@adminforth/two-factors-auth 4.4.0 → 4.4.1

package/dist/endpoints/registerPasskeyEndpoints.js

@@ -23,8 +23,8 @@ export function registerPasskeyEndpoints(server, handlers) {
         path: `/plugin/passkeys/finishRegistration`,
         noAuth: false,
         request_schema: finishRegistrationBodySchema,
-        handler: (_a) => __awaiter(this, [_a], void 0, function* ({ body, adminUser, cookies }) {
-            return handlers.finishRegistration({ body, adminUser, cookies });
+        handler: (_a) => __awaiter(this, [_a], void 0, function* ({ body, adminUser, cookies, response }) {
+            return handlers.finishRegistration({ body, adminUser, cookies, response });
         }),
     });
     server.endpoint({
@@ -37,15 +37,15 @@ export function registerPasskeyEndpoints(server, handlers) {
         method: 'GET',
         path: `/plugin/passkeys/getPasskeys`,
         noAuth: false,
-        handler: (_a) => __awaiter(this, [_a], void 0, function* ({ adminUser }) { return handlers.getPasskeys({ adminUser }); }),
+        handler: (_a) => __awaiter(this, [_a], void 0, function* ({ adminUser, response }) { return handlers.getPasskeys({ adminUser, response }); }),
     });
     server.endpoint({
         method: 'DELETE',
         path: `/plugin/passkeys/deletePasskey`,
         noAuth: false,
         request_schema: deletePasskeyBodySchema,
-        handler: (_a) => __awaiter(this, [_a], void 0, function* ({ body, adminUser }) {
-            return handlers.deletePasskey({ body, adminUser });
+        handler: (_a) => __awaiter(this, [_a], void 0, function* ({ body, adminUser, response }) {
+            return handlers.deletePasskey({ body, adminUser, response });
         }),
     });
     server.endpoint({
@@ -53,15 +53,15 @@ export function registerPasskeyEndpoints(server, handlers) {
         path: `/plugin/passkeys/renamePasskey`,
         noAuth: false,
         request_schema: renamePasskeyBodySchema,
-        handler: (_a) => __awaiter(this, [_a], void 0, function* ({ body, adminUser }) {
-            return handlers.renamePasskey({ body, adminUser });
+        handler: (_a) => __awaiter(this, [_a], void 0, function* ({ body, adminUser, response }) {
+            return handlers.renamePasskey({ body, adminUser, response });
         }),
     });
     server.endpoint({
         method: 'POST',
         path: `/plugin/passkeys/checkIfUserHasPasskeys`,
         noAuth: true,
-        handler: (_a) => __awaiter(this, [_a], void 0, function* ({ cookies }) { return handlers.checkIfUserHasPasskeys({ cookies }); }),
+        handler: (_a) => __awaiter(this, [_a], void 0, function* ({ cookies, response }) { return handlers.checkIfUserHasPasskeys({ cookies, response }); }),
     });
     server.endpoint({
         method: 'POST',

package/dist/endpoints/registerTwoFaEndpoints.js

@@ -13,7 +13,7 @@ export function registerTwoFaEndpoints(server, handlers) {
         method: 'POST',
         path: `/plugin/twofa/initSetup`,
         noAuth: true,
-        handler: (_a) => __awaiter(this, [_a], void 0, function* ({ cookies }) { return handlers.initSetup({ cookies }); }),
+        handler: (_a) => __awaiter(this, [_a], void 0, function* ({ cookies, response }) { return handlers.initSetup({ cookies, response }); }),
     });
     server.endpoint({
         method: 'POST',
@@ -37,20 +37,20 @@ export function registerTwoFaEndpoints(server, handlers) {
         method: "GET",
         path: "/plugin/twofa/skip-allow",
         noAuth: true,
-        handler: (_a) => __awaiter(this, [_a], void 0, function* ({ cookies }) { return handlers.skipAllow({ cookies }); }),
+        handler: (_a) => __awaiter(this, [_a], void 0, function* ({ cookies, response }) { return handlers.skipAllow({ cookies, response }); }),
     });
     server.endpoint({
         method: "GET",
         path: "/plugin/twofa/skip-allow-modal",
-        handler: (_a) => __awaiter(this, [_a], void 0, function* ({ adminUser, headers, cookies }) { return handlers.skipAllowModal({ adminUser, headers, cookies }); }),
+        handler: (_a) => __awaiter(this, [_a], void 0, function* ({ adminUser, headers, cookies, response }) { return handlers.skipAllowModal({ adminUser, headers, cookies, response }); }),
     });
     server.endpoint({
         method: 'POST',
         path: `/plugin/twofa/verify`,
         noAuth: false,
         request_schema: verifyTotpBodySchema,
-        handler: (_a) => __awaiter(this, [_a], void 0, function* ({ adminUser, body }) {
-            return handlers.verifyTotp({ adminUser, body });
+        handler: (_a) => __awaiter(this, [_a], void 0, function* ({ adminUser, body, response }) {
+            return handlers.verifyTotp({ adminUser, body, response });
         }),
     });
 }

package/dist/handlers/createPasskeyHandlers.d.ts

@@ -6,10 +6,11 @@ export declare function createPasskeyHandlers(ctx: any): {
         cookies: any;
         headers: any;
     }) => Promise<any>;
-    finishRegistration: ({ body, adminUser, cookies }: {
+    finishRegistration: ({ body, adminUser, cookies, response }: {
         body: any;
         adminUser: any;
         cookies: any;
+        response: any;
     }) => Promise<any>;
     createLoginOptions: ({ response, headers }: {
         response: any;
@@ -18,16 +19,19 @@ export declare function createPasskeyHandlers(ctx: any): {
     getPasskeys: ({ adminUser }: {
         adminUser: any;
     }) => Promise<any>;
-    deletePasskey: ({ body, adminUser }: {
+    deletePasskey: ({ body, adminUser, response }: {
         body: any;
         adminUser: any;
+        response: any;
     }) => Promise<any>;
-    renamePasskey: ({ body, adminUser }: {
+    renamePasskey: ({ body, adminUser, response }: {
         body: any;
         adminUser: any;
+        response: any;
     }) => Promise<any>;
-    checkIfUserHasPasskeys: ({ cookies }: {
+    checkIfUserHasPasskeys: ({ cookies, response }: {
         cookies: any;
+        response: any;
     }) => Promise<any>;
     resolveVerifyAuto: ({ body, adminUser, response, cookies, headers }: {
         body: any;

package/dist/handlers/createPasskeyHandlers.js

@@ -7,7 +7,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         step((generator = generator.apply(thisArg, _arguments || [])).next());
     });
 };
-import { errorMessage } from "../utils/errors.js";
+import { HttpStatus, errorMessage, respondWithStatus } from "../utils/errors.js";
 export function createPasskeyHandlers(ctx) {
     return {
         createRegistrationOptions: (_a) => __awaiter(this, [_a], void 0, function* ({ body, adminUser, response, cookies, headers }) {
@@ -23,31 +23,54 @@ export function createPasskeyHandlers(ctx) {
                 }
             });
             if (!verificationResult || !('ok' in verificationResult)) {
-                return { ok: false, error: 'error' in verificationResult ? verificationResult.error : 'Verification failed' };
+                return respondWithStatus({ ok: false, error: 'error' in verificationResult ? verificationResult.error : 'Verification failed' }, response, HttpStatus.FORBIDDEN);
             }
-            return ctx.passkeyService.createRegistrationOptions(mode, adminUser, response);
+            const registrationOptions = yield ctx.passkeyService.createRegistrationOptions(mode, adminUser, response);
+            if (!registrationOptions.ok) {
+                return respondWithStatus(registrationOptions, response, HttpStatus.NOT_FOUND);
+            }
+            return registrationOptions;
         }),
-        finishRegistration: (_a) => __awaiter(this, [_a], void 0, function* ({ body, adminUser, cookies }) {
-            return ctx.passkeyService.finishRegistration(body, adminUser, cookies);
+        finishRegistration: (_a) => __awaiter(this, [_a], void 0, function* ({ body, adminUser, cookies, response }) {
+            const registrationResult = yield ctx.passkeyService.finishRegistration(body, adminUser, cookies);
+            if (!registrationResult.ok) {
+                return respondWithStatus(registrationResult, response, HttpStatus.FORBIDDEN);
+            }
+            return registrationResult;
         }),
         createLoginOptions: (_a) => __awaiter(this, [_a], void 0, function* ({ response, headers }) {
             if (!(yield ctx.checkPasskeyLoginRateLimit(headers))) {
-                response.setStatus(429);
-                return { error: 'Too many login attempts, please try again later' };
+                return respondWithStatus({ error: 'Too many login attempts, please try again later' }, response, HttpStatus.TOO_MANY_REQUESTS);
+            }
+            const loginOptions = yield ctx.passkeyService.createLoginOptions(response);
+            if (!loginOptions.ok) {
+                return respondWithStatus(loginOptions, response, HttpStatus.INTERNAL_SERVER_ERROR);
             }
-            return ctx.passkeyService.createLoginOptions(response);
+            return loginOptions;
         }),
         getPasskeys: (_a) => __awaiter(this, [_a], void 0, function* ({ adminUser }) {
             return ctx.passkeyService.getPasskeys(adminUser);
         }),
-        deletePasskey: (_a) => __awaiter(this, [_a], void 0, function* ({ body, adminUser }) {
-            return ctx.passkeyService.deletePasskey(body.passkeyId, adminUser);
+        deletePasskey: (_a) => __awaiter(this, [_a], void 0, function* ({ body, adminUser, response }) {
+            const deleteResult = yield ctx.passkeyService.deletePasskey(body.passkeyId, adminUser);
+            if (!deleteResult.ok) {
+                return respondWithStatus(deleteResult, response, HttpStatus.NOT_FOUND);
+            }
+            return deleteResult;
         }),
-        renamePasskey: (_a) => __awaiter(this, [_a], void 0, function* ({ body, adminUser }) {
-            return ctx.passkeyService.renamePasskey(body.passkeyId, body.newName, adminUser);
+        renamePasskey: (_a) => __awaiter(this, [_a], void 0, function* ({ body, adminUser, response }) {
+            const renameResult = yield ctx.passkeyService.renamePasskey(body.passkeyId, body.newName, adminUser);
+            if (!renameResult.ok) {
+                return respondWithStatus(renameResult, response, HttpStatus.NOT_FOUND);
+            }
+            return renameResult;
         }),
-        checkIfUserHasPasskeys: (_a) => __awaiter(this, [_a], void 0, function* ({ cookies }) {
-            return ctx.passkeyService.checkIfUserHasPasskeys(cookies);
+        checkIfUserHasPasskeys: (_a) => __awaiter(this, [_a], void 0, function* ({ cookies, response }) {
+            const checkResult = yield ctx.passkeyService.checkIfUserHasPasskeys(cookies);
+            if (checkResult.error) {
+                return respondWithStatus(checkResult, response, HttpStatus.FORBIDDEN);
+            }
+            return checkResult;
         }),
         resolveVerifyAuto: (_a) => __awaiter(this, [_a], void 0, function* ({ body, adminUser, response, cookies, headers }) {
             var _b;
@@ -63,15 +86,15 @@ export function createPasskeyHandlers(ctx) {
             };
             try {
                 if (!idsToResolve.length || !confirmationResult) {
-                    return (resolveAllIdsAsFailed('Confirmation window was closed', 'VERIFICATION_CANCELLED'));
+                    return respondWithStatus(resolveAllIdsAsFailed('Confirmation window was closed', 'VERIFICATION_CANCELLED'), response, HttpStatus.BAD_REQUEST);
                 }
                 for (const id of idsToResolve) {
                     const validationResult = yield ctx.adminforth.auth.verify(id, 'auto2FA', false);
                     if (!validationResult) {
-                        return (resolveAllIdsAsFailed('Invalid session ID or confirmation result'));
+                        return respondWithStatus(resolveAllIdsAsFailed('Invalid session ID or confirmation result'), response, HttpStatus.FORBIDDEN);
                     }
                     if (validationResult.adminUserPk !== adminUser.pk) {
-                        return (resolveAllIdsAsFailed('Session does not belong to the authenticated user'));
+                        return respondWithStatus(resolveAllIdsAsFailed('Session does not belong to the authenticated user'), response, HttpStatus.FORBIDDEN);
                     }
                 }
                 const verificationResult = yield ctx.verifyMfaConfirmation(confirmationResult, {
@@ -84,7 +107,7 @@ export function createPasskeyHandlers(ctx) {
                     }
                 });
                 if (!verificationResult || !('ok' in verificationResult)) {
-                    return (resolveAllIdsAsFailed((_b = verificationResult === null || verificationResult === void 0 ? void 0 : verificationResult.error) !== null && _b !== void 0 ? _b : 'Verification failed'));
+                    return respondWithStatus(resolveAllIdsAsFailed((_b = verificationResult === null || verificationResult === void 0 ? void 0 : verificationResult.error) !== null && _b !== void 0 ? _b : 'Verification failed'), response, HttpStatus.FORBIDDEN);
                 }
                 if ('ok' in verificationResult && verificationResult.ok) {
                     for (const id of idsToResolve) {
@@ -92,11 +115,11 @@ export function createPasskeyHandlers(ctx) {
                     }
                     return { ok: true };
                 }
-                return (resolveAllIdsAsFailed('Verification failed'));
+                return respondWithStatus(resolveAllIdsAsFailed('Verification failed'), response, HttpStatus.FORBIDDEN);
             }
             catch (error) {
                 console.error('[AdminForth 2FA] Error resolving automatic 2FA verification', error);
-                return (resolveAllIdsAsFailed(errorMessage(error)));
+                return respondWithStatus(resolveAllIdsAsFailed(errorMessage(error)), response, HttpStatus.INTERNAL_SERVER_ERROR);
             }
         }),
     };

package/dist/handlers/createTwoFaHandlers.d.ts

@@ -11,13 +11,10 @@ export declare function createTwoFaHandlers(ctx: any): {
         cookies: any;
         headers: any;
     }) => Promise<{
+        error: any;
+    } | {
         status: string;
         allowedLogin: boolean;
-        error?: undefined;
-    } | {
-        error: any;
-        status?: undefined;
-        allowedLogin?: undefined;
     }>;
     confirmLoginWithPasskey: ({ body, response, cookies, headers, requestUrl, query }: {
         body: any;
@@ -27,21 +24,17 @@ export declare function createTwoFaHandlers(ctx: any): {
         requestUrl: any;
         query: any;
     }) => Promise<{
-        allowedLogin: boolean;
-        error: string;
-    } | {
         error: any;
     }>;
-    skipAllow: ({ cookies }: {
+    skipAllow: ({ cookies, response }: {
         cookies: any;
+        response: any;
     }) => Promise<{
         status: string;
         message: string;
-        skipAllowed?: undefined;
     } | {
         status: string;
         skipAllowed: any;
-        message?: undefined;
     }>;
     skipAllowModal: ({ adminUser, headers, cookies }: {
         adminUser: any;
@@ -50,8 +43,9 @@ export declare function createTwoFaHandlers(ctx: any): {
     }) => Promise<{
         skipAllowed: boolean;
     }>;
-    verifyTotp: ({ adminUser, body }: {
+    verifyTotp: ({ adminUser, body, response }: {
         adminUser: any;
         body: any;
+        response: any;
     }) => Promise<any>;
 };

package/dist/handlers/createTwoFaHandlers.js

@@ -7,6 +7,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         step((generator = generator.apply(thisArg, _arguments || [])).next());
     });
 };
+import { HttpStatus, respondWithStatus } from "../utils/errors.js";
 export function createTwoFaHandlers(ctx) {
     return {
         initSetup: (_a) => __awaiter(this, [_a], void 0, function* ({ cookies }) {
@@ -20,16 +21,15 @@ export function createTwoFaHandlers(ctx) {
         confirmLogin: (_a) => __awaiter(this, [_a], void 0, function* ({ body, response, cookies, headers }) {
             var _b, _c;
             if (!(yield ctx.checkPasskeyLoginRateLimit(headers))) {
-                response.setStatus(429);
-                return { error: 'Too many login attempts, please try again later' };
+                return respondWithStatus({ error: 'Too many login attempts, please try again later' }, response, HttpStatus.TOO_MANY_REQUESTS);
             }
             const totpTemporaryJWT = ctx.cookieService.getTotpTemporary(cookies);
             if (!totpTemporaryJWT) {
-                return { error: 'Login session expired. Please log in again.' };
+                return respondWithStatus({ error: 'Login session expired. Please log in again.' }, response, HttpStatus.FORBIDDEN);
             }
             const decoded = yield ctx.cookieService.verifyTotpTemporary(cookies);
             if (!decoded) {
-                return { error: 'Login session expired. Please log in again.' };
+                return respondWithStatus({ error: 'Login session expired. Please log in again.' }, response, HttpStatus.FORBIDDEN);
             }
             if (decoded.newSecret) {
                 const verified = body.skip && decoded.userCanSkipSetup ? true : ctx.totpService.verifySecret(decoded.newSecret, body.code);
@@ -42,7 +42,7 @@ export function createTwoFaHandlers(ctx) {
                     return { status: 'ok', allowedLogin: true };
                 }
                 else {
-                    return { error: 'Wrong or expired OTP code' };
+                    return respondWithStatus({ error: 'Wrong or expired OTP code' }, response, HttpStatus.FORBIDDEN);
                 }
             }
             let verified = false;
@@ -50,7 +50,7 @@ export function createTwoFaHandlers(ctx) {
             if (body.usePasskey && ctx.options.passkeys) {
                 const cookiesValidationResult = yield ctx.passkeyService.validateLoginChallengeCookie(cookies);
                 if (!cookiesValidationResult.ok) {
-                    return { error: cookiesValidationResult.error };
+                    return respondWithStatus({ error: cookiesValidationResult.error }, response, HttpStatus.FORBIDDEN);
                 }
                 const res = yield ctx.passkeyService.verifyPasskeyResponse(body.passkeyOptions, decoded.pk, cookiesValidationResult.decodedPasskeysCookies);
                 if (res.ok && res.passkeyConfirmed) {
@@ -73,25 +73,24 @@ export function createTwoFaHandlers(ctx) {
                 return { status: 'ok', allowedLogin: true };
             }
             else {
-                return { error: verificationError };
+                return respondWithStatus({ error: verificationError }, response, HttpStatus.FORBIDDEN);
             }
         }),
         confirmLoginWithPasskey: (_a) => __awaiter(this, [_a], void 0, function* ({ body, response, cookies, headers, requestUrl, query }) {
             var _b;
             if (!(yield ctx.checkPasskeyLoginRateLimit(headers))) {
-                response.setStatus(429);
-                return { error: 'Too many login attempts, please try again later' };
+                return respondWithStatus({ error: 'Too many login attempts, please try again later' }, response, HttpStatus.TOO_MANY_REQUESTS);
             }
             if (!ctx.options.passkeys || ctx.options.passkeys.allowLoginWithPasskeys === false) {
-                return { error: 'Login with passkeys is not allowed' };
+                return respondWithStatus({ error: 'Login with passkeys is not allowed' }, response, HttpStatus.FORBIDDEN);
             }
             const passkeyResponse = body.passkeyResponse;
             if (!passkeyResponse) {
-                return { error: 'Passkey response is required' };
+                return respondWithStatus({ error: 'Passkey response is required' }, response, HttpStatus.BAD_REQUEST);
             }
             const passkeyLoginResult = yield ctx.passkeyService.getLoginUserByPasskeyResponse(passkeyResponse, cookies);
             if (!passkeyLoginResult.ok) {
-                return { error: passkeyLoginResult.error };
+                return respondWithStatus({ error: passkeyLoginResult.error }, response, HttpStatus.FORBIDDEN);
             }
             const user = passkeyLoginResult.user;
             const username = user[ctx.adminforth.config.auth.usernameField];
@@ -130,10 +129,10 @@ export function createTwoFaHandlers(ctx) {
             }
             return toReturn;
         }),
-        skipAllow: (_a) => __awaiter(this, [_a], void 0, function* ({ cookies }) {
+        skipAllow: (_a) => __awaiter(this, [_a], void 0, function* ({ cookies, response }) {
             const decoded = yield ctx.cookieService.verifyTotpTemporary(cookies);
             if (!decoded) {
-                return { status: "error", message: "Invalid token" };
+                return respondWithStatus({ status: "error", message: "Invalid token" }, response, HttpStatus.FORBIDDEN);
             }
             if (!decoded.newSecret) {
                 return { status: "ok", skipAllowed: false };
@@ -166,10 +165,14 @@ export function createTwoFaHandlers(ctx) {
             }
             return { skipAllowed: false };
         }),
-        verifyTotp: (_a) => __awaiter(this, [_a], void 0, function* ({ adminUser, body }) {
+        verifyTotp: (_a) => __awaiter(this, [_a], void 0, function* ({ adminUser, body, response }) {
             if (!(body === null || body === void 0 ? void 0 : body.code))
-                return { error: 'Code is required' };
-            return ctx.totpService.verifyAdminUserCode(adminUser, body.code);
+                return respondWithStatus({ error: 'Code is required' }, response, HttpStatus.BAD_REQUEST);
+            const verificationResult = yield ctx.totpService.verifyAdminUserCode(adminUser, body.code);
+            if (!verificationResult.ok) {
+                return respondWithStatus(verificationResult, response, HttpStatus.FORBIDDEN);
+            }
+            return verificationResult;
         }),
     };
 }

package/dist/services/passkeyService.d.ts

@@ -40,8 +40,8 @@ export declare class PasskeyService {
         data: import("@simplewebauthn/server").PublicKeyCredentialCreationOptionsJSON;
     }>;
     finishRegistration(body: PasskeyRegistrationPayload, adminUser: AdminUser, cookies: CookieList): Promise<{
+        ok: boolean;
         error: string;
-        ok?: undefined;
     } | {
         ok: boolean;
         error?: undefined;

package/dist/services/passkeyService.js

@@ -161,18 +161,18 @@ export class PasskeyService {
             var _a, _b, _c, _d, _e, _f;
             const passkeysCookies = this.cookieService.getRegisterPasskeyTemporary(cookies);
             if (!passkeysCookies) {
-                return { error: 'Passkey token is required' };
+                return { ok: false, error: 'Passkey token is required' };
             }
             const decodedPasskeysCookies = yield this.cookieService.verifyRegisterPasskeyTemporary(cookies);
             if (!decodedPasskeysCookies) {
-                return { error: 'Invalid passkey token' };
+                return { ok: false, error: 'Invalid passkey token' };
             }
             if (decodedPasskeysCookies.user_id !== adminUser.pk) {
-                return { error: 'Invalid user' };
+                return { ok: false, error: 'Invalid user' };
             }
             const secret = this.userRepository.getSecret(adminUser.dbUser);
             if (!secret || secret.length === 0) {
-                return { error: 'TOTP must be set up before registering a passkey' };
+                return { ok: false, error: 'TOTP must be set up before registering a passkey' };
             }
             const settingsOrigin = (_a = this.options.passkeys) === null || _a === void 0 ? void 0 : _a.settings.expectedOrigin;
             const expectedOrigin = body.origin;
@@ -220,7 +220,7 @@ export class PasskeyService {
             }
             catch (error) {
                 console.error(error);
-                return { error: 'Error registering passkey: ' + errorMessage(error) };
+                return { ok: false, error: 'Error registering passkey: ' + errorMessage(error) };
             }
             return { ok: true };
         });

package/dist/utils/errors.d.ts

@@ -1,4 +1,13 @@
+import type { IAdminForthHttpResponse } from "adminforth";
 import type { ErrorResponse } from "./types.js";
+export declare enum HttpStatus {
+    BAD_REQUEST = 400,
+    FORBIDDEN = 403,
+    NOT_FOUND = 404,
+    TOO_MANY_REQUESTS = 429,
+    INTERNAL_SERVER_ERROR = 500
+}
+export declare function respondWithStatus<T>(body: T, response: IAdminForthHttpResponse, status: HttpStatus): T;
 export declare function errorMessage(error: unknown): string;
 export declare function errorResult(message: string): ErrorResponse;
 export declare function prefixedErrorResult(prefix: string, error: unknown): ErrorResponse;

package/dist/utils/errors.js

@@ -1,3 +1,15 @@
+export var HttpStatus;
+(function (HttpStatus) {
+    HttpStatus[HttpStatus["BAD_REQUEST"] = 400] = "BAD_REQUEST";
+    HttpStatus[HttpStatus["FORBIDDEN"] = 403] = "FORBIDDEN";
+    HttpStatus[HttpStatus["NOT_FOUND"] = 404] = "NOT_FOUND";
+    HttpStatus[HttpStatus["TOO_MANY_REQUESTS"] = 429] = "TOO_MANY_REQUESTS";
+    HttpStatus[HttpStatus["INTERNAL_SERVER_ERROR"] = 500] = "INTERNAL_SERVER_ERROR";
+})(HttpStatus || (HttpStatus = {}));
+export function respondWithStatus(body, response, status) {
+    response.setStatus(status);
+    return body;
+}
 export function errorMessage(error) {
     return error instanceof Error ? error.message : String(error);
 }

package/endpoints/registerPasskeyEndpoints.ts

@@ -23,8 +23,8 @@ export function registerPasskeyEndpoints(server: IHttpServer, handlers: any): vo
     path: `/plugin/passkeys/finishRegistration`,
     noAuth: false,
     request_schema: finishRegistrationBodySchema,
-    handler: async ({ body, adminUser, cookies }) => {
-      return handlers.finishRegistration({ body, adminUser, cookies });
+    handler: async ({ body, adminUser, cookies, response }) => {
+      return handlers.finishRegistration({ body, adminUser, cookies, response });
     },
   });
 
@@ -39,7 +39,7 @@ export function registerPasskeyEndpoints(server: IHttpServer, handlers: any): vo
     method: 'GET',
     path: `/plugin/passkeys/getPasskeys`,
     noAuth: false,
-    handler: async ({ adminUser }) => handlers.getPasskeys({ adminUser }),
+    handler: async ({ adminUser, response }) => handlers.getPasskeys({ adminUser, response }),
   });
 
   server.endpoint({
@@ -47,8 +47,8 @@ export function registerPasskeyEndpoints(server: IHttpServer, handlers: any): vo
     path: `/plugin/passkeys/deletePasskey`,
     noAuth: false,
     request_schema: deletePasskeyBodySchema,
-    handler: async ({ body, adminUser }) => {
-      return handlers.deletePasskey({ body, adminUser });
+    handler: async ({ body, adminUser, response }) => {
+      return handlers.deletePasskey({ body, adminUser, response });
     },
   });
 
@@ -57,8 +57,8 @@ export function registerPasskeyEndpoints(server: IHttpServer, handlers: any): vo
     path: `/plugin/passkeys/renamePasskey`,
     noAuth: false,
     request_schema: renamePasskeyBodySchema,
-    handler: async ({ body, adminUser }) => {
-      return handlers.renamePasskey({ body, adminUser });
+    handler: async ({ body, adminUser, response }) => {
+      return handlers.renamePasskey({ body, adminUser, response });
     },
   });
 
@@ -66,7 +66,7 @@ export function registerPasskeyEndpoints(server: IHttpServer, handlers: any): vo
     method: 'POST',
     path: `/plugin/passkeys/checkIfUserHasPasskeys`,
     noAuth: true,
-    handler: async ({ cookies }) => handlers.checkIfUserHasPasskeys({ cookies }),
+    handler: async ({ cookies, response }) => handlers.checkIfUserHasPasskeys({ cookies, response }),
   });
 
   server.endpoint({

package/endpoints/registerTwoFaEndpoints.ts

@@ -10,7 +10,7 @@ export function registerTwoFaEndpoints(server: IHttpServer, handlers: any): void
     method: 'POST',
     path: `/plugin/twofa/initSetup`,
     noAuth: true,
-    handler: async ({ cookies }) => handlers.initSetup({ cookies }),
+    handler: async ({ cookies, response }) => handlers.initSetup({ cookies, response }),
   });
 
   server.endpoint({
@@ -37,13 +37,13 @@ export function registerTwoFaEndpoints(server: IHttpServer, handlers: any): void
     method: "GET",
     path: "/plugin/twofa/skip-allow",
     noAuth: true,
-    handler: async ({ cookies }) => handlers.skipAllow({ cookies }),
+    handler: async ({ cookies, response }) => handlers.skipAllow({ cookies, response }),
   });
 
   server.endpoint({
     method: "GET",
     path: "/plugin/twofa/skip-allow-modal",
-    handler: async ({ adminUser, headers, cookies }) => handlers.skipAllowModal({ adminUser, headers, cookies }),
+    handler: async ({ adminUser, headers, cookies, response }) => handlers.skipAllowModal({ adminUser, headers, cookies, response }),
   });
 
   server.endpoint({
@@ -51,8 +51,8 @@ export function registerTwoFaEndpoints(server: IHttpServer, handlers: any): void
     path: `/plugin/twofa/verify`,
     noAuth: false,
     request_schema: verifyTotpBodySchema,
-    handler: async ({ adminUser, body }) => {
-      return handlers.verifyTotp({ adminUser, body });
+    handler: async ({ adminUser, body, response }) => {
+      return handlers.verifyTotp({ adminUser, body, response });
     },
   });
 }

package/handlers/createPasskeyHandlers.ts

@@ -1,5 +1,5 @@
 import type { HttpExtra } from "adminforth";
-import { errorMessage } from "../utils/errors.js";
+import { HttpStatus, errorMessage, respondWithStatus } from "../utils/errors.js";
 
 export function createPasskeyHandlers(ctx: any) {
   return {
@@ -17,38 +17,65 @@ export function createPasskeyHandlers(ctx: any) {
         } as HttpExtra
       });
       if (!verificationResult || !('ok' in verificationResult)) {
-        return { ok: false, error: 'error' in verificationResult ? verificationResult.error : 'Verification failed' };
+        return respondWithStatus(
+          { ok: false, error: 'error' in verificationResult ? verificationResult.error : 'Verification failed' },
+          response,
+          HttpStatus.FORBIDDEN,
+        );
       }
 
-      return ctx.passkeyService.createRegistrationOptions(mode, adminUser, response);
+      const registrationOptions = await ctx.passkeyService.createRegistrationOptions(mode, adminUser, response);
+      if (!registrationOptions.ok) {
+        return respondWithStatus(registrationOptions, response, HttpStatus.NOT_FOUND);
+      }
+      return registrationOptions;
     },
 
-    finishRegistration: async ({ body, adminUser, cookies }) => {
-      return ctx.passkeyService.finishRegistration(body, adminUser, cookies);
+    finishRegistration: async ({ body, adminUser, cookies, response }) => {
+      const registrationResult = await ctx.passkeyService.finishRegistration(body, adminUser, cookies);
+      if (!registrationResult.ok) {
+        return respondWithStatus(registrationResult, response, HttpStatus.FORBIDDEN);
+      }
+      return registrationResult;
     },
 
     createLoginOptions: async ({ response, headers }) => {
       if (!(await ctx.checkPasskeyLoginRateLimit(headers))) {
-        response.setStatus(429);
-        return { error: 'Too many login attempts, please try again later' };
+        return respondWithStatus({ error: 'Too many login attempts, please try again later' }, response, HttpStatus.TOO_MANY_REQUESTS);
+      }
+      const loginOptions = await ctx.passkeyService.createLoginOptions(response);
+      if (!loginOptions.ok) {
+        return respondWithStatus(loginOptions, response, HttpStatus.INTERNAL_SERVER_ERROR);
       }
-      return ctx.passkeyService.createLoginOptions(response);
+      return loginOptions;
     },
 
     getPasskeys: async ({ adminUser }) => {
       return ctx.passkeyService.getPasskeys(adminUser);
     },
 
-    deletePasskey: async ({ body, adminUser }) => {
-      return ctx.passkeyService.deletePasskey(body.passkeyId, adminUser);
+    deletePasskey: async ({ body, adminUser, response }) => {
+      const deleteResult = await ctx.passkeyService.deletePasskey(body.passkeyId, adminUser);
+      if (!deleteResult.ok) {
+        return respondWithStatus(deleteResult, response, HttpStatus.NOT_FOUND);
+      }
+      return deleteResult;
     },
 
-    renamePasskey: async ({ body, adminUser }) => {
-      return ctx.passkeyService.renamePasskey(body.passkeyId, body.newName, adminUser);
+    renamePasskey: async ({ body, adminUser, response }) => {
+      const renameResult = await ctx.passkeyService.renamePasskey(body.passkeyId, body.newName, adminUser);
+      if (!renameResult.ok) {
+        return respondWithStatus(renameResult, response, HttpStatus.NOT_FOUND);
+      }
+      return renameResult;
     },
 
-    checkIfUserHasPasskeys: async ({ cookies }) => {
-      return ctx.passkeyService.checkIfUserHasPasskeys(cookies);
+    checkIfUserHasPasskeys: async ({ cookies, response }) => {
+      const checkResult = await ctx.passkeyService.checkIfUserHasPasskeys(cookies);
+      if (checkResult.error) {
+        return respondWithStatus(checkResult, response, HttpStatus.FORBIDDEN);
+      }
+      return checkResult;
     },
 
     resolveVerifyAuto: async ({ body, adminUser, response, cookies, headers }) => {
@@ -66,16 +93,20 @@ export function createPasskeyHandlers(ctx: any) {
 
       try {
         if (!idsToResolve.length || !confirmationResult) {
-          return(resolveAllIdsAsFailed('Confirmation window was closed', 'VERIFICATION_CANCELLED'));
+          return respondWithStatus(
+            resolveAllIdsAsFailed('Confirmation window was closed', 'VERIFICATION_CANCELLED'),
+            response,
+            HttpStatus.BAD_REQUEST,
+          );
         }
 
         for (const id of idsToResolve) {
           const validationResult = await ctx.adminforth.auth.verify(id, 'auto2FA', false);
           if (!validationResult) {
-            return(resolveAllIdsAsFailed('Invalid session ID or confirmation result'));
+            return respondWithStatus(resolveAllIdsAsFailed('Invalid session ID or confirmation result'), response, HttpStatus.FORBIDDEN);
           }
           if (validationResult.adminUserPk !== adminUser.pk) {
-            return(resolveAllIdsAsFailed('Session does not belong to the authenticated user'));
+            return respondWithStatus(resolveAllIdsAsFailed('Session does not belong to the authenticated user'), response, HttpStatus.FORBIDDEN);
           }
         }
 
@@ -89,7 +120,7 @@ export function createPasskeyHandlers(ctx: any) {
           } as HttpExtra
         });
         if ( !verificationResult || !('ok' in verificationResult) ) {
-          return(resolveAllIdsAsFailed(verificationResult?.error ?? 'Verification failed'));
+          return respondWithStatus(resolveAllIdsAsFailed(verificationResult?.error ?? 'Verification failed'), response, HttpStatus.FORBIDDEN);
         }
         if ('ok' in verificationResult && verificationResult.ok){
           for (const id of idsToResolve) {
@@ -97,10 +128,10 @@ export function createPasskeyHandlers(ctx: any) {
           }
           return { ok: true };
         }
-        return(resolveAllIdsAsFailed('Verification failed'));
+        return respondWithStatus(resolveAllIdsAsFailed('Verification failed'), response, HttpStatus.FORBIDDEN);
       } catch (error) {
         console.error('[AdminForth 2FA] Error resolving automatic 2FA verification', error);
-        return(resolveAllIdsAsFailed(errorMessage(error)));
+        return respondWithStatus(resolveAllIdsAsFailed(errorMessage(error)), response, HttpStatus.INTERNAL_SERVER_ERROR);
       }
     },
   };

package/handlers/createTwoFaHandlers.ts

@@ -1,3 +1,5 @@
+import { HttpStatus, respondWithStatus } from "../utils/errors.js";
+
 export function createTwoFaHandlers(ctx: any) {
   return {
     initSetup: async ({ cookies }) => {
@@ -11,17 +13,16 @@ export function createTwoFaHandlers(ctx: any) {
 
     confirmLogin: async ({ body, response, cookies, headers }) => {
       if (!(await ctx.checkPasskeyLoginRateLimit(headers))) {
-        response.setStatus(429);
-        return { error: 'Too many login attempts, please try again later' };
+        return respondWithStatus({ error: 'Too many login attempts, please try again later' }, response, HttpStatus.TOO_MANY_REQUESTS);
       }
 
       const totpTemporaryJWT = ctx.cookieService.getTotpTemporary(cookies);
       if (!totpTemporaryJWT) {
-        return { error: 'Login session expired. Please log in again.' }
+        return respondWithStatus({ error: 'Login session expired. Please log in again.' }, response, HttpStatus.FORBIDDEN)
       }
       const decoded = await ctx.cookieService.verifyTotpTemporary(cookies);
       if (!decoded) {
-        return { error: 'Login session expired. Please log in again.' }
+        return respondWithStatus({ error: 'Login session expired. Please log in again.' }, response, HttpStatus.FORBIDDEN)
       }
 
       if (decoded.newSecret) {
@@ -34,7 +35,7 @@ export function createTwoFaHandlers(ctx: any) {
           ctx.cookieService.setAuthCookie({expireInDuration: decoded.sessionDuration, response, username:decoded.userName, pk:decoded.pk})
           return { status: 'ok', allowedLogin: true }
         } else {
-          return {error: 'Wrong or expired OTP code'}
+          return respondWithStatus({ error: 'Wrong or expired OTP code' }, response, HttpStatus.FORBIDDEN)
         }
       }
 
@@ -43,7 +44,7 @@ export function createTwoFaHandlers(ctx: any) {
       if (body.usePasskey && ctx.options.passkeys) {
         const cookiesValidationResult = await ctx.passkeyService.validateLoginChallengeCookie(cookies);
         if (!cookiesValidationResult.ok) {
-          return { error: cookiesValidationResult.error };
+          return respondWithStatus({ error: cookiesValidationResult.error }, response, HttpStatus.FORBIDDEN);
         }
         const res = await ctx.passkeyService.verifyPasskeyResponse(body.passkeyOptions, decoded.pk, cookiesValidationResult.decodedPasskeysCookies);
         if (res.ok && res.passkeyConfirmed) {
@@ -63,28 +64,27 @@ export function createTwoFaHandlers(ctx: any) {
         ctx.cookieService.setAuthCookie({expireInDuration: decoded.sessionDuration, response, username:decoded.userName, pk:decoded.pk})
         return { status: 'ok', allowedLogin: true }
       } else {
-        return {error: verificationError}
+        return respondWithStatus({ error: verificationError }, response, HttpStatus.FORBIDDEN)
       }
     },
 
     confirmLoginWithPasskey: async ({ body, response, cookies, headers, requestUrl, query }) => {
       if (!(await ctx.checkPasskeyLoginRateLimit(headers))) {
-        response.setStatus(429);
-        return { error: 'Too many login attempts, please try again later' };
+        return respondWithStatus({ error: 'Too many login attempts, please try again later' }, response, HttpStatus.TOO_MANY_REQUESTS);
       }
 
       if (!ctx.options.passkeys || ctx.options.passkeys.allowLoginWithPasskeys === false) {
-        return { error: 'Login with passkeys is not allowed' };
+        return respondWithStatus({ error: 'Login with passkeys is not allowed' }, response, HttpStatus.FORBIDDEN);
       }
 
       const passkeyResponse = body.passkeyResponse;
       if (!passkeyResponse) {
-        return { error: 'Passkey response is required' };
+        return respondWithStatus({ error: 'Passkey response is required' }, response, HttpStatus.BAD_REQUEST);
       }
 
       const passkeyLoginResult = await ctx.passkeyService.getLoginUserByPasskeyResponse(passkeyResponse, cookies);
       if (!passkeyLoginResult.ok) {
-        return { error: passkeyLoginResult.error };
+        return respondWithStatus({ error: passkeyLoginResult.error }, response, HttpStatus.FORBIDDEN);
       }
       const user = passkeyLoginResult.user;
       const username = user[ctx.adminforth.config.auth.usernameField];
@@ -134,10 +134,10 @@ export function createTwoFaHandlers(ctx: any) {
       return toReturn;
     },
 
-    skipAllow: async ({ cookies }) => {
+    skipAllow: async ({ cookies, response }) => {
       const decoded = await ctx.cookieService.verifyTotpTemporary(cookies);
       if (!decoded) {
-        return { status: "error", message: "Invalid token" };
+        return respondWithStatus({ status: "error", message: "Invalid token" }, response, HttpStatus.FORBIDDEN);
       }
       if (!decoded.newSecret) {
         return { status: "ok", skipAllowed: false };
@@ -173,10 +173,14 @@ export function createTwoFaHandlers(ctx: any) {
       return { skipAllowed: false };
     },
 
-    verifyTotp: async ({ adminUser, body }) => {
-      if (!body?.code) return { error: 'Code is required' };
+    verifyTotp: async ({ adminUser, body, response }) => {
+      if (!body?.code) return respondWithStatus({ error: 'Code is required' }, response, HttpStatus.BAD_REQUEST);
 
-      return ctx.totpService.verifyAdminUserCode(adminUser, body.code);
+      const verificationResult = await ctx.totpService.verifyAdminUserCode(adminUser, body.code);
+      if (!verificationResult.ok) {
+        return respondWithStatus(verificationResult, response, HttpStatus.FORBIDDEN);
+      }
+      return verificationResult;
     },
   };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adminforth/two-factors-auth",
-  "version": "4.4.0",
+  "version": "4.4.1",
   "description": "AdminForth plugin for two factors authentication",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/services/passkeyService.ts

@@ -170,18 +170,18 @@ export class PasskeyService {
   public async finishRegistration(body: PasskeyRegistrationPayload, adminUser: AdminUser, cookies: CookieList) {
     const passkeysCookies = this.cookieService.getRegisterPasskeyTemporary(cookies);
     if (!passkeysCookies) {
-      return { error: 'Passkey token is required' };
+      return { ok: false, error: 'Passkey token is required' };
     }
     const decodedPasskeysCookies = await this.cookieService.verifyRegisterPasskeyTemporary(cookies);
     if (!decodedPasskeysCookies) {
-      return { error: 'Invalid passkey token' };
+      return { ok: false, error: 'Invalid passkey token' };
     }
     if (decodedPasskeysCookies.user_id !== adminUser.pk) {
-      return { error: 'Invalid user' };
+      return { ok: false, error: 'Invalid user' };
     }
     const secret = this.userRepository.getSecret(adminUser.dbUser)
     if (!secret || secret.length === 0) {
-      return { error: 'TOTP must be set up before registering a passkey' };
+      return { ok: false, error: 'TOTP must be set up before registering a passkey' };
     }
     const settingsOrigin = this.options.passkeys?.settings.expectedOrigin;
     const expectedOrigin = body.origin;
@@ -235,7 +235,7 @@ export class PasskeyService {
       }, adminUser);
     } catch (error) {
       console.error(error);
-      return { error: 'Error registering passkey: ' + errorMessage(error) };
+      return { ok: false, error: 'Error registering passkey: ' + errorMessage(error) };
     }
     return { ok: true };
   }

package/utils/errors.ts

@@ -1,5 +1,19 @@
+import type { IAdminForthHttpResponse } from "adminforth";
 import type { ErrorResponse } from "./types.js";
 
+export enum HttpStatus {
+  BAD_REQUEST = 400,
+  FORBIDDEN = 403,
+  NOT_FOUND = 404,
+  TOO_MANY_REQUESTS = 429,
+  INTERNAL_SERVER_ERROR = 500,
+}
+
+export function respondWithStatus<T>(body: T, response: IAdminForthHttpResponse, status: HttpStatus): T {
+  response.setStatus(status);
+  return body;
+}
+
 export function errorMessage(error: unknown): string {
   return error instanceof Error ? error.message : String(error);
 }