@crossauth/fastify 0.0.15 → 0.0.17

package/dist/index.js

@@ -7,11 +7,11 @@ import ye from "@fastify/formbody";
 import be from "@fastify/cors";
 import _e from "@fastify/cookie";
 import ue from "nunjucks";
-import { setParameter as S, ParamType as C, Crypto as N, TokenEmailer as xe, OAuthClientManager as L, SessionManager as Ae, ApiKeyManager as Y, KeyStorage as Ne, OAuthAuthorizationServer as Fe, DoubleSubmitCsrfToken as Ue, OAuthClientBackend as Oe, OAuthResourceServer as Ie, OAuthTokenConsumer as Me } from "@crossauth/backend";
+import { setParameter as S, ParamType as C, Crypto as F, TokenEmailer as xe, OAuthClientManager as L, SessionManager as Ae, ApiKeyManager as Y, KeyStorage as Fe, OAuthAuthorizationServer as Ne, DoubleSubmitCsrfToken as Ue, OAuthClientBackend as Oe, OAuthResourceServer as Ie, OAuthTokenConsumer as Me } from "@crossauth/backend";
 import { CrossauthLogger as d, j as c, CrossauthError as l, ErrorCode as g, UserState as O, OAuthFlows as E } from "@crossauth/common";
 import { jwtDecode as J } from "jwt-decode";
 import Re from "qrcode";
-const F = ["Content-Type", "application/json; charset=utf-8"];
+const N = ["Content-Type", "application/json; charset=utf-8"];
 class De {
   /**
    * Constructor.
@@ -144,7 +144,7 @@ class De {
           return await this.updateUser(
             e,
             o,
-            (i, n, t) => i.header(...F).send({
+            (i, n, t) => i.header(...N).send({
               ok: !0,
               emailVerificationRequired: t
             })
@@ -157,7 +157,7 @@ class De {
             errorCodeName: n.codeName,
             errorCode: n.code
           })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, a) => {
-            t.status(this.sessionServer.errorStatus(i)).header(...F).send({
+            t.status(this.sessionServer.errorStatus(i)).header(...N).send({
               ok: !1,
               errorMessage: a.message,
               errorMessages: a.messages,
@@ -280,7 +280,7 @@ class De {
           return await this.changeFactor2(
             e,
             o,
-            (i, n, t) => i.header(...F).send({
+            (i, n, t) => i.header(...N).send({
               ok: !0,
               ...n.userData
             })
@@ -292,7 +292,7 @@ class De {
             user: (s = e.user) == null ? void 0 : s.username,
             errorCodeName: n.codeName,
             errorCode: n.code
-          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, a) => t.status(this.sessionServer.errorStatus(i)).header(...F).send({
+          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, a) => t.status(this.sessionServer.errorStatus(i)).header(...N).send({
             ok: !1,
             errorMessage: a.message,
             errorMessages: a.messages,
@@ -397,7 +397,7 @@ class De {
           return await this.changePassword(
             e,
             o,
-            (i, n) => i.header(...F).send({
+            (i, n) => i.header(...N).send({
               ok: !0
             })
           );
@@ -408,7 +408,7 @@ class De {
             user: (s = e.user) == null ? void 0 : s.username,
             errorCodeName: n.codeName,
             errorCode: n.code
-          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, a) => t.status(this.sessionServer.errorStatus(i)).header(...F).send({
+          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, a) => t.status(this.sessionServer.errorStatus(i)).header(...N).send({
             ok: !1,
             errorMessage: a.message,
             errorMessages: a.messages,
@@ -542,7 +542,7 @@ class De {
           return await this.reconfigureFactor2(
             o,
             r,
-            (i, n, t) => i.header(...F).send({
+            (i, n, t) => i.header(...N).send({
               ok: !0,
               ...n
             })
@@ -555,7 +555,7 @@ class De {
             errorCodeName: n.codeName,
             errorCode: n.code
           })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, o, r, (t, a) => {
-            t.status(this.sessionServer.errorStatus(i)).header(...F).send({
+            t.status(this.sessionServer.errorStatus(i)).header(...N).send({
               ok: !1,
               errorMessage: a.message,
               errorMessages: a.messages,
@@ -584,7 +584,7 @@ class De {
                 ok: !0,
                 user: n
               };
-              return this.sessionServer.isSessionUser(o) || (t.emailVerificationNeeded = this.enableEmailVerification), i.header(...F).send(t);
+              return this.sessionServer.isSessionUser(o) || (t.emailVerificationNeeded = this.enableEmailVerification), i.header(...N).send(t);
             }
           );
         } catch (i) {
@@ -595,7 +595,7 @@ class De {
             errorCodeName: n.codeName,
             errorCode: n.code
           })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, o, r, (t, a) => {
-            t.status(this.sessionServer.errorStatus(i)).header(...F).send({
+            t.status(this.sessionServer.errorStatus(i)).header(...N).send({
               ok: !1,
               errorMessage: a.message,
               errorMessages: a.messages,
@@ -686,7 +686,7 @@ class De {
           return await this.requestPasswordReset(
             e,
             o,
-            (r, s) => r.header(...F).send({
+            (r, s) => r.header(...N).send({
               ok: !0
             })
           );
@@ -698,7 +698,7 @@ class De {
             errorCodeName: s.codeName,
             errorCode: s.code
           })), d.logger.debug(c({ err: r })), this.sessionServer.handleError(r, e, o, (i, n) => {
-            i.status(this.sessionServer.errorStatus(r)).header(...F).send({
+            i.status(this.sessionServer.errorStatus(r)).header(...N).send({
               ok: !1,
               errorMessage: n.message,
               errorMessages: n.messages,
@@ -761,7 +761,7 @@ class De {
           const s = l.asCrossauthError(r);
           return d.logger.error(c({
             msg: "Reset password failure",
-            hashedToken: N.hash(e.body.token),
+            hashedToken: F.hash(e.body.token),
             errorCodeName: s.codeName,
             errorCode: s.code
           })), d.logger.debug(c({ err: r })), this.sessionServer.handleError(r, e, o, (i, n) => i.view(this.resetPasswordPage, {
@@ -794,7 +794,7 @@ class De {
           return await this.resetPassword(
             e,
             o,
-            (r, s) => r.header(...F).send({
+            (r, s) => r.header(...N).send({
               ok: !0
             })
           );
@@ -802,11 +802,11 @@ class De {
           const s = l.asCrossauthError(r);
           return d.logger.error(c({
             msg: "Reset password failure",
-            hashedToken: N.hash(e.body.token),
+            hashedToken: F.hash(e.body.token),
             errorCodeName: s.codeName,
             errorCode: s.code
           })), d.logger.debug(c({ err: r })), this.sessionServer.handleError(r, e, o, (i, n) => {
-            i.status(this.sessionServer.errorStatus(r)).header(...F).send({
+            i.status(this.sessionServer.errorStatus(r)).header(...N).send({
               ok: !1,
               errorMessage: n.message,
               errorMessages: n.messages,
@@ -844,7 +844,7 @@ class De {
           const s = l.asCrossauthError(r);
           return d.logger.error(c({
             msg: "Verify email failed",
-            hashedToken: N.hash(e.params.token),
+            hashedToken: F.hash(e.params.token),
             errorCodeName: s.codeName,
             errorCode: s.code
           })), d.logger.debug(c({ err: r })), this.sessionServer.handleError(r, e, o, (i, n) => i.view(this.sessionServer.errorPage, {
@@ -875,7 +875,7 @@ class De {
           return await this.verifyEmail(
             e,
             o,
-            (r, s) => r.header(...F).send({
+            (r, s) => r.header(...N).send({
               ok: !0,
               user: s
             })
@@ -884,11 +884,11 @@ class De {
           const s = l.asCrossauthError(r);
           return d.logger.error(c({
             msg: "Verify email failure",
-            hashedToken: N.hash(e.params.token),
+            hashedToken: F.hash(e.params.token),
             errorCodeName: s.codeName,
             errorCode: s.code
           })), d.logger.debug(c({ err: r })), this.sessionServer.handleError(r, e, o, (i, n) => {
-            i.status(this.sessionServer.errorStatus(r)).header(...F).send({
+            i.status(this.sessionServer.errorStatus(r)).header(...N).send({
               ok: !1,
               errorMessage: n.message,
               errorMessages: n.messages,
@@ -1008,14 +1008,14 @@ class De {
           ip: e.ip,
           user: (r = e.user) == null ? void 0 : r.username
         })), !e.user)
-          return o.status(401).header(...F).send({ ok: !1 });
+          return o.status(401).header(...N).send({ ok: !1 });
         try {
           return await this.deleteUser(
             e,
             o,
             (i) => {
               var n;
-              return i.header(...F).send({
+              return i.header(...N).send({
                 ok: !0,
                 userid: (n = e.user) == null ? void 0 : n.id
               });
@@ -1029,7 +1029,7 @@ class De {
             errorCodeName: n.codeName,
             errorCode: n.code
           })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, a) => {
-            t.status(this.sessionServer.errorStatus(i)).header(...F).send({
+            t.status(this.sessionServer.errorStatus(i)).header(...N).send({
               ok: !1,
               errorMessage: a.message,
               errorMessages: a.messages,
@@ -1107,10 +1107,10 @@ class De {
     if (!this.sessionServer.userStorage) throw new l(g.Configuration, "Cannot call changePassword unless a user storage is provided");
     let s, i = !1;
     if (!this.sessionServer.isSessionUser(e) || !e.user) {
-      const w = await this.sessionServer.getSessionData(e, "passwordchange");
-      if (w != null && w.username) {
+      const m = await this.sessionServer.getSessionData(e, "passwordchange");
+      if (m != null && m.username) {
         if (s = (await this.sessionServer.userStorage.getUserByUsername(
-          w == null ? void 0 : w.username,
+          m == null ? void 0 : m.username,
           {
             skipActiveCheck: !0,
             skipEmailVerifiedCheck: !0
@@ -1127,16 +1127,16 @@ class De {
       throw new l(g.InsufficientPriviledges);
     const n = this.sessionServer.authenticators[s.factor1], t = n.secretNames();
     let a = {}, h = {}, f = {};
-    for (let w in e.body)
-      if (w.startsWith("new_")) {
-        const m = w.replace(/^new_/, "");
-        t.includes(m) && (h[m] = e.body[w]);
-      } else if (w.startsWith("old_")) {
-        const m = w.replace(/^old_/, "");
-        t.includes(m) && (a[m] = e.body[w]);
-      } else if (w.startsWith("repeat_")) {
-        const m = w.replace(/^repeat_/, "");
-        t.includes(m) && (f[m] = e.body[w]);
+    for (let m in e.body)
+      if (m.startsWith("new_")) {
+        const w = m.replace(/^new_/, "");
+        t.includes(w) && (h[w] = e.body[m]);
+      } else if (m.startsWith("old_")) {
+        const w = m.replace(/^old_/, "");
+        t.includes(w) && (a[w] = e.body[m]);
+      } else if (m.startsWith("repeat_")) {
+        const w = m.replace(/^repeat_/, "");
+        t.includes(w) && (f[w] = e.body[m]);
       }
     if (Object.keys(f).length === 0 && (f = void 0), n.validateSecrets(h).length > 0)
       throw new l(g.PasswordFormat);
@@ -1149,15 +1149,15 @@ class De {
         f,
         a
       );
-    } catch (w) {
-      const m = l.asCrossauthError(w);
-      if (d.logger.debug(c({ err: w })), i)
+    } catch (m) {
+      const w = l.asCrossauthError(m);
+      if (d.logger.debug(c({ err: m })), i)
         try {
           await this.sessionServer.userStorage.updateUser({ id: s.id, state: v });
         } catch (P) {
           d.logger.debug(c({ err: P }));
         }
-      throw m;
+      throw w;
     }
     return i ? await this.sessionServer.loginWithUser(s, !1, e, o, r) : r(o, void 0);
   }
@@ -1229,11 +1229,11 @@ class De {
     let a = {}, h = {};
     for (let v in e.body)
       if (v.startsWith("new_")) {
-        const w = v.replace(/^new_/, "");
-        t.includes(w) && (a[w] = e.body[v]);
+        const m = v.replace(/^new_/, "");
+        t.includes(m) && (a[m] = e.body[v]);
       } else if (v.startsWith("repeat_")) {
-        const w = v.replace(/^repeat_/, "");
-        t.includes(w) && (h[w] = e.body[v]);
+        const m = v.replace(/^repeat_/, "");
+        t.includes(m) && (h[m] = e.body[v]);
       }
     if (Object.keys(h).length === 0 && (h = void 0), n.validateSecrets(a).length > 0)
       throw new l(g.PasswordFormat);
@@ -1883,8 +1883,8 @@ class He {
       t = this.sessionServer.authenticators[s.factor1].validateSecrets(e.body);
       for (let v in e.body)
         if (v.startsWith("repeat_")) {
-          const w = v.replace(/^repeat_/, "");
-          i.includes(w) && (a[w] = e.body[v]);
+          const m = v.replace(/^repeat_/, "");
+          i.includes(m) && (a[m] = e.body[v]);
         }
       Object.keys(a).length === 0 && (a = void 0);
     }
@@ -1911,8 +1911,8 @@ class He {
     if (!n) {
       let v = e.body.username;
       if ("user_email" in e.body) {
-        const w = e.body.user_email;
-        typeof w == "string" && (v = w);
+        const m = e.body.user_email;
+        typeof m == "string" && (v = m);
       }
       if (xe.validateEmail(v), !v) throw new l(g.FormEntry, "No password given but no email address found either");
       await this.sessionServer.sessionManager.requestPasswordReset(v);
@@ -2302,9 +2302,9 @@ class Le {
             errorCode: a.code
           })), d.logger.debug(c({ err: t })), this.sessionServer.handleError(t, e, o, (h, f) => {
             const v = l.asCrossauthError(t).httpStatus;
-            let w = {};
-            for (let m of this.validFlows)
-              m in e.body && (w[m] = !0);
+            let m = {};
+            for (let w of this.validFlows)
+              w in e.body && (m[w] = !0);
             return h.status(v).view(this.updateClientPage, {
               errorMessage: f.message,
               errorMessages: f.messages,
@@ -2315,7 +2315,7 @@ class Le {
               isAdmin: !0,
               next: r,
               validFlows: this.validFlows,
-              selectedFlows: w,
+              selectedFlows: m,
               flowNames: E.flowNames(this.validFlows),
               ...e.body
             });
@@ -2941,9 +2941,9 @@ class Ge {
             errorCode: a.code
           })), d.logger.debug(c({ err: t })), this.sessionServer.handleError(t, e, o, (h, f) => {
             const v = l.asCrossauthError(t).httpStatus;
-            let w = {};
-            for (let m of this.validFlows)
-              m in e.body && (w[m] = !0);
+            let m = {};
+            for (let w of this.validFlows)
+              w in e.body && (m[w] = !0);
             return h.status(v).view(this.updateClientPage, {
               errorMessage: f.message,
               errorMessages: f.messages,
@@ -2952,7 +2952,7 @@ class Ge {
               csrfToken: e.csrfToken,
               urlPrefix: this.prefix,
               validFlows: this.validFlows,
-              selectedFlows: w,
+              selectedFlows: m,
               flowNames: E.flowNames(this.validFlows),
               isAdmin: !0,
               next: r,
@@ -3475,62 +3475,62 @@ class Ke {
         break;
       }
     n && (this.userClientEndpoints = new Ge(this, s)), this.addEndpoints(), S("endpoints", C.JsonArray, this, s, "ENDPOINTS"), s.userStorage && (this.userStorage = s.userStorage), this.authenticators = r, this.sessionManager = new Ae(o, r, s), e.addHook("preHandler", async (t, a) => {
-      var v, w;
+      var v, m;
       d.logger.debug(c({ msg: "Getting session cookie" }));
       let h = this.getSessionCookieValue(t), f = {};
       if (h)
         try {
-          f.hashedSessionId = N.hash(this.sessionManager.getSessionId(h));
+          f.hashedSessionId = F.hash(this.sessionManager.getSessionId(h));
         } catch {
-          f.hashedSessionCookie = N.hash(h);
+          f.hashedSessionCookie = F.hash(h);
         }
       d.logger.debug(c({ msg: "Getting csrf cookie" }));
       let p;
       try {
         p = this.getCsrfCookieValue(t), p && this.sessionManager.validateCsrfCookie(p);
-      } catch (m) {
-        d.logger.warn(c({ msg: "Invalid csrf cookie received", cerr: m, hashedCsrfCookie: this.getHashOfCsrfCookie(t) })), a.clearCookie(this.sessionManager.csrfCookieName), p = void 0;
+      } catch (w) {
+        d.logger.warn(c({ msg: "Invalid csrf cookie received", cerr: w, hashedCsrfCookie: this.getHashOfCsrfCookie(t) })), a.clearCookie(this.sessionManager.csrfCookieName), p = void 0;
       }
       if (["GET", "OPTIONS", "HEAD"].includes(t.method))
         try {
           if (p) {
             d.logger.debug(c({ msg: "Valid CSRF cookie - creating token" }));
-            const m = await this.sessionManager.createCsrfFormOrHeaderValue(p);
-            t.csrfToken = m;
+            const w = await this.sessionManager.createCsrfFormOrHeaderValue(p);
+            t.csrfToken = w;
           } else {
             d.logger.debug(c({ msg: "Invalid CSRF cookie - recreating" }));
-            const { csrfCookie: m, csrfFormOrHeaderValue: P } = await this.sessionManager.createCsrfToken();
-            a.setCookie(m.name, m.value, m.options), t.csrfToken = P;
+            const { csrfCookie: w, csrfFormOrHeaderValue: P } = await this.sessionManager.createCsrfToken();
+            a.setCookie(w.name, w.value, w.options), t.csrfToken = P;
           }
           a.header(this.sessionManager.csrfHeaderName, t.csrfToken);
-        } catch (m) {
+        } catch (w) {
           d.logger.error(c({
             msg: "Couldn't create CSRF token",
-            cerr: m,
+            cerr: w,
             user: (v = t.user) == null ? void 0 : v.username,
             ...f
-          })), d.logger.debug(c({ err: m })), a.clearCookie(this.sessionManager.csrfCookieName);
+          })), d.logger.debug(c({ err: w })), a.clearCookie(this.sessionManager.csrfCookieName);
         }
       else if (p)
         try {
           this.csrfToken(t, a);
-        } catch (m) {
+        } catch (w) {
           d.logger.error(c({
             msg: "Couldn't create CSRF token",
-            cerr: m,
-            user: (w = t.user) == null ? void 0 : w.username,
+            cerr: w,
+            user: (m = t.user) == null ? void 0 : m.username,
             ...f
-          })), d.logger.debug(c({ err: m }));
+          })), d.logger.debug(c({ err: w }));
         }
       if (h = this.getSessionCookieValue(t), h)
         try {
-          const m = this.sessionManager.getSessionId(h);
-          let { key: P, user: T } = await this.sessionManager.userForSessionId(m);
+          const w = this.sessionManager.getSessionId(h);
+          let { key: P, user: T } = await this.sessionManager.userForSessionId(w);
           this.validateSession && this.validateSession(
             P,
             T,
             t
-          ), t.sessionId = m, t.user = T, t.authType = "cookie", d.logger.debug(c({
+          ), t.sessionId = w, t.user = T, t.authType = "cookie", d.logger.debug(c({
             msg: "Valid session id",
             user: T == null ? void 0 : T.username
           }));
@@ -3546,11 +3546,11 @@ class Ke {
         var f, p, v;
         const h = this.getSessionCookieValue(t);
         if (h && ((f = t.user) != null && f.factor2) && (this.factor2ProtectedPageEndpoints.includes(t.url) || this.factor2ProtectedApiEndpoints.includes(t.url))) {
-          const w = this.sessionManager.getSessionId(h);
+          const m = this.sessionManager.getSessionId(h);
           if (["GET", "OPTIONS", "HEAD"].includes(t.method)) {
-            const m = this.getSessionCookieValue(t);
-            if (m) {
-              const P = this.sessionManager.getSessionId(m);
+            const w = this.getSessionCookieValue(t);
+            if (w) {
+              const P = this.sessionManager.getSessionId(w);
               if ("pre2fa" in await this.sessionManager.dataForSessionId(P)) {
                 d.logger.debug("Cancelling 2FA");
                 try {
@@ -3561,16 +3561,16 @@ class Ke {
               }
             }
           } else {
-            const m = await this.sessionManager.dataForSessionId(w);
-            if ("pre2fa" in m) {
+            const w = await this.sessionManager.dataForSessionId(m);
+            if ("pre2fa" in w) {
               d.logger.debug("Completing 2FA");
-              const T = [...this.authenticators[m.pre2fa.factor2].transientSecretNames()];
+              const T = [...this.authenticators[w.pre2fa.factor2].transientSecretNames()];
               let U = {};
               for (let M in t.body)
                 T.includes(M) && (U[M] = t.body[M]);
               let _;
               try {
-                await this.sessionManager.completeTwoFactorPageVisit(U, w);
+                await this.sessionManager.completeTwoFactorPageVisit(U, m);
               } catch (M) {
                 _ = l.asCrossauthError(M), d.logger.debug(c({ err: M }));
                 const I = l.asCrossauthError(M);
@@ -3582,11 +3582,11 @@ class Ke {
                   errorCodeName: I.codeName
                 }));
               }
-              if (t.body = m.pre2fa.body, _)
+              if (t.body = w.pre2fa.body, _)
                 if (_.code == g.Expired) {
                   d.logger.debug("Error - cancelling 2FA");
                   try {
-                    await this.sessionManager.cancelTwoFactorPageVisit(w);
+                    await this.sessionManager.cancelTwoFactorPageVisit(m);
                   } catch (M) {
                     d.logger.error(c({ msg: "Failed cancelling 2FA", cerr: M, user: (p = t.user) == null ? void 0 : p.username, hashOfSessionId: this.getHashOfSessionId(t) })), d.logger.debug(c({ err: M }));
                   }
@@ -3606,7 +3606,7 @@ class Ke {
                     errorCodeName: g[_.code]
                   }));
             } else
-              return this.validateCsrfToken(t), d.logger.debug("Starting 2FA"), this.sessionManager.initiateTwoFactorPageVisit(t.user, w, t.body, t.url.replace(/\?.*$/, "")), this.factor2ProtectedPageEndpoints.includes(t.url) ? a.redirect(this.prefix + "factor2") : a.send(JSON.stringify({
+              return this.validateCsrfToken(t), d.logger.debug("Starting 2FA"), this.sessionManager.initiateTwoFactorPageVisit(t.user, m, t.body, t.url.replace(/\?.*$/, "")), this.factor2ProtectedPageEndpoints.includes(t.url) ? a.redirect(this.prefix + "factor2") : a.send(JSON.stringify({
                 ok: !0,
                 factor2Required: !0
               }));
@@ -4363,10 +4363,10 @@ class Ke {
     let n = this.createUserFn(e, this.userStorage.userEditableFields), t = this.authenticators[n.factor1].validateSecrets(e.body);
     const a = this.authenticators[n.factor1].secretNames();
     let h = {};
-    for (let w in e.body)
-      if (w.startsWith("repeat_")) {
-        const m = w.replace(/^repeat_/, "");
-        a.includes(m) && (h[m] = e.body[w]);
+    for (let m in e.body)
+      if (m.startsWith("repeat_")) {
+        const w = m.replace(/^repeat_/, "");
+        a.includes(w) && (h[w] = e.body[m]);
       }
     Object.keys(h).length === 0 && (h = void 0), n.state = "active", e.body.factor2 && e.body.factor2 != "none" ? n.state = "awaitingtwofactor" : this.enableEmailVerification && (n.state = "awaitingemailverification");
     let p = [...this.validateUserFn(n), ...t];
@@ -4374,25 +4374,25 @@ class Ke {
       throw new l(g.FormEntry, p);
     let v = !1;
     try {
-      const { user: w, secrets: m } = await this.userStorage.getUserByUsername(s);
-      await this.sessionManager.authenticators[n.factor1].authenticateUser(w, m, e.body);
-    } catch (w) {
-      l.asCrossauthError(w).code == g.TwoFactorIncomplete && (v = !0);
+      const { user: m, secrets: w } = await this.userStorage.getUserByUsername(s);
+      await this.sessionManager.authenticators[n.factor1].authenticateUser(m, w, e.body);
+    } catch (m) {
+      l.asCrossauthError(m).code == g.TwoFactorIncomplete && (v = !0);
     }
     if (!e.body.factor2 && !v)
       return await this.sessionManager.createUser(
         n,
         e.body,
         h
-      ), this.enableEmailVerification ? r(o, {}, void 0) : this.login(e, o, (w, m) => r(w, {}, m));
+      ), this.enableEmailVerification ? r(o, {}, void 0) : this.login(e, o, (m, w) => r(m, {}, w));
     {
-      let w;
+      let m;
       if (v) {
         if (!e.sessionId) throw new l(g.Unauthorized);
-        w = (await this.sessionManager.repeatTwoFactorSignup(e.sessionId)).userData;
+        m = (await this.sessionManager.repeatTwoFactorSignup(e.sessionId)).userData;
       } else {
-        const m = await this.createAnonymousSession(e, o), P = this.sessionManager.getSessionId(m);
-        w = (await this.sessionManager.initiateTwoFactorSignup(
+        const w = await this.createAnonymousSession(e, o), P = this.sessionManager.getSessionId(w);
+        m = (await this.sessionManager.initiateTwoFactorSignup(
           n,
           e.body,
           P,
@@ -4400,15 +4400,15 @@ class Ke {
         )).userData;
       }
       try {
-        let m = {
-          userData: w,
+        let w = {
+          userData: m,
           username: s,
           next: i ?? this.loginRedirect,
           csrfToken: e.csrfToken
         };
-        return r(o, m);
-      } catch (m) {
-        d.logger.error(c({ err: m }));
+        return r(o, w);
+      } catch (w) {
+        d.logger.error(c({ err: w }));
         try {
           this.sessionManager.deleteUserByUsername(s);
         } catch (P) {
@@ -4521,7 +4521,7 @@ class Ke {
   getHashOfSessionId(e) {
     if (!e.sessionId) return "";
     try {
-      return N.hash(e.sessionId);
+      return F.hash(e.sessionId);
     } catch {
     }
     return "";
@@ -4536,7 +4536,7 @@ class Ke {
     const o = this.getCsrfCookieValue(e);
     if (!o) return "";
     try {
-      return N.hash(o.split(".")[0]);
+      return F.hash(o.split(".")[0]);
     } catch {
     }
     return "";
@@ -4749,7 +4749,7 @@ class Ye {
               msg: "Valid API key",
               hahedApiKey: Y.hashSignedApiKeyValue(t.value)
             }));
-            const a = Ne.decodeData(t.data);
+            const a = Fe.decodeData(t.data);
             if (i.apiKey = { ...t, ...a }, "scope" in a && Array.isArray(a.scope)) {
               let h = [];
               for (let f of a.scope)
@@ -4804,7 +4804,7 @@ class $e {
     u(this, "refreshTokenCookieSameSite", "strict");
     u(this, "csrfTokens");
     u(this, "createGetCsrfTokenEndpoint", !1);
-    this.app = e, this.fastifyServer = o, this.clientStorage = r, this.authServer = new Fe(
+    this.app = e, this.fastifyServer = o, this.clientStorage = r, this.authServer = new Ne(
       this.clientStorage,
       s,
       i,
@@ -4842,10 +4842,10 @@ class $e {
         let h, f;
         try {
           h = await this.fastifyServer.validateCsrfToken(t);
-        } catch (w) {
-          f = l.asCrossauthError(w), f.message = "Invalid csrf cookie received", d.logger.error(c({
+        } catch (m) {
+          f = l.asCrossauthError(m), f.message = "Invalid csrf cookie received", d.logger.error(c({
             msg: f.message,
-            hashedCsrfCookie: h ? N.hash(h) : void 0,
+            hashedCsrfCookie: h ? F.hash(h) : void 0,
             user: (v = t.user) == null ? void 0 : v.username,
             cerr: f
           }));
@@ -4862,21 +4862,21 @@ class $e {
               }
             );
           {
-            let w = "500";
+            let m = "500";
             switch (f.httpStatus) {
               case 401:
-                w = "401";
+                m = "401";
                 break;
               case 400:
-                w = "400";
+                m = "400";
                 break;
             }
-            return a.status(f.httpStatus).send($[w] ?? G);
+            return a.status(f.httpStatus).send($[m] ?? G);
           }
         }
         if (!f) {
-          const w = t.body.authorized == "true";
-          return await this.authorize(t, a, w, {
+          const m = t.body.authorized == "true";
+          return await this.authorize(t, a, m, {
             responseType: t.body.response_type,
             client_id: t.body.client_id,
             redirect_uri: t.body.redirect_uri,
@@ -4890,37 +4890,37 @@ class $e {
     )), (this.authServer.validFlows.includes(E.AuthorizationCode) || this.authServer.validFlows.includes(E.AuthorizationCodeWithPKCE) || this.authServer.validFlows.includes(E.OidcAuthorizationCode) || this.authServer.validFlows.includes(E.ClientCredentials) || this.authServer.validFlows.includes(E.RefreshToken) || this.authServer.validFlows.includes(E.Password) || this.authServer.validFlows.includes(E.PasswordMfa) || this.authServer.validFlows.includes(E.DeviceCode)) && this.app.post(
       this.prefix + "token",
       async (t, a) => {
-        var w;
+        var m;
         d.logger.info(c({
           msg: "Page visit",
           method: "POST",
           url: this.prefix + "token",
           ip: t.ip,
-          user: (w = t.user) == null ? void 0 : w.username
+          user: (m = t.user) == null ? void 0 : m.username
         }));
         let h = t.body.client_id, f = t.body.client_secret;
         if (t.headers.authorization) {
-          let m, P;
+          let w, P;
           const T = t.headers.authorization.split(" ");
           if (T.length == 2 && T[0].toLocaleLowerCase() == "basic") {
-            const _ = N.base64Decode(T[1]).split(":", 2);
-            _.length == 2 && (m = _[0], P = _[1]);
+            const _ = F.base64Decode(T[1]).split(":", 2);
+            _.length == 2 && (w = _[0], P = _[1]);
           }
-          m == null || P == null ? d.logger.warn(c({
+          w == null || P == null ? d.logger.warn(c({
             msg: "Ignoring malform authenization header " + t.headers.authorization
-          })) : (h = m, f = P);
+          })) : (h = w, f = P);
         }
         let p = t.body.refresh_token;
         if ((this.refreshTokenType == "cookie" && t.cookies && this.refreshTokenCookieName in t.cookies || this.refreshTokenType == "both" && t.cookies && this.refreshTokenCookieName in t.cookies && p == null) && this.csrfTokens) {
-          const m = t.cookies[this.csrfTokens.cookieName];
+          const w = t.cookies[this.csrfTokens.cookieName];
           let P = t.headers[this.csrfTokens.headerName.toLowerCase()];
-          if (Array.isArray(P) && (P = P[0]), !m || !P)
+          if (Array.isArray(P) && (P = P[0]), !w || !P)
             return {
               error: "access_denied",
               error_description: "Invalid csrf token"
             };
           try {
-            this.csrfTokens.validateDoubleSubmitCsrfToken(m, P);
+            this.csrfTokens.validateDoubleSubmitCsrfToken(w, P);
           } catch (T) {
             return d.logger.debug(c({ err: T })), d.logger.warn(c({ cerr: T, msg: "Invalid csrf token", client_id: t.body.client_id })), {
               error: "access_denied",
@@ -4948,9 +4948,9 @@ class $e {
         if (v.error == "authorization_pending")
           return a.header(...x).status(200).send(v);
         if (v.refresh_token && this.refreshTokenType != "json" && this.setRefreshTokenCookie(a, v.refresh_token, v.expires_in), v.error || !v.access_token) {
-          let m = "server_error", P = "Neither code nor error received when requesting authorization";
-          v.error && (m = v.error), v.error_description && (P = v.error_description);
-          const T = l.fromOAuthError(m, P);
+          let w = "server_error", P = "Neither code nor error received when requesting authorization";
+          v.error && (w = v.error), v.error_description && (P = v.error_description);
+          const T = l.fromOAuthError(w, P);
           return d.logger.error(c({ cerr: T })), a.header(...x).status(T.httpStatus).send(v);
         }
         return a.header(...x).send(v);
@@ -5004,15 +5004,15 @@ class $e {
         }));
         let h = t.body.client_id, f = t.body.client_secret;
         if (t.headers.authorization) {
-          let w, m;
+          let m, w;
           const P = t.headers.authorization.split(" ");
           if (P.length == 2 && P[0].toLocaleLowerCase() == "basic") {
-            const U = N.base64Decode(P[1]).split(":", 2);
-            U.length == 2 && (w = U[0], m = U[1]);
+            const U = F.base64Decode(P[1]).split(":", 2);
+            U.length == 2 && (m = U[0], w = U[1]);
           }
-          w == null || m == null ? d.logger.warn(c({
+          m == null || w == null ? d.logger.warn(c({
             msg: "Ignoring malform authenization header " + t.headers.authorization
-          })) : (h = w, f = m);
+          })) : (h = m, f = w);
         }
         const p = await this.authServer.deviceAuthorizationEndpoint({
           client_id: h,
@@ -5020,9 +5020,9 @@ class $e {
           scope: t.body.scope
         });
         if (p.error || !p.device_code || !p.user_code) {
-          let w = "server_error", m = "Neither code nor error received when requesting authorization";
-          p.error && (w = p.error), p.error_description && (m = p.error_description);
-          const P = l.fromOAuthError(w, m);
+          let m = "server_error", w = "Neither code nor error received when requesting authorization";
+          p.error && (m = p.error), p.error_description && (w = p.error_description);
+          const P = l.fromOAuthError(m, w);
           return d.logger.error(c({ cerr: P })), a.header(...x).status(P.httpStatus).send(p);
         }
         return a.header(...x).send(p);
@@ -5125,7 +5125,7 @@ class $e {
           return d.logger.error(c({
             msg: "getcsrftoken failure",
             user: (i = e.user) == null ? void 0 : i.username,
-            hashedCsrfCookie: N.hash(r.split(".")[0]),
+            hashedCsrfCookie: F.hash(r.split(".")[0]),
             errorCode: t.code,
             errorCodeName: t.codeName
           })), d.logger.debug(c({ err: n })), o.status(t.httpStatus).header(...x).send({
@@ -5240,9 +5240,9 @@ class $e {
     codeChallenge: h,
     codeChallengeMethod: f
   }) {
-    let p, v, w;
+    let p, v, m;
     if (r) {
-      const m = await this.authServer.authorizeGetEndpoint({
+      const w = await this.authServer.authorizeGetEndpoint({
         responseType: s,
         client_id: i,
         redirect_uri: n,
@@ -5252,7 +5252,7 @@ class $e {
         codeChallengeMethod: f,
         user: e.user
       });
-      if (w = m.code, p = m.error, v = m.error_description, p || !w) {
+      if (m = w.code, p = w.error, v = w.error_description, p || !m) {
         const P = l.fromOAuthError(
           p ?? "server_error",
           v ?? "Neither code nor error received"
@@ -5282,24 +5282,24 @@ class $e {
       }
       return o.redirect(this.authServer.redirect_uri(
         n,
-        w,
+        m,
         a
       ));
     } else {
-      const m = new l(
+      const w = new l(
         g.Unauthorized,
         "You have not granted access"
       );
       d.logger.error(c({
         msg: v,
-        errorCode: m.code,
-        errorCodeName: m.codeName
+        errorCode: w.code,
+        errorCodeName: w.codeName
       }));
       try {
         return L.validateUri(n), o.redirect(n);
       } catch {
         d.logger.error(c({
-          msg: `Couldn't send error message ${m.codeName} to ${n}}`
+          msg: `Couldn't send error message ${w.codeName} to ${n}}`
         }));
       }
     }
@@ -5365,7 +5365,7 @@ class $e {
           error_description: t.error_description
         };
       if (!t.client_id)
-        return d.logger.error(c({ msg: "No client id found for user code", userCodeHash: N.hash(e), ip: o.ip, username: (s = o.user) == null ? void 0 : s.username })), {
+        return d.logger.error(c({ msg: "No client id found for user code", userCodeHash: F.hash(e), ip: o.ip, username: (s = o.user) == null ? void 0 : s.username })), {
           ok: !1,
           completed: !1,
           retryAllowed: !1,
@@ -5373,7 +5373,7 @@ class $e {
           error_description: "No client id found for user code"
         };
       if (t.error == "access_denied")
-        return d.logger.error(c({ msg: "Incorrect user code given", userCodeHash: N.hash(e), ip: o.ip, username: (i = o.user) == null ? void 0 : i.username })), this.authServer.userCodeThrottle > 0 && await ((f) => new Promise((p) => setTimeout(p, f)))(this.authServer.userCodeThrottle), {
+        return d.logger.error(c({ msg: "Incorrect user code given", userCodeHash: F.hash(e), ip: o.ip, username: (i = o.user) == null ? void 0 : i.username })), this.authServer.userCodeThrottle > 0 && await ((f) => new Promise((p) => setTimeout(p, f)))(this.authServer.userCodeThrottle), {
           ok: !1,
           completed: !1,
           retryAllowed: !0,
@@ -5381,7 +5381,7 @@ class $e {
           error_description: t.error_description
         };
       if (t.error == "expired_token")
-        return d.logger.error(c({ msg: "Expired user code", userCodeHash: N.hash(e), ip: o.ip, username: (n = o.user) == null ? void 0 : n.username })), {
+        return d.logger.error(c({ msg: "Expired user code", userCodeHash: F.hash(e), ip: o.ip, username: (n = o.user) == null ? void 0 : n.username })), {
           ok: !1,
           completed: !1,
           retryAllowed: !1,
@@ -5591,7 +5591,7 @@ function j(k) {
   let e;
   if (k)
     try {
-      e = JSON.parse(N.base64Decode(k.split(".")[1]));
+      e = JSON.parse(F.base64Decode(k.split(".")[1]));
     } catch {
       d.logger.error(c({ msg: "Couldn't decode id token" }));
     }
@@ -5608,7 +5608,7 @@ function fe(k, e) {
   if (k.access_token)
     try {
       if (k.access_token && e.includes("access")) {
-        const i = (o = J(k.access_token)) == null ? void 0 : o.jti, n = i ? N.hash(i) : void 0;
+        const i = (o = J(k.access_token)) == null ? void 0 : o.jti, n = i ? F.hash(i) : void 0;
         d.logger.debug(c({
           msg: "Got access token",
           accessTokenHash: n
@@ -5620,7 +5620,7 @@ function fe(k, e) {
   if (k.id_token)
     try {
       if (k.id_token && e.includes("id")) {
-        const i = (r = J(k.id_token)) == null ? void 0 : r.jti, n = i ? N.hash(i) : void 0;
+        const i = (r = J(k.id_token)) == null ? void 0 : r.jti, n = i ? F.hash(i) : void 0;
         d.logger.debug(c({
           msg: "Got id token",
           idTokenHash: n
@@ -5632,7 +5632,7 @@ function fe(k, e) {
   if (k.refresh_token && e.includes("refresh"))
     try {
       if (k.refresh_token) {
-        const i = (s = J(k.refresh_token)) == null ? void 0 : s.jti, n = i ? N.hash(i) : void 0;
+        const i = (s = J(k.refresh_token)) == null ? void 0 : s.jti, n = i ? F.hash(i) : void 0;
         d.logger.debug(c({
           msg: "Got refresh token",
           refreshTokenHash: n
@@ -5852,13 +5852,13 @@ class we extends Oe {
     this.prefix.endsWith("/") || (this.prefix += "/"), this.redirect_uri = this.siteUrl + this.prefix + "authzcode", this.validFlows.includes(E.AuthorizationCode) && this.server.app.get(
       this.prefix + "authzcodeflow",
       async (a, h) => {
-        var w;
+        var m;
         if (d.logger.info(c({
           msg: "Page visit",
           method: "GET",
           url: this.prefix + "authzcodeflow",
           ip: a.ip,
-          user: (w = a.user) == null ? void 0 : w.username
+          user: (m = a.user) == null ? void 0 : m.username
         })), !a.user && this.loginProtectedFlows.includes(E.AuthorizationCode))
           return h.redirect(
             302,
@@ -5866,11 +5866,11 @@ class we extends Oe {
           );
         const { url: f, error: p, error_description: v } = await this.startAuthorizationCodeFlow(a.query.scope);
         if (p || !f) {
-          const m = l.fromOAuthError(
+          const w = l.fromOAuthError(
             p ?? "server_error",
             v
           );
-          return await this.errorFn(this.server, a, h, m);
+          return await this.errorFn(this.server, a, h, w);
         }
         return d.logger.debug(c({
           msg: "Authorization code flow: redirecting",
@@ -5882,23 +5882,36 @@ class we extends Oe {
       let f = await o.sessionAdapter.getSessionData(a, this.sessionDataName);
       if (f && f.id_payload) {
         let p = f.expires_at;
-        p && p > Date.now() && f.id_payload.sub && (a.user = {
-          id: f.id_payload.userid ?? f.id_payload.sub,
-          username: f.id_payload.sub,
-          state: f.id_payload.state ?? "active"
-        }, a.idTokenPayload = f.id_payload, a.authType = "oidc");
+        if (p && p > Date.now() && f.id_payload.sub) {
+          a.user = {
+            id: f.id_payload.userid ?? f.id_payload.sub,
+            username: f.id_payload.sub,
+            state: f.id_payload.state ?? "active"
+          }, a.idTokenPayload = f.id_payload;
+          let v;
+          try {
+            v = await this.userCreationFn(
+              f.id_payload,
+              this.userStorage,
+              this.userMatchField,
+              this.idTokenMatchField
+            ), a.user = v, a.authType = v ? "oidc" : void 0;
+          } catch (m) {
+            d.logger.error(c({ cerr: m })), a.user = void 0, a.authType = void 0;
+          }
+        }
       }
       this.testMiddleware && (this.requestObj = a);
     }), this.validFlows.includes(E.AuthorizationCodeWithPKCE) && this.server.app.get(
       this.prefix + "authzcodeflowpkce",
       async (a, h) => {
-        var w;
+        var m;
         if (d.logger.info(c({
           msg: "Page visit",
           method: "GET",
           url: this.prefix + "authzcodeflowpkce",
           ip: a.ip,
-          user: (w = a.user) == null ? void 0 : w.username
+          user: (m = a.user) == null ? void 0 : m.username
         })), !a.user && this.loginProtectedFlows.includes(E.AuthorizationCodeWithPKCE))
           return h.redirect(
             302,
@@ -5909,11 +5922,11 @@ class we extends Oe {
           !0
         );
         if (p || !f) {
-          const m = l.fromOAuthError(
+          const w = l.fromOAuthError(
             p ?? "server_error",
             v
           );
-          return await this.errorFn(this.server, a, h, m);
+          return await this.errorFn(this.server, a, h, w);
         }
         return h.redirect(f);
       }
@@ -5941,7 +5954,7 @@ class we extends Oe {
         f.id_token && (this.validateIdToken(f.id_token) || (f.error = "access_denied", f.error_description = "Invalid ID token received"));
         try {
           if (f.error) {
-            const w = l.fromOAuthError(
+            const m = l.fromOAuthError(
               f.error,
               f.error_description
             );
@@ -5949,17 +5962,17 @@ class we extends Oe {
               this.server,
               a,
               h,
-              w
+              m
             );
           }
           return await this.receiveTokenFn(f, this, a, h);
-        } catch (w) {
-          const m = l.asCrossauthError(w);
+        } catch (m) {
+          const w = l.asCrossauthError(m);
           return d.logger.error(c({
             msg: "Error receiving token",
-            cerr: m,
+            cerr: w,
             user: (v = a.user) == null ? void 0 : v.user
-          })), d.logger.debug(c({ err: w })), await this.errorFn(this.server, a, h, m);
+          })), d.logger.debug(c({ err: m })), await this.errorFn(this.server, a, h, w);
         }
       }
     ), this.validFlows.includes(E.ClientCredentials) && this.server.app.post(
@@ -5973,49 +5986,49 @@ class we extends Oe {
           ip: a.ip,
           user: (f = a.user) == null ? void 0 : f.username
         })), this.server.sessionAdapter) {
-          const { error: w, reply: m } = await o.errorIfCsrfInvalid(
+          const { error: m, reply: w } = await o.errorIfCsrfInvalid(
             a,
             h,
             this.errorFn
           );
-          if (w) return m;
+          if (m) return w;
         }
         if (!a.user && this.loginProtectedFlows.includes(E.ClientCredentials))
           return h.status(401).header(...b).send({ ok: !1, msg: "Access denied" });
         try {
-          const w = await this.clientCredentialsFlow((p = a.body) == null ? void 0 : p.scope);
-          if (w.id_token && (this.validateIdToken(w.id_token) || (w.error = "access_denied", w.error_description = "Invalid ID token received")), w.error) {
-            const m = l.fromOAuthError(
-              w.error,
-              w.error_description
+          const m = await this.clientCredentialsFlow((p = a.body) == null ? void 0 : p.scope);
+          if (m.id_token && (this.validateIdToken(m.id_token) || (m.error = "access_denied", m.error_description = "Invalid ID token received")), m.error) {
+            const w = l.fromOAuthError(
+              m.error,
+              m.error_description
             );
             return await this.errorFn(
               this.server,
               a,
               h,
-              m
+              w
             );
           }
-          return await this.receiveTokenFn(w, this, a, h);
-        } catch (w) {
-          const m = l.asCrossauthError(w);
+          return await this.receiveTokenFn(m, this, a, h);
+        } catch (m) {
+          const w = l.asCrossauthError(m);
           return d.logger.error(c({
             msg: "Error receiving token",
-            cerr: m,
+            cerr: w,
             user: (v = a.user) == null ? void 0 : v.user
-          })), d.logger.debug(c({ err: w })), await this.errorFn(this.server, a, h, m);
+          })), d.logger.debug(c({ err: m })), await this.errorFn(this.server, a, h, w);
         }
       }
     ), this.validFlows.includes(E.RefreshToken) && (this.server.app.post(
       this.prefix + "refreshtokenflow",
       async (a, h) => {
-        var w, m;
+        var m, w;
         d.logger.info(c({
           msg: "Page visit",
           method: "POST",
           url: this.prefix + "refreshtokenflow",
           ip: a.ip,
-          user: (w = a.user) == null ? void 0 : w.username
+          user: (m = a.user) == null ? void 0 : m.username
         }));
         const { error: f, reply: p } = await o.errorIfCsrfInvalid(
           a,
@@ -6078,7 +6091,7 @@ class we extends Oe {
           return d.logger.error(c({
             msg: "Error receiving token",
             cerr: T,
-            user: (m = a.user) == null ? void 0 : m.user
+            user: (w = a.user) == null ? void 0 : w.user
           })), d.logger.debug(c({ err: P })), await this.errorFn(this.server, a, h, T);
         }
       }
@@ -6271,17 +6284,17 @@ class we extends Oe {
               csrfToken: a.csrfToken
             }
           );
-        } catch (w) {
-          const m = l.asCrossauthError(w);
-          return d.logger.debug(c({ err: m })), d.logger.error(c({ msg: "Couldn't delete oauth tokens", cerr: m })), h.view(
+        } catch (m) {
+          const w = l.asCrossauthError(m);
+          return d.logger.debug(c({ err: w })), d.logger.error(c({ msg: "Couldn't delete oauth tokens", cerr: w })), h.view(
             this.deleteTokensPage,
             {
               ok: !1,
               user: (v = a.user) == null ? void 0 : v.username,
               csrfToken: a.csrfToken,
-              errorMessage: m.message,
-              errorCode: m.code,
-              errorCodeName: m.codeName
+              errorMessage: w.message,
+              errorCode: w.code,
+              errorCodeName: w.codeName
             }
           );
         }
@@ -6326,8 +6339,8 @@ class we extends Oe {
             return f.header(...b).status(401).send({ ok: !1, msg: "No csrf token given" });
           let p = !1, v = a;
           a.startsWith("have_") && (v = a.replace("have_", ""), p = !0);
-          let w = v.replace("_token", ""), m = !1;
-          if (this.jwtTokens.includes(w) && (m = h.body.decode ?? !0), !this.server.sessionAdapter) throw new l(
+          let m = v.replace("_token", ""), w = !1;
+          if (this.jwtTokens.includes(m) && (w = h.body.decode ?? !0), !this.server.sessionAdapter) throw new l(
             g.Configuration,
             "Cannot get session data if sessions not enabled"
           );
@@ -6335,7 +6348,7 @@ class we extends Oe {
           if (!P)
             return p ? f.header(...b).status(200).send({ ok: !1 }) : f.header(...b).status(204).send();
           let T = P[v];
-          return m && (T = j(P[v])), T ? p ? f.header(...b).status(200).send({ ok: !0 }) : f.header(...b).status(200).send({ ...T }) : p ? f.header(...b).status(200).send({ ok: !1 }) : f.header(...b).status(204).send();
+          return w && (T = j(P[v])), T ? p ? f.header(...b).status(200).send({ ok: !0 }) : f.header(...b).status(200).send({ ...T }) : p ? f.header(...b).status(200).send({ ok: !1 }) : f.header(...b).status(204).send();
         }
       );
     if (this.server.app.post(
@@ -6358,14 +6371,14 @@ class we extends Oe {
         if (!f)
           return h.header(...b).status(204).send();
         let p = {};
-        for (let w of this.tokenEndpoints) {
-          let m = !1, P = w;
-          w.startsWith("have_") && (P = w.replace("have_", ""), m = !0);
+        for (let m of this.tokenEndpoints) {
+          let w = !1, P = m;
+          m.startsWith("have_") && (P = m.replace("have_", ""), w = !0);
           let T = P.replace("_token", ""), U = !1;
           if (this.jwtTokens.includes(T) && (U = a.body.decode ?? !0), P in f) {
             let _ = f[P];
-            U && (_ = j(f[P])), _ && (p[w] = m ? !0 : _);
-          } else m && (p[w] = !1);
+            U && (_ = j(f[P])), _ && (p[m] = w ? !0 : _);
+          } else w && (p[m] = !1);
         }
         return h.header(...b).status(200).send({ ...p });
       }
@@ -6381,26 +6394,26 @@ class we extends Oe {
       const f = this.bffEndpoints[a].methods, p = this.bffEndpoints[a].matchSubUrls ?? !1;
       let v = h;
       p && (v.endsWith("/") || (v += "/"), v += "*");
-      for (let w in f)
+      for (let m in f)
         this.server.app.route({
-          method: f[w],
+          method: f[m],
           url: this.prefix + this.bffEndpointName + v,
           // was url
-          handler: async (m, P) => {
+          handler: async (w, P) => {
             var _, M;
             d.logger.info(c({
               msg: "Page visit",
-              method: m.method,
-              url: m.url,
-              ip: m.ip,
-              user: (_ = m.user) == null ? void 0 : _.username
+              method: w.method,
+              url: w.url,
+              ip: w.ip,
+              user: (_ = w.user) == null ? void 0 : _.username
             }));
-            const T = m.url.substring(this.prefix.length + this.bffEndpointName.length);
+            const T = w.url.substring(this.prefix.length + this.bffEndpointName.length);
             d.logger.debug(c({ msg: "Resource server URL " + T }));
-            const U = f[w] != "GET" && f[w] != "HEAD" && f[w] != "OPTIONS";
+            const U = f[m] != "GET" && f[m] != "HEAD" && f[m] != "OPTIONS";
             if (this.server.sessionAdapter && U) {
               const { error: I, reply: V } = await o.errorIfCsrfInvalid(
-                m,
+                w,
                 P,
                 this.errorFn
               );
@@ -6411,13 +6424,13 @@ class we extends Oe {
                 g.Configuration,
                 "Cannot get session data if sessions not enabled"
               );
-              const I = await this.server.sessionAdapter.getSessionData(m, this.sessionDataName);
+              const I = await this.server.sessionAdapter.getSessionData(w, this.sessionDataName);
               if (!I)
                 return P.header(...b).status(401).send({ ok: !1 });
               let V = I == null ? void 0 : I.access_token;
               if (I && I.access_token) {
                 const H = await ((M = o.oAuthClient) == null ? void 0 : M.refresh(
-                  m,
+                  w,
                   P,
                   !0,
                   !0,
@@ -6432,13 +6445,13 @@ class we extends Oe {
               };
               V && (X.Authorization = "Bearer " + V);
               let W;
-              m.body ? W = await fetch(this.bffBaseUrl + T, {
+              w.body ? W = await fetch(this.bffBaseUrl + T, {
                 headers: X,
-                method: m.method,
-                body: JSON.stringify(m.body ?? "{}")
+                method: w.method,
+                body: JSON.stringify(w.body ?? "{}")
               }) : W = await fetch(this.bffBaseUrl + T, {
                 headers: X,
-                method: m.method
+                method: w.method
               });
               const Ce = await W.json();
               for (const H of W.headers.entries())
@@ -6599,7 +6612,7 @@ class we extends Oe {
         msg: "Error completing MFA",
         cerr: t,
         user: (n = r.user) == null ? void 0 : n.user,
-        hashedMfaToken: N.hash(r.body.mfa_token)
+        hashedMfaToken: F.hash(r.body.mfa_token)
       })), d.logger.debug(c({ err: t })), o ? await this.errorFn(
         this.server,
         r,
@@ -6634,7 +6647,7 @@ class we extends Oe {
         msg: "Error completing MFA",
         cerr: t,
         user: (n = r.user) == null ? void 0 : n.user,
-        hashedMfaToken: N.hash(r.body.mfa_token)
+        hashedMfaToken: F.hash(r.body.mfa_token)
       })), d.logger.debug(c({ err: t })), o ? await this.errorFn(
         this.server,
         r,
@@ -7404,7 +7417,7 @@ const K = class K {
   getHashOfSessionId(e) {
     if (!e.sessionId) return "";
     try {
-      return N.hash(e.sessionId);
+      return F.hash(e.sessionId);
     } catch {
     }
     return "";