@better-forge/auth 0.1.0 → 0.1.1

package/src/totp.ts

@@ -1,96 +1,96 @@
-import { createHash, createHmac, randomBytes, timingSafeEqual } from 'node:crypto'
-
-const ALPHABET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567'
-const PERIOD_SECONDS = 30
-const DIGITS = 6
-
-function encodeBase32(input: Buffer): string {
-  let bits = 0
-  let value = 0
-  let output = ''
-  for (const byte of input) {
-    value = (value << 8) | byte
-    bits += 8
-    while (bits >= 5) {
-      output += ALPHABET[(value >>> (bits - 5)) & 31]
-      bits -= 5
-    }
-  }
-  if (bits > 0) output += ALPHABET[(value << (5 - bits)) & 31]
-  return output
-}
-
-function decodeBase32(input: string): Buffer {
-  let bits = 0
-  let value = 0
-  const bytes: number[] = []
-  for (const character of input.toUpperCase().replace(/=|\s|-/g, '')) {
-    const index = ALPHABET.indexOf(character)
-    if (index < 0) throw new Error('Invalid base32 secret')
-    value = (value << 5) | index
-    bits += 5
-    if (bits >= 8) {
-      bytes.push((value >>> (bits - 8)) & 255)
-      bits -= 8
-    }
-  }
-  return Buffer.from(bytes)
-}
-
-function codeAt(secret: string, counter: number): string {
-  const buffer = Buffer.alloc(8)
-  buffer.writeBigUInt64BE(BigInt(counter))
-  const digest = createHmac('sha1', decodeBase32(secret)).update(buffer).digest()
-  const offset = digest[digest.length - 1]! & 0x0f
-  const binary = ((digest[offset]! & 0x7f) << 24)
-    | ((digest[offset + 1]! & 0xff) << 16)
-    | ((digest[offset + 2]! & 0xff) << 8)
-    | (digest[offset + 3]! & 0xff)
-  return String(binary % (10 ** DIGITS)).padStart(DIGITS, '0')
-}
-
-function safeEqual(left: string, right: string): boolean {
-  const a = Buffer.from(left)
-  const b = Buffer.from(right)
-  return a.length === b.length && timingSafeEqual(a, b)
-}
-
-export function generateTotpSecret(): string {
-  return encodeBase32(randomBytes(20))
-}
-
-export function verifyTotp(secret: string, input: string, now = Date.now()): boolean {
-  const normalized = input.replace(/\s/g, '')
-  const counter = Math.floor(now / 1000 / PERIOD_SECONDS)
-  return [-1, 0, 1].some((offset) => safeEqual(codeAt(secret, counter + offset), normalized))
-}
-
-export function generateTotpCode(secret: string, now = Date.now()): string {
-  return codeAt(secret, Math.floor(now / 1000 / PERIOD_SECONDS))
-}
-
-/** The `otpauth://` URI an authenticator app scans; `issuer` is the name it shows next to the account. */
-export function totpUri(secret: string, email: string, issuer: string): string {
-  const label = `${issuer}:${email}`
-  return `otpauth://totp/${encodeURIComponent(label)}?secret=${secret}&issuer=${encodeURIComponent(issuer)}&algorithm=SHA1&digits=${DIGITS}&period=${PERIOD_SECONDS}`
-}
-
-export function generateRecoveryCodes(): string[] {
-  return Array.from({ length: 8 }, () => {
-    const value = randomBytes(10).toString('hex').toUpperCase()
-    return value.match(/.{1,5}/g)!.join('-')
-  })
-}
-
-export function hashRecoveryCode(code: string): string {
-  return createHash('sha256').update(code.replace(/\s|-/g, '').toUpperCase()).digest('hex')
-}
-
-export function consumeRecoveryCode(storedJson: string | null, input: string): { valid: boolean; remaining: string[] } {
-  let stored: string[]
-  try { stored = JSON.parse(storedJson ?? '[]') as string[] } catch { return { valid: false, remaining: [] } }
-  const candidate = hashRecoveryCode(input)
-  const index = stored.findIndex((hash) => safeEqual(hash, candidate))
-  if (index < 0) return { valid: false, remaining: stored }
-  return { valid: true, remaining: stored.filter((_, itemIndex) => itemIndex !== index) }
-}
+import { createHash, createHmac, randomBytes, timingSafeEqual } from 'node:crypto'
+
+const ALPHABET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567'
+const PERIOD_SECONDS = 30
+const DIGITS = 6
+
+function encodeBase32(input: Buffer): string {
+  let bits = 0
+  let value = 0
+  let output = ''
+  for (const byte of input) {
+    value = (value << 8) | byte
+    bits += 8
+    while (bits >= 5) {
+      output += ALPHABET[(value >>> (bits - 5)) & 31]
+      bits -= 5
+    }
+  }
+  if (bits > 0) output += ALPHABET[(value << (5 - bits)) & 31]
+  return output
+}
+
+function decodeBase32(input: string): Buffer {
+  let bits = 0
+  let value = 0
+  const bytes: number[] = []
+  for (const character of input.toUpperCase().replace(/=|\s|-/g, '')) {
+    const index = ALPHABET.indexOf(character)
+    if (index < 0) throw new Error('Invalid base32 secret')
+    value = (value << 5) | index
+    bits += 5
+    if (bits >= 8) {
+      bytes.push((value >>> (bits - 8)) & 255)
+      bits -= 8
+    }
+  }
+  return Buffer.from(bytes)
+}
+
+function codeAt(secret: string, counter: number): string {
+  const buffer = Buffer.alloc(8)
+  buffer.writeBigUInt64BE(BigInt(counter))
+  const digest = createHmac('sha1', decodeBase32(secret)).update(buffer).digest()
+  const offset = digest[digest.length - 1]! & 0x0f
+  const binary = ((digest[offset]! & 0x7f) << 24)
+    | ((digest[offset + 1]! & 0xff) << 16)
+    | ((digest[offset + 2]! & 0xff) << 8)
+    | (digest[offset + 3]! & 0xff)
+  return String(binary % (10 ** DIGITS)).padStart(DIGITS, '0')
+}
+
+function safeEqual(left: string, right: string): boolean {
+  const a = Buffer.from(left)
+  const b = Buffer.from(right)
+  return a.length === b.length && timingSafeEqual(a, b)
+}
+
+export function generateTotpSecret(): string {
+  return encodeBase32(randomBytes(20))
+}
+
+export function verifyTotp(secret: string, input: string, now = Date.now()): boolean {
+  const normalized = input.replace(/\s/g, '')
+  const counter = Math.floor(now / 1000 / PERIOD_SECONDS)
+  return [-1, 0, 1].some((offset) => safeEqual(codeAt(secret, counter + offset), normalized))
+}
+
+export function generateTotpCode(secret: string, now = Date.now()): string {
+  return codeAt(secret, Math.floor(now / 1000 / PERIOD_SECONDS))
+}
+
+/** The `otpauth://` URI an authenticator app scans; `issuer` is the name it shows next to the account. */
+export function totpUri(secret: string, email: string, issuer: string): string {
+  const label = `${issuer}:${email}`
+  return `otpauth://totp/${encodeURIComponent(label)}?secret=${secret}&issuer=${encodeURIComponent(issuer)}&algorithm=SHA1&digits=${DIGITS}&period=${PERIOD_SECONDS}`
+}
+
+export function generateRecoveryCodes(): string[] {
+  return Array.from({ length: 8 }, () => {
+    const value = randomBytes(10).toString('hex').toUpperCase()
+    return value.match(/.{1,5}/g)!.join('-')
+  })
+}
+
+export function hashRecoveryCode(code: string): string {
+  return createHash('sha256').update(code.replace(/\s|-/g, '').toUpperCase()).digest('hex')
+}
+
+export function consumeRecoveryCode(storedJson: string | null, input: string): { valid: boolean; remaining: string[] } {
+  let stored: string[]
+  try { stored = JSON.parse(storedJson ?? '[]') as string[] } catch { return { valid: false, remaining: [] } }
+  const candidate = hashRecoveryCode(input)
+  const index = stored.findIndex((hash) => safeEqual(hash, candidate))
+  if (index < 0) return { valid: false, remaining: stored }
+  return { valid: true, remaining: stored.filter((_, itemIndex) => itemIndex !== index) }
+}

package/src/twoFactor.ts

@@ -1,49 +1,49 @@
-import { and, eq } from 'drizzle-orm'
-import { withImmediateTransaction } from '@better-forge/db'
-import { consumeRecoveryCode, verifyTotp } from './totp.js'
-import { authSessions, users } from './tables.js'
-import type { AuthOptions } from './context.js'
-
-type TwoFactorUser = Pick<typeof users.$inferSelect, 'id' | 'totpEnabled' | 'totpSecret' | 'totpRecoveryCodes'>
-
-export function createTwoFactor(ctx: AuthOptions) {
-  const { db, sqlite, secretBox } = ctx
-
-  /**
-   * Verify a TOTP or consume a recovery code. Recovery-code persistence uses a
-   * compare-and-swap update so the same code cannot win in concurrent requests.
-   */
-  async function verifySecondFactor(user: TwoFactorUser, code: string): Promise<boolean> {
-    if (!user.totpEnabled || !user.totpSecret) return false
-    if (verifyTotp(secretBox.decrypt(user.totpSecret), code)) return true
-
-    const storedCodes = user.totpRecoveryCodes
-    const recovery = consumeRecoveryCode(storedCodes, code)
-    if (!storedCodes || !recovery.valid) return false
-
-    const updated = await db.update(users)
-      .set({ totpRecoveryCodes: JSON.stringify(recovery.remaining) })
-      .where(and(eq(users.id, user.id), eq(users.totpRecoveryCodes, storedCodes)))
-      .returning({ id: users.id })
-    return updated.length === 1
-  }
-
-  /** Clear 2FA credentials and revoke every active session for the user. */
-  async function resetTwoFactor(userId: number): Promise<boolean> {
-    return withImmediateTransaction(sqlite, async () => {
-      const updated = await db.update(users).set({
-        totpSecret: null,
-        totpEnabled: 0,
-        totpRecoveryCodes: null,
-      }).where(and(eq(users.id, userId), eq(users.totpEnabled, 1)))
-        .returning({ id: users.id })
-      if (updated.length !== 1) return false
-      await db.delete(authSessions).where(eq(authSessions.userId, userId))
-      return true
-    })
-  }
-
-  return { verifySecondFactor, resetTwoFactor }
-}
-
-export type TwoFactor = ReturnType<typeof createTwoFactor>
+import { and, eq } from 'drizzle-orm'
+import { withImmediateTransaction } from '@better-forge/db'
+import { consumeRecoveryCode, verifyTotp } from './totp.js'
+import { authSessions, users } from './tables.js'
+import type { AuthOptions } from './context.js'
+
+type TwoFactorUser = Pick<typeof users.$inferSelect, 'id' | 'totpEnabled' | 'totpSecret' | 'totpRecoveryCodes'>
+
+export function createTwoFactor(ctx: AuthOptions) {
+  const { db, sqlite, secretBox } = ctx
+
+  /**
+   * Verify a TOTP or consume a recovery code. Recovery-code persistence uses a
+   * compare-and-swap update so the same code cannot win in concurrent requests.
+   */
+  async function verifySecondFactor(user: TwoFactorUser, code: string): Promise<boolean> {
+    if (!user.totpEnabled || !user.totpSecret) return false
+    if (verifyTotp(secretBox.decrypt(user.totpSecret), code)) return true
+
+    const storedCodes = user.totpRecoveryCodes
+    const recovery = consumeRecoveryCode(storedCodes, code)
+    if (!storedCodes || !recovery.valid) return false
+
+    const updated = await db.update(users)
+      .set({ totpRecoveryCodes: JSON.stringify(recovery.remaining) })
+      .where(and(eq(users.id, user.id), eq(users.totpRecoveryCodes, storedCodes)))
+      .returning({ id: users.id })
+    return updated.length === 1
+  }
+
+  /** Clear 2FA credentials and revoke every active session for the user. */
+  async function resetTwoFactor(userId: number): Promise<boolean> {
+    return withImmediateTransaction(sqlite, async () => {
+      const updated = await db.update(users).set({
+        totpSecret: null,
+        totpEnabled: 0,
+        totpRecoveryCodes: null,
+      }).where(and(eq(users.id, userId), eq(users.totpEnabled, 1)))
+        .returning({ id: users.id })
+      if (updated.length !== 1) return false
+      await db.delete(authSessions).where(eq(authSessions.userId, userId))
+      return true
+    })
+  }
+
+  return { verifySecondFactor, resetTwoFactor }
+}
+
+export type TwoFactor = ReturnType<typeof createTwoFactor>

package/src/userRoutes.ts

@@ -1,144 +1,144 @@
-import type { FastifyInstance } from 'fastify'
-import bcrypt from 'bcryptjs'
-import { randomInt } from 'node:crypto'
-import { eq } from 'drizzle-orm'
-import { users } from './tables.js'
-import { requestIdentity } from './middleware.js'
-import type { AuthOptions } from './context.js'
-import type { Sessions } from './sessions.js'
-import type { TwoFactor } from './twoFactor.js'
-import type { IdentityConfirmation } from './identityConfirmation.js'
-
-function generateTempPassword(): string {
-  const chars = 'ABCDEFGHJKMNPQRSTUVWXYZabcdefghjkmnpqrstuvwxyz23456789'
-  let result = ''
-  for (let i = 0; i < 12; i++) result += chars[randomInt(chars.length)]
-  return result
-}
-
-export function createUserRoutes(ctx: AuthOptions, parts: { sessions: Sessions; twoFactor: TwoFactor; identityConfirmation: IdentityConfirmation }) {
-  const { db, roles, audit } = ctx
-  const { revokeUserSessions } = parts.sessions
-  const { resetTwoFactor } = parts.twoFactor
-  const { confirmIdentity } = parts.identityConfirmation
-
-  // These routes act on accounts and sign-ins, so a hijacked session alone must not be enough.
-  const sensitive = { config: { rateLimit: ctx.rateLimits.sensitiveAction } }
-
-  async function userRoutes(app: FastifyInstance) {
-    app.get('/', async () => {
-      const all = await db.select({
-        id: users.id,
-        email: users.email,
-        role: users.role,
-        mustChangePassword: users.mustChangePassword,
-        twoFactorEnabled: users.totpEnabled,
-        oidcIssuer: users.oidcIssuer,
-        createdAt: users.createdAt,
-      }).from(users)
-      return all.map(({ mustChangePassword, oidcIssuer, ...u }) => ({
-        ...u,
-        role: roles.normalize(u.role),
-        ssoLinked: !!oidcIssuer,
-        // An SSO sign-in revokes the temporary password, so the flag alone is accurate.
-        pendingTemporaryPassword: !!mustChangePassword,
-      }))
-    })
-
-    app.post<{ Body: { email: string; role?: string; currentPassword?: string } }>('/', sensitive, async (req, reply) => {
-      const { email, role = roles.defaultForNewUsers } = req.body
-      if (!email) return reply.code(400).send({ error: 'Email is required' })
-      if (!roles.isValid(role)) return reply.code(400).send({ error: 'Invalid role' })
-      const actor = requestIdentity(req)
-      if (!await confirmIdentity(actor, req.body.currentPassword, reply)) return reply
-      const existing = await db.select().from(users).where(eq(users.email, email))
-      if (existing.length > 0) return reply.code(409).send({ error: 'User with this email already exists' })
-      const temporaryPassword = generateTempPassword()
-      const hash = await bcrypt.hash(temporaryPassword, 10)
-      const result = await db.insert(users).values({
-        email, passwordHash: hash, role, mustChangePassword: 1, createdAt: Date.now(),
-      }).returning({ id: users.id, email: users.email, role: users.role, createdAt: users.createdAt })
-      audit.write(audit.actor(actor), 'create', 'user', result[0]!.id, email,
-        audit.snapshot({ email, role }))
-      return { ...result[0], temporaryPassword }
-    })
-
-    app.patch<{ Params: { id: string }; Body: { role: string; currentPassword?: string } }>('/:id/role', sensitive, async (req, reply) => {
-      const id = Number(req.params.id)
-      const jwt = requestIdentity(req)
-      if (jwt.userId === id) return reply.code(400).send({ error: 'Cannot change your own role' })
-      if (!roles.isValid(req.body.role)) {
-        return reply.code(400).send({ error: 'Invalid role' })
-      }
-      if (!await confirmIdentity(jwt, req.body.currentPassword, reply)) return reply
-      const existing = (await db.select().from(users).where(eq(users.id, id)))[0]
-      const result = await db.update(users).set({ role: req.body.role }).where(eq(users.id, id))
-        .returning({ id: users.id, role: users.role })
-      if (!result.length) return reply.code(404).send({ error: 'User not found' })
-      if (existing) {
-        await revokeUserSessions(id)
-        const actor = requestIdentity(req)
-        audit.write(audit.actor(actor), 'update', 'user', id, existing.email,
-          { role: { from: existing.role, to: req.body.role } })
-      }
-      return result[0]
-    })
-
-    app.post<{ Params: { id: string }; Body: { currentPassword?: string } }>('/:id/reset-password', sensitive, async (req, reply) => {
-      const id = Number(req.params.id)
-      const actor = requestIdentity(req)
-      if (!await confirmIdentity(actor, req.body?.currentPassword, reply)) return reply
-      const user = (await db.select().from(users).where(eq(users.id, id)))[0]
-      if (!user) return reply.code(404).send({ error: 'User not found' })
-      const temporaryPassword = generateTempPassword()
-      const hash = await bcrypt.hash(temporaryPassword, 10)
-      await db.update(users).set({
-        passwordHash: hash,
-        mustChangePassword: 1,
-      }).where(eq(users.id, id))
-      await revokeUserSessions(id)
-      audit.write(audit.actor(actor), 'update', 'user', id, user.email,
-        { action: 'password_reset' })
-      return { temporaryPassword }
-    })
-
-    app.post<{ Params: { id: string }; Body: { currentPassword: string } }>('/:id/reset-2fa', sensitive, async (req, reply) => {
-      const id = Number(req.params.id)
-      const actor = requestIdentity(req)
-      if (!Number.isInteger(id)) return reply.code(400).send({ error: 'Invalid user ID' })
-      if (actor.userId === id) {
-        return reply.code(400).send({ error: 'Use account settings to disable your own two-factor authentication' })
-      }
-
-      if (!await confirmIdentity(actor, req.body?.currentPassword, reply)) return reply
-
-      const target = (await db.select().from(users).where(eq(users.id, id)))[0]
-      if (!target) return reply.code(404).send({ error: 'User not found' })
-      if (!target.totpEnabled) return reply.code(409).send({ error: 'Two-factor authentication is not enabled for this user' })
-      if (!await resetTwoFactor(id)) return reply.code(409).send({ error: 'Two-factor authentication is already disabled' })
-
-      await audit.write(
-        audit.actor(actor),
-        'update', 'user-security', id, target.email,
-        { twoFactorReset: { from: true, to: false }, method: 'admin_recovery' },
-      )
-      return { twoFactorEnabled: false }
-    })
-
-    app.delete<{ Params: { id: string } }>('/:id', async (req, reply) => {
-      const id = Number(req.params.id)
-      const actor = requestIdentity(req)
-      if (actor.userId === id) return reply.code(400).send({ error: 'Cannot delete your own account' })
-      const existing = (await db.select().from(users).where(eq(users.id, id)))[0]
-      await revokeUserSessions(id)
-      await db.delete(users).where(eq(users.id, id))
-      if (existing) {
-        audit.write(audit.actor(actor), 'delete', 'user', id, existing.email,
-          audit.snapshot({ email: existing.email, role: existing.role }))
-      }
-      return { success: true }
-    })
-  }
-
-  return { userRoutes }
-}
+import type { FastifyInstance } from 'fastify'
+import bcrypt from 'bcryptjs'
+import { randomInt } from 'node:crypto'
+import { eq } from 'drizzle-orm'
+import { users } from './tables.js'
+import { requestIdentity } from './middleware.js'
+import type { AuthOptions } from './context.js'
+import type { Sessions } from './sessions.js'
+import type { TwoFactor } from './twoFactor.js'
+import type { IdentityConfirmation } from './identityConfirmation.js'
+
+function generateTempPassword(): string {
+  const chars = 'ABCDEFGHJKMNPQRSTUVWXYZabcdefghjkmnpqrstuvwxyz23456789'
+  let result = ''
+  for (let i = 0; i < 12; i++) result += chars[randomInt(chars.length)]
+  return result
+}
+
+export function createUserRoutes(ctx: AuthOptions, parts: { sessions: Sessions; twoFactor: TwoFactor; identityConfirmation: IdentityConfirmation }) {
+  const { db, roles, audit } = ctx
+  const { revokeUserSessions } = parts.sessions
+  const { resetTwoFactor } = parts.twoFactor
+  const { confirmIdentity } = parts.identityConfirmation
+
+  // These routes act on accounts and sign-ins, so a hijacked session alone must not be enough.
+  const sensitive = { config: { rateLimit: ctx.rateLimits.sensitiveAction } }
+
+  async function userRoutes(app: FastifyInstance) {
+    app.get('/', async () => {
+      const all = await db.select({
+        id: users.id,
+        email: users.email,
+        role: users.role,
+        mustChangePassword: users.mustChangePassword,
+        twoFactorEnabled: users.totpEnabled,
+        oidcIssuer: users.oidcIssuer,
+        createdAt: users.createdAt,
+      }).from(users)
+      return all.map(({ mustChangePassword, oidcIssuer, ...u }) => ({
+        ...u,
+        role: roles.normalize(u.role),
+        ssoLinked: !!oidcIssuer,
+        // An SSO sign-in revokes the temporary password, so the flag alone is accurate.
+        pendingTemporaryPassword: !!mustChangePassword,
+      }))
+    })
+
+    app.post<{ Body: { email: string; role?: string; currentPassword?: string } }>('/', sensitive, async (req, reply) => {
+      const { email, role = roles.defaultForNewUsers } = req.body
+      if (!email) return reply.code(400).send({ error: 'Email is required' })
+      if (!roles.isValid(role)) return reply.code(400).send({ error: 'Invalid role' })
+      const actor = requestIdentity(req)
+      if (!await confirmIdentity(actor, req.body.currentPassword, reply)) return reply
+      const existing = await db.select().from(users).where(eq(users.email, email))
+      if (existing.length > 0) return reply.code(409).send({ error: 'User with this email already exists' })
+      const temporaryPassword = generateTempPassword()
+      const hash = await bcrypt.hash(temporaryPassword, 10)
+      const result = await db.insert(users).values({
+        email, passwordHash: hash, role, mustChangePassword: 1, createdAt: Date.now(),
+      }).returning({ id: users.id, email: users.email, role: users.role, createdAt: users.createdAt })
+      audit.write(audit.actor(actor), 'create', 'user', result[0]!.id, email,
+        audit.snapshot({ email, role }))
+      return { ...result[0], temporaryPassword }
+    })
+
+    app.patch<{ Params: { id: string }; Body: { role: string; currentPassword?: string } }>('/:id/role', sensitive, async (req, reply) => {
+      const id = Number(req.params.id)
+      const jwt = requestIdentity(req)
+      if (jwt.userId === id) return reply.code(400).send({ error: 'Cannot change your own role' })
+      if (!roles.isValid(req.body.role)) {
+        return reply.code(400).send({ error: 'Invalid role' })
+      }
+      if (!await confirmIdentity(jwt, req.body.currentPassword, reply)) return reply
+      const existing = (await db.select().from(users).where(eq(users.id, id)))[0]
+      const result = await db.update(users).set({ role: req.body.role }).where(eq(users.id, id))
+        .returning({ id: users.id, role: users.role })
+      if (!result.length) return reply.code(404).send({ error: 'User not found' })
+      if (existing) {
+        await revokeUserSessions(id)
+        const actor = requestIdentity(req)
+        audit.write(audit.actor(actor), 'update', 'user', id, existing.email,
+          { role: { from: existing.role, to: req.body.role } })
+      }
+      return result[0]
+    })
+
+    app.post<{ Params: { id: string }; Body: { currentPassword?: string } }>('/:id/reset-password', sensitive, async (req, reply) => {
+      const id = Number(req.params.id)
+      const actor = requestIdentity(req)
+      if (!await confirmIdentity(actor, req.body?.currentPassword, reply)) return reply
+      const user = (await db.select().from(users).where(eq(users.id, id)))[0]
+      if (!user) return reply.code(404).send({ error: 'User not found' })
+      const temporaryPassword = generateTempPassword()
+      const hash = await bcrypt.hash(temporaryPassword, 10)
+      await db.update(users).set({
+        passwordHash: hash,
+        mustChangePassword: 1,
+      }).where(eq(users.id, id))
+      await revokeUserSessions(id)
+      audit.write(audit.actor(actor), 'update', 'user', id, user.email,
+        { action: 'password_reset' })
+      return { temporaryPassword }
+    })
+
+    app.post<{ Params: { id: string }; Body: { currentPassword: string } }>('/:id/reset-2fa', sensitive, async (req, reply) => {
+      const id = Number(req.params.id)
+      const actor = requestIdentity(req)
+      if (!Number.isInteger(id)) return reply.code(400).send({ error: 'Invalid user ID' })
+      if (actor.userId === id) {
+        return reply.code(400).send({ error: 'Use account settings to disable your own two-factor authentication' })
+      }
+
+      if (!await confirmIdentity(actor, req.body?.currentPassword, reply)) return reply
+
+      const target = (await db.select().from(users).where(eq(users.id, id)))[0]
+      if (!target) return reply.code(404).send({ error: 'User not found' })
+      if (!target.totpEnabled) return reply.code(409).send({ error: 'Two-factor authentication is not enabled for this user' })
+      if (!await resetTwoFactor(id)) return reply.code(409).send({ error: 'Two-factor authentication is already disabled' })
+
+      await audit.write(
+        audit.actor(actor),
+        'update', 'user-security', id, target.email,
+        { twoFactorReset: { from: true, to: false }, method: 'admin_recovery' },
+      )
+      return { twoFactorEnabled: false }
+    })
+
+    app.delete<{ Params: { id: string } }>('/:id', async (req, reply) => {
+      const id = Number(req.params.id)
+      const actor = requestIdentity(req)
+      if (actor.userId === id) return reply.code(400).send({ error: 'Cannot delete your own account' })
+      const existing = (await db.select().from(users).where(eq(users.id, id)))[0]
+      await revokeUserSessions(id)
+      await db.delete(users).where(eq(users.id, id))
+      if (existing) {
+        audit.write(audit.actor(actor), 'delete', 'user', id, existing.email,
+          audit.snapshot({ email: existing.email, role: existing.role }))
+      }
+      return { success: true }
+    })
+  }
+
+  return { userRoutes }
+}