@adminforth/two-factors-auth 3.3.9 → 4.0.0

package/dist/index.js

@@ -7,11 +7,17 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         step((generator = generator.apply(thisArg, _arguments || [])).next());
     });
 };
-import { AdminForthPlugin, Filters, suggestIfTypo, convertPeriodToSeconds } from "adminforth";
-import twofactor from 'node-2fa';
-import { generateRegistrationOptions, verifyRegistrationResponse, generateAuthenticationOptions, verifyAuthenticationResponse } from '@simplewebauthn/server';
-import { isoUint8Array, isoBase64URL } from '@simplewebauthn/server/helpers';
-import aaguids from './custom/aaguid.json';
+import { AdminForthPlugin, suggestIfTypo } from "adminforth";
+import { PasskeyService } from "./services/passkeyService.js";
+import { TotpService } from "./services/totpService.js";
+import { verifyMfaConfirmation } from "./services/verifyMfaConfirmation.js";
+import { CookieService } from "./services/cookieService.js";
+import { UserRepository } from "./repositories/userRepository.js";
+import { registerPasskeyEndpoints } from "./endpoints/registerPasskeyEndpoints.js";
+import { registerTwoFaEndpoints } from "./endpoints/registerTwoFaEndpoints.js";
+import { createPasskeyHandlers } from "./handlers/createPasskeyHandlers.js";
+import { createTwoFaHandlers } from "./handlers/createTwoFaHandlers.js";
+import { parsePeriod } from "./utils/parsePeriod.js";
 import crypto from 'crypto';
 export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
     constructor(options) {
@@ -23,66 +29,22 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
     instanceUniqueRepresentation(pluginOptions) {
         return `single`;
     }
-    parseIfNeeded(value) {
-        if (typeof value === 'string') {
-            try {
-                return JSON.parse(value);
-            }
-            catch (e) {
-                throw new Error('Failed to parse JSON string: ' + e.message);
-            }
-        }
-        return value;
-    }
-    useChellenge(challenge, expiresIn) {
-        const expiresInSeconds = expiresIn ? convertPeriodToSeconds(expiresIn) : undefined;
-        this.options.passkeys.keyValueAdapter.set(challenge, 'stub_value', expiresInSeconds);
-    }
-    checkIfChellengeNotUsed(challenge) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const res = yield this.options.passkeys.keyValueAdapter.get(challenge);
-            if (!res) {
-                return true;
-            }
-            return false;
-        });
-    }
-    validateCookiesForPasskeyLogin(cookies) {
-        return __awaiter(this, void 0, void 0, function* () {
-            var _a;
-            const passkeysCookies = this.adminforth.auth.getCustomCookie({ cookies: cookies, name: `passkeyLoginTemporaryJWT` });
-            if (!passkeysCookies) {
-                return { ok: false, error: 'Passkey token is required' };
-            }
-            const decodedPasskeysCookies = yield this.adminforth.auth.verify(passkeysCookies, 'tempLoginPasskeyChallenge', false);
-            const isChallangeValid = yield this.checkIfChellengeNotUsed(decodedPasskeysCookies.challenge);
-            if (isChallangeValid) {
-                this.useChellenge(decodedPasskeysCookies.challenge, ((_a = this.options.passkeys) === null || _a === void 0 ? void 0 : _a.challengeValidityPeriod) || '2m');
-            }
-            if (!decodedPasskeysCookies || !isChallangeValid) {
-                return { ok: false, error: 'Invalid passkey' };
-            }
-            return { ok: true, decodedPasskeysCookies };
-        });
-    }
     checkIfSkipSetupAllowSkipVerify(adminUser) {
         return __awaiter(this, void 0, void 0, function* () {
             if (this.options.usersFilterToAllowSkipSetup) {
-                const res = yield this.options.usersFilterToAllowSkipSetup(adminUser); // recieve result of usersFilterToAllowSkipSetup
+                const res = this.options.usersFilterToAllowSkipSetup(adminUser); // receive result of usersFilterToAllowSkipSetup
                 if (res === false) { // if false, user is not allowed to skip anyway, so doesn't matter if they have 2FA set up or not
                     return { skipAllowed: false };
                 }
-                //recieve user's record
-                const usersResource = this.adminforth.config.resources.find(r => r.resourceId === this.adminforth.config.auth.usersResourceId);
-                const usersPrimaryKeyColumn = usersResource.columns.find((col) => col.primaryKey);
-                const userPkFieldName = usersPrimaryKeyColumn.name;
-                const userRecord = yield this.adminforth.resource(this.adminforth.config.auth.usersResourceId).get([Filters.EQ(userPkFieldName, adminUser.pk)]);
+                //receive user's record
+                const userPkFieldName = this.userRepository.getUserPkField();
+                const userRecord = yield this.userRepository.getAuthUser(adminUser.pk);
                 //check if user has 2FA set up
-                const users2FASecret = userRecord[this.options.twoFaSecretFieldName];
+                const users2FASecret = this.userRepository.getSecret(userRecord);
                 //check if user has any passkeys registered
-                const passkeys = yield this.adminforth.resource(this.options.passkeys.credentialResourceID).list([Filters.EQ(this.options.passkeys.credentialUserIdFieldName, adminUser.dbUser[userPkFieldName])]);
+                const userHasPasskeys = yield this.passkeyService.hasPasskeysForUser(adminUser.dbUser[userPkFieldName]);
                 // If user has either 2FA secret or any passkeys, they cannot skip
-                if (users2FASecret || (passkeys && passkeys.length > 0)) {
+                if (users2FASecret || userHasPasskeys) {
                     return { skipAllowed: false };
                 }
                 return { skipAllowed: res };
@@ -90,61 +52,6 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
             return { skipAllowed: false };
         });
     }
-    generateHashForStepUpMfaGraceCookie(headers, cookies) {
-        const ip = this.adminforth.auth.getClientIp(headers);
-        const userAgent = headers['user-agent'] || '';
-        const acceptLanguage = headers['accept-language'] || '';
-        const session_cookie = this.adminforth.auth.getCustomCookie({ cookies: cookies, name: "jwt" });
-        if (!ip || !userAgent || !acceptLanguage || !session_cookie) {
-            console.error("❗️❗️❗️ Cannot set step-up MFA grace cookie: missing required request headers to identify client ❗️❗️❗️");
-            return null;
-        }
-        else {
-            const hmac = crypto.createHmac('sha256', process.env.ADMINFORTH_SECRET)
-                .update(`${acceptLanguage}_${userAgent}_${ip}_${session_cookie}`)
-                .digest('hex');
-            return hmac;
-        }
-    }
-    issueTempSkip2FAGraceJWT(opts, cookies, response) {
-        if (response) {
-            if (opts.extra.headers) {
-                const hash = this.generateHashForStepUpMfaGraceCookie(opts.extra.headers, cookies);
-                if (!hash) {
-                    return;
-                }
-                const jwt = this.adminforth.auth.issueJWT({ hash: hash }, 'MfaGrace', `${this.options.stepUpMfaGracePeriodSeconds}s`);
-                //TODO: fix ts-ignore after releasing new version of adminforth with updated types
-                //@ts-ignore 
-                this.adminforth.auth.setCustomCookie({ response: response, payload: { name: "TempSkip2FA_Modal_JWT", sessionBased: true, value: jwt, httpOnly: true } });
-            }
-        }
-        else {
-            console.error("❗️❗️❗️ Cannot set step-up MFA grace cookie: response object is missing. You probably called verify() method without response parameter ❗️❗️❗️");
-        }
-    }
-    isTempSkip2FAGraceValid(headers_1, cookies_1) {
-        return __awaiter(this, arguments, void 0, function* (headers, cookies, checkIfJWTAboutToExpire = false) {
-            const hash = this.generateHashForStepUpMfaGraceCookie(headers, cookies);
-            if (!hash) {
-                return false;
-            }
-            const jwt = this.adminforth.auth.getCustomCookie({ cookies: cookies, name: "TempSkip2FA_Modal_JWT" });
-            const jwtVerificationResult = yield this.adminforth.auth.verify(jwt, 'MfaGrace', false);
-            if (!jwtVerificationResult) {
-                return false;
-            }
-            const jwtHash = jwtVerificationResult['hash'];
-            if (checkIfJWTAboutToExpire && (jwtVerificationResult["exp"] - (Date.now() / 1000)) < 30) {
-                console.error("❗️❗️❗️ Cannot validate step-up MFA grace cookie: token is expired or about to expire ❗️❗️❗️");
-                return false;
-            }
-            if (hash === jwtHash) {
-                return true;
-            }
-            return false;
-        });
-    }
     waitForResponse(id, timeoutMs) {
         return new Promise((resolve) => {
             let timeout;
@@ -181,167 +88,34 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
     }
     verify(confirmationResult, opts) {
         return __awaiter(this, void 0, void 0, function* () {
-            var _a, _b, _c, _d, _e, _f, _g;
-            if (!confirmationResult)
-                return { error: "Confirmation result is required" };
-            if (!opts.adminUser)
-                return { error: "Admin user is required" };
-            if (!opts.userPk)
-                return { error: "User PK is required" };
-            const cookies = ((_a = opts.extra) === null || _a === void 0 ? void 0 : _a.cookies) || opts.cookies;
-            const response = ((_b = opts.extra) === null || _b === void 0 ? void 0 : _b.response) || opts.response;
-            if (this.options.usersFilterToApply) {
-                const res = this.options.usersFilterToApply(opts.adminUser);
-                if (res === false) {
-                    return { ok: true };
-                }
-            }
-            if (this.options.usersFilterToAllowSkipSetup) {
-                const res = yield this.checkIfSkipSetupAllowSkipVerify(opts.adminUser);
-                if (res.skipAllowed === true) {
-                    return { ok: true };
-                }
-            }
-            if (this.options.stepUpMfaGracePeriodSeconds && ((_c = opts.extra) === null || _c === void 0 ? void 0 : _c.headers) && !confirmationResult.mode) {
-                const verificationResult = yield this.isTempSkip2FAGraceValid(opts.extra.headers, cookies);
-                if (verificationResult === true) {
-                    return { ok: true };
-                }
-            }
-            if (confirmationResult.mode === "totp") {
-                const code = confirmationResult.result;
-                const authRes = this.adminforth.config.resources
-                    .find(r => r.resourceId === this.adminforth.config.auth.usersResourceId);
-                if (!authRes)
-                    return { error: "Auth resource not found" };
-                const connector = this.adminforth.connectors[authRes.dataSource];
-                const pkName = (_d = authRes.columns.find(c => c.primaryKey)) === null || _d === void 0 ? void 0 : _d.name;
-                if (!pkName)
-                    return { error: "Primary key not found on auth resource" };
-                const pk = (_e = opts === null || opts === void 0 ? void 0 : opts.userPk) !== null && _e !== void 0 ? _e : (_g = (_f = opts === null || opts === void 0 ? void 0 : opts.adminUser) === null || _f === void 0 ? void 0 : _f.dbUser) === null || _g === void 0 ? void 0 : _g[pkName];
-                if (!pk)
-                    return { error: "User PK is required" };
-                const user = yield connector.getRecordByPrimaryKey(authRes, pk);
-                if (!user)
-                    return { error: "User not found" };
-                const secret = user[this.options.twoFaSecretFieldName];
-                if (!secret)
-                    return { error: "2FA is not set up for this user" };
-                const verified = twofactor.verifyToken(secret, code, this.options.timeStepWindow);
-                //* SET GRACE COOKIE *//
-                if (verified) {
-                    if (this.options.stepUpMfaGracePeriodSeconds) {
-                        this.issueTempSkip2FAGraceJWT(opts, cookies, response);
-                    }
-                    return { ok: true };
-                }
-                else {
-                    return { error: "Wrong or expired OTP code" };
-                }
-                ;
-            }
-            else if (confirmationResult.mode === "passkey") {
-                const cookiesValidationResult = yield this.validateCookiesForPasskeyLogin(cookies);
-                if (!cookiesValidationResult.ok) {
-                    return { error: cookiesValidationResult.error };
-                }
-                const verificationResult = yield this.verifyPasskeyResponse(confirmationResult.result, opts.userPk, cookiesValidationResult.decodedPasskeysCookies);
-                if (verificationResult.ok && verificationResult.passkeyConfirmed) {
-                    //* SET GRACE COOKIE *//
-                    if (this.options.stepUpMfaGracePeriodSeconds) {
-                        this.issueTempSkip2FAGraceJWT(opts, cookies, response);
-                    }
-                    return { ok: true };
-                }
-                return { error: "Invalid passkey" };
-            }
-            return { error: "Unsupported confirmation mode" };
-        });
-    }
-    parsePeriod(period) {
-        if (!period)
-            return 0;
-        const match = /^(\d+)([dhms])$/.exec(period.trim());
-        if (!match)
-            throw new Error(`Invalid suggestionPeriod format: ${period}`);
-        const value = parseInt(match[1], 10);
-        const unit = match[2];
-        switch (unit) {
-            case 'd': return value * 24 * 60 * 60 * 1000;
-            case 'h': return value * 60 * 60 * 1000;
-            case 'm': return value * 60 * 1000;
-            case 's': return value * 1000;
-            default: return value;
-        }
-    }
-    verifyPasskeyResponse(body, user_id, cookies) {
-        return __awaiter(this, void 0, void 0, function* () {
-            var _a, _b, _c, _d, _e;
-            const settingsOrigin = (_a = this.options.passkeys) === null || _a === void 0 ? void 0 : _a.settings.expectedOrigin;
-            const expectedOrigin = body.origin;
-            const expectedChallenge = cookies.challenge;
-            const expectedRPID = ((_d = (_c = (_b = this.options.passkeys) === null || _b === void 0 ? void 0 : _b.settings) === null || _c === void 0 ? void 0 : _c.rp) === null || _d === void 0 ? void 0 : _d.id) || (new URL(settingsOrigin)).hostname;
-            const response = JSON.parse(body.response);
-            try {
-                if (settingsOrigin !== expectedOrigin) {
-                    throw new Error(`Origin mismatch. Allowed in settings: ${settingsOrigin}, received from client: ${expectedOrigin}`);
-                }
-                const cred = yield this.adminforth.resource(this.options.passkeys.credentialResourceID).get([Filters.EQ(this.options.passkeys.credentialIdFieldName, response.id)]);
-                if (!cred) {
-                    throw new Error('Credential not found.');
-                }
-                const credMeta = this.parseIfNeeded(cred[this.options.passkeys.credentialMetaFieldName]);
-                if (!credMeta || !credMeta.public_key) {
-                    throw new Error('Credential public key not found.');
-                }
-                const userResourceId = this.adminforth.config.auth.usersResourceId;
-                const usersResource = this.adminforth.config.resources.find(r => r.resourceId === userResourceId);
-                const usersPrimaryKeyColumn = usersResource.columns.find((col) => col.primaryKey);
-                const usersPrimaryKeyFieldName = usersPrimaryKeyColumn.name;
-                const user = yield this.adminforth.resource(userResourceId).get([Filters.EQ(usersPrimaryKeyFieldName, cred[this.options.passkeys.credentialUserIdFieldName])]);
-                if (!user || !user_id || user[usersPrimaryKeyFieldName] !== user_id) {
-                    throw new Error('User not found.');
-                }
-                const { verified, authenticationInfo } = yield verifyAuthenticationResponse({
-                    response,
-                    expectedChallenge,
-                    expectedOrigin: settingsOrigin,
-                    expectedRPID,
-                    credential: {
-                        id: cred[this.options.passkeys.credentialIdFieldName],
-                        publicKey: isoBase64URL.toBuffer(credMeta.public_key),
-                        counter: credMeta.counter,
-                        transports: credMeta.transports,
-                    },
-                    requireUserVerification: ((_e = this.options.passkeys) === null || _e === void 0 ? void 0 : _e.settings.authenticatorSelection.userVerification) === 'discouraged' ? false : true,
-                });
-                if (!verified) {
-                    return { ok: false, error: 'User verification failed.' };
-                }
-                credMeta.counter = authenticationInfo.newCounter;
-                credMeta.last_used_at = new Date().toISOString();
-                const credResource = this.adminforth.config.resources.find(r => r.resourceId === this.options.passkeys.credentialResourceID);
-                const credResourcePKColumn = credResource === null || credResource === void 0 ? void 0 : credResource.columns.find(c => c.primaryKey);
-                if (!credResource || !credResourcePKColumn) {
-                    throw new Error('Credential resource or its primary key is not configured correctly');
-                }
-                const credResourcePKName = credResourcePKColumn.name;
-                yield this.adminforth
-                    .resource(this.options.passkeys.credentialResourceID)
-                    .update(cred[credResourcePKName], { [this.options.passkeys.credentialMetaFieldName]: JSON.stringify(credMeta) });
-                return { ok: true, passkeyConfirmed: true };
-            }
-            catch (e) {
-                return { ok: false, error: 'Error authenticating passkey: ' + e };
-            }
+            return verifyMfaConfirmation(this.ctx, confirmationResult, opts);
         });
     }
     modifyResourceConfig(adminforth, resourceConfig) {
-        var _a;
+        var _a, _b;
         super.modifyResourceConfig(adminforth, resourceConfig);
         this.adminforth = adminforth;
         this.adminForthAuth = adminforth.auth;
-        const suggestionPeriod = this.parsePeriod(((_a = this.options.passkeys) === null || _a === void 0 ? void 0 : _a.suggestionPeriod) || "5d");
+        this.userRepository = new UserRepository(this.adminforth, this.options);
+        this.cookieService = new CookieService(this.adminforth, this.options);
+        this.totpService = new TotpService(this.options, this.userRepository);
+        this.passkeyService = new PasskeyService(this.options, this.adminforth, this.userRepository, undefined, this.cookieService);
+        this.ctx = {
+            adminforth: this.adminforth,
+            options: this.options,
+            authResource: resourceConfig,
+            userRepository: this.userRepository,
+            totpService: this.totpService,
+            passkeyService: this.passkeyService,
+            cookieService: this.cookieService,
+            verifyMfaConfirmation: (confirmationResult, opts) => verifyMfaConfirmation(this.ctx, confirmationResult, opts),
+            checkIfSkipSetupAllowSkipVerify: this.checkIfSkipSetupAllowSkipVerify.bind(this),
+            autoVerify: {
+                verifyAuto: this.verifyAuto.bind(this),
+                resolveResponse: this.resolveResponse.bind(this),
+            },
+        };
+        const suggestionPeriod = parsePeriod(((_a = this.options.passkeys) === null || _a === void 0 ? void 0 : _a.suggestionPeriod) || "5d");
         const isPasskeysEnabled = this.options.passkeys ? true : false;
         const customPages = this.adminforth.config.customization.customPages;
         customPages.push({
@@ -365,15 +139,15 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
                 slug: 'passkeys',
                 component: this.componentPath('TwoFactorsPasskeysSettings.vue'),
                 isVisible: (adminUser) => {
-                    const secret = adminUser.dbUser[this.options.twoFaSecretFieldName];
+                    const secret = this.userRepository.getSecret(adminUser.dbUser);
                     if (!secret || secret.length === 0) {
                         return false;
                     }
                     return true;
                 }
             });
-            if (this.options.passkeys.allowLoginWithPasskeys !== false) {
-                this.options.passkeys.allowLoginWithPasskeys = true;
+            const allowLoginWithPasskeys = (_b = this.options.passkeys.allowLoginWithPasskeys) !== null && _b !== void 0 ? _b : true;
+            if (allowLoginWithPasskeys) {
                 if (!this.adminforth.config.customization.loginPageInjections) {
                     this.adminforth.config.customization.loginPageInjections = { underLoginButton: [], panelHeader: [], underInputs: [] };
                 }
@@ -467,20 +241,18 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
         const beforeLoginConfirmation = this.adminforth.config.auth.beforeLoginConfirmation;
         const beforeLoginConfirmationArray = Array.isArray(beforeLoginConfirmation) ? beforeLoginConfirmation : [beforeLoginConfirmation];
         beforeLoginConfirmationArray.push((_a) => __awaiter(this, [_a], void 0, function* ({ adminUser, response, adminforth, extra, sessionDuration }) {
-            var _b, _c, _d;
+            var _b;
             if (((_b = extra === null || extra === void 0 ? void 0 : extra.meta) === null || _b === void 0 ? void 0 : _b.loginAllowedByPasskeyDirectSignIn) === true) {
                 return { body: { loginAllowed: true }, ok: true };
             }
-            const secret = adminUser.dbUser[this.options.twoFaSecretFieldName];
+            const secret = this.userRepository.getSecret(adminUser.dbUser);
             const userName = adminUser.dbUser[adminforth.config.auth.usernameField];
             const brandName = adminforth.config.customization.brandName;
             const brandNameSlug = adminforth.config.customization.brandNameSlug;
             const issuerName = (this.options.customBrandPrefix && this.options.customBrandPrefix.trim())
                 ? this.options.customBrandPrefix.trim()
                 : brandName;
-            const authResource = adminforth.config.resources.find((res) => res.resourceId === adminforth.config.auth.usersResourceId);
-            const authPk = authResource.columns.find((col) => col.primaryKey).name;
-            const userPk = adminUser.dbUser[authPk];
+            const userPk = this.userRepository.getUserPk(adminUser);
             let newSecret = null;
             const userNeeds2FA = this.options.usersFilterToApply ? this.options.usersFilterToApply(adminUser) : true;
             if (!userNeeds2FA) {
@@ -488,10 +260,8 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
             }
             const userCanSkipSetup = this.options.usersFilterToAllowSkipSetup ? this.options.usersFilterToAllowSkipSetup(adminUser) : false;
             if (!secret) {
-                const tempSecret = twofactor.generateSecret({ name: issuerName, account: userName });
-                newSecret = tempSecret.secret;
-                const totpTemporaryJWT = this.adminforth.auth.issueJWT({ userName, newSecret, issuer: issuerName, pk: userPk, userCanSkipSetup, sessionDuration }, 'temp2FA', ((_c = this.options.passkeys) === null || _c === void 0 ? void 0 : _c.challengeValidityPeriod) || '1m');
-                this.adminforth.auth.setCustomCookie({ response, payload: { name: "2FaTemporaryJWT", value: totpTemporaryJWT, expiry: undefined, expirySeconds: 10 * 60, httpOnly: true } });
+                newSecret = this.totpService.generateSecret(issuerName, userName);
+                this.cookieService.setTotpTemporary(response, { userName, newSecret, issuer: issuerName, pk: userPk, userCanSkipSetup, sessionDuration });
                 return {
                     body: {
                         loginAllowed: false,
@@ -501,8 +271,7 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
                 };
             }
             else {
-                const value = this.adminforth.auth.issueJWT({ userName, issuer: issuerName, pk: userPk, userCanSkipSetup, sessionDuration }, 'temp2FA', ((_d = this.options.passkeys) === null || _d === void 0 ? void 0 : _d.challengeValidityPeriod) || '1m');
-                this.adminforth.auth.setCustomCookie({ response, payload: { name: "2FaTemporaryJWT", value: value, expiry: undefined, expirySeconds: 10 * 60, httpOnly: true } });
+                this.cookieService.setTotpTemporary(response, { userName, issuer: issuerName, pk: userPk, userCanSkipSetup, sessionDuration });
                 return {
                     body: {
                         loginAllowed: false,
@@ -514,583 +283,7 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
         }));
     }
     setupEndpoints(server) {
-        server.endpoint({
-            method: 'POST',
-            path: `/plugin/twofa/initSetup`,
-            noAuth: true,
-            handler: (server) => __awaiter(this, void 0, void 0, function* () {
-                const toReturn = { totpJWT: null, status: 'ok', };
-                const totpTemporaryJWT = this.adminforth.auth.getCustomCookie({ cookies: server.cookies, name: "2FaTemporaryJWT" });
-                if (totpTemporaryJWT) {
-                    toReturn.totpJWT = totpTemporaryJWT;
-                }
-                return toReturn;
-            })
-        });
-        // this enpoints sets final login cookie if 2nd factor is confirmed
-        server.endpoint({
-            method: 'POST',
-            path: `/plugin/twofa/confirmLogin`,
-            noAuth: true,
-            handler: (_a) => __awaiter(this, [_a], void 0, function* ({ body, adminUser, response, cookies }) {
-                const brandNameSlug = this.adminforth.config.customization.brandNameSlug;
-                const totpTemporaryJWT = this.adminforth.auth.getCustomCookie({ cookies: cookies, name: "2FaTemporaryJWT" });
-                if (!totpTemporaryJWT) {
-                    return { error: 'Login session expired. Please log in again.' };
-                }
-                const decoded = yield this.adminforth.auth.verify(totpTemporaryJWT, 'temp2FA');
-                if (!decoded) {
-                    return { error: 'Login session expired. Please log in again.' };
-                }
-                if (decoded.newSecret) {
-                    // set up standard TOTP request - ensured by presence of newSecret in temp2FA token
-                    const verified = body.skip && decoded.userCanSkipSetup ? true : twofactor.verifyToken(decoded.newSecret, body.code, this.options.timeStepWindow);
-                    if (verified) {
-                        this.connectors = this.adminforth.connectors;
-                        if (!body.skip) {
-                            const connector = this.connectors[this.authResource.dataSource];
-                            yield connector.updateRecord({ resource: this.authResource, recordId: decoded.pk, newValues: { [this.options.twoFaSecretFieldName]: decoded.newSecret } });
-                        }
-                        this.adminforth.auth.removeCustomCookie({ response, name: '2FaTemporaryJWT' });
-                        this.adminforth.auth.setAuthCookie({ expireInDuration: decoded.sessionDuration, response, username: decoded.userName, pk: decoded.pk });
-                        return { status: 'ok', allowedLogin: true };
-                    }
-                    else {
-                        return { error: 'Wrong or expired OTP code' };
-                    }
-                }
-                else {
-                    // login with confirming existing TOTP or Passkey
-                    let verified = null;
-                    if (body.usePasskey && this.options.passkeys) {
-                        // passkeys are enabled and user wants to use them
-                        const cookiesValidationResult = yield this.validateCookiesForPasskeyLogin(cookies);
-                        if (!cookiesValidationResult.ok) {
-                            return { error: cookiesValidationResult.error };
-                        }
-                        const res = yield this.verifyPasskeyResponse(body.passkeyOptions, decoded.pk, cookiesValidationResult.decodedPasskeysCookies);
-                        if (res.ok && res.passkeyConfirmed) {
-                            verified = true;
-                        }
-                    }
-                    else {
-                        // user already has TOTP secret, get it
-                        this.connectors = this.adminforth.connectors;
-                        const connector = this.connectors[this.authResource.dataSource];
-                        const user = yield connector.getRecordByPrimaryKey(this.authResource, decoded.pk);
-                        verified = twofactor.verifyToken(user[this.options.twoFaSecretFieldName], body.code, this.options.timeStepWindow);
-                    }
-                    if (verified) {
-                        this.adminforth.auth.removeCustomCookie({ response, name: '2FaTemporaryJWT' });
-                        this.adminforth.auth.setAuthCookie({ expireInDuration: decoded.sessionDuration, response, username: decoded.userName, pk: decoded.pk });
-                        return { status: 'ok', allowedLogin: true };
-                    }
-                    else {
-                        response.setStatus(403, "Wrong or expired TOTP code");
-                        return { error: 'Wrong or expired TOTP code', };
-                    }
-                }
-            })
-        });
-        server.endpoint({
-            method: 'POST',
-            path: `/plugin/twofa/confirmLoginWithPasskey`,
-            noAuth: true,
-            handler: (_a) => __awaiter(this, [_a], void 0, function* ({ body, response, cookies, headers, requestUrl, query }) {
-                if (this.options.passkeys.allowLoginWithPasskeys !== true) {
-                    return { error: 'Login with passkeys is not allowed' };
-                }
-                const passkeyResponse = body.passkeyResponse;
-                if (!passkeyResponse) {
-                    return { error: 'Passkey response is required' };
-                }
-                const cookiesValidationResult = yield this.validateCookiesForPasskeyLogin(cookies);
-                if (!cookiesValidationResult.ok) {
-                    return { error: cookiesValidationResult.error };
-                }
-                let parsedPasskeyResponse;
-                try {
-                    parsedPasskeyResponse = JSON.parse(passkeyResponse.response);
-                }
-                catch (e) {
-                    return { error: 'Malformed passkey response' };
-                }
-                const credential_id = parsedPasskeyResponse.id;
-                if (!credential_id) {
-                    return { error: 'Credential ID is required' };
-                }
-                const passkeyRecord = yield this.adminforth.resource(this.options.passkeys.credentialResourceID).get([Filters.EQ(this.options.passkeys.credentialIdFieldName, credential_id)]);
-                if (!passkeyRecord) {
-                    return { error: 'No such passkey found, most likeley it was removed on this website but you still have it on your device' };
-                }
-                const userPk = passkeyRecord[this.options.passkeys.credentialUserIdFieldName];
-                if (!userPk) {
-                    return { error: 'User ID not found in passkey record' };
-                }
-                const userResourceId = this.adminforth.config.auth.usersResourceId;
-                const usersResource = this.adminforth.config.resources.find(r => r.resourceId === userResourceId);
-                const usersPrimaryKeyColumn = usersResource.columns.find((col) => col.primaryKey);
-                const usersPrimaryKeyFieldName = usersPrimaryKeyColumn.name;
-                const user = yield this.adminforth.resource(userResourceId).get([Filters.EQ(usersPrimaryKeyFieldName, userPk)]);
-                if (!user) {
-                    return { error: 'User not found' };
-                }
-                const verificationResult = yield this.verifyPasskeyResponse(passkeyResponse, userPk, cookiesValidationResult.decodedPasskeysCookies);
-                if (!verificationResult.ok || !verificationResult.passkeyConfirmed) {
-                    return { error: 'Passkey verification failed' };
-                }
-                const username = user[this.adminforth.config.auth.usernameField];
-                const adminUser = {
-                    dbUser: user,
-                    pk: user.id,
-                    username,
-                };
-                const toReturn = { allowedLogin: true, error: '' };
-                const rememberMe = (body === null || body === void 0 ? void 0 : body.rememberMe) || false;
-                yield this.adminforth.restApi.processLoginCallbacks(adminUser, toReturn, response, {
-                    headers,
-                    cookies,
-                    requestUrl,
-                    query,
-                    body: {},
-                    response,
-                    meta: {
-                        loginAllowedByPasskeyDirectSignIn: true
-                    },
-                }, rememberMe ? this.adminforth.config.auth.rememberMeDuration || '30d' : '1d');
-                const rememberDaysAfterPasskeyLogin = (this.options.passkeys.rememberDaysAfterPasskeyLogin ? this.options.passkeys.rememberDaysAfterPasskeyLogin.toString().concat('d') : null);
-                if (toReturn.allowedLogin === true) {
-                    this.adminforth.auth.setAuthCookie({
-                        response,
-                        username,
-                        pk: user.id,
-                        expireInDuration: rememberDaysAfterPasskeyLogin ? rememberDaysAfterPasskeyLogin : this.adminforth.config.auth.rememberMeDuration,
-                    });
-                }
-                return toReturn;
-            })
-        }),
-            server.endpoint({
-                method: "GET",
-                path: "/plugin/twofa/skip-allow",
-                noAuth: true,
-                handler: (_a) => __awaiter(this, [_a], void 0, function* ({ cookies }) {
-                    const totpTemporaryJWT = this.adminforth.auth.getCustomCookie({
-                        cookies,
-                        name: `2FaTemporaryJWT`,
-                    });
-                    const decoded = yield this.adminforth.auth.verify(totpTemporaryJWT, "temp2FA");
-                    if (!decoded) {
-                        return { status: "error", message: "Invalid token" };
-                    }
-                    if (!decoded.newSecret) {
-                        return { status: "ok", skipAllowed: false };
-                    }
-                    else {
-                        return {
-                            status: "ok",
-                            skipAllowed: decoded.userCanSkipSetup,
-                        };
-                    }
-                }),
-            });
-        server.endpoint({
-            method: "GET",
-            path: "/plugin/twofa/skip-allow-modal",
-            handler: (_a) => __awaiter(this, [_a], void 0, function* ({ adminUser, headers, cookies }) {
-                if (this.options.usersFilterToApply) {
-                    const res = this.options.usersFilterToApply(adminUser);
-                    if (res === false) {
-                        return { skipAllowed: true };
-                    }
-                }
-                if (this.options.usersFilterToAllowSkipSetup) {
-                    const res = yield this.checkIfSkipSetupAllowSkipVerify(adminUser);
-                    if (res.skipAllowed === true) {
-                        return { skipAllowed: true };
-                    }
-                }
-                if (this.options.stepUpMfaGracePeriodSeconds) {
-                    const verificationResult = yield this.isTempSkip2FAGraceValid(headers, cookies, true);
-                    if (verificationResult === true) {
-                        return { skipAllowed: true };
-                    }
-                }
-                return { skipAllowed: false };
-            }),
-        });
-        server.endpoint({
-            method: 'POST',
-            path: `/plugin/twofa/verify`,
-            noAuth: false,
-            handler: (_a) => __awaiter(this, [_a], void 0, function* ({ adminUser, body }) {
-                if (!(body === null || body === void 0 ? void 0 : body.code))
-                    return { error: 'Code is required' };
-                const authRes = this.adminforth.config.resources
-                    .find(r => r.resourceId === this.adminforth.config.auth.usersResourceId);
-                const connector = this.adminforth.connectors[authRes.dataSource];
-                const pkName = authRes.columns.find(c => c.primaryKey).name;
-                const user = yield connector.getRecordByPrimaryKey(authRes, adminUser.dbUser[pkName]);
-                const secret = user[this.options.twoFaSecretFieldName];
-                if (!secret)
-                    return { error: '2FA is not set up for this user' };
-                const verified = twofactor.verifyToken(secret, body.code, this.options.timeStepWindow);
-                return verified ? { ok: true } : { error: 'Wrong or expired OTP code' };
-            })
-        });
-        server.endpoint({
-            method: 'POST',
-            path: `/plugin/passkeys/registerPasskeyRequest`,
-            noAuth: false,
-            handler: (_a) => __awaiter(this, [_a], void 0, function* ({ body, adminUser, response, cookies, headers }) {
-                var _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o;
-                const mode = body === null || body === void 0 ? void 0 : body.mode;
-                const confirmationResult = body === null || body === void 0 ? void 0 : body.confirmationResult;
-                const verificationResult = yield this.verify(confirmationResult, {
-                    adminUser: adminUser,
-                    userPk: adminUser.pk,
-                    cookies: cookies,
-                    response: response,
-                    extra: {
-                        headers,
-                    }
-                });
-                if (!verificationResult || !('ok' in verificationResult)) {
-                    return { ok: false, error: 'error' in verificationResult ? verificationResult.error : 'Verification failed' };
-                }
-                const settingsOrigin = (_b = this.options.passkeys) === null || _b === void 0 ? void 0 : _b.settings.expectedOrigin;
-                const rp = {
-                    name: ((_c = this.options.passkeys) === null || _c === void 0 ? void 0 : _c.settings.rp.name) || this.adminforth.config.customization.brandName,
-                    id: ((_f = (_e = (_d = this.options.passkeys) === null || _d === void 0 ? void 0 : _d.settings) === null || _e === void 0 ? void 0 : _e.rp) === null || _f === void 0 ? void 0 : _f.id) || (new URL(settingsOrigin)).hostname,
-                };
-                const userResourceId = this.adminforth.config.auth.usersResourceId;
-                const usersResource = this.adminforth.config.resources.find(r => r.resourceId === userResourceId);
-                const usersPrimaryKeyColumn = usersResource.columns.find((col) => col.primaryKey);
-                const usersPrimaryKeyFieldName = usersPrimaryKeyColumn.name;
-                const userInfo = yield this.adminforth.resource(userResourceId).get([Filters.EQ(usersPrimaryKeyFieldName, adminUser.pk)]);
-                const user = {
-                    id: adminUser.pk,
-                    name: userInfo[(_g = this.options.passkeys) === null || _g === void 0 ? void 0 : _g.settings.user.nameField],
-                    displayName: userInfo[(_h = this.options.passkeys) === null || _h === void 0 ? void 0 : _h.settings.user.displayNameField] ? userInfo[(_j = this.options.passkeys) === null || _j === void 0 ? void 0 : _j.settings.user.displayNameField] : userInfo[(_k = this.options.passkeys) === null || _k === void 0 ? void 0 : _k.settings.user.nameField],
-                };
-                const excludeCredentials = [];
-                const temp = yield this.adminforth.resource(this.options.passkeys.credentialResourceID).list([Filters.EQ(this.options.passkeys.credentialUserIdFieldName, adminUser.pk)]);
-                for (const rec of temp) {
-                    if (rec.credential_id && rec.credential_id.length > 0) {
-                        const meta = this.parseIfNeeded(rec[this.options.passkeys.credentialMetaFieldName]);
-                        excludeCredentials.push({
-                            id: rec.credential_id,
-                            type: "public-key",
-                            transports: JSON.parse(meta.transports || '[]')
-                        });
-                    }
-                }
-                const options = yield generateRegistrationOptions({
-                    rpName: rp.name,
-                    rpID: rp.id,
-                    userID: isoUint8Array.fromUTF8String(user.id),
-                    userName: user.name,
-                    userDisplayName: user.displayName,
-                    excludeCredentials,
-                    authenticatorSelection: {
-                        authenticatorAttachment: mode,
-                        requireResidentKey: ((_l = this.options.passkeys) === null || _l === void 0 ? void 0 : _l.settings.authenticatorSelection.requireResidentKey) || true,
-                        userVerification: ((_m = this.options.passkeys) === null || _m === void 0 ? void 0 : _m.settings.authenticatorSelection.userVerification) || "required"
-                    },
-                });
-                const value = this.adminforth.auth.issueJWT({ "challenge": options.challenge, "user_id": adminUser.pk }, 'registerTempPasskeyChallenge', ((_o = this.options.passkeys) === null || _o === void 0 ? void 0 : _o.challengeValidityPeriod) || '1m');
-                this.adminforth.auth.setCustomCookie({ response, payload: { name: "registerPasskeyTemporaryJWT", value: value, expiry: undefined, expirySeconds: 10 * 60, httpOnly: true } });
-                return { ok: true, data: options };
-            })
-        });
-        server.endpoint({
-            method: 'POST',
-            path: `/plugin/passkeys/finishRegisteringPasskey`,
-            noAuth: false,
-            handler: (_a) => __awaiter(this, [_a], void 0, function* ({ body, adminUser, cookies }) {
-                var _b, _c, _d, _e, _f, _g;
-                const passkeysCookies = this.adminforth.auth.getCustomCookie({ cookies: cookies, name: "registerPasskeyTemporaryJWT" });
-                if (!passkeysCookies) {
-                    return { error: 'Passkey token is required' };
-                }
-                const decodedPasskeysCookies = yield this.adminforth.auth.verify(passkeysCookies, 'registerTempPasskeyChallenge', false);
-                if (!decodedPasskeysCookies) {
-                    return { error: 'Invalid passkey token' };
-                }
-                if (decodedPasskeysCookies.user_id !== adminUser.pk) {
-                    return { error: 'Invalid user' };
-                }
-                const secret = adminUser.dbUser[this.options.twoFaSecretFieldName];
-                if (!secret || secret.length === 0) {
-                    return { error: 'TOTP must be set up before registering a passkey' };
-                }
-                const settingsOrigin = (_b = this.options.passkeys) === null || _b === void 0 ? void 0 : _b.settings.expectedOrigin;
-                const expectedOrigin = body.origin;
-                const expectedChallenge = decodedPasskeysCookies.challenge;
-                const expectedRPID = ((_e = (_d = (_c = this.options.passkeys) === null || _c === void 0 ? void 0 : _c.settings) === null || _d === void 0 ? void 0 : _d.rp) === null || _e === void 0 ? void 0 : _e.id) || (new URL(settingsOrigin)).hostname;
-                const response = JSON.parse(body.credential);
-                try {
-                    if (settingsOrigin !== expectedOrigin) {
-                        throw new Error('Invalid origin');
-                    }
-                    const { verified, registrationInfo } = yield verifyRegistrationResponse({
-                        response,
-                        expectedChallenge,
-                        expectedOrigin,
-                        expectedRPID,
-                        requireUserVerification: ((_f = this.options.passkeys) === null || _f === void 0 ? void 0 : _f.settings.authenticatorSelection.userVerification) === 'discouraged' ? false : true,
-                    });
-                    if (!verified) {
-                        throw new Error('Verification failed.');
-                    }
-                    const { aaguid, credential, credentialBackedUp } = registrationInfo;
-                    const provider_name = ((_g = aaguids[aaguid]) === null || _g === void 0 ? void 0 : _g.name) || 'Unknown provider';
-                    const credentialPublicKey = credential.publicKey;
-                    const credentialID = credential.id;
-                    const base64CredentialID = credentialID;
-                    const base64PublicKey = isoBase64URL.fromBuffer(credentialPublicKey);
-                    const credResource = this.adminforth.config.resources.find(r => r.resourceId === this.options.passkeys.credentialResourceID);
-                    if (!credResource) {
-                        throw new Error('Credential resource not found.');
-                    }
-                    yield this.adminforth.createResourceRecord({
-                        resource: credResource,
-                        record: {
-                            [this.options.passkeys.credentialIdFieldName]: base64CredentialID,
-                            [this.options.passkeys.credentialUserIdFieldName]: adminUser.pk,
-                            [this.options.passkeys.credentialMetaFieldName]: JSON.stringify({
-                                public_key: base64PublicKey,
-                                public_key_algorithm: response.response.publicKeyAlgorithm,
-                                sign_count: 0,
-                                transports: JSON.stringify(response.response.transports),
-                                created_at: new Date().toISOString(),
-                                last_used_at: new Date().toISOString(),
-                                aaguid: aaguid,
-                                name: provider_name,
-                            }),
-                        },
-                        adminUser: adminUser
-                    });
-                }
-                catch (error) {
-                    console.error(error);
-                    return { error: 'Error registering passkey: ' + error.message };
-                }
-                return { ok: true };
-            })
-        });
-        server.endpoint({
-            method: 'POST',
-            path: `/plugin/passkeys/signInRequest`,
-            noAuth: true,
-            handler: (_a) => __awaiter(this, [_a], void 0, function* ({ response }) {
-                var _b, _c, _d;
-                try {
-                    const options = yield generateAuthenticationOptions({
-                        rpID: (_b = this.options.passkeys) === null || _b === void 0 ? void 0 : _b.settings.rp.id,
-                        userVerification: ((_c = this.options.passkeys) === null || _c === void 0 ? void 0 : _c.settings.authenticatorSelection.userVerification) || "required"
-                    });
-                    const value = this.adminforth.auth.issueJWT({ "challenge": options.challenge }, 'tempLoginPasskeyChallenge', ((_d = this.options.passkeys) === null || _d === void 0 ? void 0 : _d.challengeValidityPeriod) || '1m');
-                    this.adminforth.auth.setCustomCookie({ response, payload: { name: `passkeyLoginTemporaryJWT`, value: value, expiry: undefined, expirySeconds: 10 * 60, httpOnly: true } });
-                    return { ok: true, data: options };
-                }
-                catch (e) {
-                    return { ok: false, error: e };
-                }
-            })
-        });
-        server.endpoint({
-            method: 'GET',
-            path: `/plugin/passkeys/getPasskeys`,
-            noAuth: false,
-            handler: (_a) => __awaiter(this, [_a], void 0, function* ({ adminUser }) {
-                var _b, _c, _d;
-                let passkeys;
-                try {
-                    passkeys = yield this.adminforth.resource(this.options.passkeys.credentialResourceID).list([Filters.EQ(this.options.passkeys.credentialUserIdFieldName, adminUser.pk)]);
-                }
-                catch (error) {
-                    return { ok: false, error: 'Error fetching passkeys: ' + error.message };
-                }
-                let dataToReturn = [];
-                for (const pk of passkeys) {
-                    const parsedKey = this.parseIfNeeded(pk[this.options.passkeys.credentialMetaFieldName]);
-                    dataToReturn.push({
-                        name: parsedKey.name,
-                        light_icon: ((_b = aaguids[parsedKey.aaguid]) === null || _b === void 0 ? void 0 : _b.icon_light) || null,
-                        dark_icon: ((_c = aaguids[parsedKey.aaguid]) === null || _c === void 0 ? void 0 : _c.icon_dark) || null,
-                        created_at: parsedKey.created_at,
-                        last_used_at: parsedKey.last_used_at,
-                        id: pk[this.options.passkeys.credentialIdFieldName],
-                    });
-                }
-                return { ok: true, data: dataToReturn, authenticatorAttachment: ((_d = this.options.passkeys) === null || _d === void 0 ? void 0 : _d.settings.authenticatorSelection.authenticatorAttachment) || 'both' };
-            })
-        });
-        server.endpoint({
-            method: 'DELETE',
-            path: `/plugin/passkeys/deletePasskey`,
-            noAuth: false,
-            handler: (_a) => __awaiter(this, [_a], void 0, function* ({ body, adminUser }) {
-                const credentialID = body.passkeyId;
-                if (!credentialID) {
-                    return { ok: false, error: 'Passkey ID is required' };
-                }
-                const passkeyRecord = yield this.adminforth.resource(this.options.passkeys.credentialResourceID).get([Filters.EQ(this.options.passkeys.credentialIdFieldName, credentialID), Filters.EQ(this.options.passkeys.credentialUserIdFieldName, adminUser.pk)]);
-                if (!passkeyRecord) {
-                    return { ok: false, error: 'Passkey not found' };
-                }
-                try {
-                    const credResource = this.adminforth.config.resources.find(r => r.resourceId === this.options.passkeys.credentialResourceID);
-                    if (!credResource) {
-                        throw new Error('Credential resource not found.');
-                    }
-                    const credResourcePKColumn = credResource.columns.find(c => c.primaryKey);
-                    if (!credResourcePKColumn) {
-                        throw new Error('Credential resource primary key not found.');
-                    }
-                    const credResourcePKName = credResourcePKColumn.name;
-                    const passkeyRecord = yield this.adminforth.resource(this.options.passkeys.credentialResourceID).get([Filters.EQ(this.options.passkeys.credentialIdFieldName, credentialID), Filters.EQ(this.options.passkeys.credentialUserIdFieldName, adminUser.pk)]);
-                    if (!passkeyRecord) {
-                        return { ok: false, error: 'Passkey not found' };
-                    }
-                    yield this.adminforth.deleteResourceRecord({
-                        resource: credResource,
-                        recordId: passkeyRecord[credResourcePKName],
-                        record: passkeyRecord,
-                        adminUser: adminUser,
-                    });
-                }
-                catch (error) {
-                    return { ok: false, error: 'Error deleting passkey: ' + error.message };
-                }
-                return { ok: true };
-            })
-        });
-        server.endpoint({
-            method: 'POST',
-            path: `/plugin/passkeys/renamePasskey`,
-            noAuth: false,
-            handler: (_a) => __awaiter(this, [_a], void 0, function* ({ body, adminUser }) {
-                const credentialID = body.passkeyId;
-                const newName = body.newName;
-                if (!credentialID) {
-                    return { ok: false, error: 'Passkey ID is required' };
-                }
-                if (!newName) {
-                    return { ok: false, error: 'New name is required' };
-                }
-                const credResource = this.adminforth.config.resources.find(r => r.resourceId === this.options.passkeys.credentialResourceID);
-                if (!credResource) {
-                    throw new Error('Credential resource not found.');
-                }
-                const credResourcePKColumn = credResource.columns.find(c => c.primaryKey);
-                if (!credResourcePKColumn) {
-                    throw new Error('Credential resource primary key not found.');
-                }
-                const credResourcePKName = credResourcePKColumn.name;
-                const passkeyRecord = yield this.adminforth.resource(this.options.passkeys.credentialResourceID).get([Filters.EQ(this.options.passkeys.credentialIdFieldName, credentialID), Filters.EQ(this.options.passkeys.credentialUserIdFieldName, adminUser.pk)]);
-                if (!passkeyRecord) {
-                    return { ok: false, error: 'Passkey not found' };
-                }
-                const meta = this.parseIfNeeded(passkeyRecord[this.options.passkeys.credentialMetaFieldName]);
-                meta.name = newName;
-                const newRecord = Object.assign(Object.assign({}, passkeyRecord), { [this.options.passkeys.credentialMetaFieldName]: JSON.stringify(meta) });
-                try {
-                    const credResource = this.adminforth.config.resources.find(r => r.resourceId === this.options.passkeys.credentialResourceID);
-                    if (!credResource) {
-                        throw new Error('Credential resource not found.');
-                    }
-                    yield this.adminforth.updateResourceRecord({
-                        resource: credResource,
-                        recordId: passkeyRecord[credResourcePKName],
-                        oldRecord: passkeyRecord,
-                        record: newRecord,
-                        adminUser: adminUser
-                    });
-                }
-                catch (error) {
-                    return { ok: false, error: 'Error renaming passkey: ' + error.message };
-                }
-                return { ok: true };
-            })
-        });
-        server.endpoint({
-            method: 'POST',
-            path: `/plugin/passkeys/checkIfUserHasPasskeys`,
-            noAuth: true,
-            handler: (_a) => __awaiter(this, [_a], void 0, function* ({ cookies }) {
-                if (!this.options.passkeys) {
-                    return { ok: false, hasPasskeys: false };
-                }
-                const totpTemporaryJWT = this.adminforth.auth.getCustomCookie({ cookies: cookies, name: "2FaTemporaryJWT" });
-                const decoded = yield this.adminforth.auth.verify(totpTemporaryJWT, 'temp2FA');
-                if (!decoded)
-                    return { ok: false, error: 'Invalid token' };
-                if (decoded.newSecret) {
-                    return { ok: true, hasPasskeys: false };
-                }
-                const passkeys = yield this.adminforth.resource(this.options.passkeys.credentialResourceID).list([Filters.EQ(this.options.passkeys.credentialUserIdFieldName, decoded.pk)]);
-                if (passkeys && passkeys.length > 0) {
-                    return { ok: true, hasPasskeys: true };
-                }
-                else {
-                    return { ok: true, hasPasskeys: false };
-                }
-            })
-        });
-        server.endpoint({
-            method: 'POST',
-            path: `/plugin/passkeys/resolveVerifyAuto`,
-            noAuth: false,
-            handler: (_a) => __awaiter(this, [_a], void 0, function* ({ body, adminUser, response, cookies, headers }) {
-                const sessionsIds = body === null || body === void 0 ? void 0 : body.sessionsIds;
-                const confirmationResult = body === null || body === void 0 ? void 0 : body.confirmationResult;
-                const idsToResolve = Array.isArray(sessionsIds) ? sessionsIds : [];
-                const resolveAllIdsAsFailed = (message) => {
-                    for (const id of idsToResolve) {
-                        this.resolveResponse(id, { ok: false, error: message });
-                    }
-                    return { ok: false, error: message };
-                };
-                try {
-                    if (!idsToResolve.length || !confirmationResult) {
-                        return (resolveAllIdsAsFailed('Confirmation window was closed or did not return required data'));
-                    }
-                    for (const id of idsToResolve) {
-                        const validationResult = yield this.adminforth.auth.verify(id, 'auto2FA', false);
-                        if (!validationResult) {
-                            return (resolveAllIdsAsFailed('Invalid session ID or confirmation result'));
-                        }
-                        if (validationResult.adminUserPk !== adminUser.pk) {
-                            return (resolveAllIdsAsFailed('Session does not belong to the authenticated user'));
-                        }
-                    }
-                    const verificationResult = yield this.verify(confirmationResult, {
-                        adminUser: adminUser,
-                        userPk: adminUser.pk,
-                        cookies: cookies,
-                        response: response,
-                        extra: {
-                            headers: headers,
-                        }
-                    });
-                    if (!verificationResult || !('ok' in verificationResult)) {
-                        return (resolveAllIdsAsFailed('Verification failed'));
-                    }
-                    if ('ok' in verificationResult && verificationResult.ok) {
-                        for (const id of idsToResolve) {
-                            this.resolveResponse(id, { ok: true, passkeyConfirmed: verificationResult });
-                        }
-                        return { ok: true };
-                    }
-                    return (resolveAllIdsAsFailed('Verification failed'));
-                }
-                catch (error) {
-                    console.error('[AdminForth 2FA] Error resolving automatic 2FA verification', error);
-                    return (resolveAllIdsAsFailed(error instanceof Error ? error.message : 'Verification failed'));
-                }
-            })
-        });
+        registerTwoFaEndpoints(server, createTwoFaHandlers(this.ctx));
+        registerPasskeyEndpoints(server, createPasskeyHandlers(this.ctx));
     }
 }