@crossauth/fastify 0.0.29 → 0.0.30

package/dist/index.js

@@ -93,8 +93,8 @@ class De {
           return await this.updateUser(
             e,
             o,
-            (s, i, n) => {
-              const t = n ? "Please click on the link in your email to verify your email address." : "Your details have been updated";
+            (s, i, a) => {
+              const t = a ? "Please click on the link in your email to verify your email address." : "Your details have been updated";
               return s.view(this.updateUserPage, {
                 csrfToken: e.csrfToken,
                 message: t,
@@ -106,19 +106,19 @@ class De {
         } catch (s) {
           const i = l.asCrossauthError(s);
           d.logger.error(c({ msg: "Update user failure", user: e.body.username, errorCodeName: i.codeName, errorCode: i.code })), d.logger.debug(c({ err: s }));
-          let n = {};
+          let a = {};
           for (let t in e.body)
-            t.startsWith("user_") && (n[t] = e.body[t]);
-          return this.sessionServer.handleError(s, e, o, (t, a) => t.view(this.updateUserPage, {
+            t.startsWith("user_") && (a[t] = e.body[t]);
+          return this.sessionServer.handleError(s, e, o, (t, n) => t.view(this.updateUserPage, {
             user: e.user,
-            errorMessage: a.message,
-            errorMessages: a.messages,
-            errorCode: a.code,
-            errorCodeName: g[a.code],
+            errorMessage: n.message,
+            errorMessages: n.messages,
+            errorCode: n.code,
+            errorCodeName: g[n.code],
             csrfToken: e.csrfToken,
             urlPrefix: this.prefix,
             allowedFactor2: this.sessionServer.allowedFactor2Details(),
-            ...n
+            ...a
           }));
         }
       }
@@ -144,25 +144,25 @@ class De {
           return await this.updateUser(
             e,
             o,
-            (i, n, t) => i.header(...N).send({
+            (i, a, t) => i.header(...N).send({
               ok: !0,
               emailVerificationRequired: t
             })
           );
         } catch (i) {
-          const n = l.asCrossauthError(i);
+          const a = l.asCrossauthError(i);
           return d.logger.error(c({
             msg: "Update user failure",
             user: (s = e.user) == null ? void 0 : s.username,
-            errorCodeName: n.codeName,
-            errorCode: n.code
-          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, a) => {
+            errorCodeName: a.codeName,
+            errorCode: a.code
+          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, n) => {
             t.status(this.sessionServer.errorStatus(i)).header(...N).send({
               ok: !1,
-              errorMessage: a.message,
-              errorMessages: a.messages,
-              errorCode: a.code,
-              errorCodeName: g[a.code]
+              errorMessage: n.message,
+              errorMessages: n.messages,
+              errorCode: n.code,
+              errorCodeName: g[n.code]
             });
           }, !0);
         }
@@ -184,8 +184,8 @@ class De {
           ip: e.ip,
           user: (s = e.user) == null ? void 0 : s.username
         })), !this.sessionServer.isSessionUser(e) || !e.user) {
-          const n = await this.sessionServer.getSessionData(e, "factor2change");
-          if (!(n != null && n.username) && !this.sessionServer.isSessionUser(e))
+          const a = await this.sessionServer.getSessionData(e, "factor2change");
+          if (!(a != null && a.username) && !this.sessionServer.isSessionUser(e))
             return y.sendPageError(
               o,
               401,
@@ -225,30 +225,30 @@ class De {
           return await this.changeFactor2(
             e,
             o,
-            (i, n, t) => n.factor2 ? i.view(this.configureFactor2Page, {
-              csrfToken: n.csrfToken,
+            (i, a, t) => a.factor2 ? i.view(this.configureFactor2Page, {
+              csrfToken: a.csrfToken,
               next: e.body.next ?? this.sessionServer.loginRedirect,
-              ...n.userData
+              ...a.userData
             }) : i.view(this.configureFactor2Page, {
               message: "Two factor authentication has been updated",
               next: e.body.next ?? this.sessionServer.loginRedirect,
-              csrfToken: n.csrfToken
+              csrfToken: a.csrfToken
             })
           );
         } catch (i) {
-          const n = l.asCrossauthError(i);
+          const a = l.asCrossauthError(i);
           return d.logger.error(c({
             msg: "Change two factor authentication failure",
             user: (s = e.user) == null ? void 0 : s.username,
-            errorCodeName: n.codeName,
-            errorCode: n.code
-          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, a) => {
+            errorCodeName: a.codeName,
+            errorCode: a.code
+          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, n) => {
             var h;
             return t.view(this.changeFactor2Page, {
-              errorMessage: a.message,
-              errorMessages: a.messages,
-              errorCode: a.code,
-              errorCodeName: g[a.code],
+              errorMessage: n.message,
+              errorMessages: n.messages,
+              errorCode: n.code,
+              errorCodeName: g[n.code],
               csrfToken: e.csrfToken,
               urlPrefix: this.prefix,
               allowedFactor2: this.sessionServer.allowedFactor2Details(),
@@ -280,24 +280,24 @@ class De {
           return await this.changeFactor2(
             e,
             o,
-            (i, n, t) => i.header(...N).send({
+            (i, a, t) => i.header(...N).send({
               ok: !0,
-              ...n.userData
+              ...a.userData
             })
           );
         } catch (i) {
-          const n = l.asCrossauthError(i);
+          const a = l.asCrossauthError(i);
           return d.logger.error(c({
             msg: "Change factor2 failure",
             user: (s = e.user) == null ? void 0 : s.username,
-            errorCodeName: n.codeName,
-            errorCode: n.code
-          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, a) => t.status(this.sessionServer.errorStatus(i)).header(...N).send({
+            errorCodeName: a.codeName,
+            errorCode: a.code
+          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, n) => t.status(this.sessionServer.errorStatus(i)).header(...N).send({
             ok: !1,
-            errorMessage: a.message,
-            errorMessages: a.messages,
-            errorCode: a.code,
-            errorCodeName: g[a.code]
+            errorMessage: n.message,
+            errorMessages: n.messages,
+            errorCode: n.code,
+            errorCodeName: g[n.code]
           }), !0);
         }
       }
@@ -349,7 +349,7 @@ class De {
           return await this.changePassword(
             e,
             o,
-            (i, n) => e.body.next ? i.redirect(e.body.next) : i.view(this.changePasswordPage, {
+            (i, a) => e.body.next ? i.redirect(e.body.next) : i.view(this.changePasswordPage, {
               csrfToken: e.csrfToken,
               message: "Your password has been changed.",
               urlPrefix: this.prefix,
@@ -358,17 +358,17 @@ class De {
             })
           );
         } catch (i) {
-          const n = l.asCrossauthError(i);
+          const a = l.asCrossauthError(i);
           return d.logger.error(c({
             msg: "Change password failure",
             user: (s = e.user) == null ? void 0 : s.username,
-            errorCodeName: n.codeName,
-            errorCode: n.code
-          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, a) => t.view(this.changePasswordPage, {
-            errorMessage: a.message,
-            errorMessages: a.messages,
-            errorCode: a.code,
-            errorCodeName: g[a.code],
+            errorCodeName: a.codeName,
+            errorCode: a.code
+          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, n) => t.view(this.changePasswordPage, {
+            errorMessage: n.message,
+            errorMessages: n.messages,
+            errorCode: n.code,
+            errorCodeName: g[n.code],
             csrfToken: e.csrfToken,
             urlPrefix: this.prefix,
             next: e.body.next,
@@ -397,23 +397,23 @@ class De {
           return await this.changePassword(
             e,
             o,
-            (i, n) => i.header(...N).send({
+            (i, a) => i.header(...N).send({
               ok: !0
             })
           );
         } catch (i) {
-          const n = l.asCrossauthError(i);
+          const a = l.asCrossauthError(i);
           return d.logger.error(c({
             msg: "Change password failure",
             user: (s = e.user) == null ? void 0 : s.username,
-            errorCodeName: n.codeName,
-            errorCode: n.code
-          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, a) => t.status(this.sessionServer.errorStatus(i)).header(...N).send({
+            errorCodeName: a.codeName,
+            errorCode: a.code
+          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, n) => t.status(this.sessionServer.errorStatus(i)).header(...N).send({
             ok: !1,
-            errorMessage: a.message,
-            errorMessages: a.messages,
-            errorCode: a.code,
-            errorCodeName: g[a.code]
+            errorMessage: n.message,
+            errorMessages: n.messages,
+            errorCode: n.code,
+            errorCodeName: g[n.code]
           }), !0);
         }
       }
@@ -437,7 +437,7 @@ class De {
           return await this.reconfigureFactor2(
             e,
             o,
-            (s, i, n) => s.view(this.configureFactor2Page, {
+            (s, i, a) => s.view(this.configureFactor2Page, {
               ...i,
               next: e.query.next ?? this.sessionServer.loginRedirect
             })
@@ -449,7 +449,7 @@ class De {
             user: (r = e.user) == null ? void 0 : r.username,
             errorCodeName: i.codeName,
             errorCode: i.code
-          })), d.logger.debug(c({ err: s })), this.sessionServer.handleError(s, e, o, (n, t) => n.view(this.configureFactor2Page, {
+          })), d.logger.debug(c({ err: s })), this.sessionServer.handleError(s, e, o, (a, t) => a.view(this.configureFactor2Page, {
             errorMessage: t.message,
             errorMessages: t.messages,
             errorCode: t.code,
@@ -475,8 +475,8 @@ class De {
             e,
             o,
             (s, i) => {
-              const n = i != null && i.factor2 ? this.sessionServer.authenticators[i.factor2] : void 0;
-              return !this.sessionServer.isSessionUser(e) && this.enableEmailVerification && (n == null || n.skipEmailVerificationOnSignup() != !0) ? s.view(this.signupPage, {
+              const a = i != null && i.factor2 ? this.sessionServer.authenticators[i.factor2] : void 0;
+              return !this.sessionServer.isSessionUser(e) && this.enableEmailVerification && (a == null || a.skipEmailVerificationOnSignup() != !0) ? s.view(this.signupPage, {
                 next: r,
                 csrfToken: e.csrfToken,
                 urlPrefix: this.prefix,
@@ -494,14 +494,14 @@ class De {
           d.logger.debug(c({ err: s }));
           try {
             if (!e.sessionId) {
-              const a = l.asCrossauthError(s);
-              return d.logger.error(c({ msg: "Signup second factor failure", errorCodeName: a.codeName, errorCode: a.code })), d.logger.error(c({ msg: "Session not defined during two factor process" })), o.status(500).view(this.sessionServer.errorPage, { status: 500, errorMessage: "An unknown error occurred", errorCode: g.UnknownError, errorCodeName: "UnknownError" });
+              const n = l.asCrossauthError(s);
+              return d.logger.error(c({ msg: "Signup second factor failure", errorCodeName: n.codeName, errorCode: n.code })), d.logger.error(c({ msg: "Session not defined during two factor process" })), o.status(500).view(this.sessionServer.errorPage, { status: 500, errorMessage: "An unknown error occurred", errorCode: g.UnknownError, errorCodeName: "UnknownError" });
             }
             let i = (await this.sessionServer.sessionManager.dataForSessionId(e.sessionId))["2fa"];
-            const n = l.asCrossauthError(s);
-            d.logger.error(c({ msg: "Signup two factor failure", user: i == null ? void 0 : i.username, errorCodeName: n.codeName, errorCode: n.code }));
+            const a = l.asCrossauthError(s);
+            d.logger.error(c({ msg: "Signup two factor failure", user: i == null ? void 0 : i.username, errorCodeName: a.codeName, errorCode: a.code }));
             const { userData: t } = await this.sessionServer.sessionManager.repeatTwoFactorSignup(e.sessionId);
-            return this.sessionServer.handleError(s, e, o, (a, h) => a.view(this.configureFactor2Page, {
+            return this.sessionServer.handleError(s, e, o, (n, h) => n.view(this.configureFactor2Page, {
               errorMessage: h.message,
               errorMessages: h.messages,
               errorCode: h.code,
@@ -509,7 +509,7 @@ class De {
               urlPrefix: this.prefix,
               next: r,
               ...t,
-              csrfToken: this.sessionServer.csrfToken(e, a)
+              csrfToken: this.sessionServer.csrfToken(e, n)
             }));
           } catch (i) {
             return d.logger.error(c({ err: i })), o.status(500).view(this.sessionServer.errorPage, {
@@ -542,24 +542,24 @@ class De {
           return await this.reconfigureFactor2(
             o,
             r,
-            (i, n, t) => i.header(...N).send({
+            (i, a, t) => i.header(...N).send({
               ok: !0,
-              ...n
+              ...a
             })
           );
         } catch (i) {
-          const n = l.asCrossauthError(i);
+          const a = l.asCrossauthError(i);
           d.logger.error(c({
             msg: "Configure 2FA configuration failure",
             user: (s = o.user) == null ? void 0 : s.username,
-            errorCodeName: n.codeName,
-            errorCode: n.code
-          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, o, r, (t, a) => {
+            errorCodeName: a.codeName,
+            errorCode: a.code
+          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, o, r, (t, n) => {
             t.status(this.sessionServer.errorStatus(i)).header(...N).send({
               ok: !1,
-              errorMessage: a.message,
-              errorMessages: a.messages,
-              errorCode: g[a.code]
+              errorMessage: n.message,
+              errorMessages: n.messages,
+              errorCode: g[n.code]
             });
           });
         }
@@ -579,27 +579,27 @@ class De {
           return await this.configureFactor2(
             o,
             r,
-            (i, n) => {
+            (i, a) => {
               const t = {
                 ok: !0,
-                user: n
+                user: a
               };
               return this.sessionServer.isSessionUser(o) || (t.emailVerificationNeeded = this.enableEmailVerification), i.header(...N).send(t);
             }
           );
         } catch (i) {
-          const n = l.asCrossauthError(i);
+          const a = l.asCrossauthError(i);
           d.logger.error(c({
             msg: "Configure 2FA configuration failure",
             user: (s = o.user) == null ? void 0 : s.username,
-            errorCodeName: n.codeName,
-            errorCode: n.code
-          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, o, r, (t, a) => {
+            errorCodeName: a.codeName,
+            errorCode: a.code
+          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, o, r, (t, n) => {
             t.status(this.sessionServer.errorStatus(i)).header(...N).send({
               ok: !1,
-              errorMessage: a.message,
-              errorMessages: a.messages,
-              errorCode: g[a.code]
+              errorMessage: n.message,
+              errorMessages: n.messages,
+              errorCode: g[n.code]
             });
           });
         }
@@ -650,17 +650,17 @@ class De {
           return d.logger.error(c({
             msg: "Request password reset faiulure user failure",
             email: e.body.email
-          })), d.logger.debug(c({ err: s })), this.sessionServer.handleError(s, e, o, (i, n) => n.code == g.EmailNotExist ? i.view(this.requestPasswordResetPage, {
+          })), d.logger.debug(c({ err: s })), this.sessionServer.handleError(s, e, o, (i, a) => a.code == g.EmailNotExist ? i.view(this.requestPasswordResetPage, {
             csrfToken: e.csrfToken,
             message: r,
             urlPrefix: this.prefix,
             required: e.body.required,
             next: e.body.next
           }) : e.body.next ? i.redirect(e.body.next) : i.view(this.requestPasswordResetPage, {
-            errorMessage: n.message,
-            errorMessages: n.messages,
-            errorCode: n.code,
-            errorCodeName: g[n.code],
+            errorMessage: a.message,
+            errorMessages: a.messages,
+            errorCode: a.code,
+            errorCodeName: g[a.code],
             email: e.body.email,
             csrfToken: e.csrfToken,
             urlPrefix: this.prefix
@@ -697,13 +697,13 @@ class De {
             email: e.body.email,
             errorCodeName: s.codeName,
             errorCode: s.code
-          })), d.logger.debug(c({ err: r })), this.sessionServer.handleError(r, e, o, (i, n) => {
+          })), d.logger.debug(c({ err: r })), this.sessionServer.handleError(r, e, o, (i, a) => {
             i.status(this.sessionServer.errorStatus(r)).header(...N).send({
               ok: !1,
-              errorMessage: n.message,
-              errorMessages: n.messages,
-              errorCode: n.code,
-              errorCodeName: g[n.code]
+              errorMessage: a.message,
+              errorMessages: a.messages,
+              errorCode: a.code,
+              errorCodeName: g[a.code]
             });
           }, !0);
         }
@@ -764,11 +764,11 @@ class De {
             hashedToken: F.hash(e.body.token),
             errorCodeName: s.codeName,
             errorCode: s.code
-          })), d.logger.debug(c({ err: r })), this.sessionServer.handleError(r, e, o, (i, n) => i.view(this.resetPasswordPage, {
-            errorMessage: n.message,
-            errorMessages: n.messages,
-            errorCode: n.code,
-            errorCodeName: g[n.code],
+          })), d.logger.debug(c({ err: r })), this.sessionServer.handleError(r, e, o, (i, a) => i.view(this.resetPasswordPage, {
+            errorMessage: a.message,
+            errorMessages: a.messages,
+            errorCode: a.code,
+            errorCodeName: g[a.code],
             csrfToken: e.csrfToken,
             urlPrefix: this.prefix,
             token: e.body.token
@@ -805,13 +805,13 @@ class De {
             hashedToken: F.hash(e.body.token),
             errorCodeName: s.codeName,
             errorCode: s.code
-          })), d.logger.debug(c({ err: r })), this.sessionServer.handleError(r, e, o, (i, n) => {
+          })), d.logger.debug(c({ err: r })), this.sessionServer.handleError(r, e, o, (i, a) => {
             i.status(this.sessionServer.errorStatus(r)).header(...N).send({
               ok: !1,
-              errorMessage: n.message,
-              errorMessages: n.messages,
-              errorCode: n.code,
-              errorCodeName: g[n.code]
+              errorMessage: a.message,
+              errorMessages: a.messages,
+              errorCode: a.code,
+              errorCodeName: g[a.code]
             });
           }, !0);
         }
@@ -847,11 +847,11 @@ class De {
             hashedToken: F.hash(e.params.token),
             errorCodeName: s.codeName,
             errorCode: s.code
-          })), d.logger.debug(c({ err: r })), this.sessionServer.handleError(r, e, o, (i, n) => i.view(this.sessionServer.errorPage, {
-            errorCode: n.code,
-            errorCodeName: g[n.code],
-            errorMessage: n.message,
-            errorMessages: n.messages,
+          })), d.logger.debug(c({ err: r })), this.sessionServer.handleError(r, e, o, (i, a) => i.view(this.sessionServer.errorPage, {
+            errorCode: a.code,
+            errorCodeName: g[a.code],
+            errorMessage: a.message,
+            errorMessages: a.messages,
             urlPrefix: this.prefix
           }));
         }
@@ -887,13 +887,13 @@ class De {
             hashedToken: F.hash(e.params.token),
             errorCodeName: s.codeName,
             errorCode: s.code
-          })), d.logger.debug(c({ err: r })), this.sessionServer.handleError(r, e, o, (i, n) => {
+          })), d.logger.debug(c({ err: r })), this.sessionServer.handleError(r, e, o, (i, a) => {
             i.status(this.sessionServer.errorStatus(r)).header(...N).send({
               ok: !1,
-              errorMessage: n.message,
-              errorMessages: n.messages,
-              errorCode: n.code,
-              errorCodeName: g[n.code]
+              errorMessage: a.message,
+              errorMessages: a.messages,
+              errorCode: a.code,
+              errorCodeName: g[a.code]
             });
           });
         }
@@ -919,9 +919,9 @@ class De {
         try {
           if (!this.sessionServer.userStorage) throw new l(g.Configuration, "Cannot call delete user unless a user storage is provided");
           r = (await this.sessionServer.userStorage.getUserById(e.user.id)).user;
-        } catch (n) {
-          const t = l.asCrossauthError(n);
-          return d.logger.debug(c({ err: n })), o.status(t.httpStatus).view(this.sessionServer.errorPage, {
+        } catch (a) {
+          const t = l.asCrossauthError(a);
+          return d.logger.debug(c({ err: a })), o.status(t.httpStatus).view(this.sessionServer.errorPage, {
             errorMessage: t.message,
             errorMessages: t.messages,
             errorCode: t.code,
@@ -955,9 +955,9 @@ class De {
           return await this.deleteUser(
             e,
             o,
-            (n) => {
+            (a) => {
               var t;
-              return n.view(this.deleteUserPage, {
+              return a.view(this.deleteUserPage, {
                 message: "User deleted",
                 csrfToken: e.csrfToken,
                 urlPrefix: this.prefix,
@@ -967,17 +967,17 @@ class De {
               });
             }
           );
-        } catch (n) {
-          const t = l.asCrossauthError(n);
+        } catch (a) {
+          const t = l.asCrossauthError(a);
           return d.logger.error(c({
             msg: "Failed deleting user",
             user: (i = e.user) == null ? void 0 : i.username,
             errorCodeName: t.codeName,
             errorCode: t.code
-          })), d.logger.debug(c({ err: n })), this.sessionServer.handleError(n, e, o, (a, h) => {
+          })), d.logger.debug(c({ err: a })), this.sessionServer.handleError(a, e, o, (n, h) => {
             var v;
-            const p = l.asCrossauthError(n).httpStatus;
-            return a.status(p).view(this.deleteUserPage, {
+            const m = l.asCrossauthError(a).httpStatus;
+            return n.status(m).view(this.deleteUserPage, {
               errorMessage: h.message,
               errorMessages: h.messages,
               errorCode: h.code,
@@ -1014,26 +1014,26 @@ class De {
             e,
             o,
             (i) => {
-              var n;
+              var a;
               return i.header(...N).send({
                 ok: !0,
-                userid: (n = e.user) == null ? void 0 : n.id
+                userid: (a = e.user) == null ? void 0 : a.id
               });
             }
           );
         } catch (i) {
-          const n = l.asCrossauthError(i);
+          const a = l.asCrossauthError(i);
           d.logger.error(c({
             msg: "Delete user failure",
             user: (s = e.user) == null ? void 0 : s.username,
-            errorCodeName: n.codeName,
-            errorCode: n.code
-          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, a) => {
+            errorCodeName: a.codeName,
+            errorCode: a.code
+          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, n) => {
             t.status(this.sessionServer.errorStatus(i)).header(...N).send({
               ok: !1,
-              errorMessage: a.message,
-              errorMessages: a.messages,
-              errorCode: g[a.code]
+              errorMessage: n.message,
+              errorMessages: n.messages,
+              errorCode: g[n.code]
             });
           });
         }
@@ -1060,17 +1060,17 @@ class De {
     let i = this.sessionServer.validateUserFn(s);
     if (i.length > 0)
       throw new l(g.FormEntry, i);
-    let n = await this.sessionServer.sessionManager.updateUser(e.user, s);
-    return r(o, e.user, n.emailVerificationTokenSent);
+    let a = await this.sessionServer.sessionManager.updateUser(e.user, s);
+    return r(o, e.user, a.emailVerificationTokenSent);
   }
   async changeFactor2(e, o, r) {
     if (!this.sessionServer.userStorage) throw new l(g.Configuration, "Cannot call changeFactor2 unless a user storage is provided");
     let s;
     if (!this.sessionServer.isSessionUser(e) || !e.user) {
-      const a = await this.sessionServer.getSessionData(e, "factor2change");
-      if (a != null && a.username)
+      const n = await this.sessionServer.getSessionData(e, "factor2change");
+      if (n != null && n.username)
         s = (await this.sessionServer.userStorage.getUserByUsername(
-          a == null ? void 0 : a.username,
+          n == null ? void 0 : n.username,
           {
             skipActiveCheck: !0,
             skipEmailVerifiedCheck: !0
@@ -1093,11 +1093,11 @@ class De {
         "Illegal second factor " + e.body.factor2 + " requested"
       );
     (e.body.factor2 == "none" || e.body.factor2 == "") && (i = void 0);
-    const n = await this.sessionServer.sessionManager.initiateTwoFactorSetup(s, i, e.sessionId);
+    const a = await this.sessionServer.sessionManager.initiateTwoFactorSetup(s, i, e.sessionId);
     let t = {
       factor2: i,
-      userData: n,
-      username: n.username,
+      userData: a,
+      username: a.username,
       next: e.body.next ?? this.sessionServer.loginRedirect,
       csrfToken: e.csrfToken
     };
@@ -1107,10 +1107,10 @@ class De {
     if (!this.sessionServer.userStorage) throw new l(g.Configuration, "Cannot call changePassword unless a user storage is provided");
     let s, i = !1;
     if (!this.sessionServer.isSessionUser(e) || !e.user) {
-      const m = await this.sessionServer.getSessionData(e, "passwordchange");
-      if (m != null && m.username) {
+      const p = await this.sessionServer.getSessionData(e, "passwordchange");
+      if (p != null && p.username) {
         if (s = (await this.sessionServer.userStorage.getUserByUsername(
-          m == null ? void 0 : m.username,
+          p == null ? void 0 : p.username,
           {
             skipActiveCheck: !0,
             skipEmailVerifiedCheck: !0
@@ -1125,20 +1125,20 @@ class De {
       s = e.user;
     } else
       throw new l(g.InsufficientPriviledges);
-    const n = this.sessionServer.authenticators[s.factor1], t = n.secretNames();
-    let a = {}, h = {}, f = {};
-    for (let m in e.body)
-      if (m.startsWith("new_")) {
-        const w = m.replace(/^new_/, "");
-        t.includes(w) && (h[w] = e.body[m]);
-      } else if (m.startsWith("old_")) {
-        const w = m.replace(/^old_/, "");
-        t.includes(w) && (a[w] = e.body[m]);
-      } else if (m.startsWith("repeat_")) {
-        const w = m.replace(/^repeat_/, "");
-        t.includes(w) && (f[w] = e.body[m]);
-      }
-    if (Object.keys(f).length === 0 && (f = void 0), n.validateSecrets(h).length > 0)
+    const a = this.sessionServer.authenticators[s.factor1], t = a.secretNames();
+    let n = {}, h = {}, f = {};
+    for (let p in e.body)
+      if (p.startsWith("new_")) {
+        const w = p.replace(/^new_/, "");
+        t.includes(w) && (h[w] = e.body[p]);
+      } else if (p.startsWith("old_")) {
+        const w = p.replace(/^old_/, "");
+        t.includes(w) && (n[w] = e.body[p]);
+      } else if (p.startsWith("repeat_")) {
+        const w = p.replace(/^repeat_/, "");
+        t.includes(w) && (f[w] = e.body[p]);
+      }
+    if (Object.keys(f).length === 0 && (f = void 0), a.validateSecrets(h).length > 0)
       throw new l(g.PasswordFormat);
     const v = s.state;
     try {
@@ -1147,11 +1147,11 @@ class De {
         1,
         h,
         f,
-        a
+        n
       );
-    } catch (m) {
-      const w = l.asCrossauthError(m);
-      if (d.logger.debug(c({ err: m })), i)
+    } catch (p) {
+      const w = l.asCrossauthError(p);
+      if (d.logger.debug(c({ err: p })), i)
         try {
           await this.sessionServer.userStorage.updateUser({ id: s.id, state: v });
         } catch (P) {
@@ -1177,7 +1177,7 @@ class De {
       !0,
       e,
       o,
-      (i, n) => r(i, n)
+      (i, a) => r(i, a)
     ) : r(o, s);
   }
   async reconfigureFactor2(e, o, r) {
@@ -1225,20 +1225,20 @@ class De {
   async resetPassword(e, o, r) {
     if (!e.csrfToken)
       throw new l(g.InvalidCsrf);
-    const s = e.body.token, i = await this.sessionServer.sessionManager.userForPasswordResetToken(s), n = this.sessionServer.authenticators[i.factor1], t = n.secretNames();
-    let a = {}, h = {};
+    const s = e.body.token, i = await this.sessionServer.sessionManager.userForPasswordResetToken(s), a = this.sessionServer.authenticators[i.factor1], t = a.secretNames();
+    let n = {}, h = {};
     for (let v in e.body)
       if (v.startsWith("new_")) {
-        const m = v.replace(/^new_/, "");
-        t.includes(m) && (a[m] = e.body[v]);
+        const p = v.replace(/^new_/, "");
+        t.includes(p) && (n[p] = e.body[v]);
       } else if (v.startsWith("repeat_")) {
-        const m = v.replace(/^repeat_/, "");
-        t.includes(m) && (h[m] = e.body[v]);
+        const p = v.replace(/^repeat_/, "");
+        t.includes(p) && (h[p] = e.body[v]);
       }
-    if (Object.keys(h).length === 0 && (h = void 0), n.validateSecrets(a).length > 0)
+    if (Object.keys(h).length === 0 && (h = void 0), a.validateSecrets(n).length > 0)
       throw new l(g.PasswordFormat);
-    const p = await this.sessionServer.sessionManager.resetSecret(s, 1, a, h);
-    return p.state != O.factor2ResetNeeded ? this.sessionServer.loginWithUser(p, !0, e, o, r) : r(o);
+    const m = await this.sessionServer.sessionManager.resetSecret(s, 1, n, h);
+    return m.state != O.factor2ResetNeeded ? this.sessionServer.loginWithUser(m, !0, e, o, r) : r(o);
   }
   async verifyEmail(e, o, r) {
     if (!this.enableEmailVerification) throw new l(
@@ -1270,9 +1270,9 @@ async function ze(k, e) {
       const { user: i } = await e.getUserByEmail(k);
       o.push(i);
     } catch (i) {
-      const n = l.asCrossauthError(i);
-      if (n.code != g.UserNotExist)
-        throw d.logger.debug(c({ err: n })), s;
+      const a = l.asCrossauthError(i);
+      if (a.code != g.UserNotExist)
+        throw d.logger.debug(c({ err: a })), s;
     }
   }
   return o;
@@ -1331,22 +1331,22 @@ class He {
           return d.logger.debug(c({ msg: "Next page " + r })), await this.createUser(
             e,
             o,
-            (i, n, t) => i.redirect(302, r)
+            (i, a, t) => i.redirect(302, r)
           );
         } catch (i) {
-          const n = l.asCrossauthError(i);
+          const a = l.asCrossauthError(i);
           return d.logger.error(c({
             msg: "Signup failure",
             user: e.body.username,
-            errorCodeName: n.codeName,
-            errorCode: n.code
-          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, a) => {
+            errorCodeName: a.codeName,
+            errorCode: a.code
+          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, n) => {
             const f = l.asCrossauthError(i).httpStatus;
             return t.status(f).view(this.adminCreateUserPage, {
-              errorMessage: a.message,
-              errorMessages: a.messages,
-              errorCode: a.code,
-              errorCodeName: g[a.code],
+              errorMessage: n.message,
+              errorMessages: n.messages,
+              errorCode: n.code,
+              errorCodeName: g[n.code],
               next: r,
               persist: e.body.persist,
               csrfToken: e.csrfToken,
@@ -1379,25 +1379,25 @@ class He {
           return await this.createUser(
             e,
             o,
-            (i, n, t) => i.header(...R).send({
+            (i, a, t) => i.header(...R).send({
               ok: !0,
               user: t,
-              ...n.userData
+              ...a.userData
             })
           );
         } catch (i) {
-          const n = l.asCrossauthError(i);
+          const a = l.asCrossauthError(i);
           d.logger.error(c({
             msg: "Create user failure",
             user: (s = e.user) == null ? void 0 : s.username,
-            errorCodeName: n.codeName,
-            errorCode: n.code
-          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, a) => {
+            errorCodeName: a.codeName,
+            errorCode: a.code
+          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, n) => {
             t.status(this.sessionServer.errorStatus(i)).header(...R).send({
               ok: !1,
-              errorMessage: a.message,
-              errorMessages: a.messages,
-              errorCode: g[a.code]
+              errorMessage: n.message,
+              errorMessages: n.messages,
+              errorCode: g[n.code]
             });
           });
         }
@@ -1428,7 +1428,7 @@ class He {
             s,
             i
           );
-          let n = {
+          let a = {
             urlPrefix: this.adminPrefix,
             skip: s,
             take: i,
@@ -1436,7 +1436,7 @@ class He {
             havePrevious: s > 0,
             haveNext: i != null && r.length == i
           };
-          return e.query.next && (n.next = e.query.next), o.view(this.adminSelectUserPage, n);
+          return e.query.next && (a.next = e.query.next), o.view(this.adminSelectUserPage, a);
         } catch (r) {
           const s = l.asCrossauthError(r);
           return d.logger.error(c({ err: r })), y.sendPageError(
@@ -1509,9 +1509,9 @@ class He {
             r,
             e,
             o,
-            (n, t, a, h) => {
+            (a, t, n, h) => {
               let f = "User's details have been updated.";
-              return a ? f = "User's details have been updated and sent and an email verification link." : h && (f = "User's details have been updated and sent and a password reset token sent."), n.view(this.adminUpdateUserPage, {
+              return n ? f = "User's details have been updated and sent and an email verification link." : h && (f = "User's details have been updated and sent and a password reset token sent."), a.view(this.adminUpdateUserPage, {
                 csrfToken: e.csrfToken,
                 message: f,
                 urlPrefix: this.adminPrefix,
@@ -1520,23 +1520,23 @@ class He {
             }
           );
         } catch (i) {
-          const n = l.asCrossauthError(i);
-          return d.logger.error(c({ msg: "Update user failure", user: e.body.username, errorCodeName: n.codeName, errorCode: n.code })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, a) => r ? t.view(this.adminUpdateUserPage, {
+          const a = l.asCrossauthError(i);
+          return d.logger.error(c({ msg: "Update user failure", user: e.body.username, errorCodeName: a.codeName, errorCode: a.code })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, n) => r ? t.view(this.adminUpdateUserPage, {
             user: r,
-            errorMessage: a.message,
-            errorMessages: a.messages,
-            errorCode: a.code,
-            errorCodeName: g[a.code],
+            errorMessage: n.message,
+            errorMessages: n.messages,
+            errorCode: n.code,
+            errorCodeName: g[n.code],
             csrfToken: e.csrfToken,
             urlPrefix: this.adminPrefix,
             allowedFactor2: this.sessionServer.allowedFactor2Details(),
             ...e.body
           }) : y.sendPageError(
             t,
-            n.httpStatus,
+            a.httpStatus,
             this.sessionServer.errorPage,
-            n.message,
-            n
+            a.message,
+            a
           ));
         }
       }
@@ -1561,9 +1561,9 @@ class He {
         try {
           if (!this.sessionServer.userStorage) throw new l(g.Configuration, "Cannot call deleteuser unless a user storage is provided");
           r = (await this.sessionServer.userStorage.getUserById(e.params.id)).user;
-        } catch (n) {
-          const t = l.asCrossauthError(n);
-          return d.logger.debug(c({ err: n })), o.status(t.httpStatus).view(this.sessionServer.errorPage, {
+        } catch (a) {
+          const t = l.asCrossauthError(a);
+          return d.logger.debug(c({ err: a })), o.status(t.httpStatus).view(this.sessionServer.errorPage, {
             errorMessage: t.message,
             errorMessages: t.messages,
             errorCode: t.code,
@@ -1596,7 +1596,7 @@ class He {
           return await this.deleteUser(
             e,
             o,
-            (n) => n.view(this.deleteUserPage, {
+            (a) => a.view(this.deleteUserPage, {
               message: "User deleted",
               csrfToken: e.csrfToken,
               urlPrefix: this.adminPrefix,
@@ -1605,16 +1605,16 @@ class He {
               next: r
             })
           );
-        } catch (n) {
-          const t = l.asCrossauthError(n);
+        } catch (a) {
+          const t = l.asCrossauthError(a);
           return d.logger.error(c({
             msg: "Failed deleting user",
             user: (i = e.user) == null ? void 0 : i.username,
             errorCodeName: t.codeName,
             errorCode: t.code
-          })), d.logger.debug(c({ err: n })), this.sessionServer.handleError(n, e, o, (a, h) => {
-            const p = l.asCrossauthError(n).httpStatus;
-            return a.status(p).view(this.deleteUserPage, {
+          })), d.logger.debug(c({ err: a })), this.sessionServer.handleError(a, e, o, (n, h) => {
+            const m = l.asCrossauthError(a).httpStatus;
+            return n.status(m).view(this.deleteUserPage, {
               errorMessage: h.message,
               errorMessages: h.messages,
               errorCode: h.code,
@@ -1649,25 +1649,25 @@ class He {
         let r;
         try {
           if (!this.sessionServer.userStorage) throw new l(g.Configuration, "Cannot call updateuser unless a user storage is provided");
-          const { user: n } = await this.sessionServer.userStorage.getUserById(e.params.id);
-          return r = n, await this.updateUser(
+          const { user: a } = await this.sessionServer.userStorage.getUserById(e.params.id);
+          return r = a, await this.updateUser(
             r,
             e,
             o,
-            (t, a, h) => t.header(...R).send({
+            (t, n, h) => t.header(...R).send({
               ok: !0,
               emailVerificationRequired: h
             })
           );
-        } catch (n) {
-          const t = l.asCrossauthError(n);
+        } catch (a) {
+          const t = l.asCrossauthError(a);
           return d.logger.error(c({
             msg: "Update user failure",
             user: (i = e.user) == null ? void 0 : i.username,
             errorCodeName: t.codeName,
             errorCode: t.code
-          })), d.logger.debug(c({ err: n })), this.sessionServer.handleError(n, e, o, (a, h) => {
-            a.status(this.sessionServer.errorStatus(n)).header(...R).send({
+          })), d.logger.debug(c({ err: a })), this.sessionServer.handleError(a, e, o, (n, h) => {
+            n.status(this.sessionServer.errorStatus(a)).header(...R).send({
               ok: !1,
               errorMessage: h.message,
               errorMessages: h.messages,
@@ -1734,7 +1734,7 @@ class He {
             r,
             e,
             o,
-            (n, t) => e.body.next ? n.redirect(e.body.next) : n.view(this.adminChangePasswordPage, {
+            (a, t) => e.body.next ? a.redirect(e.body.next) : a.view(this.adminChangePasswordPage, {
               csrfToken: e.csrfToken,
               message: "User's password has been changed.",
               urlPrefix: this.adminPrefix,
@@ -1744,17 +1744,17 @@ class He {
             })
           );
         } catch (i) {
-          const n = l.asCrossauthError(i);
+          const a = l.asCrossauthError(i);
           return d.logger.error(c({
             msg: "Change password failure",
             userid: e.params.id,
-            errorCodeName: n.codeName,
-            errorCode: n.code
-          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, a) => t.view(this.adminChangePasswordPage, {
-            errorMessage: a.message,
-            errorMessages: a.messages,
-            errorCode: a.code,
-            errorCodeName: g[a.code],
+            errorCodeName: a.codeName,
+            errorCode: a.code
+          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, n) => t.view(this.adminChangePasswordPage, {
+            errorMessage: n.message,
+            errorMessages: n.messages,
+            errorCode: n.code,
+            errorCodeName: g[n.code],
             csrfToken: e.csrfToken,
             urlPrefix: this.adminPrefix
           }));
@@ -1781,24 +1781,24 @@ class He {
         let r;
         try {
           if (!this.sessionServer.userStorage) throw new l(g.Configuration, "Cannot call changepassword unless a user storage is provided");
-          const { user: n } = await this.sessionServer.userStorage.getUserById(e.params.id);
-          return r = n, await this.changePassword(
+          const { user: a } = await this.sessionServer.userStorage.getUserById(e.params.id);
+          return r = a, await this.changePassword(
             r,
             e,
             o,
-            (t, a) => t.header(...R).send({
+            (t, n) => t.header(...R).send({
               ok: !0
             })
           );
-        } catch (n) {
-          const t = l.asCrossauthError(n);
+        } catch (a) {
+          const t = l.asCrossauthError(a);
           return d.logger.error(c({
             msg: "Update user failure",
             user: (i = e.user) == null ? void 0 : i.username,
             errorCodeName: t.codeName,
             errorCode: t.code
-          })), d.logger.debug(c({ err: n })), this.sessionServer.handleError(n, e, o, (a, h) => {
-            a.status(this.sessionServer.errorStatus(n)).header(...R).send({
+          })), d.logger.debug(c({ err: a })), this.sessionServer.handleError(a, e, o, (n, h) => {
+            n.status(this.sessionServer.errorStatus(a)).header(...R).send({
               ok: !1,
               errorMessage: h.message,
               errorMessages: h.messages,
@@ -1835,18 +1835,18 @@ class He {
             })
           );
         } catch (i) {
-          const n = l.asCrossauthError(i);
+          const a = l.asCrossauthError(i);
           d.logger.error(c({
             msg: "Delete user failure",
             user: (s = e.user) == null ? void 0 : s.username,
-            errorCodeName: n.codeName,
-            errorCode: n.code
-          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, a) => {
+            errorCodeName: a.codeName,
+            errorCode: a.code
+          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, n) => {
             t.status(this.sessionServer.errorStatus(i)).header(...R).send({
               ok: !1,
-              errorMessage: a.message,
-              errorMessages: a.messages,
-              errorCode: g[a.code]
+              errorMessage: n.message,
+              errorMessages: n.messages,
+              errorCode: g[n.code]
             });
           });
         }
@@ -1875,20 +1875,20 @@ class He {
       }
     );
     const i = this.sessionServer.authenticators[s.factor1].secretNames();
-    let n = !0;
+    let a = !0;
     for (let v of i)
-      !e.body[v] && !e.body["repeat_" + v] && (n = !1);
-    let t = [], a = {};
-    if (n) {
+      !e.body[v] && !e.body["repeat_" + v] && (a = !1);
+    let t = [], n = {};
+    if (a) {
       t = this.sessionServer.authenticators[s.factor1].validateSecrets(e.body);
       for (let v in e.body)
         if (v.startsWith("repeat_")) {
-          const m = v.replace(/^repeat_/, "");
-          i.includes(m) && (a[m] = e.body[v]);
+          const p = v.replace(/^repeat_/, "");
+          i.includes(p) && (n[p] = e.body[v]);
         }
-      Object.keys(a).length === 0 && (a = void 0);
+      Object.keys(n).length === 0 && (n = void 0);
     }
-    n ? s.factor2 && s.factor2 != "none" && (s.state = O.factor2ResetNeeded, d.logger.warn(c({
+    a ? s.factor2 && s.factor2 != "none" && (s.state = O.factor2ResetNeeded, d.logger.warn(c({
       msg: `Setting state for user to ${O.factor2ResetNeeded}`,
       username: s.username
     }))) : s.factor2 && s.factor2 != "none" ? (s.state = O.passwordAndFactor2ResetNeeded, d.logger.warn(c({
@@ -1901,23 +1901,23 @@ class He {
     let f = [...this.sessionServer.validateUserFn(s), ...t];
     if (f.length > 0)
       throw new l(g.FormEntry, f);
-    const p = await this.sessionServer.sessionManager.createUser(
+    const m = await this.sessionServer.sessionManager.createUser(
       s,
       e.body,
-      a,
+      n,
       !0,
-      !n
+      !a
     );
-    if (!n) {
+    if (!a) {
       let v = e.body.username;
       if ("user_email" in e.body) {
-        const m = e.body.user_email;
-        typeof m == "string" && (v = m);
+        const p = e.body.user_email;
+        typeof p == "string" && (v = p);
       }
       if (xe.validateEmail(v), !v) throw new l(g.FormEntry, "No password given but no email address found either");
       await this.sessionServer.sessionManager.requestPasswordReset(v);
     }
-    return r(o, {}, p);
+    return r(o, {}, m);
   }
   async accessDeniedPage(e, o) {
     const r = new l(g.InsufficientPriviledges);
@@ -1933,7 +1933,7 @@ class He {
     if (!o.user || !y.isAdmin(o.user))
       throw new l(g.Unauthorized);
     if (this.sessionServer.isSessionUser(o) && !o.csrfToken) throw new l(g.InvalidCsrf);
-    const i = e.factor2, n = e.state;
+    const i = e.factor2, a = e.state;
     e.state = o.body.state, e = this.sessionServer.updateUserFn(
       e,
       o,
@@ -1943,15 +1943,15 @@ class He {
       }
     );
     const t = e.factor2 && e.factor2 != "none" && e.factor2 != i;
-    if (t && !(e.state == n || e.state == "factor2ResetNeeded"))
+    if (t && !(e.state == a || e.state == "factor2ResetNeeded"))
       throw new l(g.BadRequest, "Cannot change both factor2 and state at the same time");
     t && (e.state = O.factor2ResetNeeded, d.logger.warn(c({
       msg: `Setting state for user to ${O.factor2ResetNeeded}`,
       username: e.username
     })));
-    let a = this.sessionServer.validateUserFn(e);
-    if (a.length > 0)
-      throw new l(g.FormEntry, a);
+    let n = this.sessionServer.validateUserFn(e);
+    if (n.length > 0)
+      throw new l(g.FormEntry, n);
     let h = (
       // this surely isn't right
       //await this.sessionServer.sessionManager.updateUser(request.user, user,);
@@ -1964,23 +1964,23 @@ class He {
     if (!o.user || !y.isAdmin(o.user))
       throw new l(g.Unauthorized);
     if (this.sessionServer.isSessionUser(o) && !o.csrfToken) throw new l(g.InvalidCsrf);
-    const i = this.sessionServer.authenticators[e.factor1], n = i.secretNames();
-    let t = {}, a = {};
+    const i = this.sessionServer.authenticators[e.factor1], a = i.secretNames();
+    let t = {}, n = {};
     for (let f in o.body)
       if (f.startsWith("new_")) {
-        const p = f.replace(/^new_/, "");
-        n.includes(p) && (t[p] = o.body[f]);
+        const m = f.replace(/^new_/, "");
+        a.includes(m) && (t[m] = o.body[f]);
       } else if (f.startsWith("repeat_")) {
-        const p = f.replace(/^repeat_/, "");
-        n.includes(p) && (a[p] = o.body[f]);
+        const m = f.replace(/^repeat_/, "");
+        a.includes(m) && (n[m] = o.body[f]);
       }
-    if (Object.keys(a).length === 0 && (a = void 0), i.validateSecrets(t).length > 0)
+    if (Object.keys(n).length === 0 && (n = void 0), i.validateSecrets(t).length > 0)
       throw new l(g.PasswordFormat);
     return e.state = "active", await this.sessionServer.userStorage.updateUser({ id: e.id, state: e.state }), await this.sessionServer.sessionManager.changeSecrets(
       e.username,
       1,
       t,
-      a
+      n
     ), s(r, void 0);
   }
   async deleteUser(e, o, r) {
@@ -2003,8 +2003,8 @@ async function ve(k, e, o) {
       throw d.logger.debug(c({ err: i })), i;
     try {
       r = await e.getClientByName(k, o);
-    } catch (n) {
-      const t = l.asCrossauthError(n);
+    } catch (a) {
+      const t = l.asCrossauthError(a);
       if (t.code != g.UserNotExist)
         throw d.logger.debug(c({ err: t })), i;
     }
@@ -2049,12 +2049,12 @@ class Le {
           return this.accessDeniedPage(e, o);
         const r = e.query.next ?? encodeURIComponent(e.url);
         try {
-          let s = [], i = Number(e.query.skip), n = Number(e.query.take);
-          i || (i = 0), n || (n = 10);
-          let t = null, a;
+          let s = [], i = Number(e.query.skip), a = Number(e.query.take);
+          i || (i = 0), a || (a = 10);
+          let t = null, n;
           if (e.query.userid) {
             if (!this.sessionServer.userStorage) throw new l(g.Configuration, "Cannot call selectclient with user unless a user storage is provided");
-            a = (await this.sessionServer.userStorage.getUserById(e.query.userid)).user, t = a.id;
+            n = (await this.sessionServer.userStorage.getUserById(e.query.userid)).user, t = n.id;
           }
           e.query.search ? s = await this.clientSearchFn(
             e.query.search,
@@ -2062,17 +2062,17 @@ class Le {
             t
           ) : s = await this.clientStorage.getClients(
             i,
-            n,
+            a,
             t
           );
           let h = {
             urlPrefix: this.adminPrefix,
-            user: a,
+            user: n,
             skip: i,
-            take: n,
+            take: a,
             clients: s,
             havePrevious: i > 0,
-            haveNext: n != null && s.length == n,
+            haveNext: a != null && s.length == a,
             isAdmin: !0,
             next: r
           };
@@ -2112,9 +2112,9 @@ class Le {
             if (!this.sessionServer.userStorage) throw new l(g.Configuration, "Cannot call createclient unless a user storage is provided");
             s = (await this.sessionServer.userStorage.getUserById(e.query.userid)).user;
           }
-        } catch (n) {
-          const t = l.asCrossauthError(n);
-          return d.logger.debug(c({ err: n })), o.status(t.httpStatus).view(this.sessionServer.errorPage, {
+        } catch (a) {
+          const t = l.asCrossauthError(a);
+          return d.logger.debug(c({ err: a })), o.status(t.httpStatus).view(this.sessionServer.errorPage, {
             errorMessage: t.message,
             errorMessages: t.messages,
             errorCode: t.code,
@@ -2135,7 +2135,7 @@ class Le {
     ), this.sessionServer.app.post(
       this.adminPrefix + "createclient",
       async (e, o) => {
-        var i, n;
+        var i, a;
         d.logger.info(c({
           msg: "Page visit",
           method: "POST",
@@ -2154,9 +2154,9 @@ class Le {
           return await this.createClient(
             e,
             o,
-            (t, a) => t.view(this.createClientPage, {
+            (t, n) => t.view(this.createClientPage, {
               message: "Created client",
-              client: a,
+              client: n,
               csrfToken: e.csrfToken,
               urlPrefix: this.adminPrefix,
               validFlows: this.validFlows,
@@ -2169,12 +2169,12 @@ class Le {
             s
           );
         } catch (t) {
-          const a = l.asCrossauthError(t);
+          const n = l.asCrossauthError(t);
           return d.logger.error(c({
             msg: "Failed creating OAuth client",
-            user: (n = e.user) == null ? void 0 : n.username,
-            errorCodeName: a.codeName,
-            errorCode: a.code
+            user: (a = e.user) == null ? void 0 : a.username,
+            errorCodeName: n.codeName,
+            errorCode: n.code
           })), d.logger.debug(c({ err: t })), this.sessionServer.handleError(t, e, o, (h, f) => {
             const v = l.asCrossauthError(t).httpStatus;
             return h.status(v).view(this.createClientPage, {
@@ -2212,9 +2212,9 @@ class Le {
         let r;
         try {
           r = await this.clientStorage.getClientById(e.params.client_id);
-        } catch (a) {
-          const h = l.asCrossauthError(a);
-          return d.logger.debug(c({ err: a })), o.status(h.httpStatus).view(this.sessionServer.errorPage, {
+        } catch (n) {
+          const h = l.asCrossauthError(n);
+          return d.logger.debug(c({ err: n })), o.status(h.httpStatus).view(this.sessionServer.errorPage, {
             errorMessage: h.message,
             errorMessages: h.messages,
             errorCode: h.code,
@@ -2229,24 +2229,24 @@ class Le {
             if (!this.sessionServer.userStorage) throw new l(g.Configuration, "Cannot call updateclient with user unless a user storage is provided");
             i = (await this.sessionServer.userStorage.getUserById(r.userid)).user;
           }
-        } catch (a) {
-          const h = l.asCrossauthError(a);
-          return d.logger.debug(c({ err: a })), o.status(h.httpStatus).view(this.sessionServer.errorPage, {
+        } catch (n) {
+          const h = l.asCrossauthError(n);
+          return d.logger.debug(c({ err: n })), o.status(h.httpStatus).view(this.sessionServer.errorPage, {
             errorMessage: h.message,
             errorMessages: h.messages,
             errorCode: h.code,
             errorCodeName: g[h.code]
           });
         }
-        let n = {};
-        for (let a of this.validFlows)
-          r.valid_flow.includes(a) && (n[a] = !0);
+        let a = {};
+        for (let n of this.validFlows)
+          r.valid_flow.includes(n) && (a[n] = !0);
         let t = {
           urlPrefix: this.adminPrefix,
           csrfToken: e.csrfToken,
           validFlows: this.validFlows,
           flowNames: E.flowNames(this.validFlows),
-          selectedFlows: n,
+          selectedFlows: a,
           user: i,
           client_id: r.client_id,
           client_name: r.client_name,
@@ -2260,7 +2260,7 @@ class Le {
     ), this.sessionServer.app.post(
       this.adminPrefix + "updateclient/:client_id",
       async (e, o) => {
-        var i, n;
+        var i, a;
         d.logger.info(c({
           msg: "Page visit",
           method: "POST",
@@ -2279,9 +2279,9 @@ class Le {
           return await this.updateClient(
             e,
             o,
-            (t, a, h) => t.view(this.updateClientPage, {
+            (t, n, h) => t.view(this.updateClientPage, {
               message: "Updated client",
-              client: a,
+              client: n,
               csrfToken: e.csrfToken,
               urlPrefix: this.adminPrefix,
               validFlows: this.validFlows,
@@ -2294,17 +2294,17 @@ class Le {
             })
           );
         } catch (t) {
-          const a = l.asCrossauthError(t);
+          const n = l.asCrossauthError(t);
           return d.logger.error(c({
             msg: "Failed updating OAuth client",
-            user: (n = e.user) == null ? void 0 : n.username,
-            errorCodeName: a.codeName,
-            errorCode: a.code
+            user: (a = e.user) == null ? void 0 : a.username,
+            errorCodeName: n.codeName,
+            errorCode: n.code
           })), d.logger.debug(c({ err: t })), this.sessionServer.handleError(t, e, o, (h, f) => {
             const v = l.asCrossauthError(t).httpStatus;
-            let m = {};
+            let p = {};
             for (let w of this.validFlows)
-              w in e.body && (m[w] = !0);
+              w in e.body && (p[w] = !0);
             return h.status(v).view(this.updateClientPage, {
               errorMessage: f.message,
               errorMessages: f.messages,
@@ -2315,7 +2315,7 @@ class Le {
               isAdmin: !0,
               next: r,
               validFlows: this.validFlows,
-              selectedFlows: m,
+              selectedFlows: p,
               flowNames: E.flowNames(this.validFlows),
               ...e.body
             });
@@ -2342,9 +2342,9 @@ class Le {
           return this.accessDeniedPage(e, o);
         try {
           r = await this.clientStorage.getClientById(e.params.client_id);
-        } catch (n) {
-          const t = l.asCrossauthError(n);
-          return d.logger.debug(c({ err: n })), o.status(t.httpStatus).view(this.sessionServer.errorPage, {
+        } catch (a) {
+          const t = l.asCrossauthError(a);
+          return d.logger.debug(c({ err: a })), o.status(t.httpStatus).view(this.sessionServer.errorPage, {
             errorMessage: t.message,
             errorMessages: t.messages,
             errorCode: t.code,
@@ -2376,7 +2376,7 @@ class Le {
           return await this.deleteClient(
             e,
             o,
-            (n) => n.view(this.deleteClientPage, {
+            (a) => a.view(this.deleteClientPage, {
               message: "Client deleted",
               csrfToken: e.csrfToken,
               urlPrefix: this.adminPrefix,
@@ -2385,16 +2385,16 @@ class Le {
               next: r
             })
           );
-        } catch (n) {
-          const t = l.asCrossauthError(n);
+        } catch (a) {
+          const t = l.asCrossauthError(a);
           return d.logger.error(c({
             msg: "Failed deleting OAuth client",
             user: (i = e.user) == null ? void 0 : i.username,
             errorCodeName: t.codeName,
             errorCode: t.code
-          })), d.logger.debug(c({ err: n })), this.sessionServer.handleError(n, e, o, (a, h) => {
-            const p = l.asCrossauthError(n).httpStatus;
-            return a.status(p).view(this.deleteClientPage, {
+          })), d.logger.debug(c({ err: a })), this.sessionServer.handleError(a, e, o, (n, h) => {
+            const m = l.asCrossauthError(a).httpStatus;
+            return n.status(m).view(this.deleteClientPage, {
               errorMessage: h.message,
               errorMessages: h.messages,
               errorCode: h.code,
@@ -2434,21 +2434,21 @@ class Le {
           return await this.createClient(
             e,
             o,
-            (n, t) => n.header(...B).send({
+            (a, t) => a.header(...B).send({
               ok: !0,
               client: t
             }),
             r
           );
-        } catch (n) {
-          const t = l.asCrossauthError(n);
+        } catch (a) {
+          const t = l.asCrossauthError(a);
           d.logger.error(c({
             msg: "Create client failure",
             user: (i = e.user) == null ? void 0 : i.username,
             errorCodeName: t.codeName,
             errorCode: t.code
-          })), d.logger.debug(c({ err: n })), this.sessionServer.handleError(n, e, o, (a, h) => {
-            a.status(this.sessionServer.errorStatus(n)).header(...B).send({
+          })), d.logger.debug(c({ err: a })), this.sessionServer.handleError(a, e, o, (n, h) => {
+            n.status(this.sessionServer.errorStatus(a)).header(...B).send({
               ok: !1,
               errorMessage: h.message,
               errorMessages: h.messages,
@@ -2482,27 +2482,27 @@ class Le {
           return await this.updateClient(
             e,
             o,
-            (i, n, t) => i.header(...B).send({
+            (i, a, t) => i.header(...B).send({
               ok: !0,
-              client: n,
+              client: a,
               csrfToken: e.csrfToken,
               newSecret: t
             })
           );
         } catch (i) {
-          const n = l.asCrossauthError(i);
+          const a = l.asCrossauthError(i);
           return d.logger.error(c({
             msg: "Failed updating OAuth client",
             user: (s = e.user) == null ? void 0 : s.username,
-            errorCodeName: n.codeName,
-            errorCode: n.code
-          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, a) => {
+            errorCodeName: a.codeName,
+            errorCode: a.code
+          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, n) => {
             t.status(this.sessionServer.errorStatus(i)).header(...B).send({
               ok: !1,
-              errorMessage: a.message,
-              errorMessages: a.messages,
-              errorCode: a.code,
-              errorCodeName: g[a.code]
+              errorMessage: n.message,
+              errorMessages: n.messages,
+              errorCode: n.code,
+              errorCodeName: g[n.code]
             });
           });
         }
@@ -2534,18 +2534,18 @@ class Le {
             })
           );
         } catch (i) {
-          const n = l.asCrossauthError(i);
+          const a = l.asCrossauthError(i);
           d.logger.error(c({
             msg: "Delete client failure",
             user: (s = e.user) == null ? void 0 : s.username,
-            errorCodeName: n.codeName,
-            errorCode: n.code
-          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, a) => {
+            errorCodeName: a.codeName,
+            errorCode: a.code
+          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, n) => {
             t.status(this.sessionServer.errorStatus(i)).header(...B).send({
               ok: !1,
-              errorMessage: a.message,
-              errorMessages: a.messages,
-              errorCode: g[a.code]
+              errorMessage: n.message,
+              errorMessages: n.messages,
+              errorCode: g[n.code]
             });
           });
         }
@@ -2568,24 +2568,24 @@ class Le {
       throw new l(g.InvalidCsrf);
     if (!e.user || !y.isAdmin(e.user))
       throw new l(g.InsufficientPriviledges);
-    const i = e.body.confidential == "true", n = e.body.client_name, t = e.body.redirect_uris.trim().length == 0 ? [] : e.body.redirect_uris.trim().split(/[, ][ \t\n]*/);
-    let a = [];
-    for (let p of t)
+    const i = e.body.confidential == "true", a = e.body.client_name, t = e.body.redirect_uris.trim().length == 0 ? [] : e.body.redirect_uris.trim().split(/[, ][ \t\n]*/);
+    let n = [];
+    for (let m of t)
       try {
-        L.validateUri(p);
+        L.validateUri(m);
       } catch (v) {
-        d.logger.error(c({ err: v })), a.push("[" + p + "]");
+        d.logger.error(c({ err: v })), n.push("[" + m + "]");
       }
-    if (a.length > 0)
+    if (n.length > 0)
       throw new l(
         g.BadRequest,
-        "The following redirect URIs are invalid: " + a.join(" ")
+        "The following redirect URIs are invalid: " + n.join(" ")
       );
     let h = [];
-    for (let p of this.validFlows)
-      p in e.body && h.push(p);
+    for (let m of this.validFlows)
+      m in e.body && h.push(m);
     const f = await this.clientManager.createClient(
-      n,
+      a,
       t,
       h,
       i,
@@ -2600,26 +2600,26 @@ class Le {
       throw new l(g.InsufficientPriviledges);
     const s = e.body.redirect_uris.trim().length == 0 ? [] : e.body.redirect_uris.trim().split(/[, ][ \t\n]*/);
     let i = [];
-    for (let p of s)
+    for (let m of s)
       try {
-        L.validateUri(p);
+        L.validateUri(m);
       } catch (v) {
-        d.logger.error(c({ err: v })), i.push("[" + p + "]");
+        d.logger.error(c({ err: v })), i.push("[" + m + "]");
       }
     if (i.length > 0)
       throw new l(
         g.BadRequest,
         "The following redirect URIs are invalid: " + i.join(" ")
       );
-    let n = [];
-    for (let p of this.validFlows)
-      p in e.body && n.push(p);
+    let a = [];
+    for (let m of this.validFlows)
+      m in e.body && a.push(m);
     const t = {};
-    t.client_name = e.body.client_name, t.confidential = e.body.confidential == "true", t.valid_flow = n, t.redirect_uri = s, t.userid = e.body.userid, t.userid == null && (t.userid = null);
-    const a = e.body.resetSecret == "true", { client: h, newSecret: f } = await this.clientManager.updateClient(
+    t.client_name = e.body.client_name, t.confidential = e.body.confidential == "true", t.valid_flow = a, t.redirect_uri = s, t.userid = e.body.userid, t.userid == null && (t.userid = null);
+    const n = e.body.resetSecret == "true", { client: h, newSecret: f } = await this.clientManager.updateClient(
       e.params.client_id,
       t,
-      a
+      n
     );
     return r(o, h, f);
   }
@@ -2683,7 +2683,7 @@ class Ge {
             i,
             e.user.id
           );
-          const n = e.query.next ?? encodeURIComponent(e.url);
+          const a = e.query.next ?? encodeURIComponent(e.url);
           let t = {
             urlPrefix: this.prefix,
             user: e.user,
@@ -2693,7 +2693,7 @@ class Ge {
             havePrevious: s > 0,
             haveNext: i != null && r.length == i,
             isAdmin: !1,
-            next: n
+            next: a
           };
           return e.query.next && (t.next = e.query.next), o.view(this.selectClientPage, t);
         } catch (r) {
@@ -2752,7 +2752,7 @@ class Ge {
           return await this.createClient(
             e,
             o,
-            (n, t) => n.view(this.createClientPage, {
+            (a, t) => a.view(this.createClientPage, {
               message: "Created client",
               client: t,
               csrfToken: e.csrfToken,
@@ -2766,16 +2766,16 @@ class Ge {
             }),
             e.user
           );
-        } catch (n) {
-          const t = l.asCrossauthError(n);
+        } catch (a) {
+          const t = l.asCrossauthError(a);
           return d.logger.error(c({
             msg: "Failed creating OAuth client",
             user: (i = e.user) == null ? void 0 : i.username,
             errorCodeName: t.codeName,
             errorCode: t.code
-          })), d.logger.debug(c({ err: n })), this.sessionServer.handleError(n, e, o, (a, h) => {
-            const p = l.asCrossauthError(n).httpStatus;
-            return a.status(p).view(this.createClientPage, {
+          })), d.logger.debug(c({ err: a })), this.sessionServer.handleError(a, e, o, (n, h) => {
+            const m = l.asCrossauthError(a).httpStatus;
+            return n.status(m).view(this.createClientPage, {
               errorMessage: h.message,
               errorMessages: h.messages,
               errorCode: h.code,
@@ -2813,25 +2813,25 @@ class Ge {
           return await this.createClient(
             e,
             o,
-            (i, n) => i.header(...D).send({
+            (i, a) => i.header(...D).send({
               ok: !0,
-              client: n
+              client: a
             }),
             e.user
           );
         } catch (i) {
-          const n = l.asCrossauthError(i);
+          const a = l.asCrossauthError(i);
           d.logger.error(c({
             msg: "Create client failure",
             user: (s = e.user) == null ? void 0 : s.username,
-            errorCodeName: n.codeName,
-            errorCode: n.code
-          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, a) => {
+            errorCodeName: a.codeName,
+            errorCode: a.code
+          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, n) => {
             t.status(this.sessionServer.errorStatus(i)).header(...D).send({
               ok: !1,
-              errorMessage: a.message,
-              errorMessages: a.messages,
-              errorCode: g[a.code]
+              errorMessage: n.message,
+              errorMessages: n.messages,
+              errorCode: g[n.code]
             });
           });
         }
@@ -2856,9 +2856,9 @@ class Ge {
         let r;
         try {
           r = await this.clientStorage.getClientById(e.params.client_id);
-        } catch (a) {
-          const h = l.asCrossauthError(a);
-          return d.logger.debug(c({ err: a })), o.status(h.httpStatus).view(this.sessionServer.errorPage, {
+        } catch (n) {
+          const h = l.asCrossauthError(n);
+          return d.logger.debug(c({ err: n })), o.status(h.httpStatus).view(this.sessionServer.errorPage, {
             errorMessage: h.message,
             errorMessages: h.messages,
             errorCode: h.code,
@@ -2870,24 +2870,24 @@ class Ge {
         let i;
         try {
           e.query.userid && (i = (await this.sessionServer.userStorage.getUserById(e.query.userid)).user);
-        } catch (a) {
-          const h = l.asCrossauthError(a);
-          return d.logger.debug(c({ err: a })), o.status(h.httpStatus).view(this.sessionServer.errorPage, {
+        } catch (n) {
+          const h = l.asCrossauthError(n);
+          return d.logger.debug(c({ err: n })), o.status(h.httpStatus).view(this.sessionServer.errorPage, {
             errorMessage: h.message,
             errorMessages: h.messages,
             errorCode: h.code,
             errorCodeName: g[h.code]
           });
         }
-        let n = {};
-        for (let a of this.validFlows)
-          r.valid_flow.includes(a) && (n[a] = !0);
+        let a = {};
+        for (let n of this.validFlows)
+          r.valid_flow.includes(n) && (a[n] = !0);
         let t = {
           urlPrefix: this.prefix,
           csrfToken: e.csrfToken,
           validFlows: this.validFlows,
           flowNames: E.flowNames(this.validFlows),
-          selectedFlows: n,
+          selectedFlows: a,
           user: i,
           client_id: r.client_id,
           client_name: r.client_name,
@@ -2901,7 +2901,7 @@ class Ge {
     ), this.sessionServer.app.post(
       this.prefix + "updateclient/:client_id",
       async (e, o) => {
-        var i, n;
+        var i, a;
         if (!this.sessionServer.userStorage) throw new l(g.Configuration, "Cannot call updateclient unless a user storage is provided ");
         d.logger.info(c({
           msg: "Page visit",
@@ -2918,9 +2918,9 @@ class Ge {
           return e.body.userid && (s = (await this.sessionServer.userStorage.getUserById(e.body.userid)).user), await this.updateClient(
             e,
             o,
-            (t, a, h) => t.view(this.updateClientPage, {
+            (t, n, h) => t.view(this.updateClientPage, {
               message: "Updated client",
-              client: a,
+              client: n,
               csrfToken: e.csrfToken,
               urlPrefix: this.prefix,
               validFlows: this.validFlows,
@@ -2933,17 +2933,17 @@ class Ge {
             })
           );
         } catch (t) {
-          const a = l.asCrossauthError(t);
+          const n = l.asCrossauthError(t);
           return d.logger.error(c({
             msg: "Failed updating OAuth client",
-            user: (n = e.user) == null ? void 0 : n.username,
-            errorCodeName: a.codeName,
-            errorCode: a.code
+            user: (a = e.user) == null ? void 0 : a.username,
+            errorCodeName: n.codeName,
+            errorCode: n.code
           })), d.logger.debug(c({ err: t })), this.sessionServer.handleError(t, e, o, (h, f) => {
             const v = l.asCrossauthError(t).httpStatus;
-            let m = {};
+            let p = {};
             for (let w of this.validFlows)
-              w in e.body && (m[w] = !0);
+              w in e.body && (p[w] = !0);
             return h.status(v).view(this.updateClientPage, {
               errorMessage: f.message,
               errorMessages: f.messages,
@@ -2952,7 +2952,7 @@ class Ge {
               csrfToken: e.csrfToken,
               urlPrefix: this.prefix,
               validFlows: this.validFlows,
-              selectedFlows: m,
+              selectedFlows: p,
               flowNames: E.flowNames(this.validFlows),
               isAdmin: !0,
               next: r,
@@ -2983,27 +2983,27 @@ class Ge {
           return e.body.userid && await this.sessionServer.userStorage.getUserById(e.body.userid), await this.updateClient(
             e,
             o,
-            (i, n, t) => i.header(...D).send({
+            (i, a, t) => i.header(...D).send({
               ok: !0,
-              client: n,
+              client: a,
               csrfToken: e.csrfToken,
               newSecret: t
             })
           );
         } catch (i) {
-          const n = l.asCrossauthError(i);
+          const a = l.asCrossauthError(i);
           return d.logger.error(c({
             msg: "Failed updating OAuth client",
             user: (s = e.user) == null ? void 0 : s.username,
-            errorCodeName: n.codeName,
-            errorCode: n.code
-          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, a) => {
+            errorCodeName: a.codeName,
+            errorCode: a.code
+          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, n) => {
             t.status(this.sessionServer.errorStatus(i)).header(...D).send({
               ok: !1,
-              errorMessage: a.message,
-              errorMessages: a.messages,
-              errorCode: a.code,
-              errorCodeName: g[a.code]
+              errorMessage: n.message,
+              errorMessages: n.messages,
+              errorCode: n.code,
+              errorCodeName: g[n.code]
             });
           });
         }
@@ -3032,9 +3032,9 @@ class Ge {
               g.InsufficientPriviledges,
               "You may not delete this client"
             );
-        } catch (n) {
-          const t = l.asCrossauthError(n);
-          return d.logger.debug(c({ err: n })), o.status(t.httpStatus).view(this.sessionServer.errorPage, {
+        } catch (a) {
+          const t = l.asCrossauthError(a);
+          return d.logger.debug(c({ err: a })), o.status(t.httpStatus).view(this.sessionServer.errorPage, {
             errorMessage: t.message,
             errorMessages: t.messages,
             errorCode: t.code,
@@ -3068,7 +3068,7 @@ class Ge {
           return await this.deleteClient(
             e,
             o,
-            (n) => n.view(this.deleteClientPage, {
+            (a) => a.view(this.deleteClientPage, {
               message: "Client deleted",
               csrfToken: e.csrfToken,
               urlPrefix: this.prefix,
@@ -3077,16 +3077,16 @@ class Ge {
             }),
             e.user
           );
-        } catch (n) {
-          const t = l.asCrossauthError(n);
+        } catch (a) {
+          const t = l.asCrossauthError(a);
           return d.logger.error(c({
             msg: "Failed deleting OAuth client",
             user: (i = e.user) == null ? void 0 : i.username,
             errorCodeName: t.codeName,
             errorCode: t.code
-          })), d.logger.debug(c({ err: n })), this.sessionServer.handleError(n, e, o, (a, h) => {
-            const p = l.asCrossauthError(n).httpStatus;
-            return a.status(p).view(this.deleteClientPage, {
+          })), d.logger.debug(c({ err: a })), this.sessionServer.handleError(a, e, o, (n, h) => {
+            const m = l.asCrossauthError(a).httpStatus;
+            return n.status(m).view(this.deleteClientPage, {
               errorMessage: h.message,
               errorMessages: h.messages,
               errorCode: h.code,
@@ -3129,18 +3129,18 @@ class Ge {
             e.user
           );
         } catch (i) {
-          const n = l.asCrossauthError(i);
+          const a = l.asCrossauthError(i);
           d.logger.error(c({
             msg: "Delete client failure",
             user: (s = e.user) == null ? void 0 : s.username,
-            errorCodeName: n.codeName,
-            errorCode: n.code
-          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, a) => {
+            errorCodeName: a.codeName,
+            errorCode: a.code
+          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, n) => {
             t.status(this.sessionServer.errorStatus(i)).header(...D).send({
               ok: !1,
-              errorMessage: a.message,
-              errorMessages: a.messages,
-              errorCode: g[a.code]
+              errorMessage: n.message,
+              errorMessages: n.messages,
+              errorCode: g[n.code]
             });
           });
         }
@@ -3154,23 +3154,23 @@ class Ge {
       throw new l(g.InvalidCsrf);
     if (!e.user)
       throw new l(g.InsufficientPriviledges);
-    const i = e.body.confidential == "true", n = e.body.client_name, t = e.body.redirect_uris.trim().length == 0 ? [] : e.body.redirect_uris.trim().split(/[, ][ \t\n]*/);
-    let a = [];
-    for (let p of t)
+    const i = e.body.confidential == "true", a = e.body.client_name, t = e.body.redirect_uris.trim().length == 0 ? [] : e.body.redirect_uris.trim().split(/[, ][ \t\n]*/);
+    let n = [];
+    for (let m of t)
       try {
-        L.validateUri(p);
+        L.validateUri(m);
       } catch (v) {
-        d.logger.error(c({ err: v })), a.push("[" + p + "]");
+        d.logger.error(c({ err: v })), n.push("[" + m + "]");
       }
-    if (a.length > 0)
+    if (n.length > 0)
       throw new l(
         g.BadRequest,
-        "The following redirect URIs are invalid: " + a.join(" ")
+        "The following redirect URIs are invalid: " + n.join(" ")
       );
     let h = [];
     e.body[E.AuthorizationCode] && h.push(E.AuthorizationCode), e.body[E.AuthorizationCodeWithPKCE] && h.push(E.AuthorizationCodeWithPKCE), e.body[E.ClientCredentials] && h.push(E.ClientCredentials), e.body[E.RefreshToken] && h.push(E.RefreshToken), e.body[E.DeviceCode] && h.push(E.DeviceCode), e.body[E.Password] && h.push(E.Password), e.body[E.PasswordMfa] && h.push(E.PasswordMfa), e.body[E.OidcAuthorizationCode] && h.push(E.OidcAuthorizationCode);
     const f = await this.clientManager.createClient(
-      n,
+      a,
       t,
       h,
       i,
@@ -3185,26 +3185,26 @@ class Ge {
       throw new l(g.InsufficientPriviledges);
     const s = e.body.redirect_uris.trim().length == 0 ? [] : e.body.redirect_uris.trim().split(/[, ][ \t\n]*/);
     let i = [];
-    for (let p of s)
+    for (let m of s)
       try {
-        L.validateUri(p);
+        L.validateUri(m);
       } catch (v) {
-        d.logger.error(c({ err: v })), i.push("[" + p + "]");
+        d.logger.error(c({ err: v })), i.push("[" + m + "]");
       }
     if (i.length > 0)
       throw new l(
         g.BadRequest,
         "The following redirect URIs are invalid: " + i.join(" ")
       );
-    let n = [];
-    for (let p of this.validFlows)
-      p in e.body && n.push(p);
+    let a = [];
+    for (let m of this.validFlows)
+      m in e.body && a.push(m);
     const t = {};
-    t.client_name = e.body.client_name, t.confidential = e.body.confidential == "true", t.valid_flow = n, t.redirect_uri = s, t.userid = e.user.id;
-    const a = e.body.resetSecret == "true", { client: h, newSecret: f } = await this.clientManager.updateClient(
+    t.client_name = e.body.client_name, t.confidential = e.body.confidential == "true", t.valid_flow = a, t.redirect_uri = s, t.userid = e.user.id;
+    const n = e.body.resetSecret == "true", { client: h, newSecret: f } = await this.clientManager.updateClient(
       e.params.client_id,
       t,
-      a
+      n
     );
     return r(o, h, f);
   }
@@ -3334,8 +3334,8 @@ function We(k, e) {
   };
   const s = k.user && y.isAdmin(k.user);
   for (let i in k.body) {
-    let n = i.replace(/^user_/, "");
-    i.startsWith("user_") && (s || e.includes(n)) && (r[n] = k.body[i]);
+    let a = i.replace(/^user_/, "");
+    i.startsWith("user_") && (s || e.includes(a)) && (r[a] = k.body[i]);
   }
   return r.factor1 = "localpassword", r.factor2 = k.body.factor2, r;
 }
@@ -3468,14 +3468,14 @@ class Ke {
         break;
       }
     i && (this.adminClientEndpoints = new Le(this, s));
-    let n = !1;
+    let a = !1;
     for (let t of this.endpoints)
       if (ee.includes(t) || Z.includes(t)) {
-        n = !0;
+        a = !0;
         break;
       }
-    n && (this.userClientEndpoints = new Ge(this, s)), this.addEndpoints(), S("endpoints", C.JsonArray, this, s, "ENDPOINTS"), s.userStorage && (this.userStorage = s.userStorage), this.authenticators = r, this.sessionManager = new Ae(o, r, s), e.addHook("preHandler", async (t, a) => {
-      var v, m;
+    a && (this.userClientEndpoints = new Ge(this, s)), this.addEndpoints(), S("endpoints", C.JsonArray, this, s, "ENDPOINTS"), s.userStorage && (this.userStorage = s.userStorage), this.authenticators = r, this.sessionManager = new Ae(o, r, s), e.addHook("preHandler", async (t, n) => {
+      var v, p;
       d.logger.debug(c({ msg: "Getting session cookie" }));
       let h = this.getSessionCookieValue(t), f = {};
       if (h)
@@ -3485,40 +3485,40 @@ class Ke {
           f.hashedSessionCookie = F.hash(h);
         }
       d.logger.debug(c({ msg: "Getting csrf cookie" }));
-      let p;
+      let m;
       try {
-        p = this.getCsrfCookieValue(t), p && this.sessionManager.validateCsrfCookie(p);
+        m = this.getCsrfCookieValue(t), m && this.sessionManager.validateCsrfCookie(m);
       } catch (w) {
-        d.logger.warn(c({ msg: "Invalid csrf cookie received", cerr: w, hashedCsrfCookie: this.getHashOfCsrfCookie(t) })), a.clearCookie(this.sessionManager.csrfCookieName), p = void 0;
+        d.logger.warn(c({ msg: "Invalid csrf cookie received", cerr: w, hashedCsrfCookie: this.getHashOfCsrfCookie(t) })), n.clearCookie(this.sessionManager.csrfCookieName), m = void 0;
       }
       if (["GET", "OPTIONS", "HEAD"].includes(t.method))
         try {
-          if (p) {
+          if (m) {
             d.logger.debug(c({ msg: "Valid CSRF cookie - creating token" }));
-            const w = await this.sessionManager.createCsrfFormOrHeaderValue(p);
+            const w = await this.sessionManager.createCsrfFormOrHeaderValue(m);
             t.csrfToken = w;
           } else {
             d.logger.debug(c({ msg: "Invalid CSRF cookie - recreating" }));
             const { csrfCookie: w, csrfFormOrHeaderValue: P } = await this.sessionManager.createCsrfToken();
-            a.setCookie(w.name, w.value, w.options), t.csrfToken = P;
+            n.setCookie(w.name, w.value, w.options), t.csrfToken = P;
           }
-          a.header(this.sessionManager.csrfHeaderName, t.csrfToken);
+          n.header(this.sessionManager.csrfHeaderName, t.csrfToken);
         } catch (w) {
           d.logger.error(c({
             msg: "Couldn't create CSRF token",
             cerr: w,
             user: (v = t.user) == null ? void 0 : v.username,
             ...f
-          })), d.logger.debug(c({ err: w })), a.clearCookie(this.sessionManager.csrfCookieName);
+          })), d.logger.debug(c({ err: w })), n.clearCookie(this.sessionManager.csrfCookieName);
         }
-      else if (p)
+      else if (m)
         try {
-          this.csrfToken(t, a);
+          this.csrfToken(t, n);
         } catch (w) {
           d.logger.error(c({
             msg: "Couldn't create CSRF token",
             cerr: w,
-            user: (m = t.user) == null ? void 0 : m.username,
+            user: (p = t.user) == null ? void 0 : p.username,
             ...f
           })), d.logger.debug(c({ err: w }));
         }
@@ -3538,15 +3538,15 @@ class Ke {
           d.logger.warn(c({
             msg: "Invalid session cookie received",
             hashOfSessionId: this.getHashOfSessionId(t)
-          })), a.clearCookie(this.sessionManager.sessionCookieName);
+          })), n.clearCookie(this.sessionManager.sessionCookieName);
         }
     }), e.addHook(
       "preHandler",
-      async (t, a) => {
-        var f, p, v;
+      async (t, n) => {
+        var f, m, v;
         const h = this.getSessionCookieValue(t);
         if (h && ((f = t.user) != null && f.factor2) && (this.factor2ProtectedPageEndpoints.includes(t.url) || this.factor2ProtectedApiEndpoints.includes(t.url))) {
-          const m = this.sessionManager.getSessionId(h);
+          const p = this.sessionManager.getSessionId(h);
           if (["GET", "OPTIONS", "HEAD"].includes(t.method)) {
             const w = this.getSessionCookieValue(t);
             if (w) {
@@ -3561,7 +3561,7 @@ class Ke {
               }
             }
           } else {
-            const w = await this.sessionManager.dataForSessionId(m);
+            const w = await this.sessionManager.dataForSessionId(p);
             if ("pre2fa" in w) {
               d.logger.debug("Completing 2FA");
               const T = [...this.authenticators[w.pre2fa.factor2].transientSecretNames()];
@@ -3570,7 +3570,7 @@ class Ke {
                 T.includes(M) && (U[M] = t.body[M]);
               let _;
               try {
-                await this.sessionManager.completeTwoFactorPageVisit(U, m);
+                await this.sessionManager.completeTwoFactorPageVisit(U, p);
               } catch (M) {
                 _ = l.asCrossauthError(M), d.logger.debug(c({ err: M }));
                 const I = l.asCrossauthError(M);
@@ -3586,9 +3586,9 @@ class Ke {
                 if (_.code == g.Expired) {
                   d.logger.debug("Error - cancelling 2FA");
                   try {
-                    await this.sessionManager.cancelTwoFactorPageVisit(m);
+                    await this.sessionManager.cancelTwoFactorPageVisit(p);
                   } catch (M) {
-                    d.logger.error(c({ msg: "Failed cancelling 2FA", cerr: M, user: (p = t.user) == null ? void 0 : p.username, hashOfSessionId: this.getHashOfSessionId(t) })), d.logger.debug(c({ err: M }));
+                    d.logger.error(c({ msg: "Failed cancelling 2FA", cerr: M, user: (m = t.user) == null ? void 0 : m.username, hashOfSessionId: this.getHashOfSessionId(t) })), d.logger.debug(c({ err: M }));
                   }
                   t.body = {
                     ...t.body,
@@ -3598,7 +3598,7 @@ class Ke {
                     errorCodeName: g[_.code]
                   };
                 } else
-                  return this.factor2ProtectedPageEndpoints.includes(t.url) ? a.redirect(this.prefix + "factor2?error=" + g[_.code]) : a.status(_.httpStatus).send(JSON.stringify({
+                  return this.factor2ProtectedPageEndpoints.includes(t.url) ? n.redirect(this.prefix + "factor2?error=" + g[_.code]) : n.status(_.httpStatus).send(JSON.stringify({
                     ok: !1,
                     errorMessage: _.message,
                     errorMessages: _.messages,
@@ -3606,7 +3606,7 @@ class Ke {
                     errorCodeName: g[_.code]
                   }));
             } else
-              return this.validateCsrfToken(t), d.logger.debug("Starting 2FA"), this.sessionManager.initiateTwoFactorPageVisit(t.user, m, t.body, t.url.replace(/\?.*$/, "")), this.factor2ProtectedPageEndpoints.includes(t.url) ? a.redirect(this.prefix + "factor2") : a.send(JSON.stringify({
+              return this.validateCsrfToken(t), d.logger.debug("Starting 2FA"), this.sessionManager.initiateTwoFactorPageVisit(t.user, p, t.body, t.url.replace(/\?.*$/, "")), this.factor2ProtectedPageEndpoints.includes(t.url) ? n.redirect(this.prefix + "factor2") : n.send(JSON.stringify({
                 ok: !0,
                 factor2Required: !0
               }));
@@ -3678,12 +3678,12 @@ class Ke {
                 if (this.endpoints.includes("changepassword"))
                   return d.logger.debug(c({ msg: "Password change needed - sending redirect" })), s.redirect("/changepassword?required=true&next=" + encodeURIComponent("login?next=" + r));
                 {
-                  const n = new l(g.PasswordChangeNeeded);
-                  return this.handleError(n, e, s, (t, a) => t.view(this.loginPage, {
-                    errorMessage: a.message,
-                    errorMessages: a.messages,
-                    errorCode: a.code,
-                    errorCodeName: g[a.code],
+                  const a = new l(g.PasswordChangeNeeded);
+                  return this.handleError(a, e, s, (t, n) => t.view(this.loginPage, {
+                    errorMessage: n.message,
+                    errorMessages: n.messages,
+                    errorCode: n.code,
+                    errorCodeName: g[n.code],
                     next: r,
                     persist: e.body.persist,
                     username: e.body.username,
@@ -3693,12 +3693,12 @@ class Ke {
                 }
               } else if (i.state == O.passwordResetNeeded || i.state == O.passwordAndFactor2ResetNeeded) {
                 d.logger.debug(c({ msg: "Password reset needed - sending error" }));
-                const n = new l(g.PasswordResetNeeded);
-                return this.handleError(n, e, s, (t, a) => t.view(this.loginPage, {
-                  errorMessage: a.message,
-                  errorMessages: a.messages,
-                  errorCode: a.code,
-                  errorCodeName: g[a.code],
+                const a = new l(g.PasswordResetNeeded);
+                return this.handleError(a, e, s, (t, n) => t.view(this.loginPage, {
+                  errorMessage: n.message,
+                  errorMessages: n.messages,
+                  errorCode: n.code,
+                  errorCodeName: g[n.code],
                   next: r,
                   persist: e.body.persist,
                   username: e.body.username,
@@ -3712,12 +3712,12 @@ class Ke {
                 })), this.endpoints.includes("changefactor2"))
                   return d.logger.debug(c({ msg: "Factor 2 reset needed - sending redirect" })), s.redirect("/changefactor2?required=true&next=" + encodeURIComponent("login?next=" + r));
                 {
-                  const n = new l(g.Factor2ResetNeeded);
-                  return this.handleError(n, e, s, (t, a) => t.view(this.loginPage, {
-                    errorMessage: a.message,
-                    errorMessages: a.messages,
-                    errorCode: a.code,
-                    errorCodeName: g[a.code],
+                  const a = new l(g.Factor2ResetNeeded);
+                  return this.handleError(a, e, s, (t, n) => t.view(this.loginPage, {
+                    errorMessage: n.message,
+                    errorMessages: n.messages,
+                    errorCode: n.code,
+                    errorCodeName: g[n.code],
                     next: r,
                     persist: e.body.persist,
                     username: e.body.username,
@@ -3729,7 +3729,7 @@ class Ke {
                 if (!i.factor2 || i.factor2.length == 0)
                   return d.logger.debug(c({ msg: "Successful login - sending redirect" })), s.redirect(r);
                 {
-                  let n = {
+                  let a = {
                     csrfToken: e.csrfToken,
                     next: e.body.next ?? this.loginRedirect,
                     persist: e.body.persist ? "on" : "",
@@ -3737,17 +3737,17 @@ class Ke {
                     factor2: i.factor2,
                     action: "loginfactor2"
                   };
-                  return s.view(this.factor2Page, n);
+                  return s.view(this.factor2Page, a);
                 }
               }
             }
           );
         } catch (s) {
-          return d.logger.debug(c({ err: s })), this.handleError(s, e, o, (i, n) => i.view(this.loginPage, {
-            errorMessage: n.message,
-            errorMessages: n.messages,
-            errorCode: n.code,
-            errorCodeName: g[n.code],
+          return d.logger.debug(c({ err: s })), this.handleError(s, e, o, (i, a) => i.view(this.loginPage, {
+            errorMessage: a.message,
+            errorMessages: a.messages,
+            errorCode: a.code,
+            errorCodeName: g[a.code],
             next: r,
             persist: e.body.persist,
             username: e.body.username,
@@ -3774,12 +3774,12 @@ class Ke {
           d.logger.debug(c({ err: s }));
           let i;
           try {
-            const n = e.sessionId ? await this.sessionManager.dataForSessionId(e.sessionId) : void 0;
-            i = n == null ? void 0 : n.factor2;
-          } catch (n) {
-            d.logger.error(c({ err: n }));
+            const a = e.sessionId ? await this.sessionManager.dataForSessionId(e.sessionId) : void 0;
+            i = a == null ? void 0 : a.factor2;
+          } catch (a) {
+            d.logger.error(c({ err: a }));
           }
-          return i && i in this.authenticators ? this.handleError(s, e, o, (n, t) => n.view(this.factor2Page, {
+          return i && i in this.authenticators ? this.handleError(s, e, o, (a, t) => a.view(this.factor2Page, {
             errorMessage: t.message,
             errorMessages: t.messages,
             errorCode: t.code,
@@ -3790,7 +3790,7 @@ class Ke {
             urlPrefix: this.prefix,
             factor2: i,
             action: "loginfactor2"
-          })) : this.handleError(s, e, o, (n, t) => n.view(this.loginPage, {
+          })) : this.handleError(s, e, o, (a, t) => a.view(this.loginPage, {
             errorMessage: t.message,
             errorMessages: t.messages,
             errorCode: t.code,
@@ -3822,14 +3822,14 @@ class Ke {
           g.Unauthorized,
           "2FA not initiated"
         );
-        let n = {
+        let a = {
           urlPrefix: this.prefix,
           csrfToken: e.csrfToken,
           action: i.pre2fa.url,
           errorCodeName: e.query.error,
           factor2: i.pre2fa.factor2
         };
-        return o.view(this.factor2Page, n);
+        return o.view(this.factor2Page, a);
       }
     );
   }
@@ -3865,9 +3865,9 @@ class Ke {
           return d.logger.debug(c({ msg: "Next page " + r })), await this.signup(
             e,
             o,
-            (s, i, n) => {
-              var a, h;
-              const t = (a = i == null ? void 0 : i.userData) != null && a.factor2 ? this.authenticators[i.userData.factor2] : void 0;
+            (s, i, a) => {
+              var n, h;
+              const t = (n = i == null ? void 0 : i.userData) != null && n.factor2 ? this.authenticators[i.userData.factor2] : void 0;
               return (h = i.userData) != null && h.factor2 ? s.view(this.configureFactor2Page, {
                 csrfToken: i.csrfToken,
                 ...i.userData
@@ -3889,11 +3889,11 @@ class Ke {
             user: e.body.username,
             errorCodeName: i.codeName,
             errorCode: i.code
-          })), d.logger.debug(c({ err: s })), this.handleError(s, e, o, (n, t) => {
-            let a = {};
+          })), d.logger.debug(c({ err: s })), this.handleError(s, e, o, (a, t) => {
+            let n = {};
             for (let h in e.body)
-              h.startsWith("user_") && (a[h] = e.body[h]);
-            return n.view(this.signupPage, {
+              h.startsWith("user_") && (n[h] = e.body[h]);
+            return a.view(this.signupPage, {
               errorMessage: t.message,
               errorMessages: t.messages,
               errorCode: t.code,
@@ -3905,7 +3905,7 @@ class Ke {
               factor2: e.body.factor2,
               allowedFactor2: this.allowedFactor2Details(),
               urlPrefix: this.prefix,
-              ...a
+              ...n
             });
           });
         }
@@ -3931,18 +3931,18 @@ class Ke {
             (i) => i.redirect(e.body.next ? e.body.next : this.logoutRedirect)
           );
         } catch (i) {
-          const n = l.asCrossauthError(i);
+          const a = l.asCrossauthError(i);
           return d.logger.error(c({
             msg: "Logout failure",
             user: (s = e.user) == null ? void 0 : s.username,
-            errorCodeName: n.codeName,
-            errorCode: n.code
-          })), d.logger.debug(c({ err: i })), this.handleError(i, e, o, (t, a) => t.view(this.errorPage, {
+            errorCodeName: a.codeName,
+            errorCode: a.code
+          })), d.logger.debug(c({ err: i })), this.handleError(i, e, o, (t, n) => t.view(this.errorPage, {
             urlPrefix: this.prefix,
-            errorMessage: a.message,
-            errorMessages: a.messages,
-            errorCode: a.code,
-            errorCodeName: g[a.code]
+            errorMessage: n.message,
+            errorMessages: n.messages,
+            errorCode: n.code,
+            errorCodeName: g[n.code]
           }));
         }
       }
@@ -3967,8 +3967,8 @@ class Ke {
             (r, s) => {
               if (s.state == O.passwordChangeNeeded) {
                 const i = new l(g.PasswordChangeNeeded);
-                return this.handleError(i, e, r, (n, t) => {
-                  n.status(this.errorStatus(i)).header(...A).send({
+                return this.handleError(i, e, r, (a, t) => {
+                  a.status(this.errorStatus(i)).header(...A).send({
                     ok: !1,
                     errorMessage: t.message,
                     errorMessages: t.messages,
@@ -3978,8 +3978,8 @@ class Ke {
                 });
               } else if (s.state == O.passwordResetNeeded || s.state == O.passwordAndFactor2ResetNeeded) {
                 const i = new l(g.PasswordResetNeeded);
-                return this.handleError(i, e, r, (n, t) => {
-                  n.status(this.errorStatus(i)).header(...A).send({
+                return this.handleError(i, e, r, (a, t) => {
+                  a.status(this.errorStatus(i)).header(...A).send({
                     ok: !1,
                     errorMessage: t.message,
                     errorMessages: t.messages,
@@ -3989,8 +3989,8 @@ class Ke {
                 });
               } else if (this.allowedFactor2.length > 0 && (s.state == O.factor2ResetNeeded || !this.allowedFactor2.includes(s.factor2 ? s.factor2 : "none"))) {
                 const i = new l(g.Factor2ResetNeeded);
-                return this.handleError(i, e, r, (n, t) => {
-                  n.status(this.errorStatus(i)).header(...A).send({
+                return this.handleError(i, e, r, (a, t) => {
+                  a.status(this.errorStatus(i)).header(...A).send({
                     ok: !1,
                     errorMessage: t.message,
                     errorMessages: t.messages,
@@ -4008,13 +4008,13 @@ class Ke {
             user: e.body.username,
             errorCodeName: s.codeName,
             errorCode: s.code
-          })), d.logger.debug(c({ err: r })), this.handleError(r, e, o, (i, n) => {
+          })), d.logger.debug(c({ err: r })), this.handleError(r, e, o, (i, a) => {
             i.status(this.errorStatus(r)).header(...A).send({
               ok: !1,
-              errorMessage: n.message,
-              errorMessages: n.messages,
-              errorCode: n.code,
-              errorCodeName: g[n.code]
+              errorMessage: a.message,
+              errorMessages: a.messages,
+              errorCode: a.code,
+              errorCodeName: g[a.code]
             });
           });
         }
@@ -4038,19 +4038,19 @@ class Ke {
             (r) => r.header(...A).send({ ok: !0 })
           );
         } catch (r) {
-          const i = e.user || "", n = l.asCrossauthError(r);
+          const i = e.user || "", a = l.asCrossauthError(r);
           return d.logger.error(c({
             msg: "Login failure",
             user: i,
-            errorCodeName: n.codeName,
-            errorCode: n.code
-          })), d.logger.debug(c({ err: r })), this.handleError(r, e, o, (t, a) => {
+            errorCodeName: a.codeName,
+            errorCode: a.code
+          })), d.logger.debug(c({ err: r })), this.handleError(r, e, o, (t, n) => {
             t.status(this.errorStatus(r)).header(...A).send({
               ok: !1,
-              errorMessage: a.message,
-              errorMessages: a.messages,
-              errorCode: a.code,
-              errorCodeName: g[a.code]
+              errorMessage: n.message,
+              errorMessages: n.messages,
+              errorCode: n.code,
+              errorCodeName: g[n.code]
             });
           });
         }
@@ -4080,12 +4080,12 @@ class Ke {
             hashOfSessionId: this.getHashOfSessionId(e),
             errorCodeName: s.codeName,
             errorCode: s.code
-          })), d.logger.debug(c({ err: r })), this.handleError(r, e, o, (i, n) => i.status(this.errorStatus(r)).header(...A).send({
+          })), d.logger.debug(c({ err: r })), this.handleError(r, e, o, (i, a) => i.status(this.errorStatus(r)).header(...A).send({
             ok: !1,
-            errorMessage: n.message,
-            errorMessages: n.messages,
-            errorCode: n.code,
-            errorCodeName: g[n.code]
+            errorMessage: a.message,
+            errorMessages: a.messages,
+            errorCode: a.code,
+            errorCodeName: g[a.code]
           }));
         }
       }
@@ -4114,18 +4114,18 @@ class Ke {
             (i) => i.header(...A).send({ ok: !0 })
           );
         } catch (i) {
-          const n = l.asCrossauthError(i);
+          const a = l.asCrossauthError(i);
           return d.logger.error(c({
             msg: "Logout failure",
             user: (s = e.user) == null ? void 0 : s.username,
-            errorCodeName: n.codeName,
-            errorCode: n.code
-          })), d.logger.debug(c({ err: i })), this.handleError(i, e, o, (t, a) => {
+            errorCodeName: a.codeName,
+            errorCode: a.code
+          })), d.logger.debug(c({ err: i })), this.handleError(i, e, o, (t, n) => {
             t.status(this.errorStatus(i)).header(...A).send({
               ok: !1,
-              errorMessage: a.message,
-              errorMessages: a.messages,
-              errorCode: g[a.code]
+              errorMessage: n.message,
+              errorMessages: n.messages,
+              errorCode: g[n.code]
             });
           });
         }
@@ -4148,9 +4148,9 @@ class Ke {
           return await this.signup(
             e,
             o,
-            (s, i, n) => s.header(...A).send({
+            (s, i, a) => s.header(...A).send({
               ok: !0,
-              user: n,
+              user: a,
               emailVerificationNeeded: this.enableEmailVerification ?? !1,
               ...i.userData
             })
@@ -4162,8 +4162,8 @@ class Ke {
             user: (r = e.user) == null ? void 0 : r.username,
             errorCodeName: i.codeName,
             errorCode: i.code
-          })), d.logger.debug(c({ err: s })), this.handleError(s, e, o, (n, t) => {
-            n.status(this.errorStatus(s)).header(...A).send({
+          })), d.logger.debug(c({ err: s })), this.handleError(s, e, o, (a, t) => {
+            a.status(this.errorStatus(s)).header(...A).send({
               ok: !1,
               errorMessage: t.message,
               errorMessages: t.messages,
@@ -4200,12 +4200,12 @@ class Ke {
           let i;
           return e.sessionId && (i = (await this.sessionManager.userForSessionId(e.sessionId)).user), o.header(...A).send({ ok: !0, user: i });
         } catch (i) {
-          const n = l.asCrossauthError(i);
-          let t = n.message, a = n.code, h = n.codeName;
-          switch (n.code) {
+          const a = l.asCrossauthError(i);
+          let t = a.message, n = a.code, h = a.codeName;
+          switch (a.code) {
             case g.UserNotExist:
             case g.PasswordInvalid:
-              t = "Invalid username or password", a = g.UsernameOrPasswordInvalid, h = g[a];
+              t = "Invalid username or password", n = g.UsernameOrPasswordInvalid, h = g[n];
               break;
           }
           return d.logger.error(c({
@@ -4213,10 +4213,10 @@ class Ke {
             user: (s = e.user) == null ? void 0 : s.username,
             hashOfSessionId: this.getHashOfSessionId(e),
             errorCodeName: h,
-            errorCode: a
+            errorCode: n
           })), d.logger.debug(c({ err: i })), o.status(this.errorStatus(i)).header(...A).send({
             ok: !1,
-            errorCode: a,
+            errorCode: n,
             errorCodeName: h
           });
         }
@@ -4241,18 +4241,18 @@ class Ke {
             csrfToken: e.csrfToken
           });
         } catch (i) {
-          const n = l.asCrossauthError(i);
+          const a = l.asCrossauthError(i);
           return d.logger.error(c({
             msg: "getcsrftoken failure",
             user: (s = e.user) == null ? void 0 : s.username,
             hashedCsrfCookie: this.getHashOfCsrfCookie(e),
-            errorCode: n.code,
-            errorCodeName: n.codeName
+            errorCode: a.code,
+            errorCodeName: a.codeName
           })), d.logger.debug(c({ err: i })), o.status(this.errorStatus(i)).header(...A).send({
             ok: !1,
-            errorCode: n.code,
-            errorCodeName: n.codeName,
-            error: n.message
+            errorCode: a.code,
+            errorCodeName: a.codeName,
+            error: a.message
           });
         }
       }
@@ -4267,26 +4267,26 @@ class Ke {
     );
     const s = e.body.username, i = e.body.persist;
     if (!e.csrfToken) throw new l(g.InvalidCsrf);
-    const n = this.getSessionCookieValue(e);
-    let t = this.addToSession ? this.addToSession(e) : {}, { sessionCookie: a, csrfCookie: h, user: f } = await this.sessionManager.login(s, e.body, t, i);
+    const a = this.getSessionCookieValue(e);
+    let t = this.addToSession ? this.addToSession(e) : {}, { sessionCookie: n, csrfCookie: h, user: f } = await this.sessionManager.login(s, e.body, t, i);
     if (d.logger.debug(c({
-      msg: "Login: set session cookie " + a.name + " opts " + JSON.stringify(a.options),
+      msg: "Login: set session cookie " + n.name + " opts " + JSON.stringify(n.options),
       user: e.body.username
     })), o.cookie(
-      a.name,
-      a.value,
-      a.options
+      n.name,
+      n.value,
+      n.options
     ), d.logger.debug(c({
-      msg: "Login: set csrf cookie " + h.name + " opts " + JSON.stringify(a.options),
+      msg: "Login: set csrf cookie " + h.name + " opts " + JSON.stringify(n.options),
       user: e.body.username
-    })), o.cookie(h.name, h.value, h.options), e.csrfToken = await this.sessionManager.createCsrfFormOrHeaderValue(h.value), n)
+    })), o.cookie(h.name, h.value, h.options), e.csrfToken = await this.sessionManager.createCsrfFormOrHeaderValue(h.value), a)
       try {
-        await this.sessionManager.deleteSession(n);
-      } catch (p) {
+        await this.sessionManager.deleteSession(a);
+      } catch (m) {
         d.logger.warn(c({
           msg: "Couldn't delete session ID from database",
           hashOfSessionId: this.getHashOfSessionId(e)
-        })), d.logger.debug(c({ err: p }));
+        })), d.logger.debug(c({ err: m }));
       }
     return r(o, f);
   }
@@ -4299,11 +4299,11 @@ class Ke {
     if (!s) throw new l(g.Unauthorized);
     const i = e.body.persist;
     if (this.isSessionUser(e) && !e.csrfToken) throw new l(g.InvalidCsrf);
-    let n = this.addToSession ? this.addToSession(e) : {};
-    const { sessionCookie: t, csrfCookie: a, user: h } = await this.sessionManager.completeTwoFactorLogin(
+    let a = this.addToSession ? this.addToSession(e) : {};
+    const { sessionCookie: t, csrfCookie: n, user: h } = await this.sessionManager.completeTwoFactorLogin(
       e.body,
       s,
-      n,
+      a,
       i
     );
     return d.logger.debug(c({
@@ -4314,9 +4314,9 @@ class Ke {
       t.value,
       t.options
     ), d.logger.debug(c({
-      msg: "Login: set csrf cookie " + a.name + " opts " + JSON.stringify(t.options),
+      msg: "Login: set csrf cookie " + n.name + " opts " + JSON.stringify(t.options),
       user: h == null ? void 0 : h.username
-    })), o.cookie(a.name, a.value, a.options), e.csrfToken = await this.sessionManager.createCsrfFormOrHeaderValue(a.value), r(o, h);
+    })), o.cookie(n.name, n.value, n.options), e.csrfToken = await this.sessionManager.createCsrfFormOrHeaderValue(n.value), r(o, h);
   }
   async cancelFactor2(e, o, r) {
     if (this.isSessionUser(e) && !e.csrfToken) throw new l(g.InvalidCsrf);
@@ -4327,21 +4327,21 @@ class Ke {
    * This is called after the user has been validated to log the user in
    */
   async loginWithUser(e, o, r, s, i) {
-    const n = this.getSessionCookieValue(r);
-    let t = this.addToSession ? this.addToSession(r) : {}, { sessionCookie: a, csrfCookie: h } = await this.sessionManager.login("", {}, t, void 0, e, o);
+    const a = this.getSessionCookieValue(r);
+    let t = this.addToSession ? this.addToSession(r) : {}, { sessionCookie: n, csrfCookie: h } = await this.sessionManager.login("", {}, t, void 0, e, o);
     if (d.logger.debug(c({
-      msg: "Login: set session cookie " + a.name + " opts " + JSON.stringify(a.options),
+      msg: "Login: set session cookie " + n.name + " opts " + JSON.stringify(n.options),
       user: e.username
     })), s.cookie(
-      a.name,
-      a.value,
-      a.options
+      n.name,
+      n.value,
+      n.options
     ), d.logger.debug(c({
-      msg: "Login: set csrf cookie " + h.name + " opts " + JSON.stringify(a.options),
+      msg: "Login: set csrf cookie " + h.name + " opts " + JSON.stringify(n.options),
       user: e.username
-    })), s.cookie(h.name, h.value, h.options), n)
+    })), s.cookie(h.name, h.value, h.options), a)
       try {
-        await this.sessionManager.deleteSession(n);
+        await this.sessionManager.deleteSession(a);
       } catch (f) {
         d.logger.warn(c({
           msg: "Couldn't delete session ID from database",
@@ -4360,40 +4360,40 @@ class Ke {
         "Illegal second factor " + e.body.factor2 + " requested"
       );
     (e.body.factor2 == "none" || e.body.factor2 == "") && (e.body.factor2 = void 0);
-    let n = this.createUserFn(e, this.userStorage.userEditableFields), t = this.authenticators[n.factor1].validateSecrets(e.body);
-    const a = this.authenticators[n.factor1].secretNames();
+    let a = this.createUserFn(e, this.userStorage.userEditableFields), t = this.authenticators[a.factor1].validateSecrets(e.body);
+    const n = this.authenticators[a.factor1].secretNames();
     let h = {};
-    for (let m in e.body)
-      if (m.startsWith("repeat_")) {
-        const w = m.replace(/^repeat_/, "");
-        a.includes(w) && (h[w] = e.body[m]);
-      }
-    Object.keys(h).length === 0 && (h = void 0), n.state = "active", e.body.factor2 && e.body.factor2 != "none" ? n.state = "awaitingtwofactor" : this.enableEmailVerification && (n.state = "awaitingemailverification");
-    let p = [...this.validateUserFn(n), ...t];
-    if (p.length > 0)
-      throw new l(g.FormEntry, p);
+    for (let p in e.body)
+      if (p.startsWith("repeat_")) {
+        const w = p.replace(/^repeat_/, "");
+        n.includes(w) && (h[w] = e.body[p]);
+      }
+    Object.keys(h).length === 0 && (h = void 0), a.state = "active", e.body.factor2 && e.body.factor2 != "none" ? a.state = "awaitingtwofactor" : this.enableEmailVerification && (a.state = "awaitingemailverification");
+    let m = [...this.validateUserFn(a), ...t];
+    if (m.length > 0)
+      throw new l(g.FormEntry, m);
     let v = !1;
     try {
-      const { user: m, secrets: w } = await this.userStorage.getUserByUsername(s);
-      await this.sessionManager.authenticators[n.factor1].authenticateUser(m, w, e.body);
-    } catch (m) {
-      l.asCrossauthError(m).code == g.TwoFactorIncomplete && (v = !0);
+      const { user: p, secrets: w } = await this.userStorage.getUserByUsername(s);
+      await this.sessionManager.authenticators[a.factor1].authenticateUser(p, w, e.body);
+    } catch (p) {
+      l.asCrossauthError(p).code == g.TwoFactorIncomplete && (v = !0);
     }
     if (!e.body.factor2 && !v)
       return await this.sessionManager.createUser(
-        n,
+        a,
         e.body,
         h
-      ), this.enableEmailVerification ? r(o, {}, void 0) : this.login(e, o, (m, w) => r(m, {}, w));
+      ), this.enableEmailVerification ? r(o, {}, void 0) : this.login(e, o, (p, w) => r(p, {}, w));
     {
-      let m;
+      let p;
       if (v) {
         if (!e.sessionId) throw new l(g.Unauthorized);
-        m = (await this.sessionManager.repeatTwoFactorSignup(e.sessionId)).userData;
+        p = (await this.sessionManager.repeatTwoFactorSignup(e.sessionId)).userData;
       } else {
         const w = await this.createAnonymousSession(e, o), P = this.sessionManager.getSessionId(w);
-        m = (await this.sessionManager.initiateTwoFactorSignup(
-          n,
+        p = (await this.sessionManager.initiateTwoFactorSignup(
+          a,
           e.body,
           P,
           h
@@ -4401,7 +4401,7 @@ class Ke {
       }
       try {
         let w = {
-          userData: m,
+          userData: p,
           username: s,
           next: i ?? this.loginRedirect,
           csrfToken: e.csrfToken
@@ -4446,14 +4446,14 @@ class Ke {
     d.logger.debug(c({ msg: "Creating session ID" }));
     let s = this.addToSession ? this.addToSession(e) : {};
     r && (s.data = JSON.stringify(r));
-    let { sessionCookie: i, csrfCookie: n, csrfFormOrHeaderValue: t } = await this.sessionManager.createAnonymousSession(s);
+    let { sessionCookie: i, csrfCookie: a, csrfFormOrHeaderValue: t } = await this.sessionManager.createAnonymousSession(s);
     o.cookie(
       i.name,
       i.value,
       i.options
-    ), e.csrfToken = t, o.setCookie(n.name, n.value, n.options), e.user = void 0;
-    const a = this.sessionManager.getSessionId(i.value);
-    return e.sessionId = a, i.value;
+    ), e.csrfToken = t, o.setCookie(a.name, a.value, a.options), e.user = void 0;
+    const n = this.sessionManager.getSessionId(i.value);
+    return e.sessionId = n, i.value;
   }
   /**
    * Called by each endpoint on error.  
@@ -4470,7 +4470,7 @@ class Ke {
    *        incorrect.  Default false.
    */
   handleError(e, o, r, s, i = !1) {
-    var n;
+    var a;
     try {
       let t = l.asCrossauthError(e);
       if (!i)
@@ -4486,7 +4486,7 @@ class Ke {
       return d.logger.debug(c({ err: t })), d.logger.error(c({
         cerr: t,
         hashOfSessionId: this.getHashOfSessionId(o),
-        user: (n = o.user) == null ? void 0 : n.username
+        user: (a = o.user) == null ? void 0 : a.username
       })), s(r, t);
     } catch (t) {
       return d.logger.error(c({ err: t })), s(r, new l(g.UnknownError));
@@ -4569,8 +4569,8 @@ class Ke {
     let r;
     const s = this.sessionManager.csrfHeaderName;
     if (e.headers && s.toLowerCase() in e.headers) {
-      const n = e.headers[s.toLowerCase()];
-      Array.isArray(n) ? r = n[0] : r = n;
+      const a = e.headers[s.toLowerCase()];
+      Array.isArray(a) ? r = a[0] : r = a;
     }
     if (!r && ((i = e.body) != null && i.csrfToken) && (r = e.body.csrfToken), r)
       try {
@@ -4736,7 +4736,7 @@ class Ye {
     u(this, "apiKeyManager");
     this.app = e, this.userStorage = o, this.apiKeyManager = new Y(r, s), this.app.addHook(
       "preHandler",
-      async (i, n) => {
+      async (i, a) => {
         if (i.headers.authorization)
           try {
             d.logger.debug(c({
@@ -4749,10 +4749,10 @@ class Ye {
               msg: "Valid API key",
               hahedApiKey: Y.hashSignedApiKeyValue(t.value)
             }));
-            const a = Fe.decodeData(t.data);
-            if (i.apiKey = { ...t, ...a }, "scope" in a && Array.isArray(a.scope)) {
+            const n = Fe.decodeData(t.data);
+            if (i.apiKey = { ...t, ...n }, "scope" in n && Array.isArray(n.scope)) {
               let h = [];
-              for (let f of a.scope)
+              for (let f of n.scope)
                 typeof f == "string" && h.push(f);
               i.scope = h;
             }
@@ -4782,7 +4782,7 @@ class $e {
    *        for the password flow
    * @param options see {@link FastifyAuthorizationServerOptions}
    */
-  constructor(e, o, r, s, i, n = {}) {
+  constructor(e, o, r, s, i, a = {}) {
     /** The Fastify app passed to the constructor */
     u(this, "app");
     /** The underlying framework-independent authorization server */
@@ -4808,10 +4808,10 @@ class $e {
       this.clientStorage,
       s,
       i,
-      n
-    ), S("prefix", C.String, this, n, "PREFIX"), this.prefix.endsWith("/") || (this.prefix += "/"), S("errorPage", C.String, this, n, "ERROR_PAGE"), S("devicePage", C.String, this, n, "OAUTH_DEVICE_PAGE"), S("loginUrl", C.String, this, n, "LOGIN_URL"), S("oauthAuthorizePage", C.String, this, n, "OAUTH_AUTHORIZE_PAGE"), S("refreshTokenType", C.String, this, n, "OAUTH_REFRESH_TOKEN_TYPE"), S("refreshTokenCookieName", C.String, this, n, "OAUTH_REFRESH_TOKEN_COOKIE_NAME"), S("refreshTokenCookieDomain", C.String, this, n, "OAUTH_REFRESH_TOKEN_COOKIE_DOMAIN"), S("refreshTokenCookieHttpOnly", C.Boolean, this, n, "OAUTH_REFRESH_TOKEN_COOKIE_HTTPONLY"), S("refreshTokenCookiePath", C.String, this, n, "OAUTH_REFRESH_TOKEN_COOKIE_PATH"), S("refreshTokenCookieSecure", C.Boolean, this, n, "OAUTH_REFRESH_TOKEN_COOKIE_SECURE"), S("refreshTokenCookieSameSite", C.String, this, n, "OAUTH_REFRESH_TOKEN_COOKIE_SAMESITE"), S("createGetCsrfTokenEndpoint", C.String, this, n, "OAUTH_CREATE_GET_CSRF_TOKEN_ENDPOINT"), this.refreshTokenType != "json" && (this.createGetCsrfTokenEndpoint ? this.csrfTokens = new Ue(n.doubleSubmitCookieOptions) : this.fastifyServer.sessionServer && (this.csrfTokens = this.fastifyServer.sessionServer.sessionManager.csrfTokens)), this.createGetCsrfTokenEndpoint && this.addApiGetCsrfTokenEndpoints(), e.get(
+      a
+    ), S("prefix", C.String, this, a, "PREFIX"), this.prefix.endsWith("/") || (this.prefix += "/"), S("errorPage", C.String, this, a, "ERROR_PAGE"), S("devicePage", C.String, this, a, "OAUTH_DEVICE_PAGE"), S("loginUrl", C.String, this, a, "LOGIN_URL"), S("oauthAuthorizePage", C.String, this, a, "OAUTH_AUTHORIZE_PAGE"), S("refreshTokenType", C.String, this, a, "OAUTH_REFRESH_TOKEN_TYPE"), S("refreshTokenCookieName", C.String, this, a, "OAUTH_REFRESH_TOKEN_COOKIE_NAME"), S("refreshTokenCookieDomain", C.String, this, a, "OAUTH_REFRESH_TOKEN_COOKIE_DOMAIN"), S("refreshTokenCookieHttpOnly", C.Boolean, this, a, "OAUTH_REFRESH_TOKEN_COOKIE_HTTPONLY"), S("refreshTokenCookiePath", C.String, this, a, "OAUTH_REFRESH_TOKEN_COOKIE_PATH"), S("refreshTokenCookieSecure", C.Boolean, this, a, "OAUTH_REFRESH_TOKEN_COOKIE_SECURE"), S("refreshTokenCookieSameSite", C.String, this, a, "OAUTH_REFRESH_TOKEN_COOKIE_SAMESITE"), S("createGetCsrfTokenEndpoint", C.String, this, a, "OAUTH_CREATE_GET_CSRF_TOKEN_ENDPOINT"), this.refreshTokenType != "json" && (this.createGetCsrfTokenEndpoint ? this.csrfTokens = new Ue(a.doubleSubmitCookieOptions) : this.fastifyServer.sessionServer && (this.csrfTokens = this.fastifyServer.sessionServer.sessionManager.csrfTokens)), this.createGetCsrfTokenEndpoint && this.addApiGetCsrfTokenEndpoints(), e.get(
       this.prefix + ".well-known/openid-configuration",
-      async (t, a) => a.header(...x).status(200).send(
+      async (t, n) => n.header(...x).status(200).send(
         this.authServer.oidcConfiguration({
           authorizeEndpoint: this.prefix + "authorize",
           tokenEndpoint: this.prefix + "token",
@@ -4821,29 +4821,29 @@ class $e {
       )
     ), e.get(
       this.prefix + "jwks",
-      async (t, a) => a.header(...x).status(200).send(
+      async (t, n) => n.header(...x).status(200).send(
         this.authServer.jwks()
       )
-    ), (this.authServer.validFlows.includes(E.AuthorizationCode) || this.authServer.validFlows.includes(E.AuthorizationCodeWithPKCE) || this.authServer.validFlows.includes(E.OidcAuthorizationCode)) && (e.get(this.prefix + "authorize", async (t, a) => {
+    ), (this.authServer.validFlows.includes(E.AuthorizationCode) || this.authServer.validFlows.includes(E.AuthorizationCodeWithPKCE) || this.authServer.validFlows.includes(E.OidcAuthorizationCode)) && (e.get(this.prefix + "authorize", async (t, n) => {
       var h;
-      return d.logger.info(c({ msg: "Page visit", method: "GET", url: this.prefix + "authorize", ip: t.ip, user: (h = t.user) == null ? void 0 : h.username })), await this.authorizeEndpoint(t, a, t.query);
-    }), e.post(this.prefix + "authorize", async (t, a) => {
+      return d.logger.info(c({ msg: "Page visit", method: "GET", url: this.prefix + "authorize", ip: t.ip, user: (h = t.user) == null ? void 0 : h.username })), await this.authorizeEndpoint(t, n, t.query);
+    }), e.post(this.prefix + "authorize", async (t, n) => {
       var h;
-      return d.logger.info(c({ msg: "Page visit", method: "POST", url: this.prefix + "authorize", ip: t.ip, user: (h = t.user) == null ? void 0 : h.username })), await this.authorizeEndpoint(t, a, t.body);
+      return d.logger.info(c({ msg: "Page visit", method: "POST", url: this.prefix + "authorize", ip: t.ip, user: (h = t.user) == null ? void 0 : h.username })), await this.authorizeEndpoint(t, n, t.body);
     }), this.app.post(
       this.prefix + "userauthorize",
-      async (t, a) => {
-        var p, v;
-        if (d.logger.info(c({ msg: "Page visit", method: "POST", url: this.prefix + "authorize", ip: t.ip, user: (p = t.user) == null ? void 0 : p.username })), !t.user) return y.sendPageError(
-          a,
+      async (t, n) => {
+        var m, v;
+        if (d.logger.info(c({ msg: "Page visit", method: "POST", url: this.prefix + "authorize", ip: t.ip, user: (m = t.user) == null ? void 0 : m.username })), !t.user) return y.sendPageError(
+          n,
           401,
           this.errorPage
         );
         let h, f;
         try {
           h = await this.fastifyServer.validateCsrfToken(t);
-        } catch (m) {
-          f = l.asCrossauthError(m), f.message = "Invalid csrf cookie received", d.logger.error(c({
+        } catch (p) {
+          f = l.asCrossauthError(p), f.message = "Invalid csrf cookie received", d.logger.error(c({
             msg: f.message,
             hashedCsrfCookie: h ? F.hash(h) : void 0,
             user: (v = t.user) == null ? void 0 : v.username,
@@ -4852,7 +4852,7 @@ class $e {
         }
         if (f) {
           if (this.errorPage)
-            return a.status(f.httpStatus).view(
+            return n.status(f.httpStatus).view(
               this.errorPage,
               {
                 status: f.httpStatus,
@@ -4862,21 +4862,21 @@ class $e {
               }
             );
           {
-            let m = "500";
+            let p = "500";
             switch (f.httpStatus) {
               case 401:
-                m = "401";
+                p = "401";
                 break;
               case 400:
-                m = "400";
+                p = "400";
                 break;
             }
-            return a.status(f.httpStatus).send($[m] ?? G);
+            return n.status(f.httpStatus).send($[p] ?? G);
           }
         }
         if (!f) {
-          const m = t.body.authorized == "true";
-          return await this.authorize(t, a, m, {
+          const p = t.body.authorized == "true";
+          return await this.authorize(t, n, p, {
             responseType: t.body.response_type,
             client_id: t.body.client_id,
             redirect_uri: t.body.redirect_uri,
@@ -4889,14 +4889,14 @@ class $e {
       }
     )), (this.authServer.validFlows.includes(E.AuthorizationCode) || this.authServer.validFlows.includes(E.AuthorizationCodeWithPKCE) || this.authServer.validFlows.includes(E.OidcAuthorizationCode) || this.authServer.validFlows.includes(E.ClientCredentials) || this.authServer.validFlows.includes(E.RefreshToken) || this.authServer.validFlows.includes(E.Password) || this.authServer.validFlows.includes(E.PasswordMfa) || this.authServer.validFlows.includes(E.DeviceCode)) && this.app.post(
       this.prefix + "token",
-      async (t, a) => {
-        var m;
+      async (t, n) => {
+        var p;
         d.logger.info(c({
           msg: "Page visit",
           method: "POST",
           url: this.prefix + "token",
           ip: t.ip,
-          user: (m = t.user) == null ? void 0 : m.username
+          user: (p = t.user) == null ? void 0 : p.username
         }));
         let h = t.body.client_id, f = t.body.client_secret;
         if (t.headers.authorization) {
@@ -4910,8 +4910,8 @@ class $e {
             msg: "Ignoring malform authenization header " + t.headers.authorization
           })) : (h = w, f = P);
         }
-        let p = t.body.refresh_token;
-        if ((this.refreshTokenType == "cookie" && t.cookies && this.refreshTokenCookieName in t.cookies || this.refreshTokenType == "both" && t.cookies && this.refreshTokenCookieName in t.cookies && p == null) && this.csrfTokens) {
+        let m = t.body.refresh_token;
+        if ((this.refreshTokenType == "cookie" && t.cookies && this.refreshTokenCookieName in t.cookies || this.refreshTokenType == "both" && t.cookies && this.refreshTokenCookieName in t.cookies && m == null) && this.csrfTokens) {
           const w = t.cookies[this.csrfTokens.cookieName];
           let P = t.headers[this.csrfTokens.headerName.toLowerCase()];
           if (Array.isArray(P) && (P = P[0]), !w || !P)
@@ -4927,7 +4927,7 @@ class $e {
               error_description: "Invalid csrf token"
             };
           }
-          p = t.cookies[this.refreshTokenCookieName];
+          m = t.cookies[this.refreshTokenCookieName];
         }
         const v = await this.authServer.tokenEndpoint({
           grantType: t.body.grant_type,
@@ -4942,22 +4942,22 @@ class $e {
           oobCode: t.body.oob_code,
           bindingCode: t.body.binding_code,
           otp: t.body.otp,
-          refreshToken: p,
+          refreshToken: m,
           deviceCode: t.body.device_code
         });
         if (v.error == "authorization_pending")
-          return a.header(...x).status(200).send(v);
-        if (v.refresh_token && this.refreshTokenType != "json" && this.setRefreshTokenCookie(a, v.refresh_token, v.expires_in), v.error || !v.access_token) {
+          return n.header(...x).status(200).send(v);
+        if (v.refresh_token && this.refreshTokenType != "json" && this.setRefreshTokenCookie(n, v.refresh_token, v.expires_in), v.error || !v.access_token) {
           let w = "server_error", P = "Neither code nor error received when requesting authorization";
           v.error && (w = v.error), v.error_description && (P = v.error_description);
           const T = l.fromOAuthError(w, P);
-          return d.logger.error(c({ cerr: T })), a.header(...x).status(T.httpStatus).send(v);
+          return d.logger.error(c({ cerr: T })), n.header(...x).status(T.httpStatus).send(v);
         }
-        return a.header(...x).send(v);
+        return n.header(...x).send(v);
       }
     ), this.authServer.validFlows.includes(E.PasswordMfa) && (e.get(
       this.prefix + "mfa/authenticators",
-      async (t, a) => {
+      async (t, n) => {
         var h;
         return d.logger.info(c({
           msg: "Page visit",
@@ -4965,11 +4965,11 @@ class $e {
           url: this.prefix + "mfa/authenticators",
           ip: t.ip,
           user: (h = t.user) == null ? void 0 : h.username
-        })), await this.mfaAuthenticatorsEndpoint(t, a);
+        })), await this.mfaAuthenticatorsEndpoint(t, n);
       }
     ), e.post(
       this.prefix + "mfa/authenticators",
-      async (t, a) => {
+      async (t, n) => {
         var h;
         return d.logger.info(c({
           msg: "Page visit",
@@ -4977,11 +4977,11 @@ class $e {
           url: this.prefix + "mfa/authenticators",
           ip: t.ip,
           user: (h = t.user) == null ? void 0 : h.username
-        })), await this.mfaAuthenticatorsEndpoint(t, a);
+        })), await this.mfaAuthenticatorsEndpoint(t, n);
       }
     ), e.post(
       this.prefix + "mfa/challenge",
-      async (t, a) => {
+      async (t, n) => {
         var h;
         return d.logger.info(c({
           msg: "Page visit",
@@ -4989,11 +4989,11 @@ class $e {
           url: this.prefix + "mfa/challenge",
           ip: t.ip,
           user: (h = t.user) == null ? void 0 : h.username
-        })), await this.mfaChallengeEndpoint(t, a, t.body);
+        })), await this.mfaChallengeEndpoint(t, n, t.body);
       }
     )), this.authServer.validFlows.includes(E.DeviceCode) && (this.app.post(
       this.prefix + "device_authorization",
-      async (t, a) => {
+      async (t, n) => {
         var v;
         d.logger.info(c({
           msg: "Page visit",
@@ -5004,32 +5004,32 @@ class $e {
         }));
         let h = t.body.client_id, f = t.body.client_secret;
         if (t.headers.authorization) {
-          let m, w;
+          let p, w;
           const P = t.headers.authorization.split(" ");
           if (P.length == 2 && P[0].toLocaleLowerCase() == "basic") {
             const U = F.base64Decode(P[1]).split(":", 2);
-            U.length == 2 && (m = U[0], w = U[1]);
+            U.length == 2 && (p = U[0], w = U[1]);
           }
-          m == null || w == null ? d.logger.warn(c({
+          p == null || w == null ? d.logger.warn(c({
             msg: "Ignoring malform authenization header " + t.headers.authorization
-          })) : (h = m, f = w);
+          })) : (h = p, f = w);
         }
-        const p = await this.authServer.deviceAuthorizationEndpoint({
+        const m = await this.authServer.deviceAuthorizationEndpoint({
           client_id: h,
           client_secret: f,
           scope: t.body.scope
         });
-        if (p.error || !p.device_code || !p.user_code) {
-          let m = "server_error", w = "Neither code nor error received when requesting authorization";
-          p.error && (m = p.error), p.error_description && (w = p.error_description);
-          const P = l.fromOAuthError(m, w);
-          return d.logger.error(c({ cerr: P })), a.header(...x).status(P.httpStatus).send(p);
+        if (m.error || !m.device_code || !m.user_code) {
+          let p = "server_error", w = "Neither code nor error received when requesting authorization";
+          m.error && (p = m.error), m.error_description && (w = m.error_description);
+          const P = l.fromOAuthError(p, w);
+          return d.logger.error(c({ cerr: P })), n.header(...x).status(P.httpStatus).send(m);
         }
-        return a.header(...x).send(p);
+        return n.header(...x).send(m);
       }
     ), e.get(
       this.prefix + "device",
-      async (t, a) => {
+      async (t, n) => {
         var h;
         return d.logger.info(c({
           msg: "Page visit",
@@ -5037,11 +5037,11 @@ class $e {
           url: this.prefix + "device",
           ip: t.ip,
           user: (h = t.user) == null ? void 0 : h.username
-        })), t.user ? await this.deviceGet(!1, t, a, t.user) : a.redirect(this.loginUrl + "?next=" + encodeURIComponent(t.url), 302);
+        })), t.user ? await this.deviceGet(!1, t, n, t.user) : n.redirect(this.loginUrl + "?next=" + encodeURIComponent(t.url), 302);
       }
     ), e.get(
       this.prefix + "api/device",
-      async (t, a) => {
+      async (t, n) => {
         var h;
         if (d.logger.info(c({
           msg: "Page visit",
@@ -5051,17 +5051,17 @@ class $e {
           user: (h = t.user) == null ? void 0 : h.username
         })), !t.user) {
           const f = new l(g.Unauthorized, "Not logged in");
-          return a.header(...x).status(401).send({
+          return n.header(...x).status(401).send({
             errorMessage: f.message,
             errorCode: f.code,
             errorCodeName: f.codeName
           });
         }
-        return await this.deviceGet(!0, t, a, t.user);
+        return await this.deviceGet(!0, t, n, t.user);
       }
     ), this.app.post(
       this.prefix + "device",
-      async (t, a) => {
+      async (t, n) => {
         var h;
         return d.logger.info(c({
           msg: "Page visit",
@@ -5069,11 +5069,11 @@ class $e {
           url: this.prefix + "device",
           ip: t.ip,
           user: (h = t.user) == null ? void 0 : h.username
-        })), t.user ? await this.deviceCodePost(!1, t, a) : a.redirect(this.loginUrl + "?next=" + encodeURIComponent(t.url), 302);
+        })), t.user ? await this.deviceCodePost(!1, t, n) : n.redirect(this.loginUrl + "?next=" + encodeURIComponent(t.url), 302);
       }
     ), this.app.post(
       this.prefix + "api/device",
-      async (t, a) => {
+      async (t, n) => {
         var h;
         return d.logger.info(c({
           msg: "Page visit",
@@ -5081,7 +5081,7 @@ class $e {
           url: this.prefix + "device",
           ip: t.ip,
           user: (h = t.user) == null ? void 0 : h.username
-        })), await this.deviceCodePost(!0, t, a);
+        })), await this.deviceCodePost(!0, t, n);
       }
     ));
   }
@@ -5113,22 +5113,22 @@ class $e {
         let r = "";
         try {
           const {
-            csrfCookie: n,
+            csrfCookie: a,
             csrfFormOrHeaderValue: t
           } = await this.createCsrfToken();
-          return r = n.value, o.setCookie(n.name, n.value, n.options), o.header(...x).send({
+          return r = a.value, o.setCookie(a.name, a.value, a.options), o.header(...x).send({
             ok: !0,
             csrfToken: t
           });
-        } catch (n) {
-          const t = l.asCrossauthError(n);
+        } catch (a) {
+          const t = l.asCrossauthError(a);
           return d.logger.error(c({
             msg: "getcsrftoken failure",
             user: (i = e.user) == null ? void 0 : i.username,
             hashedCsrfCookie: F.hash(r.split(".")[0]),
             errorCode: t.code,
             errorCodeName: t.codeName
-          })), d.logger.debug(c({ err: n })), o.status(t.httpStatus).header(...x).send({
+          })), d.logger.debug(c({ err: a })), o.status(t.httpStatus).header(...x).send({
             ok: !1,
             errorCode: t.code,
             errorCodeName: t.codeName,
@@ -5139,7 +5139,7 @@ class $e {
     );
   }
   async authorizeEndpoint(e, o, r) {
-    var t, a, h;
+    var t, n, h;
     if (!e.user) return o.redirect(this.loginUrl + "?next=" + encodeURIComponent(e.url), 302);
     d.logger.debug(c({ msg: "validating authorize parameters" }));
     let { error_description: s } = this.authServer.validateAuthorizeParameters(r), i;
@@ -5149,7 +5149,7 @@ class $e {
       user: (t = e.user) == null ? void 0 : t.username
     }))) : d.logger.error(c({
       msg: "authorize parameter valid",
-      user: (a = e.user) == null ? void 0 : a.username
+      user: (n = e.user) == null ? void 0 : n.username
     })), i) {
       if (this.errorPage)
         return o.status(i.httpStatus).view(
@@ -5174,19 +5174,19 @@ class $e {
         return o.status(i.httpStatus).send($[f] ?? G);
       }
     }
-    let n = !1;
+    let a = !1;
     if (d.logger.debug(c({
       msg: "Checking scopes have been authorized",
       scope: r.scope
-    })), r.scope ? n = await this.authServer.hasAllScopes(
+    })), r.scope ? a = await this.authServer.hasAllScopes(
       r.client_id,
       e.user,
       r.scope.split(" ")
-    ) : n = await this.authServer.hasAllScopes(
+    ) : a = await this.authServer.hasAllScopes(
       r.client_id,
       e.user,
       [null]
-    ), n)
+    ), a)
       return d.logger.debug(c({
         msg: "All scopes authorized",
         scope: r.scope
@@ -5219,42 +5219,42 @@ class $e {
         csrfToken: e.csrfToken
       });
     } catch (f) {
-      const p = f;
-      return d.logger.debug(c({ err: p })), this.errorPage ? o.status(p.httpStatus).view(this.errorPage, {
-        status: p.httpStatus,
+      const m = f;
+      return d.logger.debug(c({ err: m })), this.errorPage ? o.status(m.httpStatus).view(this.errorPage, {
+        status: m.httpStatus,
         errorMessage: "Invalid client given",
         client_id: r.client_id,
         user: (h = e.user) == null ? void 0 : h.username,
-        httpStatus: p.httpStatus,
+        httpStatus: m.httpStatus,
         errorCode: g.UnauthorizedClient,
         errorCodeName: g[g.UnauthorizedClient]
-      }) : o.status(p.httpStatus).send($[401]);
+      }) : o.status(m.httpStatus).send($[401]);
     }
   }
   async authorize(e, o, r, {
     responseType: s,
     client_id: i,
-    redirect_uri: n,
+    redirect_uri: a,
     scope: t,
-    state: a,
+    state: n,
     codeChallenge: h,
     codeChallengeMethod: f
   }) {
-    let p, v, m;
+    let m, v, p;
     if (r) {
       const w = await this.authServer.authorizeGetEndpoint({
         responseType: s,
         client_id: i,
-        redirect_uri: n,
+        redirect_uri: a,
         scope: t,
-        state: a,
+        state: n,
         codeChallenge: h,
         codeChallengeMethod: f,
         user: e.user
       });
-      if (m = w.code, p = w.error, v = w.error_description, p || !m) {
+      if (p = w.code, m = w.error, v = w.error_description, m || !p) {
         const P = l.fromOAuthError(
-          p ?? "server_error",
+          m ?? "server_error",
           v ?? "Neither code nor error received"
         );
         if (d.logger.error(c({ cerr: P })), this.errorPage)
@@ -5281,9 +5281,9 @@ class $e {
         }
       }
       return o.redirect(this.authServer.redirect_uri(
-        n,
-        m,
-        a
+        a,
+        p,
+        n
       ));
     } else {
       const w = new l(
@@ -5296,10 +5296,10 @@ class $e {
         errorCodeName: w.codeName
       }));
       try {
-        return L.validateUri(n), o.redirect(n);
+        return L.validateUri(a), o.redirect(a);
       } catch {
         d.logger.error(c({
-          msg: `Couldn't send error message ${w.codeName} to ${n}}`
+          msg: `Couldn't send error message ${w.codeName} to ${a}}`
         }));
       }
     }
@@ -5315,8 +5315,8 @@ class $e {
     const s = r[1], i = await this.authServer.mfaAuthenticatorsEndpoint(s);
     if (i.authenticators)
       return o.header(...x).status(200).send(i.authenticators);
-    const n = l.fromOAuthError(i.error ?? "server_error");
-    return o.header(...x).status(n.httpStatus).send(i);
+    const a = l.fromOAuthError(i.error ?? "server_error");
+    return o.header(...x).status(a.httpStatus).send(i);
   }
   async mfaChallengeEndpoint(e, o, r) {
     const s = await this.authServer.mfaChallengeEndpoint(
@@ -5353,7 +5353,7 @@ class $e {
   /////
   // Device code flow
   async applyUserCode(e, o, r) {
-    var s, i, n;
+    var s, i, a;
     try {
       const t = await this.authServer.deviceEndpoint({ userCode: e, user: r });
       if (t.error)
@@ -5373,7 +5373,7 @@ class $e {
           error_description: "No client id found for user code"
         };
       if (t.error == "access_denied")
-        return d.logger.error(c({ msg: "Incorrect user code given", userCodeHash: F.hash(e), ip: o.ip, username: (i = o.user) == null ? void 0 : i.username })), this.authServer.userCodeThrottle > 0 && await ((f) => new Promise((p) => setTimeout(p, f)))(this.authServer.userCodeThrottle), {
+        return d.logger.error(c({ msg: "Incorrect user code given", userCodeHash: F.hash(e), ip: o.ip, username: (i = o.user) == null ? void 0 : i.username })), this.authServer.userCodeThrottle > 0 && await ((f) => new Promise((m) => setTimeout(m, f)))(this.authServer.userCodeThrottle), {
           ok: !1,
           completed: !1,
           retryAllowed: !0,
@@ -5381,14 +5381,14 @@ class $e {
           error_description: t.error_description
         };
       if (t.error == "expired_token")
-        return d.logger.error(c({ msg: "Expired user code", userCodeHash: F.hash(e), ip: o.ip, username: (n = o.user) == null ? void 0 : n.username })), {
+        return d.logger.error(c({ msg: "Expired user code", userCodeHash: F.hash(e), ip: o.ip, username: (a = o.user) == null ? void 0 : a.username })), {
           ok: !1,
           completed: !1,
           retryAllowed: !1,
           error: t.error,
           error_description: t.error_description
         };
-      const a = await this.clientStorage.getClientById(t.client_id);
+      const n = await this.clientStorage.getClientById(t.client_id);
       return t.scopeAuthorizationNeeded ? {
         ok: !0,
         completed: !1,
@@ -5396,7 +5396,7 @@ class $e {
         authorizationNeeded: {
           user: r,
           client_id: t.client_id,
-          client_name: a.client_name,
+          client_name: n.client_name,
           scope: t.scope,
           scopes: t.scope ? t.scope.split(" ") : [],
           csrfToken: o.csrfToken
@@ -5412,13 +5412,13 @@ class $e {
         csrfToken: o.csrfToken
       };
     } catch (t) {
-      const a = l.asCrossauthError(t);
-      return d.logger.debug(c({ err: a })), d.logger.error(c({ msg: a.message, cerr: a })), {
+      const n = l.asCrossauthError(t);
+      return d.logger.debug(c({ err: n })), d.logger.error(c({ msg: n.message, cerr: n })), {
         ok: !1,
         completed: !1,
         retryAllowed: !0,
-        error: a.oauthErrorCode,
-        error_description: a.message
+        error: n.oauthErrorCode,
+        error_description: n.message
       };
     }
   }
@@ -5428,7 +5428,7 @@ class $e {
       if (i.error) {
         const t = l.fromOAuthError(i.error, i.error_description);
         d.logger.debug({ err: t }), d.logger.error({ cerr: t });
-        const a = {
+        const n = {
           ok: !1,
           completed: !1,
           status: t.httpStatus,
@@ -5437,9 +5437,9 @@ class $e {
           errorCodeName: t.codeName,
           retryAllowed: i.retryAllowed
         };
-        return e ? r.header(...x).status(t.httpStatus).send(a) : r.status(t.httpStatus).view(this.devicePage, {
+        return e ? r.header(...x).status(t.httpStatus).send(n) : r.status(t.httpStatus).view(this.devicePage, {
           csrfToken: o.csrfToken,
-          ...a
+          ...n
         });
       } else if (i.authorizationNeeded) {
         const t = {
@@ -5454,13 +5454,13 @@ class $e {
           ...t
         });
       }
-      const n = {
+      const a = {
         ok: !0,
         completed: !0
       };
-      return e ? r.header(...x).status(401).send(n) : r.status(200).view(this.devicePage, {
+      return e ? r.header(...x).status(401).send(a) : r.status(200).view(this.devicePage, {
         csrfToken: o.csrfToken,
-        ...n
+        ...a
       });
     } else {
       const i = {
@@ -5480,32 +5480,32 @@ class $e {
         if (o.body.user_code) {
           let s = await this.applyUserCode(o.body.user_code, o, o.user);
           if (s.error) {
-            const n = l.fromOAuthError(s.error, s.error_description);
-            d.logger.debug({ err: n }), d.logger.error({ cerr: n });
+            const a = l.fromOAuthError(s.error, s.error_description);
+            d.logger.debug({ err: a }), d.logger.error({ cerr: a });
             const t = {
               ok: !1,
               completed: !1,
-              status: n.httpStatus,
-              errorMessage: n.message,
-              errorCode: n.code,
-              errorCodeName: n.codeName,
+              status: a.httpStatus,
+              errorMessage: a.message,
+              errorCode: a.code,
+              errorCodeName: a.codeName,
               retryAllowed: s.retryAllowed
             };
-            return e ? r.header(...x).status(200).send(t) : r.status(n.httpStatus).view(this.devicePage, {
+            return e ? r.header(...x).status(200).send(t) : r.status(a.httpStatus).view(this.devicePage, {
               csrfToken: o.csrfToken,
               ...t
             });
           } else if (s.authorizationNeeded) {
-            const n = {
+            const a = {
               ok: !0,
               completed: !1,
               retryAllowed: s.retryAllowed,
               authorizationNeeded: s.authorizationNeeded,
               user_code: s.user_code
             };
-            return e ? r.header(...x).status(200).send(n) : r.status(200).view(this.devicePage, {
+            return e ? r.header(...x).status(200).send(a) : r.status(200).view(this.devicePage, {
               csrfToken: o.csrfToken,
-              ...n
+              ...a
             });
           }
           const i = {
@@ -5534,35 +5534,35 @@ class $e {
       else if (o.body.authorized == "true") {
         let s = o.body.user_code, i = o.body.scope;
         i == "";
-        const n = o.body.client_id;
+        const a = o.body.client_id;
         if (!s) throw new l(g.BadRequest, "user_code missing");
-        if (!n) throw new l(g.BadRequest, "client_id missing");
-        let t = await this.authServer.validateAndPersistScope(n, i, o.user);
+        if (!a) throw new l(g.BadRequest, "client_id missing");
+        let t = await this.authServer.validateAndPersistScope(a, i, o.user);
         if (t.error)
           throw l.fromOAuthError(t.error, t.error_description);
         if (t = await this.applyUserCode(s, o, o.user), t.error)
           throw l.fromOAuthError(t.error, t.error_description);
-        const a = {
+        const n = {
           ok: !0,
           completed: !0,
           csrfToken: o.csrfToken
         };
-        return e ? r.header(...x).status(401).send(a) : r.status(200).view(this.devicePage, a);
+        return e ? r.header(...x).status(401).send(n) : r.status(200).view(this.devicePage, n);
       } else
         throw new l(g.Unauthorized, "You did not authorize the client");
     } catch (s) {
       const i = l.asCrossauthError(s);
       d.logger.debug({ err: i }), d.logger.error({ cerr: i });
-      const n = {
+      const a = {
         ok: !1,
         status: i.httpStatus,
         errorMessage: i.message,
         errorCode: i.code,
         errorCodeName: i.codeName
       };
-      return e ? r.header(...x).status(401).send(n) : r.status(i.httpStatus).view(this.devicePage, {
+      return e ? r.header(...x).status(401).send(a) : r.status(i.httpStatus).view(this.devicePage, {
         csrfToken: o.csrfToken,
-        ...n
+        ...a
       });
     }
   }
@@ -5608,10 +5608,10 @@ function fe(k, e) {
   if (k.access_token)
     try {
       if (k.access_token && e.includes("access")) {
-        const i = (o = J(k.access_token)) == null ? void 0 : o.jti, n = i ? F.hash(i) : void 0;
+        const i = (o = J(k.access_token)) == null ? void 0 : o.jti, a = i ? F.hash(i) : void 0;
         d.logger.debug(c({
           msg: "Got access token",
-          accessTokenHash: n
+          accessTokenHash: a
         }));
       }
     } catch (i) {
@@ -5620,10 +5620,10 @@ function fe(k, e) {
   if (k.id_token)
     try {
       if (k.id_token && e.includes("id")) {
-        const i = (r = J(k.id_token)) == null ? void 0 : r.jti, n = i ? F.hash(i) : void 0;
+        const i = (r = J(k.id_token)) == null ? void 0 : r.jti, a = i ? F.hash(i) : void 0;
         d.logger.debug(c({
           msg: "Got id token",
-          idTokenHash: n
+          idTokenHash: a
         }));
       }
     } catch (i) {
@@ -5632,10 +5632,10 @@ function fe(k, e) {
   if (k.refresh_token && e.includes("refresh"))
     try {
       if (k.refresh_token) {
-        const i = (s = J(k.refresh_token)) == null ? void 0 : s.jti, n = i ? F.hash(i) : void 0;
+        const i = (s = J(k.refresh_token)) == null ? void 0 : s.jti, a = i ? F.hash(i) : void 0;
         d.logger.debug(c({
           msg: "Got refresh token",
-          refreshTokenHash: n
+          refreshTokenHash: a
         }));
       }
     } catch (i) {
@@ -5722,24 +5722,24 @@ async function Se(k, e, o, r) {
       "OAuth server did not return an expiry for the access token"
     );
   const i = Date.now() + s * 1e3;
-  let n = { ...k, expires_at: i };
+  let a = { ...k, expires_at: i };
   if ("id_token" in k) {
     let t = j(k.id_token);
-    t && (n.id_token = t);
+    t && (a.id_token = t);
   }
   if (e.server.sessionServer) {
     let t = e.server.sessionServer.getSessionCookieValue(o);
     !t && r ? t = await e.server.createAnonymousSession(
       o,
       r,
-      { [e.sessionDataName]: n }
-    ) : await e.server.sessionAdapter.updateSessionData(o, e.sessionDataName, n);
+      { [e.sessionDataName]: a }
+    ) : await e.server.sessionAdapter.updateSessionData(o, e.sessionDataName, a);
   } else {
     if (!e.server.sessionAdapter) throw new l(
       g.Configuration,
       "Cannot get session data if sessions not enabled"
     );
-    await e.server.sessionAdapter.updateSessionData(o, e.sessionDataName, n);
+    await e.server.sessionAdapter.updateSessionData(o, e.sessionDataName, a);
   }
 }
 async function qe(k, e, o, r) {
@@ -5783,7 +5783,7 @@ class we extends Oe {
    * @param options See {@link FastifyOAuthClientOptions}
    */
   constructor(o, r, s) {
-    var i, n, t;
+    var i, a, t;
     super(r, s);
     u(this, "server");
     u(this, "siteUrl", "/");
@@ -5823,7 +5823,7 @@ class we extends Oe {
     u(this, "bffEndpointName", "bff");
     u(this, "bffBaseUrl");
     u(this, "tokenEndpoints", []);
-    if (this.server = o, S("sessionDataName", C.String, this, s, "OAUTH_SESSION_DATA_NAME"), S("siteUrl", C.String, this, s, "SITE_URL", !0), S("tokenResponseType", C.String, this, s, "OAUTH_TOKEN_RESPONSE_TYPE"), S("errorResponseType", C.String, this, s, "OAUTH_ERROR_RESPONSE_TYPE"), S("prefix", C.String, this, s, "PREFIX"), this.prefix.endsWith("/") || (this.prefix += "/"), S("loginUrl", C.String, this, s, "LOGIN_URL"), S("errorPage", C.String, this, s, "ERROR_PAGE"), S("authorizedPage", C.String, this, s, "AUTHORIZED_PAGE"), S("authorizedUrl", C.String, this, s, "AUTHORIZED_URL"), S("loginProtectedFlows", C.JsonArray, this, s, "OAUTH_LOGIN_PROTECTED_FLOWS"), S("passwordFlowUrl", C.String, this, s, "OAUTH_PASSWORD_FLOW_URL"), S("passwordOtpUrl", C.String, this, s, "OAUTH_PASSWORD_OTP_URL"), S("passwordOobUrl", C.String, this, s, "OAUTH_PASSWORD_OOB_URL"), S("passwordFlowPage", C.String, this, s, "OAUTH_PASSWORD_FLOW_PAGE"), S("deviceCodeFlowPage", C.String, this, s, "OAUTH_DEVICECODE_FLOW_PAGE"), S("deleteTokensPage", C.String, this, s, "OAUTH_DELETE_TOKENS_PAGE"), S("deleteTokensGetUrl", C.String, this, s, "OAUTH_DELETE_TOKENS_GET_URL"), S("deleteTokensPostUrl", C.String, this, s, "OAUTH_DELETE_TOKENS_POST_URL"), S("apiDeleteTokensPostUrl", C.String, this, s, "OAUTHAPI__DELETE_TOKENS_POST_URL"), S("mfaOtpPage", C.String, this, s, "OAUTH_MFA_OTP_PAGE"), S("mfaOobPage", C.String, this, s, "OAUTH_MFA_OOB_PAGE"), S("deviceCodeFlowUrl", C.String, this, s, "OAUTH_DEVICECODE_FLOW_URL"), S("deviceCodePollUrl", C.String, this, s, "OAUTH_DEVICECODE_POLL_URL"), S("bffEndpointName", C.String, this, s, "OAUTH_BFF_ENDPOINT_NAME"), S("bffBaseUrl", C.String, this, s, "OAUTH_BFF_BASEURL"), S("validFlows", C.JsonArray, this, s, "OAUTH_VALIDFLOWS"), S("jwtTokens", C.JsonArray, this, s, "OAUTH_JWT_TOKENS"), (i = this.deleteTokensGetUrl) != null && i.startsWith("/") && (this.deleteTokensGetUrl = this.deleteTokensGetUrl.substring(1)), (n = this.deleteTokensPostUrl) != null && n.startsWith("/") && (this.deleteTokensPostUrl = this.deleteTokensPostUrl.substring(1)), (t = this.deleteTokensPostUrl) != null && t.startsWith("/") && (this.deleteTokensPostUrl = this.deleteTokensPostUrl.substring(1)), this.validFlows.length == 1 && this.validFlows[0] == E.All)
+    if (this.server = o, S("sessionDataName", C.String, this, s, "OAUTH_SESSION_DATA_NAME"), S("siteUrl", C.String, this, s, "SITE_URL", !0), S("tokenResponseType", C.String, this, s, "OAUTH_TOKEN_RESPONSE_TYPE"), S("errorResponseType", C.String, this, s, "OAUTH_ERROR_RESPONSE_TYPE"), S("prefix", C.String, this, s, "PREFIX"), this.prefix.endsWith("/") || (this.prefix += "/"), S("loginUrl", C.String, this, s, "LOGIN_URL"), S("errorPage", C.String, this, s, "ERROR_PAGE"), S("authorizedPage", C.String, this, s, "AUTHORIZED_PAGE"), S("authorizedUrl", C.String, this, s, "AUTHORIZED_URL"), S("loginProtectedFlows", C.JsonArray, this, s, "OAUTH_LOGIN_PROTECTED_FLOWS"), S("passwordFlowUrl", C.String, this, s, "OAUTH_PASSWORD_FLOW_URL"), S("passwordOtpUrl", C.String, this, s, "OAUTH_PASSWORD_OTP_URL"), S("passwordOobUrl", C.String, this, s, "OAUTH_PASSWORD_OOB_URL"), S("passwordFlowPage", C.String, this, s, "OAUTH_PASSWORD_FLOW_PAGE"), S("deviceCodeFlowPage", C.String, this, s, "OAUTH_DEVICECODE_FLOW_PAGE"), S("deleteTokensPage", C.String, this, s, "OAUTH_DELETE_TOKENS_PAGE"), S("deleteTokensGetUrl", C.String, this, s, "OAUTH_DELETE_TOKENS_GET_URL"), S("deleteTokensPostUrl", C.String, this, s, "OAUTH_DELETE_TOKENS_POST_URL"), S("apiDeleteTokensPostUrl", C.String, this, s, "OAUTHAPI__DELETE_TOKENS_POST_URL"), S("mfaOtpPage", C.String, this, s, "OAUTH_MFA_OTP_PAGE"), S("mfaOobPage", C.String, this, s, "OAUTH_MFA_OOB_PAGE"), S("deviceCodeFlowUrl", C.String, this, s, "OAUTH_DEVICECODE_FLOW_URL"), S("deviceCodePollUrl", C.String, this, s, "OAUTH_DEVICECODE_POLL_URL"), S("bffEndpointName", C.String, this, s, "OAUTH_BFF_ENDPOINT_NAME"), S("bffBaseUrl", C.String, this, s, "OAUTH_BFF_BASEURL"), S("validFlows", C.JsonArray, this, s, "OAUTH_VALIDFLOWS"), S("jwtTokens", C.JsonArray, this, s, "OAUTH_JWT_TOKENS"), (i = this.deleteTokensGetUrl) != null && i.startsWith("/") && (this.deleteTokensGetUrl = this.deleteTokensGetUrl.substring(1)), (a = this.deleteTokensPostUrl) != null && a.startsWith("/") && (this.deleteTokensPostUrl = this.deleteTokensPostUrl.substring(1)), (t = this.deleteTokensPostUrl) != null && t.startsWith("/") && (this.deleteTokensPostUrl = this.deleteTokensPostUrl.substring(1)), this.validFlows.length == 1 && this.validFlows[0] == E.All)
       this.validFlows = E.allFlows();
     else if (!E.areAllValidFlows(this.validFlows))
       throw new l(g.Configuration, "Invalid flows specificied in " + this.validFlows.join(","));
@@ -5851,43 +5851,43 @@ class we extends Oe {
       );
     this.prefix.endsWith("/") || (this.prefix += "/"), this.redirect_uri = this.siteUrl + this.prefix + "authzcode", this.validFlows.includes(E.AuthorizationCode) && this.server.app.get(
       this.prefix + "authzcodeflow",
-      async (a, h) => {
-        var m;
+      async (n, h) => {
+        var p;
         if (d.logger.info(c({
           msg: "Page visit",
           method: "GET",
           url: this.prefix + "authzcodeflow",
-          ip: a.ip,
-          user: (m = a.user) == null ? void 0 : m.username
-        })), !a.user && this.loginProtectedFlows.includes(E.AuthorizationCode))
+          ip: n.ip,
+          user: (p = n.user) == null ? void 0 : p.username
+        })), !n.user && this.loginProtectedFlows.includes(E.AuthorizationCode))
           return h.redirect(
             302,
-            this.loginUrl + "?next=" + encodeURIComponent(a.url)
+            this.loginUrl + "?next=" + encodeURIComponent(n.url)
           );
-        const { url: f, error: p, error_description: v } = await this.startAuthorizationCodeFlow(a.query.scope);
-        if (p || !f) {
+        const { url: f, error: m, error_description: v } = await this.startAuthorizationCodeFlow(n.query.scope);
+        if (m || !f) {
           const w = l.fromOAuthError(
-            p ?? "server_error",
+            m ?? "server_error",
             v
           );
-          return await this.errorFn(this.server, a, h, w);
+          return await this.errorFn(this.server, n, h, w);
         }
         return d.logger.debug(c({
           msg: "Authorization code flow: redirecting",
           url: f
         })), h.redirect(f);
       }
-    ), o.app.addHook("preHandler", async (a, h) => {
-      if (a.user || !o.sessionAdapter) return;
-      let f = await o.sessionAdapter.getSessionData(a, this.sessionDataName);
+    ), o.app.addHook("preHandler", async (n, h) => {
+      if (n.user || !o.sessionAdapter) return;
+      let f = await o.sessionAdapter.getSessionData(n, this.sessionDataName);
       if (f && f.id_payload) {
-        let p = f.expires_at;
-        if (p && p > Date.now() && f.id_payload.sub) {
-          a.user = {
+        let m = f.expires_at;
+        if (m && m > Date.now() && f.id_payload.sub) {
+          n.user = {
             id: f.id_payload.userid ?? f.id_payload.sub,
             username: f.id_payload.sub,
             state: f.id_payload.state ?? "active"
-          }, a.idTokenPayload = f.id_payload;
+          }, n.idTokenPayload = f.id_payload;
           let v;
           try {
             v = await this.userCreationFn(
@@ -5895,154 +5895,154 @@ class we extends Oe {
               this.userStorage,
               this.userMatchField,
               this.idTokenMatchField
-            ), a.user = v, a.authType = v ? "oidc" : void 0;
-          } catch (m) {
-            d.logger.error(c({ cerr: m })), a.user = void 0, a.authType = void 0;
+            ), n.user = v, n.authType = v ? "oidc" : void 0;
+          } catch (p) {
+            d.logger.error(c({ cerr: p })), n.user = void 0, n.authType = void 0;
           }
         }
       }
-      this.testMiddleware && (this.requestObj = a);
+      this.testMiddleware && (this.requestObj = n);
     }), this.validFlows.includes(E.AuthorizationCodeWithPKCE) && this.server.app.get(
       this.prefix + "authzcodeflowpkce",
-      async (a, h) => {
-        var m;
+      async (n, h) => {
+        var p;
         if (d.logger.info(c({
           msg: "Page visit",
           method: "GET",
           url: this.prefix + "authzcodeflowpkce",
-          ip: a.ip,
-          user: (m = a.user) == null ? void 0 : m.username
-        })), !a.user && this.loginProtectedFlows.includes(E.AuthorizationCodeWithPKCE))
+          ip: n.ip,
+          user: (p = n.user) == null ? void 0 : p.username
+        })), !n.user && this.loginProtectedFlows.includes(E.AuthorizationCodeWithPKCE))
           return h.redirect(
             302,
-            this.loginUrl + "?next=" + encodeURIComponent(a.url)
+            this.loginUrl + "?next=" + encodeURIComponent(n.url)
           );
-        const { url: f, error: p, error_description: v } = await this.startAuthorizationCodeFlow(
-          a.query.scope,
+        const { url: f, error: m, error_description: v } = await this.startAuthorizationCodeFlow(
+          n.query.scope,
           !0
         );
-        if (p || !f) {
+        if (m || !f) {
           const w = l.fromOAuthError(
-            p ?? "server_error",
+            m ?? "server_error",
             v
           );
-          return await this.errorFn(this.server, a, h, w);
+          return await this.errorFn(this.server, n, h, w);
         }
         return h.redirect(f);
       }
     ), (this.validFlows.includes(E.AuthorizationCode) || this.validFlows.includes(E.AuthorizationCodeWithPKCE) || this.validFlows.includes(E.OidcAuthorizationCode)) && this.server.app.get(
       this.prefix + "authzcode",
-      async (a, h) => {
-        var p, v;
+      async (n, h) => {
+        var m, v;
         if (d.logger.info(c({
           msg: "Page visit",
           method: "GET",
           url: this.prefix + "authzcode",
-          ip: a.ip,
-          user: (p = a.user) == null ? void 0 : p.username
-        })), !a.user && (this.loginProtectedFlows.includes(E.AuthorizationCodeWithPKCE) || this.loginProtectedFlows.includes(E.AuthorizationCode)))
+          ip: n.ip,
+          user: (m = n.user) == null ? void 0 : m.username
+        })), !n.user && (this.loginProtectedFlows.includes(E.AuthorizationCodeWithPKCE) || this.loginProtectedFlows.includes(E.AuthorizationCode)))
           return h.redirect(
             302,
-            this.loginUrl + "?next=" + encodeURIComponent(a.url)
+            this.loginUrl + "?next=" + encodeURIComponent(n.url)
           );
         const f = await this.redirectEndpoint(
-          a.query.code,
-          a.query.state,
-          a.query.error,
-          a.query.error_description
+          n.query.code,
+          n.query.state,
+          n.query.error,
+          n.query.error_description
         );
         f.id_token && (this.validateIdToken(f.id_token) || (f.error = "access_denied", f.error_description = "Invalid ID token received"));
         try {
           if (f.error) {
-            const m = l.fromOAuthError(
+            const p = l.fromOAuthError(
               f.error,
               f.error_description
             );
             return await this.errorFn(
               this.server,
-              a,
+              n,
               h,
-              m
+              p
             );
           }
-          return await this.receiveTokenFn(f, this, a, h);
-        } catch (m) {
-          const w = l.asCrossauthError(m);
+          return await this.receiveTokenFn(f, this, n, h);
+        } catch (p) {
+          const w = l.asCrossauthError(p);
           return d.logger.error(c({
             msg: "Error receiving token",
             cerr: w,
-            user: (v = a.user) == null ? void 0 : v.user
-          })), d.logger.debug(c({ err: m })), await this.errorFn(this.server, a, h, w);
+            user: (v = n.user) == null ? void 0 : v.user
+          })), d.logger.debug(c({ err: p })), await this.errorFn(this.server, n, h, w);
         }
       }
     ), this.validFlows.includes(E.ClientCredentials) && this.server.app.post(
       this.prefix + "clientcredflow",
-      async (a, h) => {
-        var f, p, v;
+      async (n, h) => {
+        var f, m, v;
         if (d.logger.info(c({
           msg: "Page visit",
           method: "POST",
           url: this.prefix + "clientcredflow",
-          ip: a.ip,
-          user: (f = a.user) == null ? void 0 : f.username
+          ip: n.ip,
+          user: (f = n.user) == null ? void 0 : f.username
         })), this.server.sessionAdapter) {
-          const { error: m, reply: w } = await o.errorIfCsrfInvalid(
-            a,
+          const { error: p, reply: w } = await o.errorIfCsrfInvalid(
+            n,
             h,
             this.errorFn
           );
-          if (m) return w;
+          if (p) return w;
         }
-        if (!a.user && this.loginProtectedFlows.includes(E.ClientCredentials))
+        if (!n.user && this.loginProtectedFlows.includes(E.ClientCredentials))
           return h.status(401).header(...b).send({ ok: !1, msg: "Access denied" });
         try {
-          const m = await this.clientCredentialsFlow((p = a.body) == null ? void 0 : p.scope);
-          if (m.id_token && (this.validateIdToken(m.id_token) || (m.error = "access_denied", m.error_description = "Invalid ID token received")), m.error) {
+          const p = await this.clientCredentialsFlow((m = n.body) == null ? void 0 : m.scope);
+          if (p.id_token && (this.validateIdToken(p.id_token) || (p.error = "access_denied", p.error_description = "Invalid ID token received")), p.error) {
             const w = l.fromOAuthError(
-              m.error,
-              m.error_description
+              p.error,
+              p.error_description
             );
             return await this.errorFn(
               this.server,
-              a,
+              n,
               h,
               w
             );
           }
-          return await this.receiveTokenFn(m, this, a, h);
-        } catch (m) {
-          const w = l.asCrossauthError(m);
+          return await this.receiveTokenFn(p, this, n, h);
+        } catch (p) {
+          const w = l.asCrossauthError(p);
           return d.logger.error(c({
             msg: "Error receiving token",
             cerr: w,
-            user: (v = a.user) == null ? void 0 : v.user
-          })), d.logger.debug(c({ err: m })), await this.errorFn(this.server, a, h, w);
+            user: (v = n.user) == null ? void 0 : v.user
+          })), d.logger.debug(c({ err: p })), await this.errorFn(this.server, n, h, w);
         }
       }
     ), this.validFlows.includes(E.RefreshToken) && (this.server.app.post(
       this.prefix + "refreshtokenflow",
-      async (a, h) => {
-        var m, w;
+      async (n, h) => {
+        var p, w;
         d.logger.info(c({
           msg: "Page visit",
           method: "POST",
           url: this.prefix + "refreshtokenflow",
-          ip: a.ip,
-          user: (m = a.user) == null ? void 0 : m.username
+          ip: n.ip,
+          user: (p = n.user) == null ? void 0 : p.username
         }));
-        const { error: f, reply: p } = await o.errorIfCsrfInvalid(
-          a,
+        const { error: f, reply: m } = await o.errorIfCsrfInvalid(
+          n,
           h,
           this.errorFn
         );
-        if (f) return p;
-        let v = a.body.refreshToken;
+        if (f) return m;
+        let v = n.body.refreshToken;
         if (!v && this.server.sessionAdapter) {
           if (!this.server.sessionAdapter) throw new l(
             g.Configuration,
             "Cannot get session data if sessions not enabled"
           );
-          const P = await this.server.sessionAdapter.getSessionData(a, this.sessionDataName);
+          const P = await this.server.sessionAdapter.getSessionData(n, this.sessionDataName);
           if (!(P != null && P.refresh_token)) {
             const T = new l(
               g.BadRequest,
@@ -6050,7 +6050,7 @@ class we extends Oe {
             );
             return await this.errorFn(
               this.server,
-              a,
+              n,
               h,
               T
             );
@@ -6064,12 +6064,12 @@ class we extends Oe {
           );
           return await this.errorFn(
             this.server,
-            a,
+            n,
             h,
             P
           );
         }
-        if (!a.user && this.loginProtectedFlows.includes(E.RefreshToken))
+        if (!n.user && this.loginProtectedFlows.includes(E.RefreshToken))
           return h.status(401).header(...b).send({ ok: !1, msg: "Access denied" });
         try {
           const P = await this.refreshTokenFlow(v);
@@ -6080,218 +6080,218 @@ class we extends Oe {
             );
             return await this.errorFn(
               this.server,
-              a,
+              n,
               h,
               T
             );
           }
-          return await this.receiveTokenFn(P, this, a, h);
+          return await this.receiveTokenFn(P, this, n, h);
         } catch (P) {
           const T = l.asCrossauthError(P);
           return d.logger.error(c({
             msg: "Error receiving token",
             cerr: T,
-            user: (w = a.user) == null ? void 0 : w.user
-          })), d.logger.debug(c({ err: P })), await this.errorFn(this.server, a, h, T);
+            user: (w = n.user) == null ? void 0 : w.user
+          })), d.logger.debug(c({ err: P })), await this.errorFn(this.server, n, h, T);
         }
       }
     ), this.server.app.post(
       this.prefix + "refreshtokensifexpired",
-      async (a, h) => {
+      async (n, h) => {
         var f;
         return d.logger.info(c({
           msg: "Page visit",
           method: "POST",
           url: this.prefix + "refreshtokensifexpired",
-          ip: a.ip,
-          user: (f = a.user) == null ? void 0 : f.username
-        })), this.refreshTokens(a, h, !1, !0);
+          ip: n.ip,
+          user: (f = n.user) == null ? void 0 : f.username
+        })), this.refreshTokens(n, h, !1, !0);
       }
     ), this.server.app.post(
       this.prefix + "api/refreshtokensifexpired",
-      async (a, h) => {
+      async (n, h) => {
         var f;
         return d.logger.info(c({
           msg: "Page visit",
           method: "POST",
           url: this.prefix + "refreshtokens",
-          ip: a.ip,
-          user: (f = a.user) == null ? void 0 : f.username
-        })), this.refreshTokens(a, h, !0, !0);
+          ip: n.ip,
+          user: (f = n.user) == null ? void 0 : f.username
+        })), this.refreshTokens(n, h, !0, !0);
       }
     ), this.server.app.post(
       this.prefix + "refreshtokens",
-      async (a, h) => {
+      async (n, h) => {
         var f;
         return d.logger.info(c({
           msg: "Page visit",
           method: "POST",
           url: this.prefix + "refreshtokens",
-          ip: a.ip,
-          user: (f = a.user) == null ? void 0 : f.username
-        })), this.refreshTokens(a, h, !1, !1);
+          ip: n.ip,
+          user: (f = n.user) == null ? void 0 : f.username
+        })), this.refreshTokens(n, h, !1, !1);
       }
     ), this.server.app.post(
       this.prefix + "api/refreshtokens",
-      async (a, h) => {
+      async (n, h) => {
         var f;
         return d.logger.info(c({
           msg: "Page visit",
           method: "POST",
           url: this.prefix + "refreshtokens",
-          ip: a.ip,
-          user: (f = a.user) == null ? void 0 : f.username
-        })), this.refreshTokens(a, h, !0, !1);
+          ip: n.ip,
+          user: (f = n.user) == null ? void 0 : f.username
+        })), this.refreshTokens(n, h, !0, !1);
       }
     )), (this.validFlows.includes(E.Password) || this.validFlows.includes(E.PasswordMfa)) && (this.server.app.get(
       this.prefix + this.passwordFlowUrl,
-      async (a, h) => {
+      async (n, h) => {
         var f;
         return d.logger.info(c({
           msg: "Page visit",
           method: "GET",
           url: this.prefix + this.passwordFlowUrl,
-          ip: a.ip,
-          user: (f = a.user) == null ? void 0 : f.username
-        })), !a.user && this.loginProtectedFlows.includes(E.Password) ? h.redirect(
+          ip: n.ip,
+          user: (f = n.user) == null ? void 0 : f.username
+        })), !n.user && this.loginProtectedFlows.includes(E.Password) ? h.redirect(
           302,
-          this.loginUrl + "?next=" + encodeURIComponent(a.url)
+          this.loginUrl + "?next=" + encodeURIComponent(n.url)
         ) : h.view(this.passwordFlowPage, {
-          user: a.user,
-          scope: a.query.scope,
-          csrfToken: a.csrfToken
+          user: n.user,
+          scope: n.query.scope,
+          csrfToken: n.csrfToken
         });
       }
     ), this.server.app.post(
       this.prefix + this.passwordFlowUrl,
-      async (a, h) => {
+      async (n, h) => {
         var f;
         return d.logger.info(c({
           msg: "Page visit",
           method: "POST",
           url: this.prefix + this.passwordFlowUrl,
-          ip: a.ip,
-          user: (f = a.user) == null ? void 0 : f.username
-        })), await this.passwordPost(!1, a, h);
+          ip: n.ip,
+          user: (f = n.user) == null ? void 0 : f.username
+        })), await this.passwordPost(!1, n, h);
       }
     )), this.validFlows.includes(E.PasswordMfa) && (this.server.app.post(
       this.prefix + this.passwordOtpUrl,
-      async (a, h) => {
+      async (n, h) => {
         var f;
         return d.logger.info(c({
           msg: "Page visit",
           method: "POST",
           url: this.prefix + this.passwordOtpUrl,
-          ip: a.ip,
-          user: (f = a.user) == null ? void 0 : f.username
-        })), await this.passwordOtp(!1, a, h);
+          ip: n.ip,
+          user: (f = n.user) == null ? void 0 : f.username
+        })), await this.passwordOtp(!1, n, h);
       }
     ), this.server.app.post(
       this.prefix + this.passwordOobUrl,
-      async (a, h) => {
+      async (n, h) => {
         var f;
         return d.logger.info(c({
           msg: "Page visit",
           method: "POST",
           url: this.prefix + this.passwordOobUrl,
-          ip: a.ip,
-          user: (f = a.user) == null ? void 0 : f.username
-        })), await this.passwordOob(!1, a, h);
+          ip: n.ip,
+          user: (f = n.user) == null ? void 0 : f.username
+        })), await this.passwordOob(!1, n, h);
       }
     )), this.validFlows.includes(E.DeviceCode) && (this.server.app.post(
       this.prefix + this.deviceCodeFlowUrl,
-      async (a, h) => {
+      async (n, h) => {
         var f;
         return d.logger.info(c({
           msg: "Page visit",
           method: "POST",
           url: this.prefix + this.deviceCodeFlowPage,
-          ip: a.ip,
-          user: (f = a.user) == null ? void 0 : f.username
-        })), await this.deviceCodePost(!1, a, h);
+          ip: n.ip,
+          user: (f = n.user) == null ? void 0 : f.username
+        })), await this.deviceCodePost(!1, n, h);
       }
     ), this.server.app.post(
       this.prefix + "api/" + this.deviceCodeFlowUrl,
-      async (a, h) => {
+      async (n, h) => {
         var f;
         return d.logger.info(c({
           msg: "Page visit",
           method: "POST",
           url: this.prefix + "api/" + this.deviceCodeFlowPage,
-          ip: a.ip,
-          user: (f = a.user) == null ? void 0 : f.username
-        })), await this.deviceCodePost(!0, a, h);
+          ip: n.ip,
+          user: (f = n.user) == null ? void 0 : f.username
+        })), await this.deviceCodePost(!0, n, h);
       }
     ), this.server.app.post(
       this.prefix + this.deviceCodePollUrl,
-      async (a, h) => {
+      async (n, h) => {
         var f;
         return d.logger.info(c({
           msg: "Page visit",
           method: "POST",
           url: this.prefix + this.deviceCodePollUrl,
-          ip: a.ip,
-          user: (f = a.user) == null ? void 0 : f.username
-        })), await this.deviceCodePoll(!1, a, h);
+          ip: n.ip,
+          user: (f = n.user) == null ? void 0 : f.username
+        })), await this.deviceCodePoll(!1, n, h);
       }
     ), this.server.app.post(
       this.prefix + "api/" + this.deviceCodePollUrl,
-      async (a, h) => {
+      async (n, h) => {
         var f;
         return d.logger.info(c({
           msg: "Page visit",
           method: "POST",
           url: this.prefix + this.deviceCodePollUrl,
-          ip: a.ip,
-          user: (f = a.user) == null ? void 0 : f.username
-        })), await this.deviceCodePoll(!0, a, h);
+          ip: n.ip,
+          user: (f = n.user) == null ? void 0 : f.username
+        })), await this.deviceCodePoll(!0, n, h);
       }
     )), this.deleteTokensGetUrl && this.server.app.get(
       this.prefix + this.deleteTokensGetUrl,
-      async (a, h) => {
-        var f, p;
+      async (n, h) => {
+        var f, m;
         return d.logger.info(c({
           msg: "Page visit",
           method: "GET",
           url: this.prefix + this.deleteTokensGetUrl,
-          ip: a.ip,
-          user: (f = a.user) == null ? void 0 : f.username
+          ip: n.ip,
+          user: (f = n.user) == null ? void 0 : f.username
         })), h.view(
           this.deleteTokensPage,
           {
-            user: (p = a.user) == null ? void 0 : p.username,
-            csrfToken: a.csrfToken
+            user: (m = n.user) == null ? void 0 : m.username,
+            csrfToken: n.csrfToken
           }
         );
       }
     ), this.deleteTokensPostUrl && this.server.app.post(
       this.prefix + this.deleteTokensPostUrl,
-      async (a, h) => {
-        var f, p, v;
+      async (n, h) => {
+        var f, m, v;
         d.logger.info(c({
           msg: "Page visit",
           method: "POST",
           url: this.prefix + this.deleteTokensPostUrl,
-          ip: a.ip,
-          user: (f = a.user) == null ? void 0 : f.username
+          ip: n.ip,
+          user: (f = n.user) == null ? void 0 : f.username
         }));
         try {
-          return await this.deleteTokens(a), h.view(
+          return await this.deleteTokens(n), h.view(
             this.deleteTokensPage,
             {
               ok: !0,
-              user: (p = a.user) == null ? void 0 : p.username,
-              csrfToken: a.csrfToken
+              user: (m = n.user) == null ? void 0 : m.username,
+              csrfToken: n.csrfToken
             }
           );
-        } catch (m) {
-          const w = l.asCrossauthError(m);
+        } catch (p) {
+          const w = l.asCrossauthError(p);
           return d.logger.debug(c({ err: w })), d.logger.error(c({ msg: "Couldn't delete oauth tokens", cerr: w })), h.view(
             this.deleteTokensPage,
             {
               ok: !1,
-              user: (v = a.user) == null ? void 0 : v.username,
-              csrfToken: a.csrfToken,
+              user: (v = n.user) == null ? void 0 : v.username,
+              csrfToken: n.csrfToken,
               errorMessage: w.message,
               errorCode: w.code,
               errorCodeName: w.codeName
@@ -6301,102 +6301,102 @@ class we extends Oe {
       }
     ), this.apiDeleteTokensPostUrl && this.server.app.post(
       this.prefix + this.apiDeleteTokensPostUrl,
-      async (a, h) => {
+      async (n, h) => {
         var f;
         d.logger.info(c({
           msg: "Page visit",
           method: "POST",
           url: this.prefix + this.apiDeleteTokensPostUrl,
-          ip: a.ip,
-          user: (f = a.user) == null ? void 0 : f.username
+          ip: n.ip,
+          user: (f = n.user) == null ? void 0 : f.username
         }));
         try {
-          return await this.deleteTokens(a), h.header(...b).send('{"ok": true}');
-        } catch (p) {
-          const v = l.asCrossauthError(p);
+          return await this.deleteTokens(n), h.header(...b).send('{"ok": true}');
+        } catch (m) {
+          const v = l.asCrossauthError(m);
           return d.logger.debug(c({ err: v })), d.logger.error(c({ msg: "Couldn't delete oauth tokens", cerr: v })), h.header(...b).status(v.httpStatus).send(JSON.stringify({
             ok: !1,
             errorMessage: v.message,
             errorCode: v.code,
             errorCodeName: v.codeName,
-            csrfToken: a.csrfToken
+            csrfToken: n.csrfToken
           }));
         }
       }
     );
-    for (let a of this.tokenEndpoints)
+    for (let n of this.tokenEndpoints)
       this.server.app.post(
-        this.prefix + a,
+        this.prefix + n,
         async (h, f) => {
           var U;
           if (d.logger.info(c({
             msg: "Page visit",
             method: "POST",
-            url: this.prefix + a,
+            url: this.prefix + n,
             ip: h.ip,
             user: (U = h.user) == null ? void 0 : U.username
           })), !h.csrfToken)
             return f.header(...b).status(401).send({ ok: !1, msg: "No csrf token given" });
-          let p = !1, v = a;
-          a.startsWith("have_") && (v = a.replace("have_", ""), p = !0);
-          let m = v.replace("_token", ""), w = !1;
-          if (this.jwtTokens.includes(m) && (w = h.body.decode ?? !0), !this.server.sessionAdapter) throw new l(
+          let m = !1, v = n;
+          n.startsWith("have_") && (v = n.replace("have_", ""), m = !0);
+          let p = v.replace("_token", ""), w = !1;
+          if (this.jwtTokens.includes(p) && (w = h.body.decode ?? !0), !this.server.sessionAdapter) throw new l(
             g.Configuration,
             "Cannot get session data if sessions not enabled"
           );
           const P = await this.server.sessionAdapter.getSessionData(h, this.sessionDataName);
           if (!P)
-            return p ? f.header(...b).status(200).send({ ok: !1 }) : f.header(...b).status(204).send();
+            return m ? f.header(...b).status(200).send({ ok: !1 }) : f.header(...b).status(204).send();
           let T = P[v];
-          return w && (T = j(P[v])), T ? p ? f.header(...b).status(200).send({ ok: !0 }) : f.header(...b).status(200).send({ ...T }) : p ? f.header(...b).status(200).send({ ok: !1 }) : f.header(...b).status(204).send();
+          return w && (T = j(P[v])), T ? m ? f.header(...b).status(200).send({ ok: !0 }) : f.header(...b).status(200).send({ ...T }) : m ? f.header(...b).status(200).send({ ok: !1 }) : f.header(...b).status(204).send();
         }
       );
     if (this.server.app.post(
       this.prefix + "tokens",
-      async (a, h) => {
+      async (n, h) => {
         var v;
         if (d.logger.info(c({
           msg: "Page visit",
           method: "POST",
           url: this.prefix + "tokens",
-          ip: a.ip,
-          user: (v = a.user) == null ? void 0 : v.username
-        })), !a.csrfToken)
+          ip: n.ip,
+          user: (v = n.user) == null ? void 0 : v.username
+        })), !n.csrfToken)
           return h.header(...b).status(401).send({ ok: !1, msg: "No csrf token given" });
         if (!this.server.sessionAdapter) throw new l(
           g.Configuration,
           "Cannot get session data if sessions not enabled"
         );
-        const f = await this.server.sessionAdapter.getSessionData(a, this.sessionDataName);
+        const f = await this.server.sessionAdapter.getSessionData(n, this.sessionDataName);
         if (!f)
           return h.header(...b).status(204).send();
-        let p = {};
-        for (let m of this.tokenEndpoints) {
-          let w = !1, P = m;
-          m.startsWith("have_") && (P = m.replace("have_", ""), w = !0);
+        let m = {};
+        for (let p of this.tokenEndpoints) {
+          let w = !1, P = p;
+          p.startsWith("have_") && (P = p.replace("have_", ""), w = !0);
           let T = P.replace("_token", ""), U = !1;
-          if (this.jwtTokens.includes(T) && (U = a.body.decode ?? !0), P in f) {
+          if (this.jwtTokens.includes(T) && (U = n.body.decode ?? !0), P in f) {
             let _ = f[P];
-            U && (_ = j(f[P])), _ && (p[m] = w ? !0 : _);
-          } else w && (p[m] = !1);
+            U && (_ = j(f[P])), _ && (m[p] = w ? !0 : _);
+          } else w && (m[p] = !1);
         }
-        return h.header(...b).status(200).send({ ...p });
+        return h.header(...b).status(200).send({ ...m });
       }
     ), this.bffEndpoints.length > 0 && !this.bffBaseUrl)
       throw new l(g.Configuration, "If enabling BFF endpoints, must also define bffBaseUrl");
     this.bffBaseUrl == null && (this.bffBaseUrl = ""), this.bffBaseUrl.endsWith("/") && (this.bffBaseUrl = this.bffBaseUrl.substring(0, this.bffBaseUrl.length - 1));
-    for (let a = 0; a < this.bffEndpoints.length; ++a) {
-      const h = this.bffEndpoints[a].url;
+    for (let n = 0; n < this.bffEndpoints.length; ++n) {
+      const h = this.bffEndpoints[n].url;
       if (h.includes("?") || h.includes("#"))
         throw new l(g.Configuration, "BFF urls may not contain query parameters or page fragments");
       if (!h.startsWith("/"))
         throw new l(g.Configuration, "BFF urls must be absolute and without the HTTP method, hostname or port");
-      const f = this.bffEndpoints[a].methods, p = this.bffEndpoints[a].matchSubUrls ?? !1;
+      const f = this.bffEndpoints[n].methods, m = this.bffEndpoints[n].matchSubUrls ?? !1;
       let v = h;
-      p && (v.endsWith("/") || (v += "/"), v += "*");
-      for (let m in f)
+      m && (v.endsWith("/") || (v += "/"), v += "*");
+      for (let p in f)
         this.server.app.route({
-          method: f[m],
+          method: f[p],
           url: this.prefix + this.bffEndpointName + v,
           // was url
           handler: async (w, P) => {
@@ -6410,7 +6410,7 @@ class we extends Oe {
             }));
             const T = w.url.substring(this.prefix.length + this.bffEndpointName.length);
             d.logger.debug(c({ msg: "Resource server URL " + T }));
-            const U = f[m] != "GET" && f[m] != "HEAD" && f[m] != "OPTIONS";
+            const U = f[p] != "GET" && f[p] != "HEAD" && f[p] != "OPTIONS";
             if (this.server.sessionAdapter && U) {
               const { error: I, reply: V } = await o.errorIfCsrfInvalid(
                 w,
@@ -6467,37 +6467,37 @@ class we extends Oe {
   async passwordPost(o, r, s) {
     var i;
     if (this.server.sessionAdapter) {
-      const { error: n, reply: t } = await this.server.errorIfCsrfInvalid(
+      const { error: a, reply: t } = await this.server.errorIfCsrfInvalid(
         r,
         s,
         this.errorFn
       );
-      if (n) return t;
+      if (a) return t;
     }
     try {
-      let n = await this.passwordFlow(
+      let a = await this.passwordFlow(
         r.body.username,
         r.body.password,
         r.body.scope
       );
-      if (n.id_token && (this.validateIdToken(n.id_token) || (n.error = "access_denied", n.error_description = "Invalid ID token received")), n.error == "mfa_required" && n.mfa_token && this.validFlows.includes(E.PasswordMfa)) {
-        const t = n.mfa_token;
-        if (n = await this.passwordMfa(
+      if (a.id_token && (this.validateIdToken(a.id_token) || (a.error = "access_denied", a.error_description = "Invalid ID token received")), a.error == "mfa_required" && a.mfa_token && this.validFlows.includes(E.PasswordMfa)) {
+        const t = a.mfa_token;
+        if (a = await this.passwordMfa(
           o,
           t,
           r.body.scope,
           r,
           s
-        ), n.id_token && (this.validateIdToken(n.id_token) || (n.error = "access_denied", n.error_description = "Invalid ID token received")), n.error) {
-          const a = l.fromOAuthError(
-            n.error,
-            n.error_description
+        ), a.id_token && (this.validateIdToken(a.id_token) || (a.error = "access_denied", a.error_description = "Invalid ID token received")), a.error) {
+          const n = l.fromOAuthError(
+            a.error,
+            a.error_description
           );
           return o ? await this.errorFn(
             this.server,
             r,
             s,
-            a
+            n
           ) : s.view(
             this.passwordFlowPage,
             {
@@ -6505,18 +6505,18 @@ class we extends Oe {
               username: r.body.username,
               password: r.body.password,
               scope: r.body.scope,
-              errorMessage: a.message,
-              errorCode: a.code,
-              errorCodeName: a.codeName,
+              errorMessage: n.message,
+              errorCode: n.code,
+              errorCodeName: n.codeName,
               csrfToken: r.csrfToken
             }
           );
         }
-        return await this.receiveTokenFn(n, this, r, s);
-      } else if (n.error) {
+        return await this.receiveTokenFn(a, this, r, s);
+      } else if (a.error) {
         const t = l.fromOAuthError(
-          n.error,
-          n.error_description
+          a.error,
+          a.error_description
         );
         return o ? await this.errorFn(this.server, r, s, t) : s.view(
           this.passwordFlowPage,
@@ -6532,14 +6532,14 @@ class we extends Oe {
           }
         );
       }
-      return await this.receiveTokenFn(n, this, r, s);
-    } catch (n) {
-      const t = l.asCrossauthError(n);
+      return await this.receiveTokenFn(a, this, r, s);
+    } catch (a) {
+      const t = l.asCrossauthError(a);
       return d.logger.error(c({
         msg: "Error receiving token",
         cerr: t,
         user: (i = r.user) == null ? void 0 : i.user
-      })), d.logger.debug(c({ err: n })), o ? await this.errorFn(
+      })), d.logger.debug(c({ err: a })), o ? await this.errorFn(
         this.server,
         r,
         s,
@@ -6556,16 +6556,16 @@ class we extends Oe {
       });
     }
   }
-  async passwordMfa(o, r, s, i, n) {
+  async passwordMfa(o, r, s, i, a) {
     const t = await this.mfaAuthenticators(r);
     if (t.error || !t.authenticators || !Array.isArray(t.authenticators) || t.authenticators.length == 0 || t.authenticators.length > 1 && !t.authenticators[0].active)
       return t.error ? t : {
         error: "access_denied",
         error_description: "No MFA authenticators available"
       };
-    const a = t.authenticators[0];
-    if (a.authenticator_type == "otp") {
-      const f = await this.mfaOtpRequest(r, a.id);
+    const n = t.authenticators[0];
+    if (n.authenticator_type == "otp") {
+      const f = await this.mfaOtpRequest(r, n.id);
       return f.error || f.challenge_type != "otp" ? {
         error: f.error ?? "server_error",
         error_description: f.error_description ?? "Invalid response from MFA OTP challenge"
@@ -6573,24 +6573,24 @@ class we extends Oe {
         scope: s,
         mfa_token: r
       };
-    } else if (a.authenticator_type == "oob") {
-      const f = await this.mfaOobRequest(r, a.id);
+    } else if (n.authenticator_type == "oob") {
+      const f = await this.mfaOobRequest(r, n.id);
       return f.error || f.challenge_type != "oob" || !f.oob_code || f.binding_method != "prompt" ? {
         error: f.error ?? "server_error",
         error_description: f.error_description ?? "Invalid response from MFA OOB challenge"
       } : {
         scope: s,
         mfa_token: r,
-        oob_channel: a.oob_channel,
+        oob_channel: n.oob_channel,
         challenge_type: f.challenge_type,
         binding_method: f.binding_method,
         oob_code: f.oob_code,
-        name: a.name
+        name: n.name
       };
     }
     const h = new l(
       g.UnknownError,
-      "Unsupported MFA type " + a.authenticator_type + " returned"
+      "Unsupported MFA type " + n.authenticator_type + " returned"
     );
     return {
       error: h.oauthErrorCode,
@@ -6598,7 +6598,7 @@ class we extends Oe {
     };
   }
   async passwordOtp(o, r, s) {
-    var n;
+    var a;
     const i = await this.mfaOtpComplete(
       r.body.mfa_token,
       r.body.otp
@@ -6611,7 +6611,7 @@ class we extends Oe {
       return d.logger.warn(c({
         msg: "Error completing MFA",
         cerr: t,
-        user: (n = r.user) == null ? void 0 : n.user,
+        user: (a = r.user) == null ? void 0 : a.user,
         hashedMfaToken: F.hash(r.body.mfa_token)
       })), d.logger.debug(c({ err: t })), o ? await this.errorFn(
         this.server,
@@ -6632,7 +6632,7 @@ class we extends Oe {
     return await this.receiveTokenFn(i, this, r, s) ?? s;
   }
   async passwordOob(o, r, s) {
-    var n;
+    var a;
     const i = await this.mfaOobComplete(
       r.body.mfa_token,
       r.body.oob_code,
@@ -6646,7 +6646,7 @@ class we extends Oe {
       return d.logger.warn(c({
         msg: "Error completing MFA",
         cerr: t,
-        user: (n = r.user) == null ? void 0 : n.user,
+        user: (a = r.user) == null ? void 0 : a.user,
         hashedMfaToken: F.hash(r.body.mfa_token)
       })), d.logger.debug(c({ err: t })), o ? await this.errorFn(
         this.server,
@@ -6671,19 +6671,19 @@ class we extends Oe {
   async deviceCodePost(o, r, s) {
     var i;
     if (this.server.sessionAdapter) {
-      const { error: n, reply: t } = await this.server.errorIfCsrfInvalid(
+      const { error: a, reply: t } = await this.server.errorIfCsrfInvalid(
         r,
         s,
         this.errorFn
       );
-      if (n) return t;
+      if (a) return t;
     }
     try {
       if (!r.csrfToken)
         throw new l(g.Unauthorized, "CSRF token missing or invalid");
-      let n = this.authServerBaseUrl;
-      n.endsWith("/") || (n += "/"), n += this.deviceAuthorizationUrl;
-      const t = await this.startDeviceCodeFlow(n, r.body.scope);
+      let a = this.authServerBaseUrl;
+      a.endsWith("/") || (a += "/"), a += this.deviceAuthorizationUrl;
+      const t = await this.startDeviceCodeFlow(a, r.body.scope);
       if (t.error) {
         const h = l.fromOAuthError(t.error, t.error_description), f = {
           user: r.user,
@@ -6697,9 +6697,9 @@ class we extends Oe {
         };
         return o ? s.header(...b).status(h.httpStatus).send(t) : s.view(this.deviceCodeFlowPage, f);
       }
-      let a;
+      let n;
       return t.verification_uri_complete && await Re.toDataURL(t.verification_uri_complete).then((h) => {
-        a = h;
+        n = h;
       }).catch((h) => {
         d.logger.debug(c({ err: h })), d.logger.warn(c({ msg: "Couldn't generate verification URL QR Code" }));
       }), o ? s.header(...b).send(t) : s.view(
@@ -6707,47 +6707,47 @@ class we extends Oe {
         {
           user: r.user,
           scope: r.body.scope,
-          verification_uri_qrdata: a,
+          verification_uri_qrdata: n,
           ...t
         }
       );
-    } catch (n) {
-      const t = l.asCrossauthError(n);
+    } catch (a) {
+      const t = l.asCrossauthError(a);
       d.logger.error(c({
         msg: "Error receiving token",
         cerr: t,
         user: (i = r.user) == null ? void 0 : i.user
-      })), d.logger.debug(c({ err: n }));
-      const a = {
+      })), d.logger.debug(c({ err: a }));
+      const n = {
         errorMessage: t.message,
         errorCode: t.code,
         errorCodeName: t.codeName
       };
-      return o ? s.header(...b).status(t.httpStatus).send(a) : s.view(this.deviceCodeFlowPage, {
+      return o ? s.header(...b).status(t.httpStatus).send(n) : s.view(this.deviceCodeFlowPage, {
         user: r.user,
         csrfToken: r.csrfToken,
         scope: r.body.scope,
-        ...a
+        ...n
       });
     }
   }
   async deviceCodePoll(o, r, s) {
     var i;
     try {
-      const n = await this.pollDeviceCodeFlow(r.body.device_code);
-      return n.id_token && (this.validateIdToken(n.id_token) || (n.error = "access_denied", n.error_description = "Invalid ID token received")), n.error ? s.header(...b).send(n) : await this.receiveTokenFn(
-        n,
+      const a = await this.pollDeviceCodeFlow(r.body.device_code);
+      return a.id_token && (this.validateIdToken(a.id_token) || (a.error = "access_denied", a.error_description = "Invalid ID token received")), a.error ? s.header(...b).send(a) : await this.receiveTokenFn(
+        a,
         this,
         r,
         o ? void 0 : s
       );
-    } catch (n) {
-      const t = l.asCrossauthError(n);
+    } catch (a) {
+      const t = l.asCrossauthError(a);
       return d.logger.error(c({
         msg: "Error receiving token",
         cerr: t,
         user: (i = r.user) == null ? void 0 : i.user
-      })), d.logger.debug(c({ err: n })), await this.errorFn(
+      })), d.logger.debug(c({ err: a })), await this.errorFn(
         this.server,
         r,
         s,
@@ -6755,8 +6755,8 @@ class we extends Oe {
       );
     }
   }
-  async refresh(o, r, s, i, n, t) {
-    if (!t || !n)
+  async refresh(o, r, s, i, a, t) {
+    if (!t || !a)
       return s ? void 0 : await this.receiveTokenFn(
         {},
         this,
@@ -6765,27 +6765,27 @@ class we extends Oe {
       );
     if (!i || t <= Date.now())
       try {
-        const a = await this.refreshTokenFlow(n);
-        if (a.id_token && (this.validateIdToken(a.id_token) || (a.error = "access_denied", a.error_description = "Invalid ID token received")), !a.error && !a.access_token && (a.error = "server_error", a.error_description = "Unexpectedly did not receive error or access token"), !a.error) {
-          const p = await this.receiveTokenFn(
-            a,
+        const n = await this.refreshTokenFlow(a);
+        if (n.id_token && (this.validateIdToken(n.id_token) || (n.error = "access_denied", n.error_description = "Invalid ID token received")), !n.error && !n.access_token && (n.error = "server_error", n.error_description = "Unexpectedly did not receive error or access token"), !n.error) {
+          const m = await this.receiveTokenFn(
+            n,
             this,
             o,
             s ? void 0 : r
           );
-          if (!s) return p;
+          if (!s) return m;
         }
         if (!s) {
-          const p = l.fromOAuthError(
-            a.error ?? "server_error",
-            a.error_description
+          const m = l.fromOAuthError(
+            n.error ?? "server_error",
+            n.error_description
           );
-          return await this.errorFn(this.server, o, r, p);
+          return await this.errorFn(this.server, o, r, m);
         }
-        let h = a.expires_in;
-        if (!h && a.access_token) {
-          const p = J(a.access_token);
-          p.exp && (h = p.exp);
+        let h = n.expires_in;
+        if (!h && n.access_token) {
+          const m = J(n.access_token);
+          m.exp && (h = m.exp);
         }
         if (!h)
           throw new l(
@@ -6794,19 +6794,19 @@ class we extends Oe {
           );
         const f = (/* @__PURE__ */ new Date()).getTime() + h * 1e3;
         return {
-          access_token: a.access_token,
-          refresh_token: a.refresh_token,
-          expires_in: a.expires_in,
+          access_token: n.access_token,
+          refresh_token: n.refresh_token,
+          expires_in: n.expires_in,
           expires_at: f,
-          error: a.error,
-          error_description: a.error_description
+          error: n.error,
+          error_description: n.error_description
         };
-      } catch (a) {
-        if (d.logger.debug(c({ err: a })), d.logger.error(c({
-          cerr: a,
+      } catch (n) {
+        if (d.logger.debug(c({ err: n })), d.logger.error(c({
+          cerr: n,
           msg: "Failed refreshing access token"
         })), !s) {
-          const h = l.asCrossauthError(a);
+          const h = l.asCrossauthError(n);
           return await this.errorFn(this.server, o, r, h);
         }
         return {
@@ -6822,12 +6822,12 @@ class we extends Oe {
       g.Configuration,
       "Cannot get session data if sessions not enabled"
     );
-    const n = await this.server.sessionAdapter.getSessionData(o, this.sessionDataName);
-    if (!(n != null && n.refresh_token)) {
+    const a = await this.server.sessionAdapter.getSessionData(o, this.sessionDataName);
+    if (!(a != null && a.refresh_token)) {
       if (s)
         return r.header(...b).status(204).send();
       {
-        const a = new l(
+        const n = new l(
           g.InvalidSession,
           "No tokens found in session"
         );
@@ -6835,7 +6835,7 @@ class we extends Oe {
           this.server,
           o,
           r,
-          a
+          n
         );
       }
     }
@@ -6844,9 +6844,9 @@ class we extends Oe {
       r,
       s,
       i,
-      n.refresh_token,
+      a.refresh_token,
       //onlyIfExpired ? oauthData.expires_at : undefined
-      n.expires_at
+      a.expires_at
     );
     if (t && t.id_token && (this.validateIdToken(t.id_token) || (t.error = "access_denied", t.error_description = "Invalid ID token received")), !s) {
       if (t == null) return this.receiveTokenFn({}, this, o, r);
@@ -6882,60 +6882,71 @@ class er extends Ie {
     super(r, s);
     u(this, "userStorage");
     u(this, "protectedEndpoints", {});
+    u(this, "protectedEndpointPrefixes", []);
     u(this, "errorBody", {});
     u(this, "sessionDataName", "oauth");
     u(this, "tokenLocations", ["header"]);
     u(this, "sessionAdapter");
     if (S("errorBody", C.Json, this, s, "OAUTH_RESSERVER_ACCESS_DENIED_BODY"), S("tokenLocations", C.JsonArray, this, s, "OAUTH_TOKEN_LOCATIONS"), S("sessionDataName", C.String, this, s, "OAUTH_SESSION_DATA_NAME"), this.userStorage = s.userStorage, this.sessionAdapter = s.sessionAdapter, s.protectedEndpoints) {
       const i = /^[!#\$%&'\(\)\*\+,\.\/a-zA-Z\[\]\^_`-]+/;
-      for (const [n, t] of Object.entries(s.protectedEndpoints)) {
-        if (!n.startsWith("/"))
+      for (const [a, t] of Object.entries(s.protectedEndpoints)) {
+        if (!a.startsWith("/"))
           throw new l(g.Configuration, "protected endpoints must be absolute paths without the protocol and hostname");
-        t.scope && t.scope.forEach((a) => {
-          if (!i.test(a)) throw new l(g.Configuration, "Illegal characters in scope " + a);
+        t.scope && t.scope.forEach((n) => {
+          if (!i.test(n)) throw new l(g.Configuration, "Illegal characters in scope " + n);
         });
       }
-      this.protectedEndpoints = s.protectedEndpoints;
+      this.protectedEndpoints = { ...s.protectedEndpoints };
+      for (let a in s.protectedEndpoints) {
+        let t = this.protectedEndpoints[a];
+        t.suburls == !0 && (a.endsWith("/") || (a += "/", this.protectedEndpoints[a] = t), this.protectedEndpointPrefixes.push(a));
+      }
     }
-    s.protectedEndpoints && o.addHook("preHandler", async (i, n) => {
-      var h, f;
+    s.protectedEndpoints && o.addHook("preHandler", async (i, a) => {
+      var m, v;
       const t = i.url.split("?", 2)[0];
-      if (!(t in this.protectedEndpoints)) return;
-      const a = await this.authorized(i);
-      if (!(i.user && i.authType == "cookie" && this.protectedEndpoints[t].acceptSessionAuthorization != !0)) {
-        if (!a) {
+      let n = !1, h = "";
+      if (t in this.protectedEndpoints)
+        n = !0, h = t;
+      else
+        for (let p of this.protectedEndpointPrefixes)
+          t.startsWith(p) && (n = !0), h = p;
+      if (!n) return;
+      const f = await this.authorized(i);
+      if (!(i.user && i.authType == "cookie" && this.protectedEndpoints[h].acceptSessionAuthorization != !0)) {
+        if (!f) {
           i.authError = "access_denied", i.authErrorDescription = "No access token";
           const p = this.authenticateHeader(i);
-          return n.header("WWW-Authenticate", p).status(401).send(this.errorBody);
+          return a.header("WWW-Authenticate", p).status(401).send(this.errorBody);
         }
-        if (!a.authorized) {
+        if (!f.authorized) {
           const p = this.authenticateHeader(i);
-          return n.header("WWW-Authenticate", p).status(401).send(this.errorBody);
+          return a.header("WWW-Authenticate", p).status(401).send(this.errorBody);
         }
       }
-      if (a) {
-        if (i.accessTokenPayload = a.tokenPayload, i.user = a.user, (h = a.tokenPayload) != null && h.scope)
-          if (Array.isArray(a.tokenPayload.scope)) {
+      if (f) {
+        if (i.accessTokenPayload = f.tokenPayload, i.user = f.user, (m = f.tokenPayload) != null && m.scope)
+          if (Array.isArray(f.tokenPayload.scope)) {
             let p = [];
-            for (let v of a.tokenPayload.scope)
-              typeof v == "string" && p.push(v);
+            for (let w of f.tokenPayload.scope)
+              typeof w == "string" && p.push(w);
             i.scope = p;
-          } else typeof a.tokenPayload.scope == "string" && (i.scope = a.tokenPayload.scope.split(" "));
-        if (this.protectedEndpoints[t].scope) {
-          for (let p of this.protectedEndpoints[t].scope ?? [])
-            if (!i.scope || !i.scope.includes(p) && this.protectedEndpoints[t].acceptSessionAuthorization != !0)
+          } else typeof f.tokenPayload.scope == "string" && (i.scope = f.tokenPayload.scope.split(" "));
+        if (this.protectedEndpoints[h].scope) {
+          for (let p of this.protectedEndpoints[h].scope ?? [])
+            if (!i.scope || !i.scope.includes(p) && this.protectedEndpoints[h].acceptSessionAuthorization != !0)
               return d.logger.warn(c({
                 msg: "Access token does not have sufficient scope",
-                username: (f = i.user) == null ? void 0 : f.username,
+                username: (v = i.user) == null ? void 0 : v.username,
                 url: i.url
-              })), i.scope = void 0, i.accessTokenPayload = void 0, i.user = void 0, i.authError = "access_denied", i.authErrorDescription = "Access token does not have sufficient scope", n.status(401).send(this.errorBody);
+              })), i.scope = void 0, i.accessTokenPayload = void 0, i.user = void 0, i.authError = "access_denied", i.authErrorDescription = "Access token does not have sufficient scope", a.status(401).send(this.errorBody);
         }
-        if (i.authType = "oauth", i.authError = a == null ? void 0 : a.error, (a == null ? void 0 : a.error) == "access_denied") {
+        if (i.authType = "oauth", i.authError = f == null ? void 0 : f.error, (f == null ? void 0 : f.error) == "access_denied") {
           const p = this.authenticateHeader(i);
-          return n.header("WWW-Authenticate", p).status(401).send(this.errorBody);
-        } else if (a != null && a.error)
-          return n.status(500).send(this.errorBody);
-        i.authErrorDescription = a == null ? void 0 : a.error_description, d.logger.debug(c({ msg: "Resource server url", url: i.url, authorized: i.accessTokenPayload != null }));
+          return a.header("WWW-Authenticate", p).status(401).send(this.errorBody);
+        } else if (f != null && f.error)
+          return a.status(500).send(this.errorBody);
+        i.authErrorDescription = f == null ? void 0 : f.error_description, d.logger.debug(c({ msg: "Resource server url", url: i.url, authorized: i.accessTokenPayload != null }));
       }
     });
   }
@@ -6963,15 +6974,15 @@ class er extends Ie {
       let r;
       for (let i of this.tokenLocations)
         if (i == "header") {
-          const n = await this.tokenFromHeader(o);
-          if (n) {
-            r = n;
+          const a = await this.tokenFromHeader(o);
+          if (a) {
+            r = a;
             break;
           }
         } else {
-          const n = await this.tokenFromSession(o);
-          if (n) {
-            r = n;
+          const a = await this.tokenFromSession(o);
+          if (a) {
+            r = a;
             break;
           }
         }
@@ -7092,9 +7103,9 @@ const K = class K {
     apiKey: r,
     oAuthAuthServer: s,
     oAuthClient: i,
-    oAuthClients: n,
+    oAuthClients: a,
     oAuthResServer: t
-  }, a = {}) {
+  }, n = {}) {
     u(this, "views", "views");
     /** The Fastify app, which was either passed in the constructor or
      *  created if none was passed in.
@@ -7119,7 +7130,7 @@ const K = class K {
     /** Config for `@fastify/cors` */
     u(this, "cors");
     u(this, "audience", "");
-    S("views", C.String, this, a, "VIEWS"), S("cors", C.Json, this, a, "CORS"), a.isAdminFn && (K.isAdminFn = a.isAdminFn), a.app ? this.app = a.app : (this.views && ue.configure(this.views, {
+    S("views", C.String, this, n, "VIEWS"), S("cors", C.Json, this, n, "CORS"), n.isAdminFn && (K.isAdminFn = n.isAdminFn), n.app ? this.app = n.app : (this.views && ue.configure(this.views, {
       autoescape: !0
     }), this.app = Ee({ logger: !1 }), this.app.register(Te, {
       engine: {
@@ -7139,7 +7150,7 @@ const K = class K {
       // options for parsing cookies
     }), this.app.decorateRequest("user", void 0), this.app.decorateRequest("csrfToken", void 0);
     let h = {};
-    if (a.authenticators && (h = a.authenticators), e) {
+    if (n.authenticators && (h = n.authenticators), e) {
       if (!h)
         throw new l(
           g.Configuration,
@@ -7149,17 +7160,17 @@ const K = class K {
         this.app,
         e.keyStorage,
         h,
-        { ...a, ...e.options }
+        { ...n, ...e.options }
       );
       this.sessionServer = f, this.sessionAdapter = this.sessionServer;
     } else o && (this.sessionAdapter = o);
     if (r) {
-      if (!a.userStorage) throw new l(g.Configuration, "Need a user storage to user API server");
+      if (!n.userStorage) throw new l(g.Configuration, "Need a user storage to user API server");
       new Ye(
         this.app,
-        a.userStorage,
+        n.userStorage,
         r.keyStorage,
-        { ...a, ...r.options }
+        { ...n, ...r.options }
       );
     }
     if (s) {
@@ -7170,7 +7181,7 @@ const K = class K {
         s.clientStorage,
         s.keyStorage,
         h,
-        { ...f, ...a, ...s.options }
+        { ...f, ...n, ...s.options }
       );
     }
     if (i && this.oAuthClients)
@@ -7178,22 +7189,22 @@ const K = class K {
     if (i && (this.oAuthClient = new we(
       this,
       i.authServerBaseUrl,
-      { ...a, ...i.options }
-    )), n) {
+      { ...n, ...i.options }
+    )), a) {
       this.oAuthClients = [];
-      for (let f of n)
+      for (let f of a)
         this.oAuthClients.push(
           new we(
             this,
             f.authServerBaseUrl,
-            { ...a, ...f.options }
+            { ...n, ...f.options }
           )
         );
     }
-    t && (this.audience = "", S("audience", C.String, this, a, "OAUTH_AUDIENCE", !0), this.oAuthResServer = new er(
+    t && (this.audience = "", S("audience", C.String, this, n, "OAUTH_AUDIENCE", !0), this.oAuthResServer = new er(
       this.app,
-      [new Me(this.audience, a)],
-      { sessionAdapter: this.sessionAdapter, ...t.options, ...a }
+      [new Me(this.audience, n)],
+      { sessionAdapter: this.sessionAdapter, ...t.options, ...n }
     ));
   }
   /**
@@ -7229,14 +7240,14 @@ const K = class K {
     try {
       if (!e.csrfToken) throw new l(g.InvalidCsrf);
       return { error: !1, reply: o };
-    } catch (n) {
-      d.logger.debug(c({ err: n })), d.logger.warn(c({
+    } catch (a) {
+      d.logger.debug(c({ err: a })), d.logger.warn(c({
         msg: "Attempt to access url without csrf token",
         url: e.url
       }));
       try {
         if (r) {
-          const t = l.asCrossauthError(n);
+          const t = l.asCrossauthError(a);
           return { error: !0, reply: await r(this, e, o, t) };
         } else if ((s = this.sessionServer) != null && s.errorPage) {
           const t = new l(g.InvalidCsrf, "CSRF Token not provided");
@@ -7270,7 +7281,7 @@ const K = class K {
    * from calling `errorFn`.
    */
   async errorIfNotLoggedIn(e, o, r) {
-    var s, i, n;
+    var s, i, a;
     if (!e.user) {
       d.logger.warn(c({
         msg: "Attempt to access url without csrf token",
@@ -7296,7 +7307,7 @@ const K = class K {
       } catch (t) {
         return d.logger.debug(c({ err: t })), d.logger.error(c({
           cerr: t,
-          hashedSessionCookie: (n = this.sessionServer) == null ? void 0 : n.getHashOfSessionId(e)
+          hashedSessionCookie: (a = this.sessionServer) == null ? void 0 : a.getHashOfSessionId(e)
         })), o.status(401).send(z);
       }
       return o.status(401).send(z);
@@ -7337,14 +7348,14 @@ const K = class K {
         }
       ) : e.status(o).send(o == 401 ? z : G);
     try {
-      let n = 0, t = "UnknownError";
+      let a = 0, t = "UnknownError";
       if ("isCrossAuthError" in i) {
-        const a = l.asCrossauthError(i);
-        n = a.code, t = a.name, s || (s = i.message);
+        const n = l.asCrossauthError(i);
+        a = n.code, t = n.name, s || (s = i.message);
       }
-      return s || (o == 401 ? (s = "You are not authorized to access this page", n = g.Unauthorized, t = g[n]) : o == 403 ? (s = "You do not have permission to access this page", n = g.Forbidden, t = g[n]) : s = "An unknwon error has occurred"), d.logger.warn(c({
+      return s || (o == 401 ? (s = "You are not authorized to access this page", a = g.Unauthorized, t = g[a]) : o == 403 ? (s = "You do not have permission to access this page", a = g.Forbidden, t = g[a]) : s = "An unknwon error has occurred"), d.logger.warn(c({
         msg: s,
-        errorCode: n,
+        errorCode: a,
         errorCodeName: t,
         httpStatus: o
       })), r ? e.status(o).view(
@@ -7352,12 +7363,12 @@ const K = class K {
         {
           status: o,
           errorMessage: s,
-          errorCode: n,
+          errorCode: a,
           errorCodeName: t
         }
       ) : e.status(o).send(o == 401 ? z : G);
-    } catch (n) {
-      return d.logger.error(c({ err: n })), e.status(o).send(o == 401 ? z : G);
+    } catch (a) {
+      return d.logger.error(c({ err: a })), e.status(o).send(o == 401 ? z : G);
     }
   }
   /*