  })
+
+  // Update database: Save as user preference for next login
+  const db = useDatabase()
+  await db
+    .update(users)
+    .set({ lastActiveRoleCode: roleCode })
+    .where(eq(users.id, session.user.id))
+}
diff --git a/server/utils/roles.ts b/server/utils/roles.ts
index d05d04e..87cdd2c 100644
--- a/server/utils/roles.ts
+++ b/server/utils/roles.ts
@@ -120,6 +120,48 @@ export async function getVisibleProductIdsForUser(userId: string): Promise<strin
   return [...new Set(visibleProducts.map((pv) => pv.productId))]
 }
 
+/**
+ * Get products visible for a SPECIFIC role (used with RoleSwitcher)
+ * Unlike getVisibleProductIdsForUser(), this only returns products for ONE role
+ *
+ * Usage:
+ * ```typescript
+ * const activeRole = await getUserActiveRole(event)
+ * const visibleProductIds = await getVisibleProductIdsForRole(userId, activeRole)
+ * ```
+ *
+ * @param userId - The user's UUID
+ * @param roleCode - Specific role to filter by ('private', 'educator', 'company')
+ * @returns Array of product UUIDs visible for this role
+ */
+export async function getVisibleProductIdsForRole(
+  userId: string,
+  roleCode: string
+): Promise<string[]> {
+  const db = useDatabase()
+
+  // Verify user has this role (approved)
+  const hasRole = await db.query.userRoles.findFirst({
+    where: and(
+      eq(userRoles.userId, userId),
+      eq(userRoles.roleCode, roleCode),
+      eq(userRoles.status, 'approved')
+    ),
+  })
+
+  // User doesn't have this role → return empty array
+  if (!hasRole) {
+    return []
+  }
+
+  // Get all products assigned to this specific role
+  const visibleProducts = await db.query.productRoleVisibility.findMany({
+    where: eq(productRoleVisibility.roleCode, roleCode),
+  })
+
+  return visibleProducts.map((pv) => pv.productId)
+}
+
 /**
  * Assign a role to a user (MVP: manual assignment, always approved)
  * Phase 2/3: This will be replaced by role request workflow