diff --git a/scripts/create-user.mjs b/scripts/create-user.mjs
index 0dca403..3621a1a 100644
--- a/scripts/create-user.mjs
+++ b/scripts/create-user.mjs
@@ -8,8 +8,8 @@ if (!username || !password) {
   console.error('Uso: npm run create-user -- <username> <password> [role]');
   process.exit(1);
 }
-if (!['admin', 'superuser', 'user', 'campus'].includes(role)) {
-  console.error('Ruolo non valido. Ammessi: admin, superuser, user, campus');
+if (!['admin', 'superuser', 'user', 'piattaforme', 'cliente', 'trainer'].includes(role)) {
+  console.error('Ruolo non valido. Ammessi: admin, superuser, user, piattaforme, cliente, trainer');
   process.exit(1);
 }
 const path = process.env.DB_PATH ?? 'data/insanitylab.db';
diff --git a/src/lib/auth.ts b/src/lib/auth.ts
index 8131b0d..e98a2f0 100644
--- a/src/lib/auth.ts
+++ b/src/lib/auth.ts
@@ -118,7 +118,7 @@ export function randomPassword(): string {
 }
 
 export function isRole(v: unknown): v is Role {
-  return v === 'admin' || v === 'superuser' || v === 'user' || v === 'piattaforme';
+  return v === 'admin' || v === 'superuser' || v === 'user' || v === 'piattaforme' || v === 'cliente' || v === 'trainer';
 }
 
 export function landingFor(role: string): string {
diff --git a/src/middleware.ts b/src/middleware.ts
index 58dc1c5..c638615 100644
--- a/src/middleware.ts
+++ b/src/middleware.ts
@@ -16,7 +16,7 @@ export const onRequest = defineMiddleware((context, next) => {
     }
     // Le piattaforme riservate si raggiungono dal sito, quindi passano dal login
     // pubblico e ci tornano dopo l'accesso; il pannello ha il proprio.
-    if (pathname.startsWith('/campus') || pathname.startsWith('/piattaforme'))
+    if (pathname.startsWith('/campus') || pathname.startsWith('/piattaforme') || pathname.startsWith('/longevity'))
       return context.redirect(`/login?next=${encodeURIComponent(pathname)}`);
     return context.redirect('/admin/login');
   }
diff --git a/tests/longevity/ruoli.test.ts b/tests/longevity/ruoli.test.ts
index 3eb32ba..fd5c3be 100644
--- a/tests/longevity/ruoli.test.ts
+++ b/tests/longevity/ruoli.test.ts
@@ -1,5 +1,5 @@
 import { describe, it, expect } from 'vitest';
-import { canAccessAdminPath, isProtectedPath, landingFor } from '../../src/lib/auth';
+import { canAccessAdminPath, isProtectedPath, landingFor, isRole } from '../../src/lib/auth';
 
 describe('accesso alle rotte longevity', () => {
   it('il cliente entra nel proprio spazio', () => {
@@ -21,6 +21,12 @@ describe('accesso alle rotte longevity', () => {
     expect(canAccessAdminPath('cliente', '/admin/posts')).toBe(false);
   });
 
+  it('il trainer non entra nelle altre piattaforme ne nel blog', () => {
+    expect(canAccessAdminPath('trainer', '/campus')).toBe(false);
+    expect(canAccessAdminPath('trainer', '/admin/content')).toBe(false);
+    expect(canAccessAdminPath('trainer', '/admin/posts')).toBe(false);
+  });
+
   it('il ruolo piattaforme non eredita longevity', () => {
     expect(canAccessAdminPath('piattaforme', '/longevity/gestionale')).toBe(false);
   });
@@ -68,3 +74,22 @@ describe('landingFor — indirizzo di atterraggio per ruolo', () => {
     expect(landingFor('user')).toBe('/admin');
   });
 });
+
+describe('isRole — validazione dei ruoli', () => {
+  it('cliente e trainer sono ruoli validi', () => {
+    expect(isRole('cliente')).toBe(true);
+    expect(isRole('trainer')).toBe(true);
+  });
+
+  it('i ruoli già esistenti restano validi', () => {
+    expect(isRole('admin')).toBe(true);
+    expect(isRole('superuser')).toBe(true);
+    expect(isRole('user')).toBe(true);
+    expect(isRole('piattaforme')).toBe(true);
+  });
+
+  it('campus e stringhe inventate non sono ruoli', () => {
+    expect(isRole('campus')).toBe(false);
+    expect(isRole('qualsiasi-cosa')).toBe(false);
+  });
+});