@adminforth/two-factors-auth 1.10.6 → 1.11.0

package/dist/custom/TwoFactorsPasskeysSettings.vue

@@ -1,5 +1,5 @@
 <template>
-    <div class="text-3xl text-gray-900 font-semibold max-w-2xl mr-6 flex-col justify-center items-center">
+    <div class="text-3xl text-lightBreadcrumbsText dark:text-darkBreadcrumbsText font-semibold max-w-2xl mr-6 flex-col justify-center items-center">
         <p class="flex items-start justify-start leading-none">Passkeys</p>
         <div class="flex flex-col items-end">
             <Table
@@ -17,17 +17,23 @@
                         class="w-96"
                         :buttons="[
                             { label: 'Save', onclick: (dialog) => { renamePasskey(item.id, passkeysNewName); dialog.hide(); } },
-                            { label: 'Cancel', options: {class: 'bg-white focus:!ring-gray-200 !text-gray-900 hover:!bg-gray-200 dark:!bg-gray-800 dark:!text-gray-300 dark:hover:!bg-gray-700 dark:border-gray-900'}, onclick: (dialog) => {passkeysNewName = ''; dialog.hide();} },
+                            { label: 'Cancel', options: {class: 'bg-white focus:!ring-gray-200 !text-gray-900 hover:!bg-gray-200 dark:!bg-gray-800 dark:!text-gray-300 dark:hover:!bg-gray-700 dark:border-gray-900 dark:hover:!border-gray-800 dark:focus:!ring-gray-800'}, onclick: (dialog) => {passkeysNewName = ''; dialog.hide();} },
                         ]"
                         header="Edit Passkey"
                     >
                         <template #trigger>
-                            <div 
-                                @click="passkeysNewName = ''"
-                                class="w-7 h-7 flex items-center justify-center hover:border rounded-md hover:shadow-md text-blue-500 hover:text-blue-700 cursor-pointer"
-                            >
-                                <IconPenSolid class="w-5 h-5" />
-                            </div>
+                            <Tooltip>
+                                <div 
+                                    @click="passkeysNewName = ''"
+                                    class="w-7 h-7 flex items-center justify-center rounded-md text-blue-500 hover:text-blue-700 cursor-pointer"
+                                >
+                                    <IconPenSolid class="w-5 h-5" />
+                                </div>
+
+                                <template #tooltip>
+                                    Rename passkey
+                                </template>
+                            </Tooltip>
                         </template>
                         <div>
                             <p>Enter new passkey name:</p>
@@ -42,17 +48,22 @@
                     <Dialog 
                         class="w-96"
                         :buttons="[
-                            { label: 'Delete', options: {class: 'bg-red-700 !text-white hover:!bg-red-600 focus:ring-2 focus:ring-red-500'}, onclick: (dialog) => { deletePasskey(item.id); dialog.hide(); } },
-                            { label: 'Cancel', options: {class: 'bg-white focus:!ring-gray-200 !text-gray-900 hover:!bg-gray-200'}, onclick: (dialog) => dialog.hide() },
+                            { label: 'Delete', options: {class: 'bg-red-700 !text-white hover:!bg-red-600 focus:ring-2 focus:ring-red-500 dark:!bg-red-700 dark:hover:!bg-red-600 dark:focus:ring-red-500 dark:!border-red-800'}, onclick: (dialog) => { deletePasskey(item.id); dialog.hide(); } },
+                            { label: 'Cancel', options: {class: 'bg-white focus:!ring-gray-200 !text-gray-900 hover:!bg-gray-200 dark:!text-white dark:!bg-gray-700 dark:hover:!bg-gray-800 dark:!border-gray-600 dark:focus:!ring-gray-800'}, onclick: (dialog) => dialog.hide() },
                         ]"
                         header="Delete Passkey"
                     >
                         <template #trigger>
-                            <div class="w-7 h-7 flex items-center justify-center hover:border rounded-md hover:shadow-md text-red-500 hover:text-red-700 cursor-pointer">
-                                <IconTrashBinSolid 
-                                    class="w-5 h-5" 
-                                />
-                            </div>
+                            <Tooltip>
+                                <div class="w-7 h-7 flex items-center justify-center rounded-md text-red-500 hover:text-red-700 cursor-pointer">
+                                    <IconTrashBinSolid 
+                                        class="w-5 h-5" 
+                                    />
+                                </div>
+                                <template #tooltip>
+                                    Delete passkey
+                                </template>
+                            </Tooltip>
                         </template>
                         <div>
                             <p>Are you sure you want to delete this passkey?</p>
@@ -66,9 +77,9 @@
             </template>
             </Table>
             <div class="flex space-x-4 mt-4" v-if="isInitialFinished">
-                <ButtonGroup :solidColor="true">
+                <ButtonGroup :solidColor="true" v-if="isFetchingPasskey === false">
                     <template #button:Profile>
-                        <div class="flex px-4 py-2" @click="addPasskey()">
+                        <div class="flex px-4 py-2" @click="addPasskeyStartAction()">
                             <IconPlusOutline class="w-5 h-5 me-2"/>
                             <p>{{ addPasskeyMode === 'platform' ? 'Add Local Passkey' : 'Add External Passkey' }}</p>
                         </div>
@@ -79,6 +90,7 @@
                         </div>
                     </template>
                 </ButtonGroup>
+                <p v-else class="flex items-center justify-center gap-2 text-base">Processing <Spinner class="w-4 h-4 inline-block" /></p>
             </div> 
             <div v-if="isCardsVisible" id="cards-container" class="w-80 mt-2 border-gray-400 p-2 bg-white rounded-lg shadow-md flex flex-col space-y-2">
                 <div v-if="isPasskeySupported" class="flex justify-between gap-4" :class="!isPasskeySupported ? 'opacity-50 pointer-events-none' : ''">
@@ -127,6 +139,29 @@
                 </div>
             </div>
         </div>
+        <Dialog 
+            ref="confirmDialog" 
+            class="w-96" 
+            :click-to-close-outside="false"   
+            :buttons="[]"
+        >
+            <div class="flex flex-col">
+                <button
+                type="button"
+                class="text-lightDialogCloseButton bg-transparent hover:bg-lightDialogCloseButtonHoverBackground hover:text-lightDialogCloseButtonHover rounded-lg text-sm w-8 h-8 ms-auto inline-flex justify-center items-center dark:text-darkDialogCloseButton dark:hover:bg-darkDialogCloseButtonHoverBackground dark:hover:text-darkDialogCloseButtonHover"
+                @click="{ isFetchingPasskey = false; fetchedOptions = null; closeDialog(); }"
+                >
+                    <svg class="w-3 h-3" aria-hidden="true" xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 14 14">
+                        <path stroke="currentColor" stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="m1 1 6 6m0 0 6 6M7 7l6-6M7 7l-6 6"/>
+                    </svg>
+                    <span class="sr-only">Close dialog</span>
+                </button>
+                <div class="flex items-center justify-center space-y-4">
+                    Now you can add a passkey. 
+                </div>
+                <Button class="mt-4" @click="addPasskeyFinishAction(fetchedOptions); closeDialog();">Add Passkey</Button>
+            </div>
+        </Dialog>
     </div>
 </template>
 
@@ -135,7 +170,7 @@
     import { callAdminForthApi } from '@/utils';
     import adminforth from '@/adminforth';
     import { onMounted, ref, Ref, onBeforeUnmount } from 'vue';
-    import { Card, Dialog, ButtonGroup, Tooltip } from '@/afcl'
+    import { Card, Dialog, ButtonGroup, Tooltip, Spinner, Button } from '@/afcl'
     import { IconTrashBinSolid, IconPenSolid, IconPlusOutline, IconCaretDownSolid, IconCheckOutline } from '@iconify-prerendered/vue-flowbite';
     import dayjs from 'dayjs';
     import utc from 'dayjs/plugin/utc';
@@ -152,6 +187,19 @@
     const addPasskeyMode: Ref<'platform' | 'cross-platform'> = ref('platform');
     const authenticatorAttachment = ref<'platform' | 'cross-platform' | 'both'>('platform');
     const isInitialFinished = ref(false);
+    const isFetchingPasskey = ref(false);
+
+    const confirmDialog = ref(null);
+
+    const openDialog = () => {
+        confirmDialog.value.open();
+    }
+
+    const closeDialog = () => {
+        confirmDialog.value.close();
+    }
+
+    const fetchedOptions = ref(null);
 
     onMounted(async () => {
         await getPasskeys();
@@ -179,13 +227,39 @@
         }
     }
 
-    async function addPasskey() {
-        const { options, challengeId } = await fetchInformationFromTheBackend();
+    async function addPasskeyStartAction() {
+        isFetchingPasskey.value = true;
+        let confirmationResult;
+        try {
+            confirmationResult = await window.adminforthTwoFaModal.get2FaConfirmationResult(undefined, "To add passkey first verify yourself");
+        } catch (e) {
+            isFetchingPasskey.value = false;
+            return;
+        }
+        if (!confirmationResult) {
+            isFetchingPasskey.value = false;
+            return;
+        }
+        const { options } = await fetchInformationFromTheBackend(confirmationResult);
+        if (!options ) {
+            isFetchingPasskey.value = false;
+            adminforth.alert({message: 'Verification failed.', variant: 'warning'});
+            return;
+        }
+        fetchedOptions.value = options;
+        openDialog();
+    }
+
+    async function addPasskeyFinishAction(options) {
         const creationResult = await callWebAuthn(options);
         if (!creationResult) {
+            isFetchingPasskey.value = false;
+            fetchedOptions.value = null;
             return;
         }
-        finishRegisteringPasskey(creationResult, challengeId);
+        fetchedOptions.value = null;
+        finishRegisteringPasskey(creationResult);
+        isFetchingPasskey.value = false;
     }
 
     async function getPasskeys() {
@@ -267,20 +341,24 @@
         }  
     } 
     
-    async function fetchInformationFromTheBackend() {
+    async function fetchInformationFromTheBackend(confirmationResult) {
         let response;
         try {
             response = await callAdminForthApi({
                 path: `/plugin/passkeys/registerPasskeyRequest`,
                 method: 'POST',
                 body: {
-                    mode: addPasskeyMode.value
+                    mode: addPasskeyMode.value,
+                    confirmationResult: confirmationResult
                 },
             });
         } catch (error) {
             console.error('Error fetching passkeys info:', error);
             return;
         }
+        if (!response.ok) {
+            return {};
+        }
         const _options = response.data;
         const challengeId = response.challengeId;
         const options = PublicKeyCredential.parseCreationOptionsFromJSON(_options);
@@ -303,7 +381,7 @@
         return result;
     }
 
-    async function finishRegisteringPasskey(credential: any, challengeId: string) {
+    async function finishRegisteringPasskey(credential: any) {
         let res 
         try {
             res = await callAdminForthApi({
@@ -312,7 +390,6 @@
                 body: {
                     credential: credential,
                     origin: window.location.origin,
-                    challengeId: challengeId,
                 },
             });
         } catch (error) {

package/dist/custom/TwoFactorsSetup.vue

@@ -80,7 +80,7 @@ import VOtpInput from "vue3-otp-input";
 import adminforth from '@/adminforth';
 import { useI18n } from 'vue-i18n';
 import { useRoute } from 'vue-router';
-import { handlePasskeyAlert } from './TwoFactorsConfirmation.vue';
+import { handlePasskeyAlert } from './utils.js';
 import ErrorMessage from '@/components/ErrorMessage.vue';
 
 const { t } = useI18n();

package/dist/custom/utils.js

@@ -0,0 +1,106 @@
+   import { callAdminForthApi } from '@/utils';
+
+   export function handlePasskeyAlert(propSuggestionPeriod, router) {
+        const currentDate = Date.now();
+        window.localStorage.removeItem('suggestionPeriod');
+        window.localStorage.setItem('suggestionPeriod', propSuggestionPeriod);
+        let suggestionPeriod = window.localStorage.getItem('suggestionPeriod');
+        let lastSuggestionDate = window.localStorage.getItem('lastSuggestionDate');
+        let suggestPasskey = window.localStorage.getItem('suggestPasskey');
+        if ( !lastSuggestionDate ) { 
+        window.localStorage.setItem('lastSuggestionDate', currentDate.toString());
+        lastSuggestionDate = window.localStorage.getItem('lastSuggestionDate');
+        }
+        if ( !suggestPasskey ) {
+        window.localStorage.setItem('suggestPasskey', 'true');
+        suggestPasskey = window.localStorage.getItem('suggestPasskey');
+        }
+        if ( currentDate - parseInt(lastSuggestionDate) > parseInt(suggestionPeriod) ) {
+        suggestPasskey = window.localStorage.getItem('suggestPasskey');
+        if (suggestPasskey !== 'true'){
+            if ( suggestPasskey === 'false' || !suggestPasskey ) {
+            window.localStorage.setItem('suggestPasskey', 'true');
+            } else if ( suggestPasskey !== 'never' ) {
+            window.localStorage.setItem('suggestPasskey', 'false');
+            }
+        }
+        }
+        suggestPasskey = window.localStorage.getItem('suggestPasskey');
+
+        if ( suggestPasskey === 'true' ) {
+        adminforth.alert({
+            message: 'Do you want to add passkey?', 
+            variant: 'info', 
+            buttons: [
+            { value: 'yes', label: 'Add passkey' },
+            { value: 'later', label: 'Later' },
+            { value: 'never', label: 'Never' },
+            ],
+            timeout: 'unlimited'
+        }).then((value) => {
+            switch (value) {
+            case 'yes':
+                router.push({ name: 'settings', params: { page: 'passkeys' } });
+                break;
+            case 'later':
+                window.localStorage.setItem('suggestPasskey', 'false');
+                break;
+            case 'never':
+                window.localStorage.setItem('suggestPasskey', 'never');
+                break;
+            default:
+                window.localStorage.setItem('suggestPasskey', 'false');
+                break;
+            }
+        });
+        }
+    }
+
+    export async function getPasskey() {
+    const { _options } = await createSignInRequest();
+    const options = PublicKeyCredential.parseRequestOptionsFromJSON(_options);
+    const credential = await authenticate(options);
+    if (!credential) {
+      isFetchingPasskey.value = false;
+      return;
+    }
+    const result = JSON.stringify(credential);
+    const passkeyOptions = {
+      response: result,
+      origin: window.location.origin,
+    };
+    return passkeyOptions;
+  }
+
+  async function createSignInRequest() {
+    let response;
+    try {
+      response = await callAdminForthApi({
+        path: `/plugin/passkeys/signInRequest`,
+        method: 'POST',
+      });
+    } catch (error) {
+      console.error('Error creating sign-in request:', error);
+      return;
+    }
+    if (response.ok === true) {
+      return { _options: response.data, challengeId: response.challengeId };
+    } else {
+      adminforth.alert({message: 'Error creating sign-in request.', variant: 'warning'});
+      codeError.value = 'Error creating sign-in request.';
+    }
+  }
+
+  async function authenticate(options) {
+    try {
+      const abortController = new AbortController();
+      const credential = await navigator.credentials.get({
+        publicKey: options,
+        signal: abortController.signal,
+      });
+      return credential;
+    } catch (error) {
+      adminforth.alert({message: 'Error during authentication', variant: 'warning'});
+      codeError.value = 'Error during authentication.';
+    }
+  }

package/dist/index.js

@@ -19,30 +19,48 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
     instanceUniqueRepresentation(pluginOptions) {
         return `single`;
     }
-    verify(code, opts) {
+    verify(confirmationResult, opts) {
         return __awaiter(this, void 0, void 0, function* () {
             var _a, _b, _c, _d;
-            if (!code)
-                return { error: "Code is required" };
-            const authRes = this.adminforth.config.resources
-                .find(r => r.resourceId === this.adminforth.config.auth.usersResourceId);
-            if (!authRes)
-                return { error: "Auth resource not found" };
-            const connector = this.adminforth.connectors[authRes.dataSource];
-            const pkName = (_a = authRes.columns.find(c => c.primaryKey)) === null || _a === void 0 ? void 0 : _a.name;
-            if (!pkName)
-                return { error: "Primary key not found on auth resource" };
-            const pk = (_b = opts === null || opts === void 0 ? void 0 : opts.userPk) !== null && _b !== void 0 ? _b : (_d = (_c = opts === null || opts === void 0 ? void 0 : opts.adminUser) === null || _c === void 0 ? void 0 : _c.dbUser) === null || _d === void 0 ? void 0 : _d[pkName];
-            if (!pk)
-                return { error: "User PK is required" };
-            const user = yield connector.getRecordByPrimaryKey(authRes, pk);
-            if (!user)
-                return { error: "User not found" };
-            const secret = user[this.options.twoFaSecretFieldName];
-            if (!secret)
-                return { error: "2FA is not set up for this user" };
-            const verified = twofactor.verifyToken(secret, code, this.options.timeStepWindow);
-            return verified ? { ok: true } : { error: "Wrong or expired OTP code" };
+            if (!confirmationResult)
+                return { error: "Confirmation result is required" };
+            if (confirmationResult.mode === "totp") {
+                const code = confirmationResult.result;
+                const authRes = this.adminforth.config.resources
+                    .find(r => r.resourceId === this.adminforth.config.auth.usersResourceId);
+                if (!authRes)
+                    return { error: "Auth resource not found" };
+                const connector = this.adminforth.connectors[authRes.dataSource];
+                const pkName = (_a = authRes.columns.find(c => c.primaryKey)) === null || _a === void 0 ? void 0 : _a.name;
+                if (!pkName)
+                    return { error: "Primary key not found on auth resource" };
+                const pk = (_b = opts === null || opts === void 0 ? void 0 : opts.userPk) !== null && _b !== void 0 ? _b : (_d = (_c = opts === null || opts === void 0 ? void 0 : opts.adminUser) === null || _c === void 0 ? void 0 : _c.dbUser) === null || _d === void 0 ? void 0 : _d[pkName];
+                if (!pk)
+                    return { error: "User PK is required" };
+                const user = yield connector.getRecordByPrimaryKey(authRes, pk);
+                if (!user)
+                    return { error: "User not found" };
+                const secret = user[this.options.twoFaSecretFieldName];
+                if (!secret)
+                    return { error: "2FA is not set up for this user" };
+                const verified = twofactor.verifyToken(secret, code, this.options.timeStepWindow);
+                return verified ? { ok: true } : { error: "Wrong or expired OTP code" };
+            }
+            else if (confirmationResult.mode === "passkey") {
+                const passkeysCookies = this.adminforth.auth.getCustomCookie({ cookies: opts.cookies, name: `passkeyLoginTemporaryJWT` });
+                if (!passkeysCookies) {
+                    return { error: 'Passkey token is required' };
+                }
+                const decodedPasskeysCookies = yield this.adminforth.auth.verify(passkeysCookies, 'tempLoginPasskeyChallenge', false);
+                if (!decodedPasskeysCookies) {
+                    return { error: 'Invalid passkey' };
+                }
+                const verificationResult = yield this.verifyPasskeyResponse(confirmationResult.result, opts.userPk, decodedPasskeysCookies);
+                if (verificationResult.ok && verificationResult.passkeyConfirmed) {
+                    return { ok: true };
+                }
+                return { error: "Invalid passkey" };
+            }
         });
     }
     parsePeriod(period) {
@@ -326,7 +344,7 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
                         if (!passkeysCookies) {
                             return { error: 'Passkey token is required' };
                         }
-                        const decodedPasskeysCookies = yield this.adminforth.auth.verify(passkeysCookies, 'tempPasskeyChallenge', false);
+                        const decodedPasskeysCookies = yield this.adminforth.auth.verify(passkeysCookies, 'tempLoginPasskeyChallenge', false);
                         if (!decodedPasskeysCookies) {
                             return { error: 'Invalid passkey' };
                         }
@@ -400,9 +418,18 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
             method: 'POST',
             path: `/plugin/passkeys/registerPasskeyRequest`,
             noAuth: false,
-            handler: (_a) => __awaiter(this, [_a], void 0, function* ({ body, adminUser, response }) {
+            handler: (_a) => __awaiter(this, [_a], void 0, function* ({ body, adminUser, response, cookies }) {
                 var _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m;
                 const mode = body === null || body === void 0 ? void 0 : body.mode;
+                const confirmationResult = body === null || body === void 0 ? void 0 : body.confirmationResult;
+                const verificationResult = yield this.verify(confirmationResult, {
+                    adminUser: adminUser,
+                    userPk: adminUser.pk,
+                    cookies: cookies
+                });
+                if (!verificationResult || !('ok' in verificationResult)) {
+                    return { ok: false, error: 'Verification failed' };
+                }
                 const settingsOrigin = (_b = this.options.passkeys) === null || _b === void 0 ? void 0 : _b.settings.expectedOrigin;
                 const rp = {
                     name: ((_c = this.options.passkeys) === null || _c === void 0 ? void 0 : _c.settings.rp.name) || this.adminforth.config.customization.brandName,
@@ -530,7 +557,7 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
                         rpID: (_b = this.options.passkeys) === null || _b === void 0 ? void 0 : _b.settings.rp.id,
                         userVerification: ((_c = this.options.passkeys) === null || _c === void 0 ? void 0 : _c.settings.authenticatorSelection.userVerification) || "required"
                     });
-                    const value = this.adminforth.auth.issueJWT({ "challenge": options.challenge }, 'tempPasskeyChallenge', '10m');
+                    const value = this.adminforth.auth.issueJWT({ "challenge": options.challenge }, 'tempLoginPasskeyChallenge', '10m');
                     this.adminforth.auth.setCustomCookie({ response, payload: { name: `passkeyLoginTemporaryJWT`, value: value, expiry: undefined, expirySeconds: 10 * 60, httpOnly: true } });
                     return { ok: true, data: options };
                 }

package/index.ts

@@ -27,31 +27,50 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
   }
 
   public async verify(
-    code: string,
-    opts?: { adminUser?: AdminUser; userPk?: string }
+    confirmationResult: Record<string, any>,
+    opts?: { adminUser?: AdminUser; userPk?: string; cookies?: any }
   ): Promise<{ ok: true } | { error: string }> {
-    if (!code) return { error: "Code is required" };
+    if (!confirmationResult) return { error: "Confirmation result is required" };
 
-    const authRes = this.adminforth.config.resources
-      .find(r => r.resourceId === this.adminforth.config.auth.usersResourceId);
+    if (confirmationResult.mode === "totp") {
+      const code = confirmationResult.result;
+      const authRes = this.adminforth.config.resources
+        .find(r => r.resourceId === this.adminforth.config.auth.usersResourceId);
 
-    if (!authRes) return { error: "Auth resource not found" };
+      if (!authRes) return { error: "Auth resource not found" };
 
-    const connector = this.adminforth.connectors[authRes.dataSource];
-    const pkName = authRes.columns.find(c => c.primaryKey)?.name;
-    if (!pkName) return { error: "Primary key not found on auth resource" };
+      const connector = this.adminforth.connectors[authRes.dataSource];
+      const pkName = authRes.columns.find(c => c.primaryKey)?.name;
+      if (!pkName) return { error: "Primary key not found on auth resource" };
 
-    const pk = opts?.userPk ?? opts?.adminUser?.dbUser?.[pkName];
-    if (!pk) return { error: "User PK is required" };
+      const pk = opts?.userPk ?? opts?.adminUser?.dbUser?.[pkName];
+      if (!pk) return { error: "User PK is required" };
 
-    const user = await connector.getRecordByPrimaryKey(authRes, pk);
-    if (!user) return { error: "User not found" };
+      const user = await connector.getRecordByPrimaryKey(authRes, pk);
+      if (!user) return { error: "User not found" };
 
-    const secret = user[this.options.twoFaSecretFieldName];
-    if (!secret) return { error: "2FA is not set up for this user" };
+      const secret = user[this.options.twoFaSecretFieldName];
+      if (!secret) return { error: "2FA is not set up for this user" };
 
-    const verified = twofactor.verifyToken(secret, code, this.options.timeStepWindow);
-    return verified ? { ok: true } : { error: "Wrong or expired OTP code" };
+      const verified = twofactor.verifyToken(secret, code, this.options.timeStepWindow);
+      return verified ? { ok: true } : { error: "Wrong or expired OTP code" };
+    } else if (confirmationResult.mode === "passkey") {
+      const passkeysCookies = this.adminforth.auth.getCustomCookie({cookies: opts.cookies, name: `passkeyLoginTemporaryJWT`});
+      if (!passkeysCookies) {
+        return { error: 'Passkey token is required' };
+      }
+
+      const decodedPasskeysCookies = await this.adminforth.auth.verify(passkeysCookies, 'tempLoginPasskeyChallenge', false);
+      if (!decodedPasskeysCookies) {
+        return { error: 'Invalid passkey' };
+      }
+      const verificationResult = await this.verifyPasskeyResponse(confirmationResult.result, opts.userPk, decodedPasskeysCookies );
+
+      if (verificationResult.ok && verificationResult.passkeyConfirmed) {
+        return  { ok: true }
+      }
+      return { error: "Invalid passkey" }
+    }
   }
 
   public parsePeriod(period?: string): number {
@@ -365,7 +384,7 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
             if (!passkeysCookies) {
               return { error: 'Passkey token is required' };
             }
-            const decodedPasskeysCookies = await this.adminforth.auth.verify(passkeysCookies, 'tempPasskeyChallenge', false);
+            const decodedPasskeysCookies = await this.adminforth.auth.verify(passkeysCookies, 'tempLoginPasskeyChallenge', false);
             if (!decodedPasskeysCookies) {
               return { error: 'Invalid passkey' };
             }
@@ -440,8 +459,19 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
       method: 'POST',
       path: `/plugin/passkeys/registerPasskeyRequest`,
       noAuth: false,
-      handler: async ({ body, adminUser, response }) => {
+      handler: async ({ body, adminUser, response, cookies }) => {
         const mode = body?.mode;
+
+        const confirmationResult = body?.confirmationResult;
+        const verificationResult = await this.verify(confirmationResult, {
+          adminUser: adminUser,
+          userPk: adminUser.pk, 
+          cookies: cookies
+        });
+        if ( !verificationResult || !('ok' in verificationResult) ) {
+          return { ok: false, error: 'Verification failed' };
+        }
+
         const settingsOrigin = this.options.passkeys?.settings.expectedOrigin;
         const rp = {
           name: this.options.passkeys?.settings.rp.name || this.adminforth.config.customization.brandName,
@@ -574,7 +604,7 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
             rpID: this.options.passkeys?.settings.rp.id,
             userVerification: this.options.passkeys?.settings.authenticatorSelection.userVerification || "required"
           });
-          const value = this.adminforth.auth.issueJWT({ "challenge": options.challenge }, 'tempPasskeyChallenge', '10m');
+          const value = this.adminforth.auth.issueJWT({ "challenge": options.challenge }, 'tempLoginPasskeyChallenge', '10m');
           this.adminforth.auth.setCustomCookie({response, payload: {name: `passkeyLoginTemporaryJWT`, value: value, expiry: undefined, expirySeconds: 10 * 60, httpOnly: true}});
           return { ok: true, data: options };
         } catch (e) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adminforth/two-factors-auth",
-  "version": "1.10.6",
+  "version": "1.11.0",
   "description": "AdminForth plugin for two factors authentication",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",