@adminforth/two-factors-auth 1.9.2 → 1.10.0

package/index.ts

@@ -2,6 +2,13 @@ import {  AdminForthPlugin, Filters } from "adminforth";
 import type { AdminForthResource, AdminUser, IAdminForth, IHttpServer, IAdminForthAuth, BeforeLoginConfirmationFunction, IAdminForthHttpResponse } from "adminforth";
 import twofactor from 'node-2fa';
 import  { PluginOptions } from "./types.js"
+import {
+  generateRegistrationOptions,
+  verifyRegistrationResponse,
+  generateAuthenticationOptions,
+  verifyAuthenticationResponse
+} from '@simplewebauthn/server';
+import { isoUint8Array, isoBase64URL } from '@simplewebauthn/server/helpers';
 
 export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
   options: PluginOptions;
@@ -47,23 +54,161 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
     return verified ? { ok: true } : { error: "Wrong or expired OTP code" };
   }
 
+  public parsePeriod(period?: string): number {
+    if (!period) return 0;
+
+    const match = /^(\d+)([dhms])$/.exec(period.trim());
+    if (!match) throw new Error(`Invalid suggestionPeriod format: ${period}`);
+
+    const value = parseInt(match[1], 10);
+    const unit = match[2];
+
+    switch (unit) {
+      case 'd': return value * 24 * 60 * 60 * 1000; 
+      case 'h': return value * 60 * 60 * 1000; 
+      case 'm': return value * 60 * 1000;
+      case 's': return value * 1000;
+      default: return value;
+    }
+  }
+
+  public async verifyPasskeyResponse(body: any, user_id: string, cookies: any) {
+    const settingsOrigin = this.options.passkeys?.settings.expectedOrigin;
+    const expectedOrigin = body.origin;
+    const expectedChallenge = cookies.challenge;
+    const expectedRPID = this.options.passkeys?.settings?.rp?.id || (new URL(settingsOrigin)).hostname;
+    const response = JSON.parse(body.response);
+    try {
+      if (settingsOrigin !== expectedOrigin) {
+        throw new Error('Invalid origin');
+      }
+      const cred = await this.adminforth.resource(this.options.passkeys.credentialResourceID).get([Filters.EQ(this.options.passkeys.credentialIdFieldName, response.id)]);
+      if (!cred) {
+        throw new Error('Credential not found.');
+      }
+      const credMeta = JSON.parse(cred[this.options.passkeys.credentialMetaFieldName]);
+      if (!credMeta || !credMeta.public_key) {
+        throw new Error('Credential public key not found.');
+      }
+      const userResourceId = this.adminforth.config.auth.usersResourceId;
+      const usersResource = this.adminforth.config.resources.find(r => r.resourceId === userResourceId);
+      const usersPrimaryKeyColumn = usersResource.columns.find((col) => col.primaryKey);
+      const usersPrimaryKeyFieldName = usersPrimaryKeyColumn.name;
+      const user = await this.adminforth.resource(userResourceId).get([Filters.EQ(usersPrimaryKeyFieldName, cred[this.options.passkeys.credentialUserIdFieldName])]);
+      if (!user || !user_id || user[usersPrimaryKeyFieldName] !== user_id) {
+        throw new Error('User not found.');
+      }
+      const { verified, authenticationInfo } = await verifyAuthenticationResponse({
+        response,
+        expectedChallenge,
+        expectedOrigin,
+        expectedRPID,
+        credential: {
+          id: cred[this.options.passkeys.credentialIdFieldName],
+          publicKey: isoBase64URL.toBuffer(credMeta.public_key),
+          counter: credMeta.counter,
+          transports: credMeta.transports,
+        },
+        requireUserVerification: this.options.passkeys?.settings.authenticatorSelection.userVerification === 'discouraged' ? false : true,
+      });
+
+      if (!verified) {
+        return { ok: false, error: 'User verification failed.' };
+      }
+      credMeta.counter = authenticationInfo.newCounter;
+      credMeta.last_used_at = new Date().toISOString();
+      await this.adminforth.resource(this.options.passkeys.credentialResourceID).update(cred[this.options.passkeys.credentialIdFieldName], { [this.options.passkeys.credentialMetaFieldName]: JSON.stringify(credMeta) });
+      return { ok: true, passkeyConfirmed: true };
+    } catch (e) {
+      return { ok: false, error: 'Error authenticating passkey: ' + e };
+    }
+  }
+
   modifyResourceConfig(adminforth: IAdminForth, resourceConfig: AdminForthResource) {
     super.modifyResourceConfig(adminforth, resourceConfig);
     this.adminforth = adminforth;
     this.adminForthAuth = adminforth.auth;
+    const suggestionPeriod = this.parsePeriod(this.options.passkeys?.suggestionPeriod || "5d");
+    const isPasskeysEnabled = this.options.passkeys ? true : false;
 
     const customPages = this.adminforth.config.customization.customPages
     customPages.push({
       path:'/confirm2fa',
-      component: { file: this.componentPath('TwoFactorsConfirmation.vue'), meta: { customLayout: true }}
+      component: { file: this.componentPath('TwoFactorsConfirmation.vue'), meta: { customLayout: true, suggestionPeriod: suggestionPeriod, isPasskeysEnabled: isPasskeysEnabled } }
     })
     customPages.push({
       path:'/setup2fa',
-      component: { file: this.componentPath('TwoFactorsSetup.vue'), meta: { title: 'Setup 2FA', customLayout: true }}
+      component: { file: this.componentPath('TwoFactorsSetup.vue'), meta: { title: 'Setup 2FA', customLayout: true, suggestionPeriod: suggestionPeriod, isPasskeysEnabled: isPasskeysEnabled  } }
     })
     const everyPageBottomInjections = this.adminforth.config.customization.globalInjections.everyPageBottom || []
     everyPageBottomInjections.push({ file: this.componentPath('TwoFAModal.vue'), meta: {} })
     this.activate( resourceConfig, adminforth )
+
+    if ( this.options.passkeys ) {
+      if( !this.adminforth.config.auth.userMenuSettingsPages ){
+        this.adminforth.config.auth.userMenuSettingsPages = [];
+      }
+      this.adminforth.config.auth.userMenuSettingsPages.push({
+        icon: 'flowbite:lock-solid',
+        pageLabel: 'Passkeys',
+        slug: 'passkeys',
+        component: this.componentPath('TwoFactorsPasskeysSettings.vue'),
+      });
+    }
+  }
+
+  validateConfigAfterDiscover(adminforth: IAdminForth, resourceConfig: AdminForthResource) {
+    if (this.options.passkeys) {
+
+      const adminForthResources = [];
+      for (const res of adminforth.config.resources) {
+        adminForthResources.push(res.resourceId);
+      }
+      if (!this.options.passkeys.credentialResourceID) {
+        throw new Error('Passkeys credentialResourceID is required');
+      }
+      if ( !(adminForthResources.includes(this.options.passkeys.credentialResourceID)) ) {
+        throw new Error('Passkeys credentialResourceID is not valid');
+      }
+      if (!this.options.passkeys.credentialIdFieldName) {
+        throw new Error('Passkeys credentialIdFieldName is required');
+      }
+      if (!this.options.passkeys.credentialMetaFieldName) {
+        throw new Error('Passkeys credentialMetaFieldName is required');
+      }
+      if (!this.options.passkeys.credentialUserIdFieldName) {
+        throw new Error('Passkeys credentialUserIdFieldName is required');
+      }
+      if (!this.options.passkeys.settings) {
+        throw new Error('Passkeys settings are required when passkeys option is enabled');
+      }
+      if (!this.options.passkeys.settings.expectedOrigin) {
+        throw new Error('Passkeys settings.expectedOrigin is required');
+      }
+      const origin = new URL( this.options.passkeys.settings.expectedOrigin ).origin;
+      if ( origin !== this.options.passkeys.settings.expectedOrigin ) {
+        throw new Error('Passkeys settings.expectedOrigin is not valid');
+      }
+      if (this.options.passkeys.settings.authenticatorSelection) {
+        if (this.options.passkeys.settings.authenticatorSelection.authenticatorAttachment) {
+          if ( !['platform', 'cross-platform', 'both'].includes(this.options.passkeys.settings.authenticatorSelection.authenticatorAttachment) ) {
+            throw new Error('Passkeys settings.authenticatorSelection.authenticatorAttachment is not valid');
+          }
+        }
+        if (this.options.passkeys.settings.authenticatorSelection.userVerification) {
+          if ( !['required', 'discouraged'].includes(this.options.passkeys.settings.authenticatorSelection.userVerification) ) {
+            throw new Error('Passkeys settings.authenticatorSelection.userVerification is not valid');
+          }
+        }
+      }
+
+      if (!this.options.passkeys.settings.user) {
+        throw new Error('Passkeys settings.user is required');
+      }
+      if (!this.options.passkeys.settings.user.nameField) {
+        throw new Error('Passkeys settings.user.nameField is required');
+      }
+    }
   }
 
   activate ( resourceConfig: AdminForthResource, adminforth: IAdminForth ){
@@ -93,8 +238,8 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
         const userName = adminUser.dbUser[adminforth.config.auth.usernameField]
         const brandName = adminforth.config.customization.brandName;
         const brandNameSlug = adminforth.config.customization.brandNameSlug;
-        const issuerName = (this.options.customBrendPrefix && this.options.customBrendPrefix.trim())
-        ? this.options.customBrendPrefix.trim()
+        const issuerName = (this.options.customBrandPrefix && this.options.customBrandPrefix.trim())
+        ? this.options.customBrandPrefix.trim()
         : brandName;
         const authResource = adminforth.config.resources.find((res)=>res.resourceId === adminforth.config.auth.usersResourceId )
         const authPk = authResource.columns.find((col)=>col.primaryKey).name
@@ -112,10 +257,22 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
 
         if (!secret){
           const tempSecret = twofactor.generateSecret({name: issuerName,account: userName})
-          newSecret = tempSecret.secret
+          newSecret = tempSecret.secret;
+
+          const totpTemporaryJWT = this.adminforth.auth.issueJWT({userName, newSecret, issuer:issuerName, pk:userPk, userCanSkipSetup, rememberMeDays }, 'temp2FA', '2h');
+          this.adminforth.auth.setCustomCookie({response, payload: {name: "2FaTemporaryJWT", value: totpTemporaryJWT, expiry: 1 * 60 * 60 * 1000, httpOnly: true}});
+
+          return {
+            body:{
+              loginAllowed: false,
+              redirectTo: secret ? '/confirm2fa' : '/setup2fa',
+            },
+            ok: true
+          }
+
         } else {
-          const value = this.adminforth.auth.issueJWT({userName, issuer:issuerName, pk:userPk, userCanSkipSetup, rememberMeDays }, 'tempTotp', '2h');
-          response.setHeader('Set-Cookie', `adminforth_${brandNameSlug}_totpTemporaryJWT=${value}; Path=${this.adminforth.config.baseUrl || '/'}; HttpOnly; SameSite=Strict; max-age=3600; `);
+          const value = this.adminforth.auth.issueJWT({userName, issuer:issuerName, pk:userPk, userCanSkipSetup, rememberMeDays }, 'temp2FA', '2h');
+          this.adminforth.auth.setCustomCookie({response, payload: {name: "2FaTemporaryJWT", value: value, expiry: 1 * 60 * 60 * 1000, httpOnly: true}});
 
           return {
             body:{
@@ -125,16 +282,7 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
             ok: true
           }
         }
-        const totpTemporaryJWT = this.adminforth.auth.issueJWT({userName, newSecret, issuer:issuerName, pk:userPk, userCanSkipSetup, rememberMeDays }, 'tempTotp', '2h');
-        response.setHeader('Set-Cookie', `adminforth_${brandNameSlug}_totpTemporaryJWT=${totpTemporaryJWT}; Path=${this.adminforth.config.baseUrl || '/'}; HttpOnly; SameSite=Strict; Expires=${new Date(Date.now() + '1h').toUTCString() } `);
-
-        return {
-          body:{
-            loginAllowed: false,
-            redirectTo: secret ? '/confirm2fa' : '/setup2fa',
-          },
-          ok: true
-        }
+        
       })
   }
 
@@ -145,27 +293,29 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
       noAuth: true,
       handler: async (server) => {
         const toReturn = {totpJWT:null,status:'ok',}
-        const brandNameSlug = this.adminforth.config.customization.brandNameSlug;
-
-        const totpTemporaryJWT = server.cookies.find((cookie)=>cookie.key === `adminforth_${brandNameSlug}_totpTemporaryJWT`)?.value;
+        const totpTemporaryJWT = this.adminforth.auth.getCustomCookie({cookies: server.cookies, name: "2FaTemporaryJWT"});
         if (totpTemporaryJWT){
           toReturn.totpJWT = totpTemporaryJWT
         }
         return toReturn
       }
     })
+
+    // this enpoints sets final login cookie if 2nd factor is confirmed
     server.endpoint({
       method: 'POST',
-      path: `/plugin/twofa/confirmSetup`,
+      path: `/plugin/twofa/confirmLogin`,
       noAuth: true,
       handler: async ({ body, adminUser, response, cookies  }) => {
         const brandNameSlug = this.adminforth.config.customization.brandNameSlug;
-        const totpTemporaryJWT = cookies.find((cookie)=>cookie.key === `adminforth_${brandNameSlug}_totpTemporaryJWT`)?.value;
-        const decoded = await this.adminforth.auth.verify(totpTemporaryJWT, 'tempTotp');
-        if (!decoded)
-          return {status:'error',message:'Invalid token'}
+        const totpTemporaryJWT = this.adminforth.auth.getCustomCookie({cookies: cookies, name: "2FaTemporaryJWT"});
+        const decoded = await this.adminforth.auth.verify(totpTemporaryJWT, 'temp2FA');
+        if (!decoded) {
+          return { status:'error', message:'Invalid token' }
+        }
 
         if (decoded.newSecret) {
+          // set up standard TOTP request - ensured by presence of newSecret in temp2FA token
           const verified = body.skip && decoded.userCanSkipSetup ? true : twofactor.verifyToken(decoded.newSecret, body.code, this.options.timeStepWindow);
           if (verified) {
             this.connectors = this.adminforth.connectors
@@ -173,20 +323,38 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
               const connector = this.connectors[this.authResource.dataSource];
               await connector.updateRecord({resource:this.authResource, recordId:decoded.pk, newValues:{[this.options.twoFaSecretFieldName]: decoded.newSecret}})
             }
-            this.adminforth.auth.removeCustomCookie({response, name:'totpTemporaryJWT'})
+            this.adminforth.auth.removeCustomCookie({response, name:'2FaTemporaryJWT'})
             this.adminforth.auth.setAuthCookie({expireInDays: decoded.rememberMeDays, response, username:decoded.userName, pk:decoded.pk})
             return { status: 'ok', allowedLogin: true }
           } else {
             return {error: 'Wrong or expired OTP code'}
           }
         } else {
-         // user already has secret, get it
-          this.connectors = this.adminforth.connectors
-          const connector = this.connectors[this.authResource.dataSource];
-          const user = await connector.getRecordByPrimaryKey(this.authResource, decoded.pk)
-          const verified = twofactor.verifyToken(user[this.options.twoFaSecretFieldName], body.code, this.options.timeStepWindow);
+          // login with confirming existing TOTP or Passkey
+          let verified = null;
+          if (body.usePasskey && this.options.passkeys) {
+            // passkeys are enabled and user wants to use them
+            const passkeysCookies = this.adminforth.auth.getCustomCookie({cookies: cookies, name: `passkeyTemporaryJWT`});
+            if (!passkeysCookies) {
+              return { error: 'Passkey token is required' };
+            }
+            const decodedPasskeysCookies = await this.adminforth.auth.verify(passkeysCookies, 'tempPasskeyChallenge', false);
+            if (!decodedPasskeysCookies) {
+              return { error: 'Invalid passkey token' };
+            }
+            const res = await this.verifyPasskeyResponse(body.passkeyOptions, decoded.pk, decodedPasskeysCookies);
+            if (res.ok && res.passkeyConfirmed) {
+              verified = true;
+            }
+          } else {
+            // user already has TOTP secret, get it
+            this.connectors = this.adminforth.connectors
+            const connector = this.connectors[this.authResource.dataSource];
+            const user = await connector.getRecordByPrimaryKey(this.authResource, decoded.pk)
+            verified = twofactor.verifyToken(user[this.options.twoFaSecretFieldName], body.code, this.options.timeStepWindow);
+          }
           if (verified) {
-            this.adminforth.auth.removeCustomCookie({response, name:'totpTemporaryJWT'})
+            this.adminforth.auth.removeCustomCookie({response, name:'2FaTemporaryJWT'})
             this.adminforth.auth.setAuthCookie({expireInDays: decoded.rememberMeDays, response, username:decoded.userName, pk:decoded.pk})
             return { status: 'ok', allowedLogin: true }
           } else {
@@ -200,13 +368,13 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
       path: "/plugin/twofa/skip-allow",
       noAuth: true,
       handler: async ({ cookies }) => {
-        const brandNameSlug = this.adminforth.config.customization.brandNameSlug;
-        const totpTemporaryJWT = cookies.find(
-          (cookie) => cookie.key === `adminforth_${brandNameSlug}_totpTemporaryJWT`
-        )?.value;
+        const totpTemporaryJWT = this.adminforth.auth.getCustomCookie({
+          cookies,
+          name: `2FaTemporaryJWT`,
+        });
         const decoded = await this.adminforth.auth.verify(
           totpTemporaryJWT,
-          "tempTotp",
+          "temp2FA",
         );
         if (!decoded) {
           return { status: "error", message: "Invalid token" };
@@ -241,5 +409,263 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
         return verified ? { ok: true } : { error: 'Wrong or expired OTP code' };
       }
     });
+    server.endpoint({
+      method: 'POST',
+      path: `/plugin/passkeys/registerPasskeyRequest`,
+      noAuth: false,
+      handler: async ({ body, adminUser, response }) => {
+        const mode = body?.mode;
+        const settingsOrigin = this.options.passkeys?.settings.expectedOrigin;
+        const rp = {
+          name: this.options.passkeys?.settings.rp.name || this.adminforth.config.customization.brandName,
+          id: this.options.passkeys?.settings?.rp?.id || (new URL(settingsOrigin)).hostname,
+        };
+        const userResourceId = this.adminforth.config.auth.usersResourceId;
+        const usersResource = this.adminforth.config.resources.find(r => r.resourceId === userResourceId);
+        const usersPrimaryKeyColumn = usersResource.columns.find((col) => col.primaryKey);
+        const usersPrimaryKeyFieldName = usersPrimaryKeyColumn.name;
+        const userInfo = await this.adminforth.resource(userResourceId).get( [Filters.EQ(usersPrimaryKeyFieldName, adminUser.pk)] );
+        const user = {
+          id: adminUser.pk,
+          name: userInfo[this.options.passkeys?.settings.user.nameField],
+          displayName: userInfo[this.options.passkeys?.settings.user.displayNameField] ? userInfo[this.options.passkeys?.settings.user.displayNameField] : userInfo[this.options.passkeys?.settings.user.nameField],
+        };
+        const excludeCredentials = [];
+        const temp = await this.adminforth.resource(this.options.passkeys.credentialResourceID).list([Filters.EQ(this.options.passkeys.credentialUserIdFieldName, adminUser.pk)]);
+        for (const rec of temp) {
+          if (rec.credential_id && rec.credential_id.length > 0) {
+            const meta = JSON.parse(rec[this.options.passkeys.credentialMetaFieldName]);
+            excludeCredentials.push({
+              id: rec.credential_id,
+              type: "public-key",
+              transports: JSON.parse(meta.transports || '[]')
+            });
+          }
+        }
+        const options = await generateRegistrationOptions({
+          rpName: rp.name,
+          rpID: rp.id,
+          userID: isoUint8Array.fromUTF8String(user.id),
+          userName: user.name,
+          userDisplayName: user.displayName,
+          excludeCredentials,
+          authenticatorSelection: {
+            authenticatorAttachment: mode,
+            requireResidentKey: this.options.passkeys?.settings.authenticatorSelection.requireResidentKey || true,
+            userVerification: this.options.passkeys?.settings.authenticatorSelection.userVerification || "required"
+          },
+        });
+        const value = this.adminforth.auth.issueJWT({ "challenge": options.challenge }, 'tempPasskeyChallenge', '5m');
+        this.adminforth.auth.setCustomCookie({response, payload: {name: "passkeyTemporaryJWT", value: value, expiry: 1 * 60 * 60 * 1000, httpOnly: true}});
+        return { ok: true, data: options };
+      }
+    });
+    server.endpoint({
+      method: 'POST',
+      path: `/plugin/passkeys/finishRegisteringPasskey`,
+      noAuth: false,
+      handler: async ({body, adminUser, cookies }) => {
+        const passkeysCookies = this.adminforth.auth.getCustomCookie({cookies: cookies, name: "passkeyTemporaryJWT"});
+        if (!passkeysCookies) {
+          return { error: 'Passkey token is required' };
+        }
+        const decodedPasskeysCookies = await this.adminforth.auth.verify(passkeysCookies, 'tempPasskeyChallenge', false);
+        if (!decodedPasskeysCookies) {
+          return { error: 'Invalid passkey token' };
+        }
+        const settingsOrigin = this.options.passkeys?.settings.expectedOrigin;
+        const expectedOrigin = body.origin;
+        const expectedChallenge = decodedPasskeysCookies.challenge;
+        const expectedRPID = this.options.passkeys?.settings?.rp?.id || (new URL(settingsOrigin)).hostname;
+        const response = JSON.parse(body.credential);
+        try {
+          if (settingsOrigin !== expectedOrigin) {
+            throw new Error('Invalid origin');
+          }
+          const { verified, registrationInfo } = await verifyRegistrationResponse({
+            response,
+            expectedChallenge,
+            expectedOrigin,
+            expectedRPID,
+            requireUserVerification: this.options.passkeys?.settings.authenticatorSelection.userVerification === 'discouraged' ? false : true,
+          });
+
+          if (!verified) {
+            throw new Error('Verification failed.');
+          }
+          const {
+            aaguid,
+            credential,
+            credentialBackedUp
+          } = registrationInfo;
+          
+          const credentialPublicKey = credential.publicKey;
+          const credentialID = credential.id;
+
+          const base64CredentialID = credentialID;
+          const base64PublicKey = isoBase64URL.fromBuffer(credentialPublicKey);
+
+          const credResource = this.adminforth.config.resources.find(r => r.resourceId === this.options.passkeys.credentialResourceID);
+          if (!credResource) {
+            throw new Error('Credential resource not found.');
+          }
+          await this.adminforth.createResourceRecord({
+            resource: credResource, 
+            record: {
+              [this.options.passkeys.credentialIdFieldName]           : base64CredentialID,
+              [this.options.passkeys.credentialUserIdFieldName]       : adminUser.pk,
+              [this.options.passkeys.credentialMetaFieldName]         : JSON.stringify({
+                public_key              : base64PublicKey,
+                public_key_algorithm    : response.response.publicKeyAlgorithm,
+                sign_count              : 0,
+                transports              : JSON.stringify(response.response.transports),
+                created_at              : new Date().toISOString(),
+                last_used_at            : new Date().toISOString(),
+                aaguid                  : aaguid,
+                name                    : `Passkey ${adminUser.username}`,
+              }),
+            },
+            adminUser: adminUser
+          });
+        } catch (error) {
+          console.error(error);
+          return { error: 'Error registering passkey: ' + error.message };
+        }
+        return { ok: true };
+      }
+    });
+    server.endpoint({
+      method: 'POST',
+      path: `/plugin/passkeys/signInRequest`,
+      noAuth: true,
+      handler: async ({ response }) => {
+        try {
+          const options = await generateAuthenticationOptions({
+            rpID: this.options.passkeys?.settings.rp.id,
+            userVerification: this.options.passkeys?.settings.authenticatorSelection.userVerification || "required"
+          });
+          const value = this.adminforth.auth.issueJWT({ "challenge": options.challenge }, 'tempPasskeyChallenge', '5m');
+          this.adminforth.auth.setCustomCookie({response, payload: {name: `passkeyTemporaryJWT`, value: value, expiry: 1 * 60 * 60 * 1000, httpOnly: true}});
+          return { ok: true, data: options };
+        } catch (e) {
+          return { ok: false, error: e };
+        }
+      }
+    });
+    server.endpoint({
+      method: 'GET',
+      path: `/plugin/passkeys/getPasskeys`,
+      noAuth: false,
+      handler: async ({ adminUser }) => {
+        let passkeys;
+        try {
+          passkeys = await this.adminforth.resource(this.options.passkeys.credentialResourceID).list( [Filters.EQ(this.options.passkeys.credentialUserIdFieldName, adminUser.pk)] );
+        } catch (error) {
+          return { ok: false, error: 'Error fetching passkeys: ' + error.message };
+        }
+        let dataToReturn = [];
+        for (const pk of passkeys) {
+          const parsedKey = JSON.parse(pk[this.options.passkeys.credentialMetaFieldName]);
+          dataToReturn.push({
+            name: parsedKey.name,
+            created_at: parsedKey.created_at,
+            last_used_at: parsedKey.last_used_at,
+            id: pk[this.options.passkeys.credentialIdFieldName],
+          });
+        }
+        return { ok: true, data: dataToReturn, authenticatorAttachment: this.options.passkeys?.settings.authenticatorSelection.authenticatorAttachment || 'both' };
+      }
+    });
+    server.endpoint({
+      method: 'DELETE',
+      path: `/plugin/passkeys/deletePasskey`,
+      noAuth: false,
+      handler: async ({body, adminUser }) => {
+        const passkeyId = body.passkeyId;
+        if (!passkeyId) {
+          return { ok: false, error: 'Passkey ID is required' };
+        }
+
+        const passkeyRecord = await this.adminforth.resource(this.options.passkeys.credentialResourceID).get([Filters.EQ(this.options.passkeys.credentialIdFieldName, passkeyId), Filters.EQ(this.options.passkeys.credentialUserIdFieldName, adminUser.pk)]);
+        if (!passkeyRecord) {
+          return { ok: false, error: 'Passkey not found' };
+        }
+        try {
+          const credResource = this.adminforth.config.resources.find(r => r.resourceId === this.options.passkeys.credentialResourceID);
+          if (!credResource) {
+            throw new Error('Credential resource not found.');
+          }
+          await this.adminforth.deleteResourceRecord({
+            resource: credResource,
+            recordId: passkeyId,
+            record: passkeyRecord,
+            adminUser: adminUser,
+          });
+        } catch (error) {
+          return { ok: false, error: 'Error deleting passkey: ' + error.message };
+        }
+
+        return { ok: true };
+      }
+    });
+    server.endpoint({
+      method: 'POST',
+      path: `/plugin/passkeys/renamePasskey`,
+      noAuth: false,
+      handler: async ({body, adminUser }) => {
+        const passkeyId = body.passkeyId;
+        const newName = body.newName;
+        if (!passkeyId) {
+          return { ok: false, error: 'Passkey ID is required' };
+        }
+        if (!newName) {
+          return { ok: false, error: 'New name is required' };
+        }
+
+        const passkeyRecord = await this.adminforth.resource(this.options.passkeys.credentialResourceID).get([Filters.EQ(this.options.passkeys.credentialIdFieldName, passkeyId), Filters.EQ(this.options.passkeys.credentialUserIdFieldName, adminUser.pk)]);
+        if (!passkeyRecord) {
+          return { ok: false, error: 'Passkey not found' };
+        }
+        const meta = JSON.parse(passkeyRecord[this.options.passkeys.credentialMetaFieldName]);
+        meta.name = newName;
+        const newRecord = { ...passkeyRecord, [this.options.passkeys.credentialMetaFieldName]: JSON.stringify(meta) };
+        try {
+          const credResource = this.adminforth.config.resources.find(r => r.resourceId === this.options.passkeys.credentialResourceID);
+          if (!credResource) {
+            throw new Error('Credential resource not found.');
+          }
+          await this.adminforth.updateResourceRecord({
+            resource: credResource,
+            recordId: passkeyId,
+            oldRecord: passkeyRecord,
+            record: newRecord,
+            adminUser: adminUser
+          });
+        } catch (error) {
+          return { ok: false, error: 'Error renaming passkey: ' + error.message };
+        }
+        return { ok: true };
+      }
+    });
+    server.endpoint({
+      method: 'POST',
+      path: `/plugin/passkeys/checkIfUserHasPasskeys`,
+      noAuth: true,
+      handler: async ({ cookies }) => {
+        const totpTemporaryJWT = this.adminforth.auth.getCustomCookie({cookies: cookies, name: "2FaTemporaryJWT"});
+        const decoded = await this.adminforth.auth.verify(totpTemporaryJWT, 'temp2FA');
+        if (!decoded)
+          return { ok: false, error:'Invalid token'}
+        if (decoded.newSecret) {
+          return { ok: true, hasPasskeys: false };
+        }
+        const passkeys = await this.adminforth.resource(this.options.passkeys.credentialResourceID).list( [Filters.EQ(this.options.passkeys.credentialUserIdFieldName, decoded.pk)] );
+        if (passkeys && passkeys.length > 0) {
+          return { ok: true, hasPasskeys: true };
+        } else {
+          return { ok: true, hasPasskeys: false };
+        }
+      }
+    });
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adminforth/two-factors-auth",
-  "version": "1.9.2",
+  "version": "1.10.0",
   "description": "AdminForth plugin for two factors authentication",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -25,6 +25,8 @@
   "author": "devforth",
   "license": "ISC",
   "dependencies": {
+    "@simplewebauthn/server": "^13.2.1",
+    "adminforth": "^2.4.0-next.193",
     "node-2fa": "^2.0.3"
   },
   "devDependencies": {