@adminforth/two-factors-auth 4.2.4 → 4.3.1

package/build.log

@@ -17,5 +17,5 @@ custom/tsconfig.json
 custom/use2faApi.ts
 custom/utils.js
 
-sent 288,176 bytes  received 248 bytes  576,848.00 bytes/sec
-total size is 287,203  speedup is 1.00
+sent 288,126 bytes  received 248 bytes  576,748.00 bytes/sec
+total size is 287,166  speedup is 1.00

package/custom/TwoFactorsSetup.vue

@@ -249,8 +249,7 @@ async function sendCode (value) {
     method: 'POST',
     path: '/plugin/twofa/confirmLogin',
     body: {
-      code: value,
-      secret: totp.value.newSecret,
+      code: value
     }
   })
   if (resp.allowedLogin) {

package/dist/custom/TwoFactorsSetup.vue

@@ -249,8 +249,7 @@ async function sendCode (value) {
     method: 'POST',
     path: '/plugin/twofa/confirmLogin',
     body: {
-      code: value,
-      secret: totp.value.newSecret,
+      code: value
     }
   })
   if (resp.allowedLogin) {

package/dist/endpoints/registerPasskeyEndpoints.js

@@ -7,18 +7,30 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         step((generator = generator.apply(thisArg, _arguments || [])).next());
     });
 };
+import { parseBody } from "adminforth";
+import { registrationOptionsBodySchema, finishRegistrationBodySchema, deletePasskeyBodySchema, renamePasskeyBodySchema, resolveVerifyAutoBodySchema, } from "./validation.js";
 export function registerPasskeyEndpoints(server, handlers) {
     server.endpoint({
         method: 'POST',
         path: `/plugin/passkeys/registrationOptions`,
         noAuth: false,
-        handler: (_a) => __awaiter(this, [_a], void 0, function* ({ body, adminUser, response, cookies, headers }) { return handlers.createRegistrationOptions({ body, adminUser, response, cookies, headers }); }),
+        handler: (_a) => __awaiter(this, [_a], void 0, function* ({ body, adminUser, response, cookies, headers }) {
+            const parsed = parseBody(registrationOptionsBodySchema, body, response);
+            if ('error' in parsed)
+                return parsed.error;
+            return handlers.createRegistrationOptions({ body, adminUser, response, cookies, headers });
+        }),
     });
     server.endpoint({
         method: 'POST',
         path: `/plugin/passkeys/finishRegistration`,
         noAuth: false,
-        handler: (_a) => __awaiter(this, [_a], void 0, function* ({ body, adminUser, cookies }) { return handlers.finishRegistration({ body, adminUser, cookies }); }),
+        handler: (_a) => __awaiter(this, [_a], void 0, function* ({ body, adminUser, cookies, response }) {
+            const parsed = parseBody(finishRegistrationBodySchema, body, response);
+            if ('error' in parsed)
+                return parsed.error;
+            return handlers.finishRegistration({ body, adminUser, cookies });
+        }),
     });
     server.endpoint({
         method: 'POST',
@@ -36,13 +48,23 @@ export function registerPasskeyEndpoints(server, handlers) {
         method: 'DELETE',
         path: `/plugin/passkeys/deletePasskey`,
         noAuth: false,
-        handler: (_a) => __awaiter(this, [_a], void 0, function* ({ body, adminUser }) { return handlers.deletePasskey({ body, adminUser }); }),
+        handler: (_a) => __awaiter(this, [_a], void 0, function* ({ body, adminUser, response }) {
+            const parsed = parseBody(deletePasskeyBodySchema, body, response);
+            if ('error' in parsed)
+                return parsed.error;
+            return handlers.deletePasskey({ body, adminUser });
+        }),
     });
     server.endpoint({
         method: 'POST',
         path: `/plugin/passkeys/renamePasskey`,
         noAuth: false,
-        handler: (_a) => __awaiter(this, [_a], void 0, function* ({ body, adminUser }) { return handlers.renamePasskey({ body, adminUser }); }),
+        handler: (_a) => __awaiter(this, [_a], void 0, function* ({ body, adminUser, response }) {
+            const parsed = parseBody(renamePasskeyBodySchema, body, response);
+            if ('error' in parsed)
+                return parsed.error;
+            return handlers.renamePasskey({ body, adminUser });
+        }),
     });
     server.endpoint({
         method: 'POST',
@@ -54,6 +76,11 @@ export function registerPasskeyEndpoints(server, handlers) {
         method: 'POST',
         path: `/plugin/passkeys/resolveVerifyAuto`,
         noAuth: false,
-        handler: (_a) => __awaiter(this, [_a], void 0, function* ({ body, adminUser, response, cookies, headers }) { return handlers.resolveVerifyAuto({ body, adminUser, response, cookies, headers }); }),
+        handler: (_a) => __awaiter(this, [_a], void 0, function* ({ body, adminUser, response, cookies, headers }) {
+            const parsed = parseBody(resolveVerifyAutoBodySchema, body, response);
+            if ('error' in parsed)
+                return parsed.error;
+            return handlers.resolveVerifyAuto({ body, adminUser, response, cookies, headers });
+        }),
     });
 }

package/dist/endpoints/registerTwoFaEndpoints.js

@@ -7,6 +7,8 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         step((generator = generator.apply(thisArg, _arguments || [])).next());
     });
 };
+import { parseBody } from "adminforth";
+import { confirmLoginBodySchema, confirmLoginWithPasskeyBodySchema, verifyTotpBodySchema, } from "./validation.js";
 export function registerTwoFaEndpoints(server, handlers) {
     server.endpoint({
         method: 'POST',
@@ -18,13 +20,23 @@ export function registerTwoFaEndpoints(server, handlers) {
         method: 'POST',
         path: `/plugin/twofa/confirmLogin`,
         noAuth: true,
-        handler: (_a) => __awaiter(this, [_a], void 0, function* ({ body, response, cookies, headers }) { return handlers.confirmLogin({ body, response, cookies, headers }); }),
+        handler: (_a) => __awaiter(this, [_a], void 0, function* ({ body, response, cookies, headers }) {
+            const parsed = parseBody(confirmLoginBodySchema, body, response);
+            if ('error' in parsed)
+                return parsed.error;
+            return handlers.confirmLogin({ body, response, cookies, headers });
+        }),
     });
     server.endpoint({
         method: 'POST',
         path: `/plugin/twofa/confirmLoginWithPasskey`,
         noAuth: true,
-        handler: (_a) => __awaiter(this, [_a], void 0, function* ({ body, response, cookies, headers, requestUrl, query }) { return handlers.confirmLoginWithPasskey({ body, response, cookies, headers, requestUrl, query }); }),
+        handler: (_a) => __awaiter(this, [_a], void 0, function* ({ body, response, cookies, headers, requestUrl, query }) {
+            const parsed = parseBody(confirmLoginWithPasskeyBodySchema, body, response);
+            if ('error' in parsed)
+                return parsed.error;
+            return handlers.confirmLoginWithPasskey({ body, response, cookies, headers, requestUrl, query });
+        }),
     });
     server.endpoint({
         method: "GET",
@@ -41,6 +53,11 @@ export function registerTwoFaEndpoints(server, handlers) {
         method: 'POST',
         path: `/plugin/twofa/verify`,
         noAuth: false,
-        handler: (_a) => __awaiter(this, [_a], void 0, function* ({ adminUser, body }) { return handlers.verifyTotp({ adminUser, body }); }),
+        handler: (_a) => __awaiter(this, [_a], void 0, function* ({ adminUser, body, response }) {
+            const parsed = parseBody(verifyTotpBodySchema, body, response);
+            if ('error' in parsed)
+                return parsed.error;
+            return handlers.verifyTotp({ adminUser, body });
+        }),
     });
 }

package/dist/endpoints/validation.d.ts

@@ -0,0 +1,33 @@
+import { z } from "zod";
+export declare const confirmLoginBodySchema: z.ZodObject<{
+    code: z.ZodOptional<z.ZodString>;
+    skip: z.ZodOptional<z.ZodBoolean>;
+    usePasskey: z.ZodOptional<z.ZodBoolean>;
+    passkeyOptions: z.ZodOptional<z.ZodAny>;
+}, z.core.$strict>;
+export declare const confirmLoginWithPasskeyBodySchema: z.ZodObject<{
+    passkeyResponse: z.ZodRecord<z.ZodString, z.ZodAny>;
+    rememberMe: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>;
+export declare const verifyTotpBodySchema: z.ZodObject<{
+    code: z.ZodString;
+}, z.core.$strict>;
+export declare const registrationOptionsBodySchema: z.ZodObject<{
+    mode: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    confirmationResult: z.ZodRecord<z.ZodString, z.ZodAny>;
+}, z.core.$strict>;
+export declare const finishRegistrationBodySchema: z.ZodObject<{
+    credential: z.ZodAny;
+    origin: z.ZodString;
+}, z.core.$strict>;
+export declare const deletePasskeyBodySchema: z.ZodObject<{
+    passkeyId: z.ZodString;
+}, z.core.$strict>;
+export declare const renamePasskeyBodySchema: z.ZodObject<{
+    passkeyId: z.ZodString;
+    newName: z.ZodString;
+}, z.core.$strict>;
+export declare const resolveVerifyAutoBodySchema: z.ZodObject<{
+    sessionsIds: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
+    confirmationResult: z.ZodRecord<z.ZodString, z.ZodAny>;
+}, z.core.$strict>;

package/dist/endpoints/validation.js

@@ -0,0 +1,35 @@
+import { z } from "zod";
+// twofa endpoints
+export const confirmLoginBodySchema = z.object({
+    code: z.string().optional(),
+    skip: z.boolean().optional(),
+    usePasskey: z.boolean().optional(),
+    passkeyOptions: z.any().optional(),
+}).strict();
+export const confirmLoginWithPasskeyBodySchema = z.object({
+    passkeyResponse: z.record(z.string(), z.any()),
+    rememberMe: z.boolean().optional(),
+}).strict();
+export const verifyTotpBodySchema = z.object({
+    code: z.string(),
+}).strict();
+// passkey endpoints
+export const registrationOptionsBodySchema = z.object({
+    mode: z.string().nullish(),
+    confirmationResult: z.record(z.string(), z.any()),
+}).strict();
+export const finishRegistrationBodySchema = z.object({
+    credential: z.any(),
+    origin: z.string(),
+}).strict();
+export const deletePasskeyBodySchema = z.object({
+    passkeyId: z.string(),
+}).strict();
+export const renamePasskeyBodySchema = z.object({
+    passkeyId: z.string(),
+    newName: z.string(),
+}).strict();
+export const resolveVerifyAutoBodySchema = z.object({
+    sessionsIds: z.array(z.string()).nullish(),
+    confirmationResult: z.record(z.string(), z.any()),
+}).strict();

package/endpoints/registerPasskeyEndpoints.ts

@@ -1,19 +1,34 @@
 import type { IHttpServer } from "adminforth";
+import { parseBody } from "adminforth";
+import {
+  registrationOptionsBodySchema,
+  finishRegistrationBodySchema,
+  deletePasskeyBodySchema,
+  renamePasskeyBodySchema,
+  resolveVerifyAutoBodySchema,
+} from "./validation.js";
 
 export function registerPasskeyEndpoints(server: IHttpServer, handlers: any): void {
   server.endpoint({
     method: 'POST',
     path: `/plugin/passkeys/registrationOptions`,
     noAuth: false,
-    handler: async ({ body, adminUser, response, cookies, headers }) =>
-      handlers.createRegistrationOptions({ body, adminUser, response, cookies, headers }),
+    handler: async ({ body, adminUser, response, cookies, headers }) => {
+      const parsed = parseBody(registrationOptionsBodySchema, body, response);
+      if ('error' in parsed) return parsed.error;
+      return handlers.createRegistrationOptions({ body, adminUser, response, cookies, headers });
+    },
   });
 
   server.endpoint({
     method: 'POST',
     path: `/plugin/passkeys/finishRegistration`,
     noAuth: false,
-    handler: async ({ body, adminUser, cookies }) => handlers.finishRegistration({ body, adminUser, cookies }),
+    handler: async ({ body, adminUser, cookies, response }) => {
+      const parsed = parseBody(finishRegistrationBodySchema, body, response);
+      if ('error' in parsed) return parsed.error;
+      return handlers.finishRegistration({ body, adminUser, cookies });
+    },
   });
 
   server.endpoint({
@@ -34,14 +49,22 @@ export function registerPasskeyEndpoints(server: IHttpServer, handlers: any): vo
     method: 'DELETE',
     path: `/plugin/passkeys/deletePasskey`,
     noAuth: false,
-    handler: async ({ body, adminUser }) => handlers.deletePasskey({ body, adminUser }),
+    handler: async ({ body, adminUser, response }) => {
+      const parsed = parseBody(deletePasskeyBodySchema, body, response);
+      if ('error' in parsed) return parsed.error;
+      return handlers.deletePasskey({ body, adminUser });
+    },
   });
 
   server.endpoint({
     method: 'POST',
     path: `/plugin/passkeys/renamePasskey`,
     noAuth: false,
-    handler: async ({ body, adminUser }) => handlers.renamePasskey({ body, adminUser }),
+    handler: async ({ body, adminUser, response }) => {
+      const parsed = parseBody(renamePasskeyBodySchema, body, response);
+      if ('error' in parsed) return parsed.error;
+      return handlers.renamePasskey({ body, adminUser });
+    },
   });
 
   server.endpoint({
@@ -55,7 +78,10 @@ export function registerPasskeyEndpoints(server: IHttpServer, handlers: any): vo
     method: 'POST',
     path: `/plugin/passkeys/resolveVerifyAuto`,
     noAuth: false,
-    handler: async ({ body, adminUser, response, cookies, headers }) =>
-      handlers.resolveVerifyAuto({ body, adminUser, response, cookies, headers }),
+    handler: async ({ body, adminUser, response, cookies, headers }) => {
+      const parsed = parseBody(resolveVerifyAutoBodySchema, body, response);
+      if ('error' in parsed) return parsed.error;
+      return handlers.resolveVerifyAuto({ body, adminUser, response, cookies, headers });
+    },
   });
 }

package/endpoints/registerTwoFaEndpoints.ts

@@ -1,4 +1,10 @@
 import type { IHttpServer } from "adminforth";
+import { parseBody } from "adminforth";
+import {
+  confirmLoginBodySchema,
+  confirmLoginWithPasskeyBodySchema,
+  verifyTotpBodySchema,
+} from "./validation.js";
 
 export function registerTwoFaEndpoints(server: IHttpServer, handlers: any): void {
   server.endpoint({
@@ -12,15 +18,22 @@ export function registerTwoFaEndpoints(server: IHttpServer, handlers: any): void
     method: 'POST',
     path: `/plugin/twofa/confirmLogin`,
     noAuth: true,
-    handler: async ({ body, response, cookies, headers }) => handlers.confirmLogin({ body, response, cookies, headers }),
+    handler: async ({ body, response, cookies, headers }) => {
+      const parsed = parseBody(confirmLoginBodySchema, body, response);
+      if ('error' in parsed) return parsed.error;
+      return handlers.confirmLogin({ body, response, cookies, headers });
+    },
   });
 
   server.endpoint({
     method: 'POST',
     path: `/plugin/twofa/confirmLoginWithPasskey`,
     noAuth: true,
-    handler: async ({ body, response, cookies, headers, requestUrl, query }) =>
-      handlers.confirmLoginWithPasskey({ body, response, cookies, headers, requestUrl, query }),
+    handler: async ({ body, response, cookies, headers, requestUrl, query }) => {
+      const parsed = parseBody(confirmLoginWithPasskeyBodySchema, body, response);
+      if ('error' in parsed) return parsed.error;
+      return handlers.confirmLoginWithPasskey({ body, response, cookies, headers, requestUrl, query });
+    },
   });
 
   server.endpoint({
@@ -40,6 +53,10 @@ export function registerTwoFaEndpoints(server: IHttpServer, handlers: any): void
     method: 'POST',
     path: `/plugin/twofa/verify`,
     noAuth: false,
-    handler: async ({ adminUser, body }) => handlers.verifyTotp({ adminUser, body }),
+    handler: async ({ adminUser, body, response }) => {
+      const parsed = parseBody(verifyTotpBodySchema, body, response);
+      if ('error' in parsed) return parsed.error;
+      return handlers.verifyTotp({ adminUser, body });
+    },
   });
 }

package/endpoints/validation.ts

@@ -0,0 +1,43 @@
+import { z } from "zod";
+
+// twofa endpoints
+export const confirmLoginBodySchema = z.object({
+  code: z.string().optional(),
+  skip: z.boolean().optional(),
+  usePasskey: z.boolean().optional(),
+  passkeyOptions: z.any().optional(),
+}).strict();
+
+export const confirmLoginWithPasskeyBodySchema = z.object({
+  passkeyResponse: z.record(z.string(), z.any()),
+  rememberMe: z.boolean().optional(),
+}).strict();
+
+export const verifyTotpBodySchema = z.object({
+  code: z.string(),
+}).strict();
+
+// passkey endpoints
+export const registrationOptionsBodySchema = z.object({
+  mode: z.string().nullish(),
+  confirmationResult: z.record(z.string(), z.any()),
+}).strict();
+
+export const finishRegistrationBodySchema = z.object({
+  credential: z.any(),
+  origin: z.string(),
+}).strict();
+
+export const deletePasskeyBodySchema = z.object({
+  passkeyId: z.string(),
+}).strict();
+
+export const renamePasskeyBodySchema = z.object({
+  passkeyId: z.string(),
+  newName: z.string(),
+}).strict();
+
+export const resolveVerifyAutoBodySchema = z.object({
+  sessionsIds: z.array(z.string()).nullish(),
+  confirmationResult: z.record(z.string(), z.any()),
+}).strict();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adminforth/two-factors-auth",
-  "version": "4.2.4",
+  "version": "4.3.1",
   "description": "AdminForth plugin for two factors authentication",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -25,14 +25,15 @@
   "license": "MIT",
   "dependencies": {
     "@simplewebauthn/server": "^13.2.1",
-    "node-2fa": "^2.0.3"
+    "node-2fa": "^2.0.3",
+    "zod": "^4.3.6"
   },
   "peerDependencies": {
-    "adminforth": "^3.6.21"
+    "adminforth": "^3.7.1"
   },
   "devDependencies": {
     "@types/node": "^22.10.7",
-    "adminforth": "^3.6.21",
+    "adminforth": "^3.7.1",
     "semantic-release": "^24.2.1",
     "semantic-release-slack-bot": "^4.0.2",
     "typescript": "^5.7.3"