@crossauth/fastify 0.0.35 → 0.0.37

package/dist/index.js

@@ -93,23 +93,23 @@ class De {
           return await this.updateUser(
             e,
             o,
-            (s, i, n) => {
-              const t = n ? "Please click on the link in your email to verify your email address." : "Your details have been updated";
+            (s, t, n) => {
+              const i = n ? "Please click on the link in your email to verify your email address." : "Your details have been updated";
               return s.view(this.updateUserPage, {
                 csrfToken: e.csrfToken,
-                message: t,
+                message: i,
                 urlPrefix: this.prefix,
                 allowedFactor2: this.sessionServer.allowedFactor2Details()
               });
             }
           );
         } catch (s) {
-          const i = l.asCrossauthError(s);
-          d.logger.error(c({ msg: "Update user failure", user: e.body.username, errorCodeName: i.codeName, errorCode: i.code })), d.logger.debug(c({ err: s }));
+          const t = l.asCrossauthError(s);
+          d.logger.error(c({ msg: "Update user failure", user: e.body.username, errorCodeName: t.codeName, errorCode: t.code })), d.logger.debug(c({ err: s }));
           let n = {};
-          for (let t in e.body)
-            t.startsWith("user_") && (n[t] = e.body[t]);
-          return this.sessionServer.handleError(s, e, o, (t, a) => t.view(this.updateUserPage, {
+          for (let i in e.body)
+            i.startsWith("user_") && (n[i] = e.body[i]);
+          return this.sessionServer.handleError(s, e, o, (i, a) => i.view(this.updateUserPage, {
             user: e.user,
             errorMessage: a.message,
             errorMessages: a.messages,
@@ -144,20 +144,20 @@ class De {
           return await this.updateUser(
             e,
             o,
-            (i, n, t) => i.header(...U).send({
+            (t, n, i) => t.header(...U).send({
               ok: !0,
-              emailVerificationRequired: t
+              emailVerificationRequired: i
             })
           );
-        } catch (i) {
-          const n = l.asCrossauthError(i);
+        } catch (t) {
+          const n = l.asCrossauthError(t);
           return d.logger.error(c({
             msg: "Update user failure",
             user: (s = e.user) == null ? void 0 : s.username,
             errorCodeName: n.codeName,
             errorCode: n.code
-          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, a) => {
-            t.status(this.sessionServer.errorStatus(i)).header(...U).send({
+          })), d.logger.debug(c({ err: t })), this.sessionServer.handleError(t, e, o, (i, a) => {
+            i.status(this.sessionServer.errorStatus(t)).header(...U).send({
               ok: !1,
               errorMessage: a.message,
               errorMessages: a.messages,
@@ -176,7 +176,7 @@ class De {
     this.sessionServer.app.get(
       this.prefix + "changefactor2",
       async (e, o) => {
-        var s, i;
+        var s, t;
         if (d.logger.info(c({
           msg: "Page visit",
           method: "GET",
@@ -197,7 +197,7 @@ class De {
           csrfToken: e.csrfToken,
           next: e.query.next ?? this.sessionServer.loginRedirect,
           allowedFactor2: this.sessionServer.allowedFactor2Details(),
-          factor2: ((i = e.user) == null ? void 0 : i.factor2) ?? "none",
+          factor2: ((t = e.user) == null ? void 0 : t.factor2) ?? "none",
           required: e.query.required ?? !1
         };
         return o.view(this.changeFactor2Page, r);
@@ -213,8 +213,8 @@ class De {
           ip: e.ip,
           user: (r = e.user) == null ? void 0 : r.username
         })), !this.sessionServer.isSessionUser(e) || !e.user) {
-          const i = await this.sessionServer.getSessionData(e, "factor2change");
-          if (!(i != null && i.username) && !this.sessionServer.isSessionUser(e))
+          const t = await this.sessionServer.getSessionData(e, "factor2change");
+          if (!(t != null && t.username) && !this.sessionServer.isSessionUser(e))
             return b.sendPageError(
               o,
               401,
@@ -225,26 +225,26 @@ class De {
           return await this.changeFactor2(
             e,
             o,
-            (i, n, t) => n.factor2 ? i.view(this.configureFactor2Page, {
+            (t, n, i) => n.factor2 ? t.view(this.configureFactor2Page, {
               csrfToken: n.csrfToken,
               next: e.body.next ?? this.sessionServer.loginRedirect,
               ...n.userData
-            }) : i.view(this.configureFactor2Page, {
+            }) : t.view(this.configureFactor2Page, {
               message: "Two factor authentication has been updated",
               next: e.body.next ?? this.sessionServer.loginRedirect,
               csrfToken: n.csrfToken
             })
           );
-        } catch (i) {
-          const n = l.asCrossauthError(i);
+        } catch (t) {
+          const n = l.asCrossauthError(t);
           return d.logger.error(c({
             msg: "Change two factor authentication failure",
             user: (s = e.user) == null ? void 0 : s.username,
             errorCodeName: n.codeName,
             errorCode: n.code
-          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, a) => {
+          })), d.logger.debug(c({ err: t })), this.sessionServer.handleError(t, e, o, (i, a) => {
             var h;
-            return t.view(this.changeFactor2Page, {
+            return i.view(this.changeFactor2Page, {
               errorMessage: a.message,
               errorMessages: a.messages,
               errorCode: a.code,
@@ -280,19 +280,19 @@ class De {
           return await this.changeFactor2(
             e,
             o,
-            (i, n, t) => i.header(...U).send({
+            (t, n, i) => t.header(...U).send({
               ok: !0,
               ...n.userData
             })
           );
-        } catch (i) {
-          const n = l.asCrossauthError(i);
+        } catch (t) {
+          const n = l.asCrossauthError(t);
           return d.logger.error(c({
             msg: "Change factor2 failure",
             user: (s = e.user) == null ? void 0 : s.username,
             errorCodeName: n.codeName,
             errorCode: n.code
-          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, a) => t.status(this.sessionServer.errorStatus(i)).header(...U).send({
+          })), d.logger.debug(c({ err: t })), this.sessionServer.handleError(t, e, o, (i, a) => i.status(this.sessionServer.errorStatus(t)).header(...U).send({
             ok: !1,
             errorMessage: a.message,
             errorMessages: a.messages,
@@ -318,8 +318,8 @@ class De {
           ip: e.ip,
           user: (s = e.user) == null ? void 0 : s.username
         })), !this.sessionServer.isSessionUser(e) || !e.user) {
-          const i = await this.sessionServer.getSessionData(e, "passwordchange");
-          if ((i == null ? void 0 : i.username) == null && !this.sessionServer.isSessionUser(e))
+          const t = await this.sessionServer.getSessionData(e, "passwordchange");
+          if ((t == null ? void 0 : t.username) == null && !this.sessionServer.isSessionUser(e))
             return b.sendPageError(
               o,
               401,
@@ -349,7 +349,7 @@ class De {
           return await this.changePassword(
             e,
             o,
-            (i, n) => e.body.next ? i.redirect(e.body.next) : i.view(this.changePasswordPage, {
+            (t, n) => e.body.next ? t.redirect(e.body.next) : t.view(this.changePasswordPage, {
               csrfToken: e.csrfToken,
               message: "Your password has been changed.",
               urlPrefix: this.prefix,
@@ -357,14 +357,14 @@ class De {
               required: e.body.required
             })
           );
-        } catch (i) {
-          const n = l.asCrossauthError(i);
+        } catch (t) {
+          const n = l.asCrossauthError(t);
           return d.logger.error(c({
             msg: "Change password failure",
             user: (s = e.user) == null ? void 0 : s.username,
             errorCodeName: n.codeName,
             errorCode: n.code
-          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, a) => t.view(this.changePasswordPage, {
+          })), d.logger.debug(c({ err: t })), this.sessionServer.handleError(t, e, o, (i, a) => i.view(this.changePasswordPage, {
             errorMessage: a.message,
             errorMessages: a.messages,
             errorCode: a.code,
@@ -397,18 +397,18 @@ class De {
           return await this.changePassword(
             e,
             o,
-            (i, n) => i.header(...U).send({
+            (t, n) => t.header(...U).send({
               ok: !0
             })
           );
-        } catch (i) {
-          const n = l.asCrossauthError(i);
+        } catch (t) {
+          const n = l.asCrossauthError(t);
           return d.logger.error(c({
             msg: "Change password failure",
             user: (s = e.user) == null ? void 0 : s.username,
             errorCodeName: n.codeName,
             errorCode: n.code
-          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, a) => t.status(this.sessionServer.errorStatus(i)).header(...U).send({
+          })), d.logger.debug(c({ err: t })), this.sessionServer.handleError(t, e, o, (i, a) => i.status(this.sessionServer.errorStatus(t)).header(...U).send({
             ok: !1,
             errorMessage: a.message,
             errorMessages: a.messages,
@@ -437,23 +437,23 @@ class De {
           return await this.reconfigureFactor2(
             e,
             o,
-            (s, i, n) => s.view(this.configureFactor2Page, {
-              ...i,
+            (s, t, n) => s.view(this.configureFactor2Page, {
+              ...t,
               next: e.query.next ?? this.sessionServer.loginRedirect
             })
           );
         } catch (s) {
-          const i = l.asCrossauthError(s);
+          const t = l.asCrossauthError(s);
           return d.logger.error(c({
             msg: "Configure factor2 failure",
             user: (r = e.user) == null ? void 0 : r.username,
-            errorCodeName: i.codeName,
-            errorCode: i.code
-          })), d.logger.debug(c({ err: s })), this.sessionServer.handleError(s, e, o, (n, t) => n.view(this.configureFactor2Page, {
-            errorMessage: t.message,
-            errorMessages: t.messages,
-            errorCode: t.code,
-            errorCodeName: g[t.code],
+            errorCodeName: t.codeName,
+            errorCode: t.code
+          })), d.logger.debug(c({ err: s })), this.sessionServer.handleError(s, e, o, (n, i) => n.view(this.configureFactor2Page, {
+            errorMessage: i.message,
+            errorMessages: i.messages,
+            errorCode: i.code,
+            errorCodeName: g[i.code],
             next: e.query.next ?? this.sessionServer.loginRedirect,
             csrfToken: e.csrfToken,
             urlPrefix: this.prefix
@@ -474,8 +474,8 @@ class De {
           return d.logger.debug(c({ msg: "Next page " + r })), await this.configureFactor2(
             e,
             o,
-            (s, i) => {
-              const n = i != null && i.factor2 ? this.sessionServer.authenticators[i.factor2] : void 0;
+            (s, t) => {
+              const n = t != null && t.factor2 ? this.sessionServer.authenticators[t.factor2] : void 0;
               return !this.sessionServer.isSessionUser(e) && this.enableEmailVerification && (n == null || n.skipEmailVerificationOnSignup() != !0) ? s.view(this.signupPage, {
                 next: r,
                 csrfToken: e.csrfToken,
@@ -497,10 +497,10 @@ class De {
               const a = l.asCrossauthError(s);
               return d.logger.error(c({ msg: "Signup second factor failure", errorCodeName: a.codeName, errorCode: a.code })), d.logger.error(c({ msg: "Session not defined during two factor process" })), o.status(500).view(this.sessionServer.errorPage, { status: 500, errorMessage: "An unknown error occurred", errorCode: g.UnknownError, errorCodeName: "UnknownError" });
             }
-            let i = (await this.sessionServer.sessionManager.dataForSessionId(e.sessionId))["2fa"];
+            let t = (await this.sessionServer.sessionManager.dataForSessionId(e.sessionId))["2fa"];
             const n = l.asCrossauthError(s);
-            d.logger.error(c({ msg: "Signup two factor failure", user: i == null ? void 0 : i.username, errorCodeName: n.codeName, errorCode: n.code }));
-            const { userData: t } = await this.sessionServer.sessionManager.repeatTwoFactorSignup(e.sessionId);
+            d.logger.error(c({ msg: "Signup two factor failure", user: t == null ? void 0 : t.username, errorCodeName: n.codeName, errorCode: n.code }));
+            const { userData: i } = await this.sessionServer.sessionManager.repeatTwoFactorSignup(e.sessionId);
             return this.sessionServer.handleError(s, e, o, (a, h) => a.view(this.configureFactor2Page, {
               errorMessage: h.message,
               errorMessages: h.messages,
@@ -508,11 +508,11 @@ class De {
               errorCodeName: g[h.code],
               urlPrefix: this.prefix,
               next: r,
-              ...t,
+              ...i,
               csrfToken: this.sessionServer.csrfToken(e, a)
             }));
-          } catch (i) {
-            return d.logger.error(c({ err: i })), o.status(500).view(this.sessionServer.errorPage, {
+          } catch (t) {
+            return d.logger.error(c({ err: t })), o.status(500).view(this.sessionServer.errorPage, {
               status: 500,
               errorMessage: "An unknown error occurred",
               errorCode: g.UnknownError,
@@ -542,20 +542,20 @@ class De {
           return await this.reconfigureFactor2(
             o,
             r,
-            (i, n, t) => i.header(...U).send({
+            (t, n, i) => t.header(...U).send({
               ok: !0,
               ...n
             })
           );
-        } catch (i) {
-          const n = l.asCrossauthError(i);
+        } catch (t) {
+          const n = l.asCrossauthError(t);
           d.logger.error(c({
             msg: "Configure 2FA configuration failure",
             user: (s = o.user) == null ? void 0 : s.username,
             errorCodeName: n.codeName,
             errorCode: n.code
-          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, o, r, (t, a) => {
-            t.status(this.sessionServer.errorStatus(i)).header(...U).send({
+          })), d.logger.debug(c({ err: t })), this.sessionServer.handleError(t, o, r, (i, a) => {
+            i.status(this.sessionServer.errorStatus(t)).header(...U).send({
               ok: !1,
               errorMessage: a.message,
               errorMessages: a.messages,
@@ -579,23 +579,23 @@ class De {
           return await this.configureFactor2(
             o,
             r,
-            (i, n) => {
-              const t = {
+            (t, n) => {
+              const i = {
                 ok: !0,
                 user: n
               };
-              return this.sessionServer.isSessionUser(o) || (t.emailVerificationNeeded = this.enableEmailVerification), i.header(...U).send(t);
+              return this.sessionServer.isSessionUser(o) || (i.emailVerificationNeeded = this.enableEmailVerification), t.header(...U).send(i);
             }
           );
-        } catch (i) {
-          const n = l.asCrossauthError(i);
+        } catch (t) {
+          const n = l.asCrossauthError(t);
           d.logger.error(c({
             msg: "Configure 2FA configuration failure",
             user: (s = o.user) == null ? void 0 : s.username,
             errorCodeName: n.codeName,
             errorCode: n.code
-          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, o, r, (t, a) => {
-            t.status(this.sessionServer.errorStatus(i)).header(...U).send({
+          })), d.logger.debug(c({ err: t })), this.sessionServer.handleError(t, o, r, (i, a) => {
+            i.status(this.sessionServer.errorStatus(t)).header(...U).send({
               ok: !1,
               errorMessage: a.message,
               errorMessages: a.messages,
@@ -640,7 +640,7 @@ class De {
           return await this.requestPasswordReset(
             e,
             o,
-            (s, i) => s.view(this.requestPasswordResetPage, {
+            (s, t) => s.view(this.requestPasswordResetPage, {
               csrfToken: e.csrfToken,
               message: r,
               urlPrefix: this.prefix
@@ -650,13 +650,13 @@ class De {
           return d.logger.error(c({
             msg: "Request password reset faiulure user failure",
             email: e.body.email
-          })), d.logger.debug(c({ err: s })), this.sessionServer.handleError(s, e, o, (i, n) => n.code == g.EmailNotExist ? i.view(this.requestPasswordResetPage, {
+          })), d.logger.debug(c({ err: s })), this.sessionServer.handleError(s, e, o, (t, n) => n.code == g.EmailNotExist ? t.view(this.requestPasswordResetPage, {
             csrfToken: e.csrfToken,
             message: r,
             urlPrefix: this.prefix,
             required: e.body.required,
             next: e.body.next
-          }) : e.body.next ? i.redirect(e.body.next) : i.view(this.requestPasswordResetPage, {
+          }) : e.body.next ? t.redirect(e.body.next) : t.view(this.requestPasswordResetPage, {
             errorMessage: n.message,
             errorMessages: n.messages,
             errorCode: n.code,
@@ -697,8 +697,8 @@ class De {
             email: e.body.email,
             errorCodeName: s.codeName,
             errorCode: s.code
-          })), d.logger.debug(c({ err: r })), this.sessionServer.handleError(r, e, o, (i, n) => {
-            i.status(this.sessionServer.errorStatus(r)).header(...U).send({
+          })), d.logger.debug(c({ err: r })), this.sessionServer.handleError(r, e, o, (t, n) => {
+            t.status(this.sessionServer.errorStatus(r)).header(...U).send({
               ok: !1,
               errorMessage: n.message,
               errorMessages: n.messages,
@@ -764,7 +764,7 @@ class De {
             hashedToken: F.hash(e.body.token),
             errorCodeName: s.codeName,
             errorCode: s.code
-          })), d.logger.debug(c({ err: r })), this.sessionServer.handleError(r, e, o, (i, n) => i.view(this.resetPasswordPage, {
+          })), d.logger.debug(c({ err: r })), this.sessionServer.handleError(r, e, o, (t, n) => t.view(this.resetPasswordPage, {
             errorMessage: n.message,
             errorMessages: n.messages,
             errorCode: n.code,
@@ -805,8 +805,8 @@ class De {
             hashedToken: F.hash(e.body.token),
             errorCodeName: s.codeName,
             errorCode: s.code
-          })), d.logger.debug(c({ err: r })), this.sessionServer.handleError(r, e, o, (i, n) => {
-            i.status(this.sessionServer.errorStatus(r)).header(...U).send({
+          })), d.logger.debug(c({ err: r })), this.sessionServer.handleError(r, e, o, (t, n) => {
+            t.status(this.sessionServer.errorStatus(r)).header(...U).send({
               ok: !1,
               errorMessage: n.message,
               errorMessages: n.messages,
@@ -847,7 +847,7 @@ class De {
             hashedToken: F.hash(e.params.token),
             errorCodeName: s.codeName,
             errorCode: s.code
-          })), d.logger.debug(c({ err: r })), this.sessionServer.handleError(r, e, o, (i, n) => i.view(this.sessionServer.errorPage, {
+          })), d.logger.debug(c({ err: r })), this.sessionServer.handleError(r, e, o, (t, n) => t.view(this.sessionServer.errorPage, {
             errorCode: n.code,
             errorCodeName: g[n.code],
             errorMessage: n.message,
@@ -887,8 +887,8 @@ class De {
             hashedToken: F.hash(e.params.token),
             errorCodeName: s.codeName,
             errorCode: s.code
-          })), d.logger.debug(c({ err: r })), this.sessionServer.handleError(r, e, o, (i, n) => {
-            i.status(this.sessionServer.errorStatus(r)).header(...U).send({
+          })), d.logger.debug(c({ err: r })), this.sessionServer.handleError(r, e, o, (t, n) => {
+            t.status(this.sessionServer.errorStatus(r)).header(...U).send({
               ok: !1,
               errorMessage: n.message,
               errorMessages: n.messages,
@@ -920,28 +920,28 @@ class De {
           if (!this.sessionServer.userStorage) throw new l(g.Configuration, "Cannot call delete user unless a user storage is provided");
           r = (await this.sessionServer.userStorage.getUserById(e.user.id)).user;
         } catch (n) {
-          const t = l.asCrossauthError(n);
-          return d.logger.debug(c({ err: n })), o.status(t.httpStatus).view(this.sessionServer.errorPage, {
-            errorMessage: t.message,
-            errorMessages: t.messages,
-            errorCode: t.code,
-            errorCodeName: g[t.code]
+          const i = l.asCrossauthError(n);
+          return d.logger.debug(c({ err: n })), o.status(i.httpStatus).view(this.sessionServer.errorPage, {
+            errorMessage: i.message,
+            errorMessages: i.messages,
+            errorCode: i.code,
+            errorCodeName: g[i.code]
           });
         }
         const s = e.query.next ?? this.prefix;
-        let i = {
+        let t = {
           urlPrefix: this.prefix,
           csrfToken: e.csrfToken,
           next: s,
           isAdmin: !1,
           user: r
         };
-        return o.view(this.deleteUserPage, i);
+        return o.view(this.deleteUserPage, t);
       }
     ), this.sessionServer.app.post(
       this.prefix + "deleteuser",
       async (e, o) => {
-        var s, i;
+        var s, t;
         if (d.logger.info(c({
           msg: "Page visit",
           method: "POST",
@@ -956,24 +956,24 @@ class De {
             e,
             o,
             (n) => {
-              var t;
+              var i;
               return n.view(this.deleteUserPage, {
                 message: "User deleted",
                 csrfToken: e.csrfToken,
                 urlPrefix: this.prefix,
-                userid: (t = e.user) == null ? void 0 : t.id,
+                userid: (i = e.user) == null ? void 0 : i.id,
                 isAdmin: !1,
                 next: r
               });
             }
           );
         } catch (n) {
-          const t = l.asCrossauthError(n);
+          const i = l.asCrossauthError(n);
           return d.logger.error(c({
             msg: "Failed deleting user",
-            user: (i = e.user) == null ? void 0 : i.username,
-            errorCodeName: t.codeName,
-            errorCode: t.code
+            user: (t = e.user) == null ? void 0 : t.username,
+            errorCodeName: i.codeName,
+            errorCode: i.code
           })), d.logger.debug(c({ err: n })), this.sessionServer.handleError(n, e, o, (a, h) => {
             var v;
             const p = l.asCrossauthError(n).httpStatus;
@@ -1013,23 +1013,23 @@ class De {
           return await this.deleteUser(
             e,
             o,
-            (i) => {
+            (t) => {
               var n;
-              return i.header(...U).send({
+              return t.header(...U).send({
                 ok: !0,
                 userid: (n = e.user) == null ? void 0 : n.id
               });
             }
           );
-        } catch (i) {
-          const n = l.asCrossauthError(i);
+        } catch (t) {
+          const n = l.asCrossauthError(t);
           d.logger.error(c({
             msg: "Delete user failure",
             user: (s = e.user) == null ? void 0 : s.username,
             errorCodeName: n.codeName,
             errorCode: n.code
-          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, a) => {
-            t.status(this.sessionServer.errorStatus(i)).header(...U).send({
+          })), d.logger.debug(c({ err: t })), this.sessionServer.handleError(t, e, o, (i, a) => {
+            i.status(this.sessionServer.errorStatus(t)).header(...U).send({
               ok: !1,
               errorMessage: a.message,
               errorMessages: a.messages,
@@ -1057,9 +1057,9 @@ class De {
       e,
       this.sessionServer.userStorage.userEditableFields
     );
-    let i = this.sessionServer.validateUserFn(s);
-    if (i.length > 0)
-      throw new l(g.FormEntry, i);
+    let t = this.sessionServer.validateUserFn(s);
+    if (t.length > 0)
+      throw new l(g.FormEntry, t);
     let n = await this.sessionServer.sessionManager.updateUser(e.user, s);
     return r(o, e.user, n.emailVerificationTokenSent);
   }
@@ -1086,26 +1086,26 @@ class De {
       throw new l(g.Unauthorized);
     if (!e.csrfToken)
       throw new l(g.InvalidCsrf);
-    let i = e.body.factor2;
+    let t = e.body.factor2;
     if (e.body.factor2 && !this.sessionServer.allowedFactor2.includes(e.body.factor2))
       throw new l(
         g.Forbidden,
         "Illegal second factor " + e.body.factor2 + " requested"
       );
-    (e.body.factor2 == "none" || e.body.factor2 == "") && (i = void 0);
-    const n = await this.sessionServer.sessionManager.initiateTwoFactorSetup(s, i, e.sessionId);
-    let t = {
-      factor2: i,
+    (e.body.factor2 == "none" || e.body.factor2 == "") && (t = void 0);
+    const n = await this.sessionServer.sessionManager.initiateTwoFactorSetup(s, t, e.sessionId);
+    let i = {
+      factor2: t,
       userData: n,
       username: n.username,
       next: e.body.next ?? this.sessionServer.loginRedirect,
       csrfToken: e.csrfToken
     };
-    return r(o, t);
+    return r(o, i);
   }
   async changePassword(e, o, r) {
     if (!this.sessionServer.userStorage) throw new l(g.Configuration, "Cannot call changePassword unless a user storage is provided");
-    let s, i = !1;
+    let s, t = !1;
     if (!this.sessionServer.isSessionUser(e) || !e.user) {
       const m = await this.sessionServer.getSessionData(e, "passwordchange");
       if (m != null && m.username) {
@@ -1115,7 +1115,7 @@ class De {
             skipActiveCheck: !0,
             skipEmailVerifiedCheck: !0
           }
-        )).user, i = !0, !e.csrfToken)
+        )).user, t = !0, !e.csrfToken)
           throw new l(g.InvalidCsrf);
       } else
         throw new l(g.Unauthorized);
@@ -1125,24 +1125,24 @@ class De {
       s = e.user;
     } else
       throw new l(g.InsufficientPriviledges);
-    const n = this.sessionServer.authenticators[s.factor1], t = n.secretNames();
+    const n = this.sessionServer.authenticators[s.factor1], i = n.secretNames();
     let a = {}, h = {}, f = {};
     for (let m in e.body)
       if (m.startsWith("new_")) {
         const w = m.replace(/^new_/, "");
-        t.includes(w) && (h[w] = e.body[m]);
+        i.includes(w) && (h[w] = e.body[m]);
       } else if (m.startsWith("old_")) {
         const w = m.replace(/^old_/, "");
-        t.includes(w) && (a[w] = e.body[m]);
+        i.includes(w) && (a[w] = e.body[m]);
       } else if (m.startsWith("repeat_")) {
         const w = m.replace(/^repeat_/, "");
-        t.includes(w) && (f[w] = e.body[m]);
+        i.includes(w) && (f[w] = e.body[m]);
       }
     if (Object.keys(f).length === 0 && (f = void 0), n.validateSecrets(h).length > 0)
       throw new l(g.PasswordFormat);
     const v = s.state;
     try {
-      i && (s.state = "active", await this.sessionServer.userStorage.updateUser({ id: s.id, state: s.state })), await this.sessionServer.sessionManager.changeSecrets(
+      t && (s.state = "active", await this.sessionServer.userStorage.updateUser({ id: s.id, state: s.state })), await this.sessionServer.sessionManager.changeSecrets(
         s.username,
         1,
         h,
@@ -1151,7 +1151,7 @@ class De {
       );
     } catch (m) {
       const w = l.asCrossauthError(m);
-      if (d.logger.debug(c({ err: m })), i)
+      if (d.logger.debug(c({ err: m })), t)
         try {
           await this.sessionServer.userStorage.updateUser({ id: s.id, state: v });
         } catch (P) {
@@ -1159,7 +1159,7 @@ class De {
         }
       throw w;
     }
-    return i ? await this.sessionServer.loginWithUser(s, !1, e, o, r) : r(o, void 0);
+    return t ? await this.sessionServer.loginWithUser(s, !1, e, o, r) : r(o, void 0);
   }
   async configureFactor2(e, o, r) {
     if (this.sessionServer.isSessionUser(e) && !e.csrfToken)
@@ -1177,20 +1177,20 @@ class De {
       !0,
       e,
       o,
-      (i, n) => r(i, n)
+      (t, n) => r(t, n)
     ) : r(o, s);
   }
   async reconfigureFactor2(e, o, r) {
     if (!e.user || !e.sessionId || !this.sessionServer.isSessionUser(e))
       throw new l(g.Unauthorized);
     let s = e.user.factor2;
-    const i = this.sessionServer.authenticators[s];
-    if (!i || i.secretNames().length == 0)
+    const t = this.sessionServer.authenticators[s];
+    if (!t || t.secretNames().length == 0)
       throw new l(
         g.BadRequest,
         "Selected second factor does not have configuration"
       );
-    let t = {
+    let i = {
       ...await this.sessionServer.sessionManager.initiateTwoFactorSetup(
         e.user,
         s,
@@ -1198,7 +1198,7 @@ class De {
       ),
       csrfToken: e.csrfToken
     };
-    return r(o, t);
+    return r(o, i);
   }
   async requestPasswordReset(e, o, r) {
     if (!this.enablePasswordReset)
@@ -1211,12 +1211,12 @@ class De {
     const s = e.body.email;
     try {
       await this.sessionServer.sessionManager.requestPasswordReset(s);
-    } catch (i) {
-      l.asCrossauthError(i).code == g.UserNotExist ? d.logger.warn(c({
+    } catch (t) {
+      l.asCrossauthError(t).code == g.UserNotExist ? d.logger.warn(c({
         msg: "Password reset requested for invalid email",
         email: e.body.email
       })) : d.logger.debug(c({
-        err: i,
+        err: t,
         msg: "Couldn't send password reset email"
       }));
     }
@@ -1225,15 +1225,15 @@ class De {
   async resetPassword(e, o, r) {
     if (!e.csrfToken)
       throw new l(g.InvalidCsrf);
-    const s = e.body.token, i = await this.sessionServer.sessionManager.userForPasswordResetToken(s), n = this.sessionServer.authenticators[i.factor1], t = n.secretNames();
+    const s = e.body.token, t = await this.sessionServer.sessionManager.userForPasswordResetToken(s), n = this.sessionServer.authenticators[t.factor1], i = n.secretNames();
     let a = {}, h = {};
     for (let v in e.body)
       if (v.startsWith("new_")) {
         const m = v.replace(/^new_/, "");
-        t.includes(m) && (a[m] = e.body[v]);
+        i.includes(m) && (a[m] = e.body[v]);
       } else if (v.startsWith("repeat_")) {
         const m = v.replace(/^repeat_/, "");
-        t.includes(m) && (h[m] = e.body[v]);
+        i.includes(m) && (h[m] = e.body[v]);
       }
     if (Object.keys(h).length === 0 && (h = void 0), n.validateSecrets(a).length > 0)
       throw new l(g.PasswordFormat);
@@ -1245,8 +1245,8 @@ class De {
       g.Configuration,
       "Email verification reset not enabled"
     );
-    const s = e.params.token, i = await this.sessionServer.sessionManager.applyEmailVerificationToken(s);
-    return await this.sessionServer.loginWithUser(i, !0, e, o, r);
+    const s = e.params.token, t = await this.sessionServer.sessionManager.applyEmailVerificationToken(s);
+    return await this.sessionServer.loginWithUser(t, !0, e, o, r);
   }
   async deleteUser(e, o, r) {
     if (!this.sessionServer.userStorage) throw new l(g.Configuration, "Cannot call deleteUser unless a user storage is provided");
@@ -1267,10 +1267,10 @@ async function ze(S, e) {
     if (s.code != g.UserNotExist)
       throw d.logger.debug(c({ err: s })), s;
     try {
-      const { user: i } = await e.getUserByEmail(S);
-      o.push(i);
-    } catch (i) {
-      const n = l.asCrossauthError(i);
+      const { user: t } = await e.getUserByEmail(S);
+      o.push(t);
+    } catch (t) {
+      const n = l.asCrossauthError(t);
       if (n.code != g.UserNotExist)
         throw d.logger.debug(c({ err: n })), s;
     }
@@ -1331,18 +1331,18 @@ class He {
           return d.logger.debug(c({ msg: "Next page " + r })), await this.createUser(
             e,
             o,
-            (i, n, t) => i.redirect(302, r)
+            (t, n, i) => t.redirect(302, r)
           );
-        } catch (i) {
-          const n = l.asCrossauthError(i);
+        } catch (t) {
+          const n = l.asCrossauthError(t);
           return d.logger.error(c({
             msg: "Signup failure",
             user: e.body.username,
             errorCodeName: n.codeName,
             errorCode: n.code
-          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, a) => {
-            const f = l.asCrossauthError(i).httpStatus;
-            return t.status(f).view(this.adminCreateUserPage, {
+          })), d.logger.debug(c({ err: t })), this.sessionServer.handleError(t, e, o, (i, a) => {
+            const f = l.asCrossauthError(t).httpStatus;
+            return i.status(f).view(this.adminCreateUserPage, {
               errorMessage: a.message,
               errorMessages: a.messages,
               errorCode: a.code,
@@ -1379,21 +1379,21 @@ class He {
           return await this.createUser(
             e,
             o,
-            (i, n, t) => i.header(...R).send({
+            (t, n, i) => t.header(...R).send({
               ok: !0,
-              user: t,
+              user: i,
               ...n.userData
             })
           );
-        } catch (i) {
-          const n = l.asCrossauthError(i);
+        } catch (t) {
+          const n = l.asCrossauthError(t);
           d.logger.error(c({
             msg: "Create user failure",
             user: (s = e.user) == null ? void 0 : s.username,
             errorCodeName: n.codeName,
             errorCode: n.code
-          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, a) => {
-            t.status(this.sessionServer.errorStatus(i)).header(...R).send({
+          })), d.logger.debug(c({ err: t })), this.sessionServer.handleError(t, e, o, (i, a) => {
+            i.status(this.sessionServer.errorStatus(t)).header(...R).send({
               ok: !1,
               errorMessage: a.message,
               errorMessages: a.messages,
@@ -1420,21 +1420,21 @@ class He {
         })), !(e != null && e.user) || !b.isAdmin(e.user))
           return this.accessDeniedPage(e, o);
         try {
-          let r = [], s = Number(e.query.skip), i = Number(e.query.take);
-          s < 0 && (i = -s, s = 0), s || (s = 0), i || (i = 10), e.query.search ? r = await this.userSearchFn(
+          let r = [], s = Number(e.query.skip), t = Number(e.query.take);
+          s < 0 && (t = -s, s = 0), s || (s = 0), t || (t = 10), e.query.search ? r = await this.userSearchFn(
             e.query.search,
             this.sessionServer.userStorage
           ) : r = await this.sessionServer.userStorage.getUsers(
             s,
-            i
+            t
           );
           let n = {
             urlPrefix: this.adminPrefix,
             skip: s,
-            take: i,
+            take: t,
             users: r,
             havePrevious: s > 0,
-            haveNext: i != null && r.length == i
+            haveNext: t != null && r.length == t
           };
           return e.query.next && (n.next = e.query.next), o.view(this.adminSelectUserPage, n);
         } catch (r) {
@@ -1504,12 +1504,12 @@ class He {
         let r;
         try {
           if (!this.sessionServer.userStorage) throw new l(g.Configuration, "Cannot call updateuser unless a user storage is provided");
-          const { user: i } = await this.sessionServer.userStorage.getUserById(e.params.id);
-          return r = i, await this.updateUser(
+          const { user: t } = await this.sessionServer.userStorage.getUserById(e.params.id);
+          return r = t, await this.updateUser(
             r,
             e,
             o,
-            (n, t, a, h) => {
+            (n, i, a, h) => {
               let f = "User's details have been updated.";
               return a ? f = "User's details have been updated and sent and an email verification link." : h && (f = "User's details have been updated and sent and a password reset token sent."), n.view(this.adminUpdateUserPage, {
                 csrfToken: e.csrfToken,
@@ -1519,9 +1519,9 @@ class He {
               });
             }
           );
-        } catch (i) {
-          const n = l.asCrossauthError(i);
-          return d.logger.error(c({ msg: "Update user failure", user: e.body.username, errorCodeName: n.codeName, errorCode: n.code })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, a) => r ? t.view(this.adminUpdateUserPage, {
+        } catch (t) {
+          const n = l.asCrossauthError(t);
+          return d.logger.error(c({ msg: "Update user failure", user: e.body.username, errorCodeName: n.codeName, errorCode: n.code })), d.logger.debug(c({ err: t })), this.sessionServer.handleError(t, e, o, (i, a) => r ? i.view(this.adminUpdateUserPage, {
             user: r,
             errorMessage: a.message,
             errorMessages: a.messages,
@@ -1532,7 +1532,7 @@ class He {
             allowedFactor2: this.sessionServer.allowedFactor2Details(),
             ...e.body
           }) : b.sendPageError(
-            t,
+            i,
             n.httpStatus,
             this.sessionServer.errorPage,
             n.message,
@@ -1562,28 +1562,28 @@ class He {
           if (!this.sessionServer.userStorage) throw new l(g.Configuration, "Cannot call deleteuser unless a user storage is provided");
           r = (await this.sessionServer.userStorage.getUserById(e.params.id)).user;
         } catch (n) {
-          const t = l.asCrossauthError(n);
-          return d.logger.debug(c({ err: n })), o.status(t.httpStatus).view(this.sessionServer.errorPage, {
-            errorMessage: t.message,
-            errorMessages: t.messages,
-            errorCode: t.code,
-            errorCodeName: g[t.code]
+          const i = l.asCrossauthError(n);
+          return d.logger.debug(c({ err: n })), o.status(i.httpStatus).view(this.sessionServer.errorPage, {
+            errorMessage: i.message,
+            errorMessages: i.messages,
+            errorCode: i.code,
+            errorCodeName: g[i.code]
           });
         }
         const s = e.query.next ?? this.adminPrefix + "selectuser";
-        let i = {
+        let t = {
           urlPrefix: this.adminPrefix,
           csrfToken: e.csrfToken,
           next: s,
           isAdmin: !0,
           user: r
         };
-        return o.view(this.deleteUserPage, i);
+        return o.view(this.deleteUserPage, t);
       }
     ), this.sessionServer.app.post(
       this.adminPrefix + "deleteuser/:id",
       async (e, o) => {
-        var s, i;
+        var s, t;
         d.logger.info(c({
           msg: "Page visit",
           method: "POST",
@@ -1606,12 +1606,12 @@ class He {
             })
           );
         } catch (n) {
-          const t = l.asCrossauthError(n);
+          const i = l.asCrossauthError(n);
           return d.logger.error(c({
             msg: "Failed deleting user",
-            user: (i = e.user) == null ? void 0 : i.username,
-            errorCodeName: t.codeName,
-            errorCode: t.code
+            user: (t = e.user) == null ? void 0 : t.username,
+            errorCodeName: i.codeName,
+            errorCode: i.code
           })), d.logger.debug(c({ err: n })), this.sessionServer.handleError(n, e, o, (a, h) => {
             const p = l.asCrossauthError(n).httpStatus;
             return a.status(p).view(this.deleteUserPage, {
@@ -1637,7 +1637,7 @@ class He {
     this.sessionServer.app.post(
       this.adminPrefix + "api/updateuser/:id",
       async (e, o) => {
-        var s, i;
+        var s, t;
         if (d.logger.info(c({
           msg: "API visit",
           method: "POST",
@@ -1654,18 +1654,18 @@ class He {
             r,
             e,
             o,
-            (t, a, h) => t.header(...R).send({
+            (i, a, h) => i.header(...R).send({
               ok: !0,
               emailVerificationRequired: h
             })
           );
         } catch (n) {
-          const t = l.asCrossauthError(n);
+          const i = l.asCrossauthError(n);
           return d.logger.error(c({
             msg: "Update user failure",
-            user: (i = e.user) == null ? void 0 : i.username,
-            errorCodeName: t.codeName,
-            errorCode: t.code
+            user: (t = e.user) == null ? void 0 : t.username,
+            errorCodeName: i.codeName,
+            errorCode: i.code
           })), d.logger.debug(c({ err: n })), this.sessionServer.handleError(n, e, o, (a, h) => {
             a.status(this.sessionServer.errorStatus(n)).header(...R).send({
               ok: !1,
@@ -1698,20 +1698,20 @@ class He {
           return this.accessDeniedPage(e, o);
         try {
           const { user: s } = await this.sessionServer.userStorage.getUserById(e.params.id);
-          let i = {
+          let t = {
             urlPrefix: this.adminPrefix,
             csrfToken: e.csrfToken,
             user: s
           };
-          return o.view(this.adminChangePasswordPage, i);
+          return o.view(this.adminChangePasswordPage, t);
         } catch (s) {
-          const i = l.asCrossauthError(s);
+          const t = l.asCrossauthError(s);
           return d.logger.error(c({ err: s })), b.sendPageError(
             o,
-            i.httpStatus,
+            t.httpStatus,
             this.sessionServer.errorPage,
-            i.message,
-            i
+            t.message,
+            t
           );
         }
       }
@@ -1729,12 +1729,12 @@ class He {
         let r;
         try {
           if (!this.sessionServer.userStorage) throw new l(g.Configuration, "Cannot call changepassword unless a user storage is provided");
-          const { user: i } = await this.sessionServer.userStorage.getUserById(e.params.id);
-          return r = i, await this.changePassword(
+          const { user: t } = await this.sessionServer.userStorage.getUserById(e.params.id);
+          return r = t, await this.changePassword(
             r,
             e,
             o,
-            (n, t) => e.body.next ? n.redirect(e.body.next) : n.view(this.adminChangePasswordPage, {
+            (n, i) => e.body.next ? n.redirect(e.body.next) : n.view(this.adminChangePasswordPage, {
               csrfToken: e.csrfToken,
               message: "User's password has been changed.",
               urlPrefix: this.adminPrefix,
@@ -1743,14 +1743,14 @@ class He {
               user: r
             })
           );
-        } catch (i) {
-          const n = l.asCrossauthError(i);
+        } catch (t) {
+          const n = l.asCrossauthError(t);
           return d.logger.error(c({
             msg: "Change password failure",
             userid: e.params.id,
             errorCodeName: n.codeName,
             errorCode: n.code
-          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, a) => t.view(this.adminChangePasswordPage, {
+          })), d.logger.debug(c({ err: t })), this.sessionServer.handleError(t, e, o, (i, a) => i.view(this.adminChangePasswordPage, {
             errorMessage: a.message,
             errorMessages: a.messages,
             errorCode: a.code,
@@ -1769,7 +1769,7 @@ class He {
     this.sessionServer.app.post(
       this.adminPrefix + "api/changepassword/:id",
       async (e, o) => {
-        var s, i;
+        var s, t;
         if (d.logger.info(c({
           msg: "API visit",
           method: "POST",
@@ -1786,17 +1786,17 @@ class He {
             r,
             e,
             o,
-            (t, a) => t.header(...R).send({
+            (i, a) => i.header(...R).send({
               ok: !0
             })
           );
         } catch (n) {
-          const t = l.asCrossauthError(n);
+          const i = l.asCrossauthError(n);
           return d.logger.error(c({
             msg: "Update user failure",
-            user: (i = e.user) == null ? void 0 : i.username,
-            errorCodeName: t.codeName,
-            errorCode: t.code
+            user: (t = e.user) == null ? void 0 : t.username,
+            errorCodeName: i.codeName,
+            errorCode: i.code
           })), d.logger.debug(c({ err: n })), this.sessionServer.handleError(n, e, o, (a, h) => {
             a.status(this.sessionServer.errorStatus(n)).header(...R).send({
               ok: !1,
@@ -1829,20 +1829,20 @@ class He {
           return await this.deleteUser(
             e,
             o,
-            (i) => i.header(...R).send({
+            (t) => t.header(...R).send({
               ok: !0,
               client_id: e.params.id
             })
           );
-        } catch (i) {
-          const n = l.asCrossauthError(i);
+        } catch (t) {
+          const n = l.asCrossauthError(t);
           d.logger.error(c({
             msg: "Delete user failure",
             user: (s = e.user) == null ? void 0 : s.username,
             errorCodeName: n.codeName,
             errorCode: n.code
-          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, a) => {
-            t.status(this.sessionServer.errorStatus(i)).header(...R).send({
+          })), d.logger.debug(c({ err: t })), this.sessionServer.handleError(t, e, o, (i, a) => {
+            i.status(this.sessionServer.errorStatus(t)).header(...R).send({
               ok: !1,
               errorMessage: a.message,
               errorMessages: a.messages,
@@ -1872,19 +1872,20 @@ class He {
       {
         ...this.sessionServer.userStorage.userEditableFields,
         ...this.sessionServer.userStorage.adminEditableFields
-      }
+      },
+      this.sessionServer.adminAllowedFactor1
     );
-    const i = this.sessionServer.authenticators[s.factor1].secretNames();
+    const t = this.sessionServer.authenticators[s.factor1].secretNames();
     let n = !0;
-    for (let v of i)
+    for (let v of t)
       !e.body[v] && !e.body["repeat_" + v] && (n = !1);
-    let t = [], a = {};
+    let i = [], a = {};
     if (n) {
-      t = this.sessionServer.authenticators[s.factor1].validateSecrets(e.body);
+      i = this.sessionServer.authenticators[s.factor1].validateSecrets(e.body);
       for (let v in e.body)
         if (v.startsWith("repeat_")) {
           const m = v.replace(/^repeat_/, "");
-          i.includes(m) && (a[m] = e.body[v]);
+          t.includes(m) && (a[m] = e.body[v]);
         }
       Object.keys(a).length === 0 && (a = void 0);
     }
@@ -1898,7 +1899,7 @@ class He {
       msg: `Setting state for user to ${O.passwordResetNeeded}`,
       username: s.username
     })));
-    let f = [...this.sessionServer.validateUserFn(s), ...t];
+    let f = [...this.sessionServer.validateUserFn(s), ...i];
     if (f.length > 0)
       throw new l(g.FormEntry, f);
     const p = await this.sessionServer.sessionManager.createUser(
@@ -1921,11 +1922,11 @@ class He {
   }
   async accessDeniedPage(e, o) {
     const r = new l(g.InsufficientPriviledges);
-    return this.sessionServer.handleError(r, e, o, (s, i) => s.status(r.httpStatus).view(this.sessionServer.errorPage, {
-      errorMessage: i.message,
-      errorMessages: i.messages,
-      errorCode: i.code,
-      errorCodeName: g[i.code]
+    return this.sessionServer.handleError(r, e, o, (s, t) => s.status(r.httpStatus).view(this.sessionServer.errorPage, {
+      errorMessage: t.message,
+      errorMessages: t.messages,
+      errorCode: t.code,
+      errorCodeName: g[t.code]
     }));
   }
   async updateUser(e, o, r, s) {
@@ -1933,7 +1934,7 @@ class He {
     if (!o.user || !b.isAdmin(o.user))
       throw new l(g.Unauthorized);
     if (this.sessionServer.isSessionUser(o) && !o.csrfToken) throw new l(g.InvalidCsrf);
-    const i = e.factor2, n = e.state;
+    const t = e.factor2, n = e.state;
     e.state = o.body.state, e = this.sessionServer.updateUserFn(
       e,
       o,
@@ -1942,10 +1943,10 @@ class He {
         ...this.sessionServer.userStorage.adminEditableFields
       }
     );
-    const t = e.factor2 && e.factor2 != "none" && e.factor2 != i;
-    if (t && !(e.state == n || e.state == "factor2ResetNeeded"))
+    const i = e.factor2 && e.factor2 != "none" && e.factor2 != t;
+    if (i && !(e.state == n || e.state == "factor2ResetNeeded"))
       throw new l(g.BadRequest, "Cannot change both factor2 and state at the same time");
-    t && (e.state = O.factor2ResetNeeded, d.logger.warn(c({
+    i && (e.state = O.factor2ResetNeeded, d.logger.warn(c({
       msg: `Setting state for user to ${O.factor2ResetNeeded}`,
       username: e.username
     })));
@@ -1964,22 +1965,22 @@ class He {
     if (!o.user || !b.isAdmin(o.user))
       throw new l(g.Unauthorized);
     if (this.sessionServer.isSessionUser(o) && !o.csrfToken) throw new l(g.InvalidCsrf);
-    const i = this.sessionServer.authenticators[e.factor1], n = i.secretNames();
-    let t = {}, a = {};
+    const t = this.sessionServer.authenticators[e.factor1], n = t.secretNames();
+    let i = {}, a = {};
     for (let f in o.body)
       if (f.startsWith("new_")) {
         const p = f.replace(/^new_/, "");
-        n.includes(p) && (t[p] = o.body[f]);
+        n.includes(p) && (i[p] = o.body[f]);
       } else if (f.startsWith("repeat_")) {
         const p = f.replace(/^repeat_/, "");
         n.includes(p) && (a[p] = o.body[f]);
       }
-    if (Object.keys(a).length === 0 && (a = void 0), i.validateSecrets(t).length > 0)
+    if (Object.keys(a).length === 0 && (a = void 0), t.validateSecrets(i).length > 0)
       throw new l(g.PasswordFormat);
     return e.state = "active", await this.sessionServer.userStorage.updateUser({ id: e.id, state: e.state }), await this.sessionServer.sessionManager.changeSecrets(
       e.username,
       1,
-      t,
+      i,
       a
     ), s(r, void 0);
   }
@@ -1998,15 +1999,15 @@ async function ve(S, e, o) {
     const s = await e.getClientById(S);
     r.push(s);
   } catch (s) {
-    const i = l.asCrossauthError(s);
-    if (i.code != g.UserNotExist)
-      throw d.logger.debug(c({ err: i })), i;
+    const t = l.asCrossauthError(s);
+    if (t.code != g.UserNotExist)
+      throw d.logger.debug(c({ err: t })), t;
     try {
       r = await e.getClientByName(S, o);
     } catch (n) {
-      const t = l.asCrossauthError(n);
-      if (t.code != g.UserNotExist)
-        throw d.logger.debug(c({ err: t })), i;
+      const i = l.asCrossauthError(n);
+      if (i.code != g.UserNotExist)
+        throw d.logger.debug(c({ err: i })), t;
     }
   }
   return r;
@@ -2049,42 +2050,42 @@ class Le {
           return this.accessDeniedPage(e, o);
         const r = e.query.next ?? encodeURIComponent(e.url);
         try {
-          let s = [], i = Number(e.query.skip), n = Number(e.query.take);
-          i || (i = 0), n || (n = 10);
-          let t = null, a;
+          let s = [], t = Number(e.query.skip), n = Number(e.query.take);
+          t || (t = 0), n || (n = 10);
+          let i = null, a;
           if (e.query.userid) {
             if (!this.sessionServer.userStorage) throw new l(g.Configuration, "Cannot call selectclient with user unless a user storage is provided");
-            a = (await this.sessionServer.userStorage.getUserById(e.query.userid)).user, t = a.id;
+            a = (await this.sessionServer.userStorage.getUserById(e.query.userid)).user, i = a.id;
           }
           e.query.search ? s = await this.clientSearchFn(
             e.query.search,
             this.clientStorage,
-            t
+            i
           ) : s = await this.clientStorage.getClients(
-            i,
+            t,
             n,
-            t
+            i
           );
           let h = {
             urlPrefix: this.adminPrefix,
             user: a,
-            skip: i,
+            skip: t,
             take: n,
             clients: s,
-            havePrevious: i > 0,
+            havePrevious: t > 0,
             haveNext: n != null && s.length == n,
             isAdmin: !0,
             next: r
           };
           return e.query.next && (h.next = e.query.next), o.view(this.selectClientPage, h);
         } catch (s) {
-          const i = l.asCrossauthError(s);
+          const t = l.asCrossauthError(s);
           return d.logger.error(c({ err: s })), b.sendPageError(
             o,
-            i.httpStatus,
+            t.httpStatus,
             this.sessionServer.errorPage,
-            i.message,
-            i
+            t.message,
+            t
           );
         }
       }
@@ -2113,15 +2114,15 @@ class Le {
             s = (await this.sessionServer.userStorage.getUserById(e.query.userid)).user;
           }
         } catch (n) {
-          const t = l.asCrossauthError(n);
-          return d.logger.debug(c({ err: n })), o.status(t.httpStatus).view(this.sessionServer.errorPage, {
-            errorMessage: t.message,
-            errorMessages: t.messages,
-            errorCode: t.code,
-            errorCodeName: g[t.code]
+          const i = l.asCrossauthError(n);
+          return d.logger.debug(c({ err: n })), o.status(i.httpStatus).view(this.sessionServer.errorPage, {
+            errorMessage: i.message,
+            errorMessages: i.messages,
+            errorCode: i.code,
+            errorCodeName: g[i.code]
           });
         }
-        let i = {
+        let t = {
           urlPrefix: this.adminPrefix,
           csrfToken: e.csrfToken,
           validFlows: this.validFlows,
@@ -2130,18 +2131,18 @@ class Le {
           isAdmin: !0,
           next: r
         };
-        return o.view(this.createClientPage, i);
+        return o.view(this.createClientPage, t);
       }
     ), this.sessionServer.app.post(
       this.adminPrefix + "createclient",
       async (e, o) => {
-        var i, n;
+        var t, n;
         d.logger.info(c({
           msg: "Page visit",
           method: "POST",
           url: this.adminPrefix + "createclient",
           ip: e.ip,
-          user: (i = e.user) == null ? void 0 : i.username
+          user: (t = e.user) == null ? void 0 : t.username
         }));
         let r = e.body.next;
         r || (e.body.userid ? r = this.adminPrefix + "selectuser" : r = this.adminPrefix + "selectclient");
@@ -2154,7 +2155,7 @@ class Le {
           return await this.createClient(
             e,
             o,
-            (t, a) => t.view(this.createClientPage, {
+            (i, a) => i.view(this.createClientPage, {
               message: "Created client",
               client: a,
               csrfToken: e.csrfToken,
@@ -2168,15 +2169,15 @@ class Le {
             }),
             s
           );
-        } catch (t) {
-          const a = l.asCrossauthError(t);
+        } catch (i) {
+          const a = l.asCrossauthError(i);
           return d.logger.error(c({
             msg: "Failed creating OAuth client",
             user: (n = e.user) == null ? void 0 : n.username,
             errorCodeName: a.codeName,
             errorCode: a.code
-          })), d.logger.debug(c({ err: t })), this.sessionServer.handleError(t, e, o, (h, f) => {
-            const v = l.asCrossauthError(t).httpStatus;
+          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (h, f) => {
+            const v = l.asCrossauthError(i).httpStatus;
             return h.status(v).view(this.createClientPage, {
               errorMessage: f.message,
               errorMessages: f.messages,
@@ -2223,11 +2224,11 @@ class Le {
         }
         let s = e.query.next;
         s || (e.query.userid ? s = this.adminPrefix + "selectuser" : s = this.adminPrefix + "selectclient");
-        let i;
+        let t;
         try {
           if (r.userid) {
             if (!this.sessionServer.userStorage) throw new l(g.Configuration, "Cannot call updateclient with user unless a user storage is provided");
-            i = (await this.sessionServer.userStorage.getUserById(r.userid)).user;
+            t = (await this.sessionServer.userStorage.getUserById(r.userid)).user;
           }
         } catch (a) {
           const h = l.asCrossauthError(a);
@@ -2241,13 +2242,13 @@ class Le {
         let n = {};
         for (let a of this.validFlows)
           r.valid_flow.includes(a) && (n[a] = !0);
-        let t = {
+        let i = {
           urlPrefix: this.adminPrefix,
           csrfToken: e.csrfToken,
           validFlows: this.validFlows,
           flowNames: E.flowNames(this.validFlows),
           selectedFlows: n,
-          user: i,
+          user: t,
           client_id: r.client_id,
           client_name: r.client_name,
           confidential: r.confidential,
@@ -2255,18 +2256,18 @@ class Le {
           isAdmin: !0,
           next: s
         };
-        return o.view(this.updateClientPage, t);
+        return o.view(this.updateClientPage, i);
       }
     ), this.sessionServer.app.post(
       this.adminPrefix + "updateclient/:client_id",
       async (e, o) => {
-        var i, n;
+        var t, n;
         d.logger.info(c({
           msg: "Page visit",
           method: "POST",
           url: this.adminPrefix + "updateclient",
           ip: e.ip,
-          user: (i = e.user) == null ? void 0 : i.username
+          user: (t = e.user) == null ? void 0 : t.username
         }));
         let r = e.body.next;
         r || (e.body.userid ? r = this.adminPrefix + "selectuser" : r = this.adminPrefix + "selectclient");
@@ -2279,7 +2280,7 @@ class Le {
           return await this.updateClient(
             e,
             o,
-            (t, a, h) => t.view(this.updateClientPage, {
+            (i, a, h) => i.view(this.updateClientPage, {
               message: "Updated client",
               client: a,
               csrfToken: e.csrfToken,
@@ -2293,15 +2294,15 @@ class Le {
               ...e.body
             })
           );
-        } catch (t) {
-          const a = l.asCrossauthError(t);
+        } catch (i) {
+          const a = l.asCrossauthError(i);
           return d.logger.error(c({
             msg: "Failed updating OAuth client",
             user: (n = e.user) == null ? void 0 : n.username,
             errorCodeName: a.codeName,
             errorCode: a.code
-          })), d.logger.debug(c({ err: t })), this.sessionServer.handleError(t, e, o, (h, f) => {
-            const v = l.asCrossauthError(t).httpStatus;
+          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (h, f) => {
+            const v = l.asCrossauthError(i).httpStatus;
             let m = {};
             for (let w of this.validFlows)
               w in e.body && (m[w] = !0);
@@ -2343,27 +2344,27 @@ class Le {
         try {
           r = await this.clientStorage.getClientById(e.params.client_id);
         } catch (n) {
-          const t = l.asCrossauthError(n);
-          return d.logger.debug(c({ err: n })), o.status(t.httpStatus).view(this.sessionServer.errorPage, {
-            errorMessage: t.message,
-            errorMessages: t.messages,
-            errorCode: t.code,
-            errorCodeName: g[t.code]
+          const i = l.asCrossauthError(n);
+          return d.logger.debug(c({ err: n })), o.status(i.httpStatus).view(this.sessionServer.errorPage, {
+            errorMessage: i.message,
+            errorMessages: i.messages,
+            errorCode: i.code,
+            errorCodeName: g[i.code]
           });
         }
         const s = e.query.next ?? this.adminPrefix + "selectclient";
-        let i = {
+        let t = {
           urlPrefix: this.adminPrefix,
           csrfToken: e.csrfToken,
           next: s,
           client: r
         };
-        return o.view(this.deleteClientPage, i);
+        return o.view(this.deleteClientPage, t);
       }
     ), this.sessionServer.app.post(
       this.adminPrefix + "deleteclient/:client_id",
       async (e, o) => {
-        var s, i;
+        var s, t;
         d.logger.info(c({
           msg: "Page visit",
           method: "POST",
@@ -2386,12 +2387,12 @@ class Le {
             })
           );
         } catch (n) {
-          const t = l.asCrossauthError(n);
+          const i = l.asCrossauthError(n);
           return d.logger.error(c({
             msg: "Failed deleting OAuth client",
-            user: (i = e.user) == null ? void 0 : i.username,
-            errorCodeName: t.codeName,
-            errorCode: t.code
+            user: (t = e.user) == null ? void 0 : t.username,
+            errorCodeName: i.codeName,
+            errorCode: i.code
           })), d.logger.debug(c({ err: n })), this.sessionServer.handleError(n, e, o, (a, h) => {
             const p = l.asCrossauthError(n).httpStatus;
             return a.status(p).view(this.deleteClientPage, {
@@ -2417,7 +2418,7 @@ class Le {
     this.sessionServer.app.post(
       this.adminPrefix + "api/createclient",
       async (e, o) => {
-        var s, i;
+        var s, t;
         d.logger.info(c({
           msg: "API visit",
           method: "POST",
@@ -2434,19 +2435,19 @@ class Le {
           return await this.createClient(
             e,
             o,
-            (n, t) => n.header(...B).send({
+            (n, i) => n.header(...B).send({
               ok: !0,
-              client: t
+              client: i
             }),
             r
           );
         } catch (n) {
-          const t = l.asCrossauthError(n);
+          const i = l.asCrossauthError(n);
           d.logger.error(c({
             msg: "Create client failure",
-            user: (i = e.user) == null ? void 0 : i.username,
-            errorCodeName: t.codeName,
-            errorCode: t.code
+            user: (t = e.user) == null ? void 0 : t.username,
+            errorCodeName: i.codeName,
+            errorCode: i.code
           })), d.logger.debug(c({ err: n })), this.sessionServer.handleError(n, e, o, (a, h) => {
             a.status(this.sessionServer.errorStatus(n)).header(...B).send({
               ok: !1,
@@ -2482,22 +2483,22 @@ class Le {
           return await this.updateClient(
             e,
             o,
-            (i, n, t) => i.header(...B).send({
+            (t, n, i) => t.header(...B).send({
               ok: !0,
               client: n,
               csrfToken: e.csrfToken,
-              newSecret: t
+              newSecret: i
             })
           );
-        } catch (i) {
-          const n = l.asCrossauthError(i);
+        } catch (t) {
+          const n = l.asCrossauthError(t);
           return d.logger.error(c({
             msg: "Failed updating OAuth client",
             user: (s = e.user) == null ? void 0 : s.username,
             errorCodeName: n.codeName,
             errorCode: n.code
-          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, a) => {
-            t.status(this.sessionServer.errorStatus(i)).header(...B).send({
+          })), d.logger.debug(c({ err: t })), this.sessionServer.handleError(t, e, o, (i, a) => {
+            i.status(this.sessionServer.errorStatus(t)).header(...B).send({
               ok: !1,
               errorMessage: a.message,
               errorMessages: a.messages,
@@ -2528,20 +2529,20 @@ class Le {
           return await this.deleteClient(
             e,
             o,
-            (i) => i.header(...B).send({
+            (t) => t.header(...B).send({
               ok: !0,
               client_id: e.params.client_id
             })
           );
-        } catch (i) {
-          const n = l.asCrossauthError(i);
+        } catch (t) {
+          const n = l.asCrossauthError(t);
           d.logger.error(c({
             msg: "Delete client failure",
             user: (s = e.user) == null ? void 0 : s.username,
             errorCodeName: n.codeName,
             errorCode: n.code
-          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, a) => {
-            t.status(this.sessionServer.errorStatus(i)).header(...B).send({
+          })), d.logger.debug(c({ err: t })), this.sessionServer.handleError(t, e, o, (i, a) => {
+            i.status(this.sessionServer.errorStatus(t)).header(...B).send({
               ok: !1,
               errorMessage: a.message,
               errorMessages: a.messages,
@@ -2556,11 +2557,11 @@ class Le {
   // Internal functions
   async accessDeniedPage(e, o) {
     const r = new l(g.InsufficientPriviledges);
-    return this.sessionServer.handleError(r, e, o, (s, i) => s.status(r.httpStatus).view(this.sessionServer.errorPage, {
-      errorMessage: i.message,
-      errorMessages: i.messages,
-      errorCode: i.code,
-      errorCodeName: g[i.code]
+    return this.sessionServer.handleError(r, e, o, (s, t) => s.status(r.httpStatus).view(this.sessionServer.errorPage, {
+      errorMessage: t.message,
+      errorMessages: t.messages,
+      errorCode: t.code,
+      errorCodeName: g[t.code]
     }));
   }
   async createClient(e, o, r, s) {
@@ -2568,9 +2569,9 @@ class Le {
       throw new l(g.InvalidCsrf);
     if (!e.user || !b.isAdmin(e.user))
       throw new l(g.InsufficientPriviledges);
-    const i = e.body.confidential == "true", n = e.body.client_name, t = e.body.redirect_uris.trim().length == 0 ? [] : e.body.redirect_uris.trim().split(/[, ][ \t\n]*/);
+    const t = e.body.confidential == "true", n = e.body.client_name, i = e.body.redirect_uris.trim().length == 0 ? [] : e.body.redirect_uris.trim().split(/[, ][ \t\n]*/);
     let a = [];
-    for (let p of t)
+    for (let p of i)
       try {
         L.validateUri(p);
       } catch (v) {
@@ -2586,9 +2587,9 @@ class Le {
       p in e.body && h.push(p);
     const f = await this.clientManager.createClient(
       n,
-      t,
-      h,
       i,
+      h,
+      t,
       s == null ? void 0 : s.id
     );
     return r(o, f);
@@ -2599,26 +2600,26 @@ class Le {
     if (!e.user || !b.isAdmin(e.user))
       throw new l(g.InsufficientPriviledges);
     const s = e.body.redirect_uris.trim().length == 0 ? [] : e.body.redirect_uris.trim().split(/[, ][ \t\n]*/);
-    let i = [];
+    let t = [];
     for (let p of s)
       try {
         L.validateUri(p);
       } catch (v) {
-        d.logger.error(c({ err: v })), i.push("[" + p + "]");
+        d.logger.error(c({ err: v })), t.push("[" + p + "]");
       }
-    if (i.length > 0)
+    if (t.length > 0)
       throw new l(
         g.BadRequest,
-        "The following redirect URIs are invalid: " + i.join(" ")
+        "The following redirect URIs are invalid: " + t.join(" ")
       );
     let n = [];
     for (let p of this.validFlows)
       p in e.body && n.push(p);
-    const t = {};
-    t.client_name = e.body.client_name, t.confidential = e.body.confidential == "true", t.valid_flow = n, t.redirect_uri = s, t.userid = e.body.userid, t.userid == null && (t.userid = null);
+    const i = {};
+    i.client_name = e.body.client_name, i.confidential = e.body.confidential == "true", i.valid_flow = n, i.redirect_uri = s, i.userid = e.body.userid, i.userid == null && (i.userid = null);
     const a = e.body.resetSecret == "true", { client: h, newSecret: f } = await this.clientManager.updateClient(
       e.params.client_id,
-      t,
+      i,
       a
     );
     return r(o, h, f);
@@ -2673,29 +2674,29 @@ class Ge {
         })), !(e != null && e.user))
           return o.redirect(this.sessionServer.loginUrl + "?next=" + this.prefix + "selectclient");
         try {
-          let r = [], s = Number(e.query.skip), i = Number(e.query.take);
-          s || (s = 0), i || (i = 10), e.query.search ? r = await this.clientSearchFn(
+          let r = [], s = Number(e.query.skip), t = Number(e.query.take);
+          s || (s = 0), t || (t = 10), e.query.search ? r = await this.clientSearchFn(
             e.query.search,
             this.clientStorage,
             e.user.id
           ) : r = await this.clientStorage.getClients(
             s,
-            i,
+            t,
             e.user.id
           );
           const n = e.query.next ?? encodeURIComponent(e.url);
-          let t = {
+          let i = {
             urlPrefix: this.prefix,
             user: e.user,
             skip: s,
-            take: i,
+            take: t,
             clients: r,
             havePrevious: s > 0,
-            haveNext: i != null && r.length == i,
+            haveNext: t != null && r.length == t,
             isAdmin: !1,
             next: n
           };
-          return e.query.next && (t.next = e.query.next), o.view(this.selectClientPage, t);
+          return e.query.next && (i.next = e.query.next), o.view(this.selectClientPage, i);
         } catch (r) {
           const s = l.asCrossauthError(r);
           return d.logger.error(c({ err: r })), b.sendPageError(
@@ -2738,7 +2739,7 @@ class Ge {
     ), this.sessionServer.app.post(
       this.prefix + "createclient",
       async (e, o) => {
-        var s, i;
+        var s, t;
         if (d.logger.info(c({
           msg: "Page visit",
           method: "POST",
@@ -2752,9 +2753,9 @@ class Ge {
           return await this.createClient(
             e,
             o,
-            (n, t) => n.view(this.createClientPage, {
+            (n, i) => n.view(this.createClientPage, {
               message: "Created client",
-              client: t,
+              client: i,
               csrfToken: e.csrfToken,
               urlPrefix: this.prefix,
               validFlows: this.validFlows,
@@ -2767,12 +2768,12 @@ class Ge {
             e.user
           );
         } catch (n) {
-          const t = l.asCrossauthError(n);
+          const i = l.asCrossauthError(n);
           return d.logger.error(c({
             msg: "Failed creating OAuth client",
-            user: (i = e.user) == null ? void 0 : i.username,
-            errorCodeName: t.codeName,
-            errorCode: t.code
+            user: (t = e.user) == null ? void 0 : t.username,
+            errorCodeName: i.codeName,
+            errorCode: i.code
           })), d.logger.debug(c({ err: n })), this.sessionServer.handleError(n, e, o, (a, h) => {
             const p = l.asCrossauthError(n).httpStatus;
             return a.status(p).view(this.createClientPage, {
@@ -2813,21 +2814,21 @@ class Ge {
           return await this.createClient(
             e,
             o,
-            (i, n) => i.header(...D).send({
+            (t, n) => t.header(...D).send({
               ok: !0,
               client: n
             }),
             e.user
           );
-        } catch (i) {
-          const n = l.asCrossauthError(i);
+        } catch (t) {
+          const n = l.asCrossauthError(t);
           d.logger.error(c({
             msg: "Create client failure",
             user: (s = e.user) == null ? void 0 : s.username,
             errorCodeName: n.codeName,
             errorCode: n.code
-          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, a) => {
-            t.status(this.sessionServer.errorStatus(i)).header(...D).send({
+          })), d.logger.debug(c({ err: t })), this.sessionServer.handleError(t, e, o, (i, a) => {
+            i.status(this.sessionServer.errorStatus(t)).header(...D).send({
               ok: !1,
               errorMessage: a.message,
               errorMessages: a.messages,
@@ -2867,9 +2868,9 @@ class Ge {
         }
         let s = e.query.next;
         s || (e.query.userid ? s = this.prefix + "selectuser" : s = this.prefix + "selectclient");
-        let i;
+        let t;
         try {
-          e.query.userid && (i = (await this.sessionServer.userStorage.getUserById(e.query.userid)).user);
+          e.query.userid && (t = (await this.sessionServer.userStorage.getUserById(e.query.userid)).user);
         } catch (a) {
           const h = l.asCrossauthError(a);
           return d.logger.debug(c({ err: a })), o.status(h.httpStatus).view(this.sessionServer.errorPage, {
@@ -2882,13 +2883,13 @@ class Ge {
         let n = {};
         for (let a of this.validFlows)
           r.valid_flow.includes(a) && (n[a] = !0);
-        let t = {
+        let i = {
           urlPrefix: this.prefix,
           csrfToken: e.csrfToken,
           validFlows: this.validFlows,
           flowNames: E.flowNames(this.validFlows),
           selectedFlows: n,
-          user: i,
+          user: t,
           client_id: r.client_id,
           client_name: r.client_name,
           confidential: r.confidential,
@@ -2896,19 +2897,19 @@ class Ge {
           isAdmin: !0,
           next: s
         };
-        return o.view(this.updateClientPage, t);
+        return o.view(this.updateClientPage, i);
       }
     ), this.sessionServer.app.post(
       this.prefix + "updateclient/:client_id",
       async (e, o) => {
-        var i, n;
+        var t, n;
         if (!this.sessionServer.userStorage) throw new l(g.Configuration, "Cannot call updateclient unless a user storage is provided ");
         d.logger.info(c({
           msg: "Page visit",
           method: "POST",
           url: this.prefix + "updateclient",
           ip: e.ip,
-          user: (i = e.user) == null ? void 0 : i.username
+          user: (t = e.user) == null ? void 0 : t.username
         }));
         let r = e.body.next;
         r || (r = this.prefix + "selectuser");
@@ -2918,7 +2919,7 @@ class Ge {
           return e.body.userid && (s = (await this.sessionServer.userStorage.getUserById(e.body.userid)).user), await this.updateClient(
             e,
             o,
-            (t, a, h) => t.view(this.updateClientPage, {
+            (i, a, h) => i.view(this.updateClientPage, {
               message: "Updated client",
               client: a,
               csrfToken: e.csrfToken,
@@ -2932,15 +2933,15 @@ class Ge {
               ...e.body
             })
           );
-        } catch (t) {
-          const a = l.asCrossauthError(t);
+        } catch (i) {
+          const a = l.asCrossauthError(i);
           return d.logger.error(c({
             msg: "Failed updating OAuth client",
             user: (n = e.user) == null ? void 0 : n.username,
             errorCodeName: a.codeName,
             errorCode: a.code
-          })), d.logger.debug(c({ err: t })), this.sessionServer.handleError(t, e, o, (h, f) => {
-            const v = l.asCrossauthError(t).httpStatus;
+          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (h, f) => {
+            const v = l.asCrossauthError(i).httpStatus;
             let m = {};
             for (let w of this.validFlows)
               w in e.body && (m[w] = !0);
@@ -2983,22 +2984,22 @@ class Ge {
           return e.body.userid && await this.sessionServer.userStorage.getUserById(e.body.userid), await this.updateClient(
             e,
             o,
-            (i, n, t) => i.header(...D).send({
+            (t, n, i) => t.header(...D).send({
               ok: !0,
               client: n,
               csrfToken: e.csrfToken,
-              newSecret: t
+              newSecret: i
             })
           );
-        } catch (i) {
-          const n = l.asCrossauthError(i);
+        } catch (t) {
+          const n = l.asCrossauthError(t);
           return d.logger.error(c({
             msg: "Failed updating OAuth client",
             user: (s = e.user) == null ? void 0 : s.username,
             errorCodeName: n.codeName,
             errorCode: n.code
-          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, a) => {
-            t.status(this.sessionServer.errorStatus(i)).header(...D).send({
+          })), d.logger.debug(c({ err: t })), this.sessionServer.handleError(t, e, o, (i, a) => {
+            i.status(this.sessionServer.errorStatus(t)).header(...D).send({
               ok: !1,
               errorMessage: a.message,
               errorMessages: a.messages,
@@ -3033,28 +3034,28 @@ class Ge {
               "You may not delete this client"
             );
         } catch (n) {
-          const t = l.asCrossauthError(n);
-          return d.logger.debug(c({ err: n })), o.status(t.httpStatus).view(this.sessionServer.errorPage, {
-            errorMessage: t.message,
-            errorMessages: t.messages,
-            errorCode: t.code,
-            errorCodeName: g[t.code]
+          const i = l.asCrossauthError(n);
+          return d.logger.debug(c({ err: n })), o.status(i.httpStatus).view(this.sessionServer.errorPage, {
+            errorMessage: i.message,
+            errorMessages: i.messages,
+            errorCode: i.code,
+            errorCodeName: g[i.code]
           });
         }
         const s = e.query.next ?? "/";
-        let i = {
+        let t = {
           urlPrefix: this.prefix,
           csrfToken: e.csrfToken,
           backUrl: this.prefix + "selectclient",
           client: r,
           next: s
         };
-        return o.view(this.deleteClientPage, i);
+        return o.view(this.deleteClientPage, t);
       }
     ), this.sessionServer.app.post(
       this.prefix + "deleteclient/:client_id",
       async (e, o) => {
-        var s, i;
+        var s, t;
         if (d.logger.info(c({
           msg: "Page visit",
           method: "POST",
@@ -3078,12 +3079,12 @@ class Ge {
             e.user
           );
         } catch (n) {
-          const t = l.asCrossauthError(n);
+          const i = l.asCrossauthError(n);
           return d.logger.error(c({
             msg: "Failed deleting OAuth client",
-            user: (i = e.user) == null ? void 0 : i.username,
-            errorCodeName: t.codeName,
-            errorCode: t.code
+            user: (t = e.user) == null ? void 0 : t.username,
+            errorCodeName: i.codeName,
+            errorCode: i.code
           })), d.logger.debug(c({ err: n })), this.sessionServer.handleError(n, e, o, (a, h) => {
             const p = l.asCrossauthError(n).httpStatus;
             return a.status(p).view(this.deleteClientPage, {
@@ -3122,21 +3123,21 @@ class Ge {
           return await this.deleteClient(
             e,
             o,
-            (i) => i.header(...D).send({
+            (t) => t.header(...D).send({
               ok: !0,
               client_id: e.params.client_id
             }),
             e.user
           );
-        } catch (i) {
-          const n = l.asCrossauthError(i);
+        } catch (t) {
+          const n = l.asCrossauthError(t);
           d.logger.error(c({
             msg: "Delete client failure",
             user: (s = e.user) == null ? void 0 : s.username,
             errorCodeName: n.codeName,
             errorCode: n.code
-          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, a) => {
-            t.status(this.sessionServer.errorStatus(i)).header(...D).send({
+          })), d.logger.debug(c({ err: t })), this.sessionServer.handleError(t, e, o, (i, a) => {
+            i.status(this.sessionServer.errorStatus(t)).header(...D).send({
               ok: !1,
               errorMessage: a.message,
               errorMessages: a.messages,
@@ -3154,9 +3155,9 @@ class Ge {
       throw new l(g.InvalidCsrf);
     if (!e.user)
       throw new l(g.InsufficientPriviledges);
-    const i = e.body.confidential == "true", n = e.body.client_name, t = e.body.redirect_uris.trim().length == 0 ? [] : e.body.redirect_uris.trim().split(/[, ][ \t\n]*/);
+    const t = e.body.confidential == "true", n = e.body.client_name, i = e.body.redirect_uris.trim().length == 0 ? [] : e.body.redirect_uris.trim().split(/[, ][ \t\n]*/);
     let a = [];
-    for (let p of t)
+    for (let p of i)
       try {
         L.validateUri(p);
       } catch (v) {
@@ -3171,9 +3172,9 @@ class Ge {
     e.body[E.AuthorizationCode] && h.push(E.AuthorizationCode), e.body[E.AuthorizationCodeWithPKCE] && h.push(E.AuthorizationCodeWithPKCE), e.body[E.ClientCredentials] && h.push(E.ClientCredentials), e.body[E.RefreshToken] && h.push(E.RefreshToken), e.body[E.DeviceCode] && h.push(E.DeviceCode), e.body[E.Password] && h.push(E.Password), e.body[E.PasswordMfa] && h.push(E.PasswordMfa), e.body[E.OidcAuthorizationCode] && h.push(E.OidcAuthorizationCode);
     const f = await this.clientManager.createClient(
       n,
-      t,
-      h,
       i,
+      h,
+      t,
       s == null ? void 0 : s.id
     );
     return r(o, f);
@@ -3184,26 +3185,26 @@ class Ge {
     if (!e.user)
       throw new l(g.InsufficientPriviledges);
     const s = e.body.redirect_uris.trim().length == 0 ? [] : e.body.redirect_uris.trim().split(/[, ][ \t\n]*/);
-    let i = [];
+    let t = [];
     for (let p of s)
       try {
         L.validateUri(p);
       } catch (v) {
-        d.logger.error(c({ err: v })), i.push("[" + p + "]");
+        d.logger.error(c({ err: v })), t.push("[" + p + "]");
       }
-    if (i.length > 0)
+    if (t.length > 0)
       throw new l(
         g.BadRequest,
-        "The following redirect URIs are invalid: " + i.join(" ")
+        "The following redirect URIs are invalid: " + t.join(" ")
       );
     let n = [];
     for (let p of this.validFlows)
       p in e.body && n.push(p);
-    const t = {};
-    t.client_name = e.body.client_name, t.confidential = e.body.confidential == "true", t.valid_flow = n, t.redirect_uri = s, t.userid = e.user.id;
+    const i = {};
+    i.client_name = e.body.client_name, i.confidential = e.body.confidential == "true", i.valid_flow = n, i.redirect_uri = s, i.userid = e.user.id;
     const a = e.body.resetSecret == "true", { client: h, newSecret: f } = await this.clientManager.updateClient(
       e.params.client_id,
-      t,
+      i,
       a
     );
     return r(o, h, f);
@@ -3327,23 +3328,23 @@ function Ve(S) {
   let e = [];
   return S.username == null ? e.push("Username must be given") : S.username.length < 2 ? e.push("Username must be at least 2 characters") : S.username.length > 254 && e.push("Username must be no longer than 254 characters"), e;
 }
-function We(S, e) {
-  let r = {
+function We(S, e, o) {
+  let s = {
     username: S.body.username,
     state: "active"
   };
-  const s = S.user && b.isAdmin(S.user);
-  for (let i in S.body) {
-    let n = i.replace(/^user_/, "");
-    i.startsWith("user_") && (s || e.includes(n)) && (r[n] = S.body[i]);
+  const t = S.user && b.isAdmin(S.user);
+  for (let n in S.body) {
+    let i = n.replace(/^user_/, "");
+    n.startsWith("user_") && (t || e.includes(i)) && (s[i] = S.body[n]);
   }
-  return r.factor1 = "localpassword", r.factor2 = S.body.factor2, r;
+  return s.factor1 = "localpassword", o.includes(s.factor1) && (s.factor1 = S.body.factor1), s.factor2 = S.body.factor2, s;
 }
 function Je(S, e, o) {
   const r = e.user && b.isAdmin(e.user);
   for (let s in e.body) {
-    let i = s.replace(/^user_/, "");
-    s.startsWith("user_") && (r || o.includes(i)) && (S[i] = e.body[s]);
+    let t = s.replace(/^user_/, "");
+    s.startsWith("user_") && (r || o.includes(t)) && (S[t] = e.body[s]);
   }
   return S;
 }
@@ -3460,24 +3461,26 @@ class Ke {
     ]);
     u(this, "editUserScope");
     u(this, "enableCsrfProtection", !0);
-    this.app = e, this.userEndpoints = new De(this, s), this.adminEndpoints = new He(this, s), C("prefix", k.String, this, s, "PREFIX"), this.prefix.endsWith("/") || (this.prefix += "/"), this.prefix.startsWith("/") || "" + this.prefix, this.loginUrl = this.prefix + "login", C("signupPage", k.String, this, s, "SIGNUP_PAGE"), C("loginPage", k.String, this, s, "LOGIN_PAGE"), C("factor2Page", k.String, this, s, "FACTOR2_PAGE"), C("configureFactor2Page", k.String, this, s, "SIGNUP_FACTOR2_PAGE"), C("errorPage", k.String, this, s, "ERROR_PAGE"), C("emailFrom", k.String, this, s, "EMAIL_FROM"), C("allowedFactor2", k.JsonArray, this, s, "ALLOWED_FACTOR2"), C("enableEmailVerification", k.Boolean, this, s, "ENABLE_EMAIL_VERIFICATION"), C("enablePasswordReset", k.Boolean, this, s, "ENABLE_PASSWORD_RESET"), C("factor2ProtectedPageEndpoints", k.JsonArray, this, s, "FACTOR2_PROTECTED_PAGE_ENDPOINTS"), C("factor2ProtectedApiEndpoints", k.JsonArray, this, s, "FACTOR2_PROTECTED_API_ENDPOINTS"), C("enableAdminEndpoints", k.Boolean, this, s, "ENABLE_ADMIN_ENDPOINTS"), C("enableOAuthClientManagement", k.Boolean, this, s, "ENABLE_OAUTH_CLIENT_MANAGEMENT"), C("editUserScope", k.String, this, s, "EDIT_USER_SCOPE"), s.validateUserFn && (this.validateUserFn = s.validateUserFn), s.createUserFn && (this.createUserFn = s.createUserFn), s.updateUserFn && (this.updateUserFn = s.updateUserFn), s.addToSession && (this.addToSession = s.addToSession), s.validateSession && (this.validateSession = s.validateSession), this.endpoints = [...he, ...le], this.endpoints = [...this.endpoints, ...re, ...ie], this.enableAdminEndpoints && (this.endpoints = [...this.endpoints, ...se, ...te]), this.enableOAuthClientManagement && (this.endpoints = [...this.endpoints, ...Z, ...ee, ...Q, ...q]), this.enableEmailVerification && (this.endpoints = [...this.endpoints, ...ae, ...ne]), this.enablePasswordReset && (this.endpoints = [...this.endpoints, ...de, ...ce]), s.endpoints && (C("endpoints", k.JsonArray, this, s, "SESSION_ENDPOINTS"), this.endpoints.length == 1 && this.endpoints[0] == "all" && (this.endpoints = je), this.endpoints.length == 1 && this.endpoints[0] == "allMinusOAuth" && (this.endpoints = Be)), this.allowedFactor2.length > 0 && (this.endpoints = [...this.endpoints, ...ge, ...oe]);
-    let i = !1;
-    for (let t of this.endpoints)
-      if (q.includes(t) || Q.includes(t)) {
-        i = !0;
+    u(this, "userAllowedFactor1", ["localpassword"]);
+    u(this, "adminAllowedFactor1", ["localpassword"]);
+    this.app = e, this.userEndpoints = new De(this, s), this.adminEndpoints = new He(this, s), C("prefix", k.String, this, s, "PREFIX"), this.prefix.endsWith("/") || (this.prefix += "/"), this.prefix.startsWith("/") || "" + this.prefix, this.loginUrl = this.prefix + "login", C("signupPage", k.String, this, s, "SIGNUP_PAGE"), C("loginPage", k.String, this, s, "LOGIN_PAGE"), C("factor2Page", k.String, this, s, "FACTOR2_PAGE"), C("configureFactor2Page", k.String, this, s, "SIGNUP_FACTOR2_PAGE"), C("errorPage", k.String, this, s, "ERROR_PAGE"), C("emailFrom", k.String, this, s, "EMAIL_FROM"), C("allowedFactor2", k.JsonArray, this, s, "ALLOWED_FACTOR2"), C("enableEmailVerification", k.Boolean, this, s, "ENABLE_EMAIL_VERIFICATION"), C("enablePasswordReset", k.Boolean, this, s, "ENABLE_PASSWORD_RESET"), C("factor2ProtectedPageEndpoints", k.JsonArray, this, s, "FACTOR2_PROTECTED_PAGE_ENDPOINTS"), C("factor2ProtectedApiEndpoints", k.JsonArray, this, s, "FACTOR2_PROTECTED_API_ENDPOINTS"), C("enableAdminEndpoints", k.Boolean, this, s, "ENABLE_ADMIN_ENDPOINTS"), C("enableOAuthClientManagement", k.Boolean, this, s, "ENABLE_OAUTH_CLIENT_MANAGEMENT"), C("editUserScope", k.String, this, s, "EDIT_USER_SCOPE"), C("userAllowedFactor1", k.JsonArray, this, s, "USER_ALLOWED_FACTOR1"), C("adminAllowedFactor1", k.JsonArray, this, s, "ADMIN_ALLOWED_FACTOR1"), s.validateUserFn && (this.validateUserFn = s.validateUserFn), s.createUserFn && (this.createUserFn = s.createUserFn), s.updateUserFn && (this.updateUserFn = s.updateUserFn), s.addToSession && (this.addToSession = s.addToSession), s.validateSession && (this.validateSession = s.validateSession), this.endpoints = [...he, ...le], this.endpoints = [...this.endpoints, ...re, ...ie], this.enableAdminEndpoints && (this.endpoints = [...this.endpoints, ...se, ...te]), this.enableOAuthClientManagement && (this.endpoints = [...this.endpoints, ...Z, ...ee, ...Q, ...q]), this.enableEmailVerification && (this.endpoints = [...this.endpoints, ...ae, ...ne]), this.enablePasswordReset && (this.endpoints = [...this.endpoints, ...de, ...ce]), s.endpoints && (C("endpoints", k.JsonArray, this, s, "SESSION_ENDPOINTS"), this.endpoints.length == 1 && this.endpoints[0] == "all" && (this.endpoints = je), this.endpoints.length == 1 && this.endpoints[0] == "allMinusOAuth" && (this.endpoints = Be)), this.allowedFactor2.length > 0 && (this.endpoints = [...this.endpoints, ...ge, ...oe]);
+    let t = !1;
+    for (let i of this.endpoints)
+      if (q.includes(i) || Q.includes(i)) {
+        t = !0;
         break;
       }
-    i && (this.adminClientEndpoints = new Le(this, s));
+    t && (this.adminClientEndpoints = new Le(this, s));
     let n = !1;
-    for (let t of this.endpoints)
-      if (ee.includes(t) || Z.includes(t)) {
+    for (let i of this.endpoints)
+      if (ee.includes(i) || Z.includes(i)) {
         n = !0;
         break;
       }
-    n && (this.userClientEndpoints = new Ge(this, s)), this.addEndpoints(), C("endpoints", k.JsonArray, this, s, "ENDPOINTS"), s.userStorage && (this.userStorage = s.userStorage), this.authenticators = r, this.sessionManager = new Ae(o, r, s), e.addHook("preHandler", async (t, a) => {
+    n && (this.userClientEndpoints = new Ge(this, s)), this.addEndpoints(), C("endpoints", k.JsonArray, this, s, "ENDPOINTS"), s.userStorage && (this.userStorage = s.userStorage), this.authenticators = r, this.sessionManager = new Ae(o, r, s), e.addHook("preHandler", async (i, a) => {
       var v, m;
       d.logger.debug(c({ msg: "Getting session cookie" }));
-      let h = this.getSessionCookieValue(t), f = {};
+      let h = this.getSessionCookieValue(i), f = {};
       if (h)
         try {
           f.hashedSessionId = F.hash(this.sessionManager.getSessionId(h));
@@ -3487,68 +3490,68 @@ class Ke {
       d.logger.debug(c({ msg: "Getting csrf cookie" }));
       let p;
       try {
-        p = this.getCsrfCookieValue(t), p && this.sessionManager.validateCsrfCookie(p);
+        p = this.getCsrfCookieValue(i), p && this.sessionManager.validateCsrfCookie(p);
       } catch (w) {
-        d.logger.warn(c({ msg: "Invalid csrf cookie received", cerr: w, hashedCsrfCookie: this.getHashOfCsrfCookie(t) })), a.clearCookie(this.sessionManager.csrfCookieName), p = void 0;
+        d.logger.warn(c({ msg: "Invalid csrf cookie received", cerr: w, hashedCsrfCookie: this.getHashOfCsrfCookie(i) })), a.clearCookie(this.sessionManager.csrfCookieName), p = void 0;
       }
-      if (["GET", "OPTIONS", "HEAD"].includes(t.method))
+      if (["GET", "OPTIONS", "HEAD"].includes(i.method))
         try {
           if (p) {
             d.logger.debug(c({ msg: "Valid CSRF cookie - creating token" }));
             const w = await this.sessionManager.createCsrfFormOrHeaderValue(p);
-            t.csrfToken = w;
+            i.csrfToken = w;
           } else {
             d.logger.debug(c({ msg: "Invalid CSRF cookie - recreating" }));
             const { csrfCookie: w, csrfFormOrHeaderValue: P } = await this.sessionManager.createCsrfToken();
-            a.setCookie(w.name, w.value, w.options), t.csrfToken = P;
+            a.setCookie(w.name, w.value, w.options), i.csrfToken = P;
           }
-          a.header(this.sessionManager.csrfHeaderName, t.csrfToken);
+          a.header(this.sessionManager.csrfHeaderName, i.csrfToken);
         } catch (w) {
           d.logger.error(c({
             msg: "Couldn't create CSRF token",
             cerr: w,
-            user: (v = t.user) == null ? void 0 : v.username,
+            user: (v = i.user) == null ? void 0 : v.username,
             ...f
           })), d.logger.debug(c({ err: w })), a.clearCookie(this.sessionManager.csrfCookieName);
         }
       else if (p)
         try {
-          this.csrfToken(t, a);
+          this.csrfToken(i, a);
         } catch (w) {
           d.logger.error(c({
             msg: "Couldn't create CSRF token",
             cerr: w,
-            user: (m = t.user) == null ? void 0 : m.username,
+            user: (m = i.user) == null ? void 0 : m.username,
             ...f
           })), d.logger.debug(c({ err: w }));
         }
-      if (h = this.getSessionCookieValue(t), h)
+      if (h = this.getSessionCookieValue(i), h)
         try {
           const w = this.sessionManager.getSessionId(h);
           let { key: P, user: T } = await this.sessionManager.userForSessionId(w);
           this.validateSession && this.validateSession(
             P,
             T,
-            t
-          ), t.sessionId = w, t.user = T, t.authType = "cookie", d.logger.debug(c({
+            i
+          ), i.sessionId = w, i.user = T, i.authType = "cookie", d.logger.debug(c({
             msg: "Valid session id",
             user: T == null ? void 0 : T.username
           }));
         } catch {
           d.logger.warn(c({
             msg: "Invalid session cookie received",
-            hashOfSessionId: this.getHashOfSessionId(t)
+            hashOfSessionId: this.getHashOfSessionId(i)
           })), a.clearCookie(this.sessionManager.sessionCookieName);
         }
     }), e.addHook(
       "preHandler",
-      async (t, a) => {
+      async (i, a) => {
         var f, p, v;
-        const h = this.getSessionCookieValue(t);
-        if (h && ((f = t.user) != null && f.factor2) && (this.factor2ProtectedPageEndpoints.includes(t.url) || this.factor2ProtectedApiEndpoints.includes(t.url))) {
+        const h = this.getSessionCookieValue(i);
+        if (h && ((f = i.user) != null && f.factor2) && (this.factor2ProtectedPageEndpoints.includes(i.url) || this.factor2ProtectedApiEndpoints.includes(i.url))) {
           const m = this.sessionManager.getSessionId(h);
-          if (["GET", "OPTIONS", "HEAD"].includes(t.method)) {
-            const w = this.getSessionCookieValue(t);
+          if (["GET", "OPTIONS", "HEAD"].includes(i.method)) {
+            const w = this.getSessionCookieValue(i);
             if (w) {
               const P = this.sessionManager.getSessionId(w);
               if ("pre2fa" in await this.sessionManager.dataForSessionId(P)) {
@@ -3556,7 +3559,7 @@ class Ke {
                 try {
                   await this.sessionManager.cancelTwoFactorPageVisit(P);
                 } catch (N) {
-                  d.logger.debug(c({ err: N })), d.logger.error(c({ msg: "Failed cancelling 2FA", cerr: N, user: (v = t.user) == null ? void 0 : v.username, hashOfSessionId: this.getHashOfSessionId(t) }));
+                  d.logger.debug(c({ err: N })), d.logger.error(c({ msg: "Failed cancelling 2FA", cerr: N, user: (v = i.user) == null ? void 0 : v.username, hashOfSessionId: this.getHashOfSessionId(i) }));
                 }
               }
             }
@@ -3566,8 +3569,8 @@ class Ke {
               d.logger.debug("Completing 2FA");
               const T = [...this.authenticators[w.pre2fa.factor2].transientSecretNames()];
               let N = {};
-              for (let M in t.body)
-                T.includes(M) && (N[M] = t.body[M]);
+              for (let M in i.body)
+                T.includes(M) && (N[M] = i.body[M]);
               let y;
               try {
                 await this.sessionManager.completeTwoFactorPageVisit(N, m);
@@ -3577,28 +3580,28 @@ class Ke {
                 d.logger.error(c({
                   msg: y.message,
                   cerr: M,
-                  user: t.body.username,
+                  user: i.body.username,
                   errorCode: I.code,
                   errorCodeName: I.codeName
                 }));
               }
-              if (t.body = w.pre2fa.body, y)
+              if (i.body = w.pre2fa.body, y)
                 if (y.code == g.Expired) {
                   d.logger.debug("Error - cancelling 2FA");
                   try {
                     await this.sessionManager.cancelTwoFactorPageVisit(m);
                   } catch (M) {
-                    d.logger.error(c({ msg: "Failed cancelling 2FA", cerr: M, user: (p = t.user) == null ? void 0 : p.username, hashOfSessionId: this.getHashOfSessionId(t) })), d.logger.debug(c({ err: M }));
+                    d.logger.error(c({ msg: "Failed cancelling 2FA", cerr: M, user: (p = i.user) == null ? void 0 : p.username, hashOfSessionId: this.getHashOfSessionId(i) })), d.logger.debug(c({ err: M }));
                   }
-                  t.body = {
-                    ...t.body,
+                  i.body = {
+                    ...i.body,
                     errorMessage: y.message,
                     errorMessages: y.message,
                     errorCode: "" + y.code,
                     errorCodeName: g[y.code]
                   };
                 } else
-                  return this.factor2ProtectedPageEndpoints.includes(t.url) ? a.redirect(this.prefix + "factor2?error=" + g[y.code]) : a.status(y.httpStatus).send(JSON.stringify({
+                  return this.factor2ProtectedPageEndpoints.includes(i.url) ? a.redirect(this.prefix + "factor2?error=" + g[y.code]) : a.status(y.httpStatus).send(JSON.stringify({
                     ok: !1,
                     errorMessage: y.message,
                     errorMessages: y.messages,
@@ -3606,7 +3609,7 @@ class Ke {
                     errorCodeName: g[y.code]
                   }));
             } else
-              return this.validateCsrfToken(t), d.logger.debug("Starting 2FA"), this.sessionManager.initiateTwoFactorPageVisit(t.user, m, t.body, t.url.replace(/\?.*$/, "")), this.factor2ProtectedPageEndpoints.includes(t.url) ? a.redirect(this.prefix + "factor2") : a.send(JSON.stringify({
+              return this.validateCsrfToken(i), d.logger.debug("Starting 2FA"), this.sessionManager.initiateTwoFactorPageVisit(i.user, m, i.body, i.url.replace(/\?.*$/, "")), this.factor2ProtectedPageEndpoints.includes(i.url) ? a.redirect(this.prefix + "factor2") : a.send(JSON.stringify({
                 ok: !0,
                 factor2Required: !0
               }));
@@ -3673,13 +3676,13 @@ class Ke {
           return await this.login(
             e,
             o,
-            (s, i) => {
-              if (i.state == O.passwordChangeNeeded) {
+            (s, t) => {
+              if (t.state == O.passwordChangeNeeded) {
                 if (this.endpoints.includes("changepassword"))
                   return d.logger.debug(c({ msg: "Password change needed - sending redirect" })), s.redirect("/changepassword?required=true&next=" + encodeURIComponent("login?next=" + r));
                 {
                   const n = new l(g.PasswordChangeNeeded);
-                  return this.handleError(n, e, s, (t, a) => t.view(this.loginPage, {
+                  return this.handleError(n, e, s, (i, a) => i.view(this.loginPage, {
                     errorMessage: a.message,
                     errorMessages: a.messages,
                     errorCode: a.code,
@@ -3691,10 +3694,10 @@ class Ke {
                     urlPrefix: this.prefix
                   }));
                 }
-              } else if (i.state == O.passwordResetNeeded || i.state == O.passwordAndFactor2ResetNeeded) {
+              } else if (t.state == O.passwordResetNeeded || t.state == O.passwordAndFactor2ResetNeeded) {
                 d.logger.debug(c({ msg: "Password reset needed - sending error" }));
                 const n = new l(g.PasswordResetNeeded);
-                return this.handleError(n, e, s, (t, a) => t.view(this.loginPage, {
+                return this.handleError(n, e, s, (i, a) => i.view(this.loginPage, {
                   errorMessage: a.message,
                   errorMessages: a.messages,
                   errorCode: a.code,
@@ -3705,15 +3708,15 @@ class Ke {
                   csrfToken: e.csrfToken,
                   urlPrefix: this.prefix
                 }));
-              } else if (this.allowedFactor2.length > 0 && (i.state == O.factor2ResetNeeded || !this.allowedFactor2.includes(i.factor2 ? i.factor2 : "none"))) {
+              } else if (this.allowedFactor2.length > 0 && (t.state == O.factor2ResetNeeded || !this.allowedFactor2.includes(t.factor2 ? t.factor2 : "none"))) {
                 if (d.logger.debug(c({
-                  msg: `Factor2 reset needed.  Factor2 is ${i.factor2}, state is ${i.state}, allowed factor2 is [${this.allowedFactor2.join(", ")}]`,
-                  username: i.username
+                  msg: `Factor2 reset needed.  Factor2 is ${t.factor2}, state is ${t.state}, allowed factor2 is [${this.allowedFactor2.join(", ")}]`,
+                  username: t.username
                 })), this.endpoints.includes("changefactor2"))
                   return d.logger.debug(c({ msg: "Factor 2 reset needed - sending redirect" })), s.redirect("/changefactor2?required=true&next=" + encodeURIComponent("login?next=" + r));
                 {
                   const n = new l(g.Factor2ResetNeeded);
-                  return this.handleError(n, e, s, (t, a) => t.view(this.loginPage, {
+                  return this.handleError(n, e, s, (i, a) => i.view(this.loginPage, {
                     errorMessage: a.message,
                     errorMessages: a.messages,
                     errorCode: a.code,
@@ -3726,7 +3729,7 @@ class Ke {
                   }));
                 }
               } else {
-                if (!i.factor2 || i.factor2.length == 0)
+                if (!t.factor2 || t.factor2.length == 0)
                   return d.logger.debug(c({ msg: "Successful login - sending redirect" })), s.redirect(r);
                 {
                   let n = {
@@ -3734,7 +3737,7 @@ class Ke {
                     next: e.body.next ?? this.loginRedirect,
                     persist: e.body.persist ? "on" : "",
                     urlPrefix: this.prefix,
-                    factor2: i.factor2,
+                    factor2: t.factor2,
                     action: "loginfactor2"
                   };
                   return s.view(this.factor2Page, n);
@@ -3743,7 +3746,7 @@ class Ke {
             }
           );
         } catch (s) {
-          return d.logger.debug(c({ err: s })), this.handleError(s, e, o, (i, n) => i.view(this.loginPage, {
+          return d.logger.debug(c({ err: s })), this.handleError(s, e, o, (t, n) => t.view(this.loginPage, {
             errorMessage: n.message,
             errorMessages: n.messages,
             errorCode: n.code,
@@ -3768,33 +3771,33 @@ class Ke {
           return d.logger.debug(c({ msg: "Next page " + r })), await this.loginFactor2(
             e,
             o,
-            (s, i) => (d.logger.debug(c({ msg: "Successful login - sending redirect to" })), s.redirect(r))
+            (s, t) => (d.logger.debug(c({ msg: "Successful login - sending redirect to" })), s.redirect(r))
           );
         } catch (s) {
           d.logger.debug(c({ err: s }));
-          let i;
+          let t;
           try {
             const n = e.sessionId ? await this.sessionManager.dataForSessionId(e.sessionId) : void 0;
-            i = n == null ? void 0 : n.factor2;
+            t = n == null ? void 0 : n.factor2;
           } catch (n) {
             d.logger.error(c({ err: n }));
           }
-          return i && i in this.authenticators ? this.handleError(s, e, o, (n, t) => n.view(this.factor2Page, {
-            errorMessage: t.message,
-            errorMessages: t.messages,
-            errorCode: t.code,
-            errorCodeName: g[t.code],
+          return t && t in this.authenticators ? this.handleError(s, e, o, (n, i) => n.view(this.factor2Page, {
+            errorMessage: i.message,
+            errorMessages: i.messages,
+            errorCode: i.code,
+            errorCodeName: g[i.code],
             next: e.body.next,
             persist: e.body.persist ? "on" : "",
             csrfToken: e.csrfToken,
             urlPrefix: this.prefix,
-            factor2: i,
+            factor2: t,
             action: "loginfactor2"
-          })) : this.handleError(s, e, o, (n, t) => n.view(this.loginPage, {
-            errorMessage: t.message,
-            errorMessages: t.messages,
-            errorCode: t.code,
-            errorCodeName: g[t.code],
+          })) : this.handleError(s, e, o, (n, i) => n.view(this.loginPage, {
+            errorMessage: i.message,
+            errorMessages: i.messages,
+            errorCode: i.code,
+            errorCodeName: g[i.code],
             next: e.body.next,
             persist: e.body.persist ? "on" : "",
             csrfToken: e.csrfToken,
@@ -3817,17 +3820,17 @@ class Ke {
           g.Unauthorized,
           "No session cookie present"
         );
-        const r = this.getSessionCookieValue(e), s = this.sessionManager.getSessionId(r ?? ""), i = await this.sessionManager.dataForSessionId(s);
-        if (!(i != null && i.pre2fa)) throw new l(
+        const r = this.getSessionCookieValue(e), s = this.sessionManager.getSessionId(r ?? ""), t = await this.sessionManager.dataForSessionId(s);
+        if (!(t != null && t.pre2fa)) throw new l(
           g.Unauthorized,
           "2FA not initiated"
         );
         let n = {
           urlPrefix: this.prefix,
           csrfToken: e.csrfToken,
-          action: i.pre2fa.url,
+          action: t.pre2fa.url,
           errorCodeName: e.query.error,
-          factor2: i.pre2fa.factor2
+          factor2: t.pre2fa.factor2
         };
         return o.view(this.factor2Page, n);
       }
@@ -3865,39 +3868,39 @@ class Ke {
           return d.logger.debug(c({ msg: "Next page " + r })), await this.signup(
             e,
             o,
-            (s, i, n) => {
+            (s, t, n) => {
               var a, h;
-              const t = (a = i == null ? void 0 : i.userData) != null && a.factor2 ? this.authenticators[i.userData.factor2] : void 0;
-              return (h = i.userData) != null && h.factor2 ? s.view(this.configureFactor2Page, {
-                csrfToken: i.csrfToken,
-                ...i.userData
-              }) : this.enableEmailVerification && (t == null || t.skipEmailVerificationOnSignup() != !0) ? s.view(this.signupPage, {
+              const i = (a = t == null ? void 0 : t.userData) != null && a.factor2 ? this.authenticators[t.userData.factor2] : void 0;
+              return (h = t.userData) != null && h.factor2 ? s.view(this.configureFactor2Page, {
+                csrfToken: t.csrfToken,
+                ...t.userData
+              }) : this.enableEmailVerification && (i == null || i.skipEmailVerificationOnSignup() != !0) ? s.view(this.signupPage, {
                 next: r,
                 csrfToken: e.csrfToken,
                 message: "Please check your email to finish signing up.",
                 allowedFactor2: this.allowedFactor2Details(),
                 urlPrefix: this.prefix,
                 factor2: e.body.factor2,
-                ...i.userData
+                ...t.userData
               }) : s.redirect(this.loginRedirect);
             }
           );
         } catch (s) {
-          const i = l.asCrossauthError(s);
+          const t = l.asCrossauthError(s);
           return d.logger.error(c({
             msg: "Signup failure",
             user: e.body.username,
-            errorCodeName: i.codeName,
-            errorCode: i.code
-          })), d.logger.debug(c({ err: s })), this.handleError(s, e, o, (n, t) => {
+            errorCodeName: t.codeName,
+            errorCode: t.code
+          })), d.logger.debug(c({ err: s })), this.handleError(s, e, o, (n, i) => {
             let a = {};
             for (let h in e.body)
               h.startsWith("user_") && (a[h] = e.body[h]);
             return n.view(this.signupPage, {
-              errorMessage: t.message,
-              errorMessages: t.messages,
-              errorCode: t.code,
-              errorCodeName: g[t.code],
+              errorMessage: i.message,
+              errorMessages: i.messages,
+              errorCode: i.code,
+              errorCodeName: g[i.code],
               next: r,
               persist: e.body.persist,
               username: e.body.username,
@@ -3928,16 +3931,16 @@ class Ke {
           return await this.logout(
             e,
             o,
-            (i) => i.redirect(e.body.next ? e.body.next : this.logoutRedirect)
+            (t) => t.redirect(e.body.next ? e.body.next : this.logoutRedirect)
           );
-        } catch (i) {
-          const n = l.asCrossauthError(i);
+        } catch (t) {
+          const n = l.asCrossauthError(t);
           return d.logger.error(c({
             msg: "Logout failure",
             user: (s = e.user) == null ? void 0 : s.username,
             errorCodeName: n.codeName,
             errorCode: n.code
-          })), d.logger.debug(c({ err: i })), this.handleError(i, e, o, (t, a) => t.view(this.errorPage, {
+          })), d.logger.debug(c({ err: t })), this.handleError(t, e, o, (i, a) => i.view(this.errorPage, {
             urlPrefix: this.prefix,
             errorMessage: a.message,
             errorMessages: a.messages,
@@ -3966,36 +3969,36 @@ class Ke {
             o,
             (r, s) => {
               if (s.state == O.passwordChangeNeeded) {
-                const i = new l(g.PasswordChangeNeeded);
-                return this.handleError(i, e, r, (n, t) => {
-                  n.status(this.errorStatus(i)).header(...A).send({
+                const t = new l(g.PasswordChangeNeeded);
+                return this.handleError(t, e, r, (n, i) => {
+                  n.status(this.errorStatus(t)).header(...A).send({
                     ok: !1,
-                    errorMessage: t.message,
-                    errorMessages: t.messages,
-                    errorCode: t.code,
-                    errorCodeName: g[t.code]
+                    errorMessage: i.message,
+                    errorMessages: i.messages,
+                    errorCode: i.code,
+                    errorCodeName: g[i.code]
                   });
                 });
               } else if (s.state == O.passwordResetNeeded || s.state == O.passwordAndFactor2ResetNeeded) {
-                const i = new l(g.PasswordResetNeeded);
-                return this.handleError(i, e, r, (n, t) => {
-                  n.status(this.errorStatus(i)).header(...A).send({
+                const t = new l(g.PasswordResetNeeded);
+                return this.handleError(t, e, r, (n, i) => {
+                  n.status(this.errorStatus(t)).header(...A).send({
                     ok: !1,
-                    errorMessage: t.message,
-                    errorMessages: t.messages,
-                    errorCode: t.code,
-                    errorCodeName: g[t.code]
+                    errorMessage: i.message,
+                    errorMessages: i.messages,
+                    errorCode: i.code,
+                    errorCodeName: g[i.code]
                   });
                 });
               } else if (this.allowedFactor2.length > 0 && (s.state == O.factor2ResetNeeded || !this.allowedFactor2.includes(s.factor2 ? s.factor2 : "none"))) {
-                const i = new l(g.Factor2ResetNeeded);
-                return this.handleError(i, e, r, (n, t) => {
-                  n.status(this.errorStatus(i)).header(...A).send({
+                const t = new l(g.Factor2ResetNeeded);
+                return this.handleError(t, e, r, (n, i) => {
+                  n.status(this.errorStatus(t)).header(...A).send({
                     ok: !1,
-                    errorMessage: t.message,
-                    errorMessages: t.messages,
-                    errorCode: t.code,
-                    errorCodeName: g[t.code]
+                    errorMessage: i.message,
+                    errorMessages: i.messages,
+                    errorCode: i.code,
+                    errorCodeName: g[i.code]
                   });
                 });
               } else return s.twoFactorRequired ? r.header(...A).send({ ok: !0, twoFactorRequired: !0 }) : r.header(...A).send({ ok: !0, user: s });
@@ -4008,8 +4011,8 @@ class Ke {
             user: e.body.username,
             errorCodeName: s.codeName,
             errorCode: s.code
-          })), d.logger.debug(c({ err: r })), this.handleError(r, e, o, (i, n) => {
-            i.status(this.errorStatus(r)).header(...A).send({
+          })), d.logger.debug(c({ err: r })), this.handleError(r, e, o, (t, n) => {
+            t.status(this.errorStatus(r)).header(...A).send({
               ok: !1,
               errorMessage: n.message,
               errorMessages: n.messages,
@@ -4038,14 +4041,14 @@ class Ke {
             (r) => r.header(...A).send({ ok: !0 })
           );
         } catch (r) {
-          const i = e.user || "", n = l.asCrossauthError(r);
+          const t = e.user || "", n = l.asCrossauthError(r);
           return d.logger.error(c({
             msg: "Login failure",
-            user: i,
+            user: t,
             errorCodeName: n.codeName,
             errorCode: n.code
-          })), d.logger.debug(c({ err: r })), this.handleError(r, e, o, (t, a) => {
-            t.status(this.errorStatus(r)).header(...A).send({
+          })), d.logger.debug(c({ err: r })), this.handleError(r, e, o, (i, a) => {
+            i.status(this.errorStatus(r)).header(...A).send({
               ok: !1,
               errorMessage: a.message,
               errorMessages: a.messages,
@@ -4080,7 +4083,7 @@ class Ke {
             hashOfSessionId: this.getHashOfSessionId(e),
             errorCodeName: s.codeName,
             errorCode: s.code
-          })), d.logger.debug(c({ err: r })), this.handleError(r, e, o, (i, n) => i.status(this.errorStatus(r)).header(...A).send({
+          })), d.logger.debug(c({ err: r })), this.handleError(r, e, o, (t, n) => t.status(this.errorStatus(r)).header(...A).send({
             ok: !1,
             errorMessage: n.message,
             errorMessages: n.messages,
@@ -4111,17 +4114,17 @@ class Ke {
           return await this.logout(
             e,
             o,
-            (i) => i.header(...A).send({ ok: !0 })
+            (t) => t.header(...A).send({ ok: !0 })
           );
-        } catch (i) {
-          const n = l.asCrossauthError(i);
+        } catch (t) {
+          const n = l.asCrossauthError(t);
           return d.logger.error(c({
             msg: "Logout failure",
             user: (s = e.user) == null ? void 0 : s.username,
             errorCodeName: n.codeName,
             errorCode: n.code
-          })), d.logger.debug(c({ err: i })), this.handleError(i, e, o, (t, a) => {
-            t.status(this.errorStatus(i)).header(...A).send({
+          })), d.logger.debug(c({ err: t })), this.handleError(t, e, o, (i, a) => {
+            i.status(this.errorStatus(t)).header(...A).send({
               ok: !1,
               errorMessage: a.message,
               errorMessages: a.messages,
@@ -4148,26 +4151,26 @@ class Ke {
           return await this.signup(
             e,
             o,
-            (s, i, n) => s.header(...A).send({
+            (s, t, n) => s.header(...A).send({
               ok: !0,
               user: n,
               emailVerificationNeeded: this.enableEmailVerification ?? !1,
-              ...i.userData
+              ...t.userData
             })
           );
         } catch (s) {
-          const i = l.asCrossauthError(s);
+          const t = l.asCrossauthError(s);
           d.logger.error(c({
             msg: "Signup failure",
             user: (r = e.user) == null ? void 0 : r.username,
-            errorCodeName: i.codeName,
-            errorCode: i.code
-          })), d.logger.debug(c({ err: s })), this.handleError(s, e, o, (n, t) => {
+            errorCodeName: t.codeName,
+            errorCode: t.code
+          })), d.logger.debug(c({ err: s })), this.handleError(s, e, o, (n, i) => {
             n.status(this.errorStatus(s)).header(...A).send({
               ok: !1,
-              errorMessage: t.message,
-              errorMessages: t.messages,
-              errorCode: g[t.code]
+              errorMessage: i.message,
+              errorMessages: i.messages,
+              errorCode: g[i.code]
             });
           });
         }
@@ -4197,24 +4200,24 @@ class Ke {
           "No CSRF token present"
         );
         try {
-          let i;
-          return e.sessionId && (i = (await this.sessionManager.userForSessionId(e.sessionId)).user), o.header(...A).send({ ok: !0, user: i });
-        } catch (i) {
-          const n = l.asCrossauthError(i);
-          let t = n.message, a = n.code, h = n.codeName;
+          let t;
+          return e.sessionId && (t = (await this.sessionManager.userForSessionId(e.sessionId)).user), o.header(...A).send({ ok: !0, user: t });
+        } catch (t) {
+          const n = l.asCrossauthError(t);
+          let i = n.message, a = n.code, h = n.codeName;
           switch (n.code) {
             case g.UserNotExist:
             case g.PasswordInvalid:
-              t = "Invalid username or password", a = g.UsernameOrPasswordInvalid, h = g[a];
+              i = "Invalid username or password", a = g.UsernameOrPasswordInvalid, h = g[a];
               break;
           }
           return d.logger.error(c({
-            msg: t,
+            msg: i,
             user: (s = e.user) == null ? void 0 : s.username,
             hashOfSessionId: this.getHashOfSessionId(e),
             errorCodeName: h,
             errorCode: a
-          })), d.logger.debug(c({ err: i })), o.status(this.errorStatus(i)).header(...A).send({
+          })), d.logger.debug(c({ err: t })), o.status(this.errorStatus(t)).header(...A).send({
             ok: !1,
             errorCode: a,
             errorCodeName: h
@@ -4240,15 +4243,15 @@ class Ke {
             ok: !0,
             csrfToken: e.csrfToken
           });
-        } catch (i) {
-          const n = l.asCrossauthError(i);
+        } catch (t) {
+          const n = l.asCrossauthError(t);
           return d.logger.error(c({
             msg: "getcsrftoken failure",
             user: (s = e.user) == null ? void 0 : s.username,
             hashedCsrfCookie: this.getHashOfCsrfCookie(e),
             errorCode: n.code,
             errorCodeName: n.codeName
-          })), d.logger.debug(c({ err: i })), o.status(this.errorStatus(i)).header(...A).send({
+          })), d.logger.debug(c({ err: t })), o.status(this.errorStatus(t)).header(...A).send({
             ok: !1,
             errorCode: n.code,
             errorCodeName: n.codeName,
@@ -4265,10 +4268,10 @@ class Ke {
       o,
       e.user
     );
-    const s = e.body.username, i = e.body.persist;
+    const s = e.body.username, t = e.body.persist;
     if (!e.csrfToken) throw new l(g.InvalidCsrf);
     const n = this.getSessionCookieValue(e);
-    let t = this.addToSession ? this.addToSession(e) : {}, { sessionCookie: a, csrfCookie: h, user: f } = await this.sessionManager.login(s, e.body, t, i);
+    let i = this.addToSession ? this.addToSession(e) : {}, { sessionCookie: a, csrfCookie: h, user: f } = await this.sessionManager.login(s, e.body, i, t);
     if (d.logger.debug(c({
       msg: "Login: set session cookie " + a.name + " opts " + JSON.stringify(a.options),
       user: e.body.username
@@ -4297,24 +4300,24 @@ class Ke {
     );
     const s = e.sessionId;
     if (!s) throw new l(g.Unauthorized);
-    const i = e.body.persist;
+    const t = e.body.persist;
     if (this.isSessionUser(e) && !e.csrfToken) throw new l(g.InvalidCsrf);
     let n = this.addToSession ? this.addToSession(e) : {};
-    const { sessionCookie: t, csrfCookie: a, user: h } = await this.sessionManager.completeTwoFactorLogin(
+    const { sessionCookie: i, csrfCookie: a, user: h } = await this.sessionManager.completeTwoFactorLogin(
       e.body,
       s,
       n,
-      i
+      t
     );
     return d.logger.debug(c({
-      msg: "Login: set session cookie " + t.name + " opts " + JSON.stringify(t.options),
+      msg: "Login: set session cookie " + i.name + " opts " + JSON.stringify(i.options),
       user: h == null ? void 0 : h.username
     })), o.cookie(
-      t.name,
-      t.value,
-      t.options
+      i.name,
+      i.value,
+      i.options
     ), d.logger.debug(c({
-      msg: "Login: set csrf cookie " + a.name + " opts " + JSON.stringify(t.options),
+      msg: "Login: set csrf cookie " + a.name + " opts " + JSON.stringify(i.options),
       user: h == null ? void 0 : h.username
     })), o.cookie(a.name, a.value, a.options), e.csrfToken = await this.sessionManager.createCsrfFormOrHeaderValue(a.value), r(o, h);
   }
@@ -4326,9 +4329,9 @@ class Ke {
   /**
    * This is called after the user has been validated to log the user in
    */
-  async loginWithUser(e, o, r, s, i) {
+  async loginWithUser(e, o, r, s, t) {
     const n = this.getSessionCookieValue(r);
-    let t = this.addToSession ? this.addToSession(r) : {}, { sessionCookie: a, csrfCookie: h } = await this.sessionManager.login("", {}, t, void 0, e, o);
+    let i = this.addToSession ? this.addToSession(r) : {}, { sessionCookie: a, csrfCookie: h } = await this.sessionManager.login("", {}, i, void 0, e, o);
     if (d.logger.debug(c({
       msg: "Login: set session cookie " + a.name + " opts " + JSON.stringify(a.options),
       user: e.username
@@ -4348,19 +4351,19 @@ class Ke {
           hashOfSessionId: this.getHashOfSessionId(r)
         })), d.logger.debug(c({ err: f }));
       }
-    return i(s, e);
+    return t(s, e);
   }
   async signup(e, o, r) {
     if (!this.userStorage) throw new l(g.Configuration, "Cannot call signup unless you provide a user stotage");
     if (this.isSessionUser(e) && !e.csrfToken) throw new l(g.InvalidCsrf);
-    const s = e.body.username, i = e.body.next;
+    const s = e.body.username, t = e.body.next;
     if (e.body.factor2 || (e.body.factor2 = this.allowedFactor2[0]), e.body.factor2 && !this.allowedFactor2.includes(e.body.factor2 ?? "none"))
       throw new l(
         g.Forbidden,
         "Illegal second factor " + e.body.factor2 + " requested"
       );
     (e.body.factor2 == "none" || e.body.factor2 == "") && (e.body.factor2 = void 0);
-    let n = this.createUserFn(e, this.userStorage.userEditableFields), t = this.authenticators[n.factor1].validateSecrets(e.body);
+    let n = this.createUserFn(e, this.userStorage.userEditableFields, this.userAllowedFactor1), i = this.authenticators[n.factor1].validateSecrets(e.body);
     const a = this.authenticators[n.factor1].secretNames();
     let h = {};
     for (let m in e.body)
@@ -4369,7 +4372,7 @@ class Ke {
         a.includes(w) && (h[w] = e.body[m]);
       }
     Object.keys(h).length === 0 && (h = void 0), n.state = "active", e.body.factor2 && e.body.factor2 != "none" ? n.state = "awaitingtwofactor" : this.enableEmailVerification && (n.state = "awaitingemailverification");
-    let p = [...this.validateUserFn(n), ...t];
+    let p = [...this.validateUserFn(n), ...i];
     if (p.length > 0)
       throw new l(g.FormEntry, p);
     let v = !1;
@@ -4403,7 +4406,7 @@ class Ke {
         let w = {
           userData: m,
           username: s,
-          next: i ?? this.loginRedirect,
+          next: t ?? this.loginRedirect,
           csrfToken: e.csrfToken
         };
         return r(o, w);
@@ -4446,14 +4449,14 @@ class Ke {
     d.logger.debug(c({ msg: "Creating session ID" }));
     let s = this.addToSession ? this.addToSession(e) : {};
     r && (s.data = JSON.stringify(r));
-    let { sessionCookie: i, csrfCookie: n, csrfFormOrHeaderValue: t } = await this.sessionManager.createAnonymousSession(s);
+    let { sessionCookie: t, csrfCookie: n, csrfFormOrHeaderValue: i } = await this.sessionManager.createAnonymousSession(s);
     o.cookie(
-      i.name,
-      i.value,
-      i.options
-    ), e.csrfToken = t, o.setCookie(n.name, n.value, n.options), e.user = void 0;
-    const a = this.sessionManager.getSessionId(i.value);
-    return e.sessionId = a, i.value;
+      t.name,
+      t.value,
+      t.options
+    ), e.csrfToken = i, o.setCookie(n.name, n.value, n.options), e.user = void 0;
+    const a = this.sessionManager.getSessionId(t.value);
+    return e.sessionId = a, t.value;
   }
   /**
    * Called by each endpoint on error.  
@@ -4469,27 +4472,27 @@ class Ke {
    *        incorrect.  If false, report that the username or password is
    *        incorrect.  Default false.
    */
-  handleError(e, o, r, s, i = !1) {
+  handleError(e, o, r, s, t = !1) {
     var n;
     try {
-      let t = l.asCrossauthError(e);
-      if (!i)
-        switch (t.code) {
+      let i = l.asCrossauthError(e);
+      if (!t)
+        switch (i.code) {
           case g.UserNotExist:
           case g.PasswordInvalid:
-            t = new l(
+            i = new l(
               g.UsernameOrPasswordInvalid,
               "Invalid username or password"
             );
             break;
         }
-      return d.logger.debug(c({ err: t })), d.logger.error(c({
-        cerr: t,
+      return d.logger.debug(c({ err: i })), d.logger.error(c({
+        cerr: i,
         hashOfSessionId: this.getHashOfSessionId(o),
         user: (n = o.user) == null ? void 0 : n.username
-      })), s(r, t);
-    } catch (t) {
-      return d.logger.error(c({ err: t })), s(r, new l(g.UnknownError));
+      })), s(r, i);
+    } catch (i) {
+      return d.logger.error(c({ err: i })), s(r, new l(g.UnknownError));
     }
   }
   //////////////
@@ -4565,14 +4568,14 @@ class Ke {
    * @returns the Fastiy reply
    */
   csrfToken(e, o) {
-    var i;
+    var t;
     let r;
     const s = this.sessionManager.csrfHeaderName;
     if (e.headers && s.toLowerCase() in e.headers) {
       const n = e.headers[s.toLowerCase()];
       Array.isArray(n) ? r = n[0] : r = n;
     }
-    if (!r && ((i = e.body) != null && i.csrfToken) && (r = e.body.csrfToken), r)
+    if (!r && ((t = e.body) != null && t.csrfToken) && (r = e.body.csrfToken), r)
       try {
         this.sessionManager.validateDoubleSubmitCsrfToken(
           this.getCsrfCookieValue(e),
@@ -4598,18 +4601,18 @@ class Ke {
    */
   sendJsonError(e, o, r, s) {
     (!r || !s) && (r = "Unknown error");
-    const i = s ? l.asCrossauthError(s) : void 0;
+    const t = s ? l.asCrossauthError(s) : void 0;
     return d.logger.warn(c({
       msg: r,
-      errorCode: i == null ? void 0 : i.code,
-      errorCodeName: i == null ? void 0 : i.codeName,
+      errorCode: t == null ? void 0 : t.code,
+      errorCodeName: t == null ? void 0 : t.codeName,
       httpStatus: o
     })), e.header(...A).status(o).send({
       ok: !1,
       status: o,
       errorMessage: r,
-      errorCode: i == null ? void 0 : i.code,
-      errorCodeName: i == null ? void 0 : i.codeName
+      errorCode: t == null ? void 0 : t.code,
+      errorCodeName: t == null ? void 0 : t.codeName
     });
   }
   /**
@@ -4736,35 +4739,35 @@ class Ye {
     u(this, "apiKeyManager");
     this.app = e, this.userStorage = o, this.apiKeyManager = new Y(r, s), this.app.addHook(
       "preHandler",
-      async (i, n) => {
-        if (i.headers.authorization)
+      async (t, n) => {
+        if (t.headers.authorization)
           try {
             d.logger.debug(c({
               msg: "Received authorization header"
             }));
-            const t = await this.apiKeyManager.validateToken(
-              i.headers.authorization
+            const i = await this.apiKeyManager.validateToken(
+              t.headers.authorization
             );
             d.logger.debug(c({
               msg: "Valid API key",
-              hahedApiKey: Y.hashSignedApiKeyValue(t.value)
+              hahedApiKey: Y.hashSignedApiKeyValue(i.value)
             }));
-            const a = Fe.decodeData(t.data);
-            if (i.apiKey = { ...t, ...a }, "scope" in a && Array.isArray(a.scope)) {
+            const a = Fe.decodeData(i.data);
+            if (t.apiKey = { ...i, ...a }, "scope" in a && Array.isArray(a.scope)) {
               let h = [];
               for (let f of a.scope)
                 typeof f == "string" && h.push(f);
-              i.scope = h;
+              t.scope = h;
             }
-            if (t.userid)
+            if (i.userid)
               try {
-                const { user: h } = await this.userStorage.getUserById(t.userid);
-                i.user = h, i.authType = "apiKey", d.logger.debug(c({ msg: "API key is for user", userid: h.id, user: h.username, hahedApiKey: Y.hashSignedApiKeyValue(t.value) }));
+                const { user: h } = await this.userStorage.getUserById(i.userid);
+                t.user = h, t.authType = "apiKey", d.logger.debug(c({ msg: "API key is for user", userid: h.id, user: h.username, hahedApiKey: Y.hashSignedApiKeyValue(i.value) }));
               } catch (h) {
-                d.logger.error(c({ msg: "API key has invalid user", userid: t.userid, hashedApiKey: Y.hashSignedApiKeyValue(t.value) })), d.logger.debug(c({ err: h }));
+                d.logger.error(c({ msg: "API key has invalid user", userid: i.userid, hashedApiKey: Y.hashSignedApiKeyValue(i.value) })), d.logger.debug(c({ err: h }));
               }
-          } catch (t) {
-            d.logger.error(c({ msg: "Invalid authorization header received", header: i.headers.authorization })), d.logger.debug(c({ err: t }));
+          } catch (i) {
+            d.logger.error(c({ msg: "Invalid authorization header received", header: t.headers.authorization })), d.logger.debug(c({ err: i }));
           }
       }
     );
@@ -4782,7 +4785,7 @@ class $e {
    *        for the password flow
    * @param options see {@link FastifyAuthorizationServerOptions}
    */
-  constructor(e, o, r, s, i, n = {}) {
+  constructor(e, o, r, s, t, n = {}) {
     /** The Fastify app passed to the constructor */
     u(this, "app");
     /** The underlying framework-independent authorization server */
@@ -4807,11 +4810,11 @@ class $e {
     this.app = e, this.fastifyServer = o, this.clientStorage = r, this.authServer = new Ne(
       this.clientStorage,
       s,
-      i,
+      t,
       n
     ), C("prefix", k.String, this, n, "PREFIX"), this.prefix.endsWith("/") || (this.prefix += "/"), C("errorPage", k.String, this, n, "ERROR_PAGE"), C("devicePage", k.String, this, n, "OAUTH_DEVICE_PAGE"), C("loginUrl", k.String, this, n, "LOGIN_URL"), C("oauthAuthorizePage", k.String, this, n, "OAUTH_AUTHORIZE_PAGE"), C("refreshTokenType", k.String, this, n, "OAUTH_REFRESH_TOKEN_TYPE"), C("refreshTokenCookieName", k.String, this, n, "OAUTH_REFRESH_TOKEN_COOKIE_NAME"), C("refreshTokenCookieDomain", k.String, this, n, "OAUTH_REFRESH_TOKEN_COOKIE_DOMAIN"), C("refreshTokenCookieHttpOnly", k.Boolean, this, n, "OAUTH_REFRESH_TOKEN_COOKIE_HTTPONLY"), C("refreshTokenCookiePath", k.String, this, n, "OAUTH_REFRESH_TOKEN_COOKIE_PATH"), C("refreshTokenCookieSecure", k.Boolean, this, n, "OAUTH_REFRESH_TOKEN_COOKIE_SECURE"), C("refreshTokenCookieSameSite", k.String, this, n, "OAUTH_REFRESH_TOKEN_COOKIE_SAMESITE"), C("createGetCsrfTokenEndpoint", k.String, this, n, "OAUTH_CREATE_GET_CSRF_TOKEN_ENDPOINT"), this.refreshTokenType != "json" && (this.createGetCsrfTokenEndpoint ? this.csrfTokens = new Ue(n.doubleSubmitCookieOptions) : this.fastifyServer.sessionServer && (this.csrfTokens = this.fastifyServer.sessionServer.sessionManager.csrfTokens)), this.createGetCsrfTokenEndpoint && this.addApiGetCsrfTokenEndpoints(), e.get(
       this.prefix + ".well-known/openid-configuration",
-      async (t, a) => a.header(...x).status(200).send(
+      async (i, a) => a.header(...x).status(200).send(
         this.authServer.oidcConfiguration({
           authorizeEndpoint: this.prefix + "authorize",
           tokenEndpoint: this.prefix + "token",
@@ -4821,32 +4824,32 @@ class $e {
       )
     ), e.get(
       this.prefix + "jwks",
-      async (t, a) => a.header(...x).status(200).send(
+      async (i, a) => a.header(...x).status(200).send(
         this.authServer.jwks()
       )
-    ), (this.authServer.validFlows.includes(E.AuthorizationCode) || this.authServer.validFlows.includes(E.AuthorizationCodeWithPKCE) || this.authServer.validFlows.includes(E.OidcAuthorizationCode)) && (e.get(this.prefix + "authorize", async (t, a) => {
+    ), (this.authServer.validFlows.includes(E.AuthorizationCode) || this.authServer.validFlows.includes(E.AuthorizationCodeWithPKCE) || this.authServer.validFlows.includes(E.OidcAuthorizationCode)) && (e.get(this.prefix + "authorize", async (i, a) => {
       var h;
-      return d.logger.info(c({ msg: "Page visit", method: "GET", url: this.prefix + "authorize", ip: t.ip, user: (h = t.user) == null ? void 0 : h.username })), await this.authorizeEndpoint(t, a, t.query);
-    }), e.post(this.prefix + "authorize", async (t, a) => {
+      return d.logger.info(c({ msg: "Page visit", method: "GET", url: this.prefix + "authorize", ip: i.ip, user: (h = i.user) == null ? void 0 : h.username })), await this.authorizeEndpoint(i, a, i.query);
+    }), e.post(this.prefix + "authorize", async (i, a) => {
       var h;
-      return d.logger.info(c({ msg: "Page visit", method: "POST", url: this.prefix + "authorize", ip: t.ip, user: (h = t.user) == null ? void 0 : h.username })), await this.authorizeEndpoint(t, a, t.body);
+      return d.logger.info(c({ msg: "Page visit", method: "POST", url: this.prefix + "authorize", ip: i.ip, user: (h = i.user) == null ? void 0 : h.username })), await this.authorizeEndpoint(i, a, i.body);
     }), this.app.post(
       this.prefix + "userauthorize",
-      async (t, a) => {
+      async (i, a) => {
         var p, v;
-        if (d.logger.info(c({ msg: "Page visit", method: "POST", url: this.prefix + "authorize", ip: t.ip, user: (p = t.user) == null ? void 0 : p.username })), !t.user) return b.sendPageError(
+        if (d.logger.info(c({ msg: "Page visit", method: "POST", url: this.prefix + "authorize", ip: i.ip, user: (p = i.user) == null ? void 0 : p.username })), !i.user) return b.sendPageError(
           a,
           401,
           this.errorPage
         );
         let h, f;
         try {
-          h = await this.fastifyServer.validateCsrfToken(t);
+          h = await this.fastifyServer.validateCsrfToken(i);
         } catch (m) {
           f = l.asCrossauthError(m), f.message = "Invalid csrf cookie received", d.logger.error(c({
             msg: f.message,
             hashedCsrfCookie: h ? F.hash(h) : void 0,
-            user: (v = t.user) == null ? void 0 : v.username,
+            user: (v = i.user) == null ? void 0 : v.username,
             cerr: f
           }));
         }
@@ -4875,45 +4878,45 @@ class $e {
           }
         }
         if (!f) {
-          const m = t.body.authorized == "true";
-          return await this.authorize(t, a, m, {
-            responseType: t.body.response_type,
-            client_id: t.body.client_id,
-            redirect_uri: t.body.redirect_uri,
-            scope: t.body.scope,
-            state: t.body.state,
-            codeChallenge: t.body.code_challenge,
-            codeChallengeMethod: t.body.code_challenge_method
+          const m = i.body.authorized == "true";
+          return await this.authorize(i, a, m, {
+            responseType: i.body.response_type,
+            client_id: i.body.client_id,
+            redirect_uri: i.body.redirect_uri,
+            scope: i.body.scope,
+            state: i.body.state,
+            codeChallenge: i.body.code_challenge,
+            codeChallengeMethod: i.body.code_challenge_method
           });
         }
       }
     )), (this.authServer.validFlows.includes(E.AuthorizationCode) || this.authServer.validFlows.includes(E.AuthorizationCodeWithPKCE) || this.authServer.validFlows.includes(E.OidcAuthorizationCode) || this.authServer.validFlows.includes(E.ClientCredentials) || this.authServer.validFlows.includes(E.RefreshToken) || this.authServer.validFlows.includes(E.Password) || this.authServer.validFlows.includes(E.PasswordMfa) || this.authServer.validFlows.includes(E.DeviceCode)) && this.app.post(
       this.prefix + "token",
-      async (t, a) => {
+      async (i, a) => {
         var m;
         d.logger.info(c({
           msg: "Page visit",
           method: "POST",
           url: this.prefix + "token",
-          ip: t.ip,
-          user: (m = t.user) == null ? void 0 : m.username
+          ip: i.ip,
+          user: (m = i.user) == null ? void 0 : m.username
         }));
-        let h = t.body.client_id, f = t.body.client_secret;
-        if (t.headers.authorization) {
+        let h = i.body.client_id, f = i.body.client_secret;
+        if (i.headers.authorization) {
           let w, P;
-          const T = t.headers.authorization.split(" ");
+          const T = i.headers.authorization.split(" ");
           if (T.length == 2 && T[0].toLocaleLowerCase() == "basic") {
             const y = F.base64Decode(T[1]).split(":", 2);
             y.length == 2 && (w = y[0], P = y[1]);
           }
           w == null || P == null ? d.logger.warn(c({
-            msg: "Ignoring malform authenization header " + t.headers.authorization
+            msg: "Ignoring malform authenization header " + i.headers.authorization
           })) : (h = w, f = P);
         }
-        let p = t.body.refresh_token;
-        if ((this.refreshTokenType == "cookie" && t.cookies && this.refreshTokenCookieName in t.cookies || this.refreshTokenType == "both" && t.cookies && this.refreshTokenCookieName in t.cookies && p == null) && this.csrfTokens) {
-          const w = t.cookies[this.csrfTokens.cookieName];
-          let P = t.headers[this.csrfTokens.headerName.toLowerCase()];
+        let p = i.body.refresh_token;
+        if ((this.refreshTokenType == "cookie" && i.cookies && this.refreshTokenCookieName in i.cookies || this.refreshTokenType == "both" && i.cookies && this.refreshTokenCookieName in i.cookies && p == null) && this.csrfTokens) {
+          const w = i.cookies[this.csrfTokens.cookieName];
+          let P = i.headers[this.csrfTokens.headerName.toLowerCase()];
           if (Array.isArray(P) && (P = P[0]), !w || !P)
             return {
               error: "access_denied",
@@ -4922,28 +4925,28 @@ class $e {
           try {
             this.csrfTokens.validateDoubleSubmitCsrfToken(w, P);
           } catch (T) {
-            return d.logger.debug(c({ err: T })), d.logger.warn(c({ cerr: T, msg: "Invalid csrf token", client_id: t.body.client_id })), {
+            return d.logger.debug(c({ err: T })), d.logger.warn(c({ cerr: T, msg: "Invalid csrf token", client_id: i.body.client_id })), {
               error: "access_denied",
               error_description: "Invalid csrf token"
             };
           }
-          p = t.cookies[this.refreshTokenCookieName];
+          p = i.cookies[this.refreshTokenCookieName];
         }
         const v = await this.authServer.tokenEndpoint({
-          grantType: t.body.grant_type,
+          grantType: i.body.grant_type,
           client_id: h,
           client_secret: f,
-          scope: t.body.scope,
-          codeVerifier: t.body.code_verifier,
-          code: t.body.code,
-          username: t.body.username,
-          password: t.body.password,
-          mfaToken: t.body.mfa_token,
-          oobCode: t.body.oob_code,
-          bindingCode: t.body.binding_code,
-          otp: t.body.otp,
+          scope: i.body.scope,
+          codeVerifier: i.body.code_verifier,
+          code: i.body.code,
+          username: i.body.username,
+          password: i.body.password,
+          mfaToken: i.body.mfa_token,
+          oobCode: i.body.oob_code,
+          bindingCode: i.body.binding_code,
+          otp: i.body.otp,
           refreshToken: p,
-          deviceCode: t.body.device_code
+          deviceCode: i.body.device_code
         });
         if (v.error == "authorization_pending")
           return a.header(...x).status(200).send(v);
@@ -4957,67 +4960,67 @@ class $e {
       }
     ), this.authServer.validFlows.includes(E.PasswordMfa) && (e.get(
       this.prefix + "mfa/authenticators",
-      async (t, a) => {
+      async (i, a) => {
         var h;
         return d.logger.info(c({
           msg: "Page visit",
           method: "GET",
           url: this.prefix + "mfa/authenticators",
-          ip: t.ip,
-          user: (h = t.user) == null ? void 0 : h.username
-        })), await this.mfaAuthenticatorsEndpoint(t, a);
+          ip: i.ip,
+          user: (h = i.user) == null ? void 0 : h.username
+        })), await this.mfaAuthenticatorsEndpoint(i, a);
       }
     ), e.post(
       this.prefix + "mfa/authenticators",
-      async (t, a) => {
+      async (i, a) => {
         var h;
         return d.logger.info(c({
           msg: "Page visit",
           method: "POST",
           url: this.prefix + "mfa/authenticators",
-          ip: t.ip,
-          user: (h = t.user) == null ? void 0 : h.username
-        })), await this.mfaAuthenticatorsEndpoint(t, a);
+          ip: i.ip,
+          user: (h = i.user) == null ? void 0 : h.username
+        })), await this.mfaAuthenticatorsEndpoint(i, a);
       }
     ), e.post(
       this.prefix + "mfa/challenge",
-      async (t, a) => {
+      async (i, a) => {
         var h;
         return d.logger.info(c({
           msg: "Page visit",
           method: "POST",
           url: this.prefix + "mfa/challenge",
-          ip: t.ip,
-          user: (h = t.user) == null ? void 0 : h.username
-        })), await this.mfaChallengeEndpoint(t, a, t.body);
+          ip: i.ip,
+          user: (h = i.user) == null ? void 0 : h.username
+        })), await this.mfaChallengeEndpoint(i, a, i.body);
       }
     )), this.authServer.validFlows.includes(E.DeviceCode) && (this.app.post(
       this.prefix + "device_authorization",
-      async (t, a) => {
+      async (i, a) => {
         var v;
         d.logger.info(c({
           msg: "Page visit",
           method: "POST",
           url: this.prefix + "device_authorization",
-          ip: t.ip,
-          user: (v = t.user) == null ? void 0 : v.username
+          ip: i.ip,
+          user: (v = i.user) == null ? void 0 : v.username
         }));
-        let h = t.body.client_id, f = t.body.client_secret;
-        if (t.headers.authorization) {
+        let h = i.body.client_id, f = i.body.client_secret;
+        if (i.headers.authorization) {
           let m, w;
-          const P = t.headers.authorization.split(" ");
+          const P = i.headers.authorization.split(" ");
           if (P.length == 2 && P[0].toLocaleLowerCase() == "basic") {
             const N = F.base64Decode(P[1]).split(":", 2);
             N.length == 2 && (m = N[0], w = N[1]);
           }
           m == null || w == null ? d.logger.warn(c({
-            msg: "Ignoring malform authenization header " + t.headers.authorization
+            msg: "Ignoring malform authenization header " + i.headers.authorization
           })) : (h = m, f = w);
         }
         const p = await this.authServer.deviceAuthorizationEndpoint({
           client_id: h,
           client_secret: f,
-          scope: t.body.scope
+          scope: i.body.scope
         });
         if (p.error || !p.device_code || !p.user_code) {
           let m = "server_error", w = "Neither code nor error received when requesting authorization";
@@ -5029,27 +5032,27 @@ class $e {
       }
     ), e.get(
       this.prefix + "device",
-      async (t, a) => {
+      async (i, a) => {
         var h;
         return d.logger.info(c({
           msg: "Page visit",
           method: "GET",
           url: this.prefix + "device",
-          ip: t.ip,
-          user: (h = t.user) == null ? void 0 : h.username
-        })), t.user ? await this.deviceGet(!1, t, a, t.user) : a.redirect(this.loginUrl + "?next=" + encodeURIComponent(t.url), 302);
+          ip: i.ip,
+          user: (h = i.user) == null ? void 0 : h.username
+        })), i.user ? await this.deviceGet(!1, i, a, i.user) : a.redirect(this.loginUrl + "?next=" + encodeURIComponent(i.url), 302);
       }
     ), e.get(
       this.prefix + "api/device",
-      async (t, a) => {
+      async (i, a) => {
         var h;
         if (d.logger.info(c({
           msg: "Page visit",
           method: "GET",
           url: this.prefix + "device",
-          ip: t.ip,
-          user: (h = t.user) == null ? void 0 : h.username
-        })), !t.user) {
+          ip: i.ip,
+          user: (h = i.user) == null ? void 0 : h.username
+        })), !i.user) {
           const f = new l(g.Unauthorized, "Not logged in");
           return a.header(...x).status(401).send({
             errorMessage: f.message,
@@ -5057,31 +5060,31 @@ class $e {
             errorCodeName: f.codeName
           });
         }
-        return await this.deviceGet(!0, t, a, t.user);
+        return await this.deviceGet(!0, i, a, i.user);
       }
     ), this.app.post(
       this.prefix + "device",
-      async (t, a) => {
+      async (i, a) => {
         var h;
         return d.logger.info(c({
           msg: "Page visit",
           method: "POST",
           url: this.prefix + "device",
-          ip: t.ip,
-          user: (h = t.user) == null ? void 0 : h.username
-        })), t.user ? await this.deviceCodePost(!1, t, a) : a.redirect(this.loginUrl + "?next=" + encodeURIComponent(t.url), 302);
+          ip: i.ip,
+          user: (h = i.user) == null ? void 0 : h.username
+        })), i.user ? await this.deviceCodePost(!1, i, a) : a.redirect(this.loginUrl + "?next=" + encodeURIComponent(i.url), 302);
       }
     ), this.app.post(
       this.prefix + "api/device",
-      async (t, a) => {
+      async (i, a) => {
         var h;
         return d.logger.info(c({
           msg: "Page visit",
           method: "POST",
           url: this.prefix + "device",
-          ip: t.ip,
-          user: (h = t.user) == null ? void 0 : h.username
-        })), await this.deviceCodePost(!0, t, a);
+          ip: i.ip,
+          user: (h = i.user) == null ? void 0 : h.username
+        })), await this.deviceCodePost(!0, i, a);
       }
     ));
   }
@@ -5102,7 +5105,7 @@ class $e {
     this.csrfTokens && this.app.get(
       this.prefix + "getcsrftoken",
       async (e, o) => {
-        var s, i;
+        var s, t;
         if (d.logger.info(c({
           msg: "API visit",
           method: "POST",
@@ -5114,56 +5117,56 @@ class $e {
         try {
           const {
             csrfCookie: n,
-            csrfFormOrHeaderValue: t
+            csrfFormOrHeaderValue: i
           } = await this.createCsrfToken();
           return r = n.value, o.setCookie(n.name, n.value, n.options), o.header(...x).send({
             ok: !0,
-            csrfToken: t
+            csrfToken: i
           });
         } catch (n) {
-          const t = l.asCrossauthError(n);
+          const i = l.asCrossauthError(n);
           return d.logger.error(c({
             msg: "getcsrftoken failure",
-            user: (i = e.user) == null ? void 0 : i.username,
+            user: (t = e.user) == null ? void 0 : t.username,
             hashedCsrfCookie: F.hash(r.split(".")[0]),
-            errorCode: t.code,
-            errorCodeName: t.codeName
-          })), d.logger.debug(c({ err: n })), o.status(t.httpStatus).header(...x).send({
+            errorCode: i.code,
+            errorCodeName: i.codeName
+          })), d.logger.debug(c({ err: n })), o.status(i.httpStatus).header(...x).send({
             ok: !1,
-            errorCode: t.code,
-            errorCodeName: t.codeName,
-            error: t.message
+            errorCode: i.code,
+            errorCodeName: i.codeName,
+            error: i.message
           });
         }
       }
     );
   }
   async authorizeEndpoint(e, o, r) {
-    var t, a, h;
+    var i, a, h;
     if (!e.user) return o.redirect(this.loginUrl + "?next=" + encodeURIComponent(e.url), 302);
     d.logger.debug(c({ msg: "validating authorize parameters" }));
-    let { error_description: s } = this.authServer.validateAuthorizeParameters(r), i;
-    if (s ? (i = new l(g.BadRequest, s), d.logger.error(c({
+    let { error_description: s } = this.authServer.validateAuthorizeParameters(r), t;
+    if (s ? (t = new l(g.BadRequest, s), d.logger.error(c({
       msg: "authorize parameter invalid",
-      cerr: i,
-      user: (t = e.user) == null ? void 0 : t.username
+      cerr: t,
+      user: (i = e.user) == null ? void 0 : i.username
     }))) : d.logger.error(c({
       msg: "authorize parameter valid",
       user: (a = e.user) == null ? void 0 : a.username
-    })), i) {
+    })), t) {
       if (this.errorPage)
-        return o.status(i.httpStatus).view(
+        return o.status(t.httpStatus).view(
           this.errorPage,
           {
-            status: i.httpStatus,
-            errorMessage: i.message,
-            errorCode: i.code,
-            errorCodeName: i.codeName
+            status: t.httpStatus,
+            errorMessage: t.message,
+            errorCode: t.code,
+            errorCodeName: t.codeName
           }
         );
       {
         let f = "500";
-        switch (i.httpStatus) {
+        switch (t.httpStatus) {
           case 401:
             f = "401";
             break;
@@ -5171,7 +5174,7 @@ class $e {
             f = "400";
             break;
         }
-        return o.status(i.httpStatus).send($[f] ?? G);
+        return o.status(t.httpStatus).send($[f] ?? G);
       }
     }
     let n = !1;
@@ -5233,9 +5236,9 @@ class $e {
   }
   async authorize(e, o, r, {
     responseType: s,
-    client_id: i,
+    client_id: t,
     redirect_uri: n,
-    scope: t,
+    scope: i,
     state: a,
     codeChallenge: h,
     codeChallengeMethod: f
@@ -5244,9 +5247,9 @@ class $e {
     if (r) {
       const w = await this.authServer.authorizeGetEndpoint({
         responseType: s,
-        client_id: i,
+        client_id: t,
         redirect_uri: n,
-        scope: t,
+        scope: i,
         state: a,
         codeChallenge: h,
         codeChallengeMethod: f,
@@ -5305,18 +5308,18 @@ class $e {
     }
   }
   async mfaAuthenticatorsEndpoint(e, o) {
-    var t;
-    const r = (t = e.headers.authorization) == null ? void 0 : t.split(" ");
+    var i;
+    const r = (i = e.headers.authorization) == null ? void 0 : i.split(" ");
     if (!r || r.length != 2)
       return {
         error: "access_denied",
         error_desciption: "Invalid authorization header"
       };
-    const s = r[1], i = await this.authServer.mfaAuthenticatorsEndpoint(s);
-    if (i.authenticators)
-      return o.header(...x).status(200).send(i.authenticators);
-    const n = l.fromOAuthError(i.error ?? "server_error");
-    return o.header(...x).status(n.httpStatus).send(i);
+    const s = r[1], t = await this.authServer.mfaAuthenticatorsEndpoint(s);
+    if (t.authenticators)
+      return o.header(...x).status(200).send(t.authenticators);
+    const n = l.fromOAuthError(t.error ?? "server_error");
+    return o.header(...x).status(n.httpStatus).send(t);
   }
   async mfaChallengeEndpoint(e, o, r) {
     const s = await this.authServer.mfaChallengeEndpoint(
@@ -5327,15 +5330,15 @@ class $e {
       r.authenticator_id
     );
     if (s.error) {
-      const i = l.fromOAuthError(s.error);
-      return o.header(...x).status(i.httpStatus).send(s);
+      const t = l.fromOAuthError(s.error);
+      return o.header(...x).status(t.httpStatus).send(s);
     }
     return o.header(...x).status(200).send(s);
   }
   setRefreshTokenCookie(e, o, r) {
     if (!this.refreshTokenCookieName) return;
-    let s = r ? new Date(Date.now() + r * 1e3).toUTCString() : void 0, i = this.refreshTokenCookieName + "=" + o;
-    s && (i += "; expires=" + new Date(s).toUTCString()), this.refreshTokenCookieSameSite && (i += "; SameSite=" + this.refreshTokenCookieSameSite), this.refreshTokenCookieDomain && (i += "; domain=" + this.refreshTokenCookieDomain), this.refreshTokenCookiePath && (i += "; path=" + this.refreshTokenCookiePath), this.refreshTokenCookieHttpOnly == !0 && (i += "; httpOnly"), this.refreshTokenCookieSecure == !0 && (i += "; secure"), e.setCookie(this.refreshTokenCookieName, i);
+    let s = r ? new Date(Date.now() + r * 1e3).toUTCString() : void 0, t = this.refreshTokenCookieName + "=" + o;
+    s && (t += "; expires=" + new Date(s).toUTCString()), this.refreshTokenCookieSameSite && (t += "; SameSite=" + this.refreshTokenCookieSameSite), this.refreshTokenCookieDomain && (t += "; domain=" + this.refreshTokenCookieDomain), this.refreshTokenCookiePath && (t += "; path=" + this.refreshTokenCookiePath), this.refreshTokenCookieHttpOnly == !0 && (t += "; httpOnly"), this.refreshTokenCookieSecure == !0 && (t += "; secure"), e.setCookie(this.refreshTokenCookieName, t);
   }
   /**
    * Returns this server's OIDC configuration.  Just wraps
@@ -5353,18 +5356,18 @@ class $e {
   /////
   // Device code flow
   async applyUserCode(e, o, r) {
-    var s, i, n;
+    var s, t, n;
     try {
-      const t = await this.authServer.deviceEndpoint({ userCode: e, user: r });
-      if (t.error)
+      const i = await this.authServer.deviceEndpoint({ userCode: e, user: r });
+      if (i.error)
         return {
           ok: !1,
           completed: !1,
           retryAllowed: !1,
-          error: t.error,
-          error_description: t.error_description
+          error: i.error,
+          error_description: i.error_description
         };
-      if (!t.client_id)
+      if (!i.client_id)
         return d.logger.error(c({ msg: "No client id found for user code", userCodeHash: F.hash(e), ip: o.ip, username: (s = o.user) == null ? void 0 : s.username })), {
           ok: !1,
           completed: !1,
@@ -5372,33 +5375,33 @@ class $e {
           error: "server_error",
           error_description: "No client id found for user code"
         };
-      if (t.error == "access_denied")
-        return d.logger.error(c({ msg: "Incorrect user code given", userCodeHash: F.hash(e), ip: o.ip, username: (i = o.user) == null ? void 0 : i.username })), this.authServer.userCodeThrottle > 0 && await ((f) => new Promise((p) => setTimeout(p, f)))(this.authServer.userCodeThrottle), {
+      if (i.error == "access_denied")
+        return d.logger.error(c({ msg: "Incorrect user code given", userCodeHash: F.hash(e), ip: o.ip, username: (t = o.user) == null ? void 0 : t.username })), this.authServer.userCodeThrottle > 0 && await ((f) => new Promise((p) => setTimeout(p, f)))(this.authServer.userCodeThrottle), {
           ok: !1,
           completed: !1,
           retryAllowed: !0,
-          error: t.error,
-          error_description: t.error_description
+          error: i.error,
+          error_description: i.error_description
         };
-      if (t.error == "expired_token")
+      if (i.error == "expired_token")
         return d.logger.error(c({ msg: "Expired user code", userCodeHash: F.hash(e), ip: o.ip, username: (n = o.user) == null ? void 0 : n.username })), {
           ok: !1,
           completed: !1,
           retryAllowed: !1,
-          error: t.error,
-          error_description: t.error_description
+          error: i.error,
+          error_description: i.error_description
         };
-      const a = await this.clientStorage.getClientById(t.client_id);
-      return t.scopeAuthorizationNeeded ? {
+      const a = await this.clientStorage.getClientById(i.client_id);
+      return i.scopeAuthorizationNeeded ? {
         ok: !0,
         completed: !1,
         retryAllowed: !0,
         authorizationNeeded: {
           user: r,
-          client_id: t.client_id,
+          client_id: i.client_id,
           client_name: a.client_name,
-          scope: t.scope,
-          scopes: t.scope ? t.scope.split(" ") : [],
+          scope: i.scope,
+          scopes: i.scope ? i.scope.split(" ") : [],
           csrfToken: o.csrfToken
         },
         user: o.user,
@@ -5411,8 +5414,8 @@ class $e {
         user: o.user,
         csrfToken: o.csrfToken
       };
-    } catch (t) {
-      const a = l.asCrossauthError(t);
+    } catch (i) {
+      const a = l.asCrossauthError(i);
       return d.logger.debug(c({ err: a })), d.logger.error(c({ msg: a.message, cerr: a })), {
         ok: !1,
         completed: !1,
@@ -5424,34 +5427,34 @@ class $e {
   }
   async deviceGet(e, o, r, s) {
     if (o.query.user_code) {
-      let i = await this.applyUserCode(o.query.user_code, o, s);
-      if (i.error) {
-        const t = l.fromOAuthError(i.error, i.error_description);
-        d.logger.debug({ err: t }), d.logger.error({ cerr: t });
+      let t = await this.applyUserCode(o.query.user_code, o, s);
+      if (t.error) {
+        const i = l.fromOAuthError(t.error, t.error_description);
+        d.logger.debug({ err: i }), d.logger.error({ cerr: i });
         const a = {
           ok: !1,
           completed: !1,
-          status: t.httpStatus,
-          errorMessage: t.message,
-          errorCode: t.code,
-          errorCodeName: t.codeName,
-          retryAllowed: i.retryAllowed
+          status: i.httpStatus,
+          errorMessage: i.message,
+          errorCode: i.code,
+          errorCodeName: i.codeName,
+          retryAllowed: t.retryAllowed
         };
-        return e ? r.header(...x).status(t.httpStatus).send(a) : r.status(t.httpStatus).view(this.devicePage, {
+        return e ? r.header(...x).status(i.httpStatus).send(a) : r.status(i.httpStatus).view(this.devicePage, {
           csrfToken: o.csrfToken,
           ...a
         });
-      } else if (i.authorizationNeeded) {
-        const t = {
+      } else if (t.authorizationNeeded) {
+        const i = {
           ok: !0,
           completed: !1,
-          retryAllowed: i.retryAllowed,
-          authorizationNeeded: i.authorizationNeeded,
-          user_code: i.user_code
+          retryAllowed: t.retryAllowed,
+          authorizationNeeded: t.authorizationNeeded,
+          user_code: t.user_code
         };
-        return e ? r.header(...x).status(200).send(t) : r.status(200).view(this.devicePage, {
+        return e ? r.header(...x).status(200).send(i) : r.status(200).view(this.devicePage, {
           csrfToken: o.csrfToken,
-          ...t
+          ...i
         });
       }
       const n = {
@@ -5463,13 +5466,13 @@ class $e {
         ...n
       });
     } else {
-      const i = {
+      const t = {
         ok: !1,
         completed: !1,
         user_code: o.query.user_code,
         csrfToken: o.csrfToken
       };
-      return e ? r.header(...x).status(200).send(i) : r.status(200).view(this.devicePage, i);
+      return e ? r.header(...x).status(200).send(t) : r.status(200).view(this.devicePage, t);
     }
   }
   async deviceCodePost(e, o, r) {
@@ -5482,7 +5485,7 @@ class $e {
           if (s.error) {
             const n = l.fromOAuthError(s.error, s.error_description);
             d.logger.debug({ err: n }), d.logger.error({ cerr: n });
-            const t = {
+            const i = {
               ok: !1,
               completed: !1,
               status: n.httpStatus,
@@ -5491,9 +5494,9 @@ class $e {
               errorCodeName: n.codeName,
               retryAllowed: s.retryAllowed
             };
-            return e ? r.header(...x).status(200).send(t) : r.status(n.httpStatus).view(this.devicePage, {
+            return e ? r.header(...x).status(200).send(i) : r.status(n.httpStatus).view(this.devicePage, {
               csrfToken: o.csrfToken,
-              ...t
+              ...i
             });
           } else if (s.authorizationNeeded) {
             const n = {
@@ -5508,14 +5511,14 @@ class $e {
               ...n
             });
           }
-          const i = {
+          const t = {
             ok: !0,
             completed: !0,
             csrfToken: o.csrfToken
           };
-          return e ? r.header(...x).status(200).send(i) : r.status(200).view(this.devicePage, i);
+          return e ? r.header(...x).status(200).send(t) : r.status(200).view(this.devicePage, t);
         } else {
-          const s = l.fromOAuthError("unauthorized", "Please enter the code"), i = {
+          const s = l.fromOAuthError("unauthorized", "Please enter the code"), t = {
             ok: !1,
             completed: !1,
             user_code: o.body.user_code,
@@ -5526,22 +5529,22 @@ class $e {
             errorCode: s.code,
             errorCodeName: s.codeName
           };
-          return e ? r.header(...x).status(401).send(i) : r.status(200).view(this.devicePage, {
+          return e ? r.header(...x).status(401).send(t) : r.status(200).view(this.devicePage, {
             csrfToken: o.csrfToken,
-            ...i
+            ...t
           });
         }
       else if (o.body.authorized == "true") {
-        let s = o.body.user_code, i = o.body.scope;
-        i == "";
+        let s = o.body.user_code, t = o.body.scope;
+        t == "";
         const n = o.body.client_id;
         if (!s) throw new l(g.BadRequest, "user_code missing");
         if (!n) throw new l(g.BadRequest, "client_id missing");
-        let t = await this.authServer.validateAndPersistScope(n, i, o.user);
-        if (t.error)
-          throw l.fromOAuthError(t.error, t.error_description);
-        if (t = await this.applyUserCode(s, o, o.user), t.error)
-          throw l.fromOAuthError(t.error, t.error_description);
+        let i = await this.authServer.validateAndPersistScope(n, t, o.user);
+        if (i.error)
+          throw l.fromOAuthError(i.error, i.error_description);
+        if (i = await this.applyUserCode(s, o, o.user), i.error)
+          throw l.fromOAuthError(i.error, i.error_description);
         const a = {
           ok: !0,
           completed: !0,
@@ -5551,16 +5554,16 @@ class $e {
       } else
         throw new l(g.Unauthorized, "You did not authorize the client");
     } catch (s) {
-      const i = l.asCrossauthError(s);
-      d.logger.debug({ err: i }), d.logger.error({ cerr: i });
+      const t = l.asCrossauthError(s);
+      d.logger.debug({ err: t }), d.logger.error({ cerr: t });
       const n = {
         ok: !1,
-        status: i.httpStatus,
-        errorMessage: i.message,
-        errorCode: i.code,
-        errorCodeName: i.codeName
+        status: t.httpStatus,
+        errorMessage: t.message,
+        errorCode: t.code,
+        errorCodeName: t.codeName
       };
-      return e ? r.header(...x).status(401).send(n) : r.status(i.httpStatus).view(this.devicePage, {
+      return e ? r.header(...x).status(401).send(n) : r.status(t.httpStatus).view(this.devicePage, {
         csrfToken: o.csrfToken,
         ...n
       });
@@ -5609,10 +5612,10 @@ function fe(S, e) {
   if (S.access_token)
     try {
       if (S.access_token && e.includes("access")) {
-        const r = J(S.access_token), s = r.jti ? r.jti : r.sid ? r.sid : "", i = s ? F.hash(s) : void 0;
+        const r = J(S.access_token), s = r.jti ? r.jti : r.sid ? r.sid : "", t = s ? F.hash(s) : void 0;
         d.logger.debug(c({
           msg: "Got access token",
-          accessTokenHash: i
+          accessTokenHash: t
         }));
       }
     } catch (r) {
@@ -5623,10 +5626,10 @@ function fe(S, e) {
       if (S.id_token && e.includes("id")) {
         let r = S.id_payload ?? J(S.id_token);
         if (r) {
-          const s = r.jti ? r.jti : r.sid ? r.sid : "", i = s ? F.hash(s) : void 0;
+          const s = r.jti ? r.jti : r.sid ? r.sid : "", t = s ? F.hash(s) : void 0;
           d.logger.debug(c({
             msg: "Got id token",
-            idTokenHash: i
+            idTokenHash: t
           }));
         }
       }
@@ -5665,11 +5668,11 @@ async function Qe(S, e, o, r) {
       let s = { ...S };
       return e.jwtTokens.includes("id") && S.id_token && (s.id_payload = S.id_payload ?? j(S.id_token)), r.status(200).view(e.authorizedPage, s);
     } catch (s) {
-      const i = l.asCrossauthError(s);
-      return r.status(i.httpStatus).view(e.errorPage, {
-        status: i.httpStatus,
-        errorMessage: i.message,
-        errorCodeName: i.codeName
+      const t = l.asCrossauthError(s);
+      return r.status(t.httpStatus).view(e.errorPage, {
+        status: t.httpStatus,
+        errorMessage: t.message,
+        errorCodeName: t.codeName
       });
     }
 }
@@ -5701,12 +5704,12 @@ async function Ze(S, e, o, r) {
       return e.jwtTokens.includes("id") && (s.id_payload = S.id_payload ?? j(S.id_token)), r.status(200).view(e.authorizedPage, s);
     }
   } catch (s) {
-    const i = l.asCrossauthError(s);
-    if (d.logger.debug(c({ err: i })), d.logger.debug(c({ cerr: i, msg: "Error receiving tokens" })), r)
-      return r.status(i.httpStatus).view(e.errorPage, {
-        status: i.httpStatus,
-        errorMessage: i.message,
-        errorCodeName: i.codeName
+    const t = l.asCrossauthError(s);
+    if (d.logger.debug(c({ err: t })), d.logger.debug(c({ cerr: t, msg: "Error receiving tokens" })), r)
+      return r.status(t.httpStatus).view(e.errorPage, {
+        status: t.httpStatus,
+        errorMessage: t.message,
+        errorCodeName: t.codeName
       });
   }
 }
@@ -5717,19 +5720,19 @@ async function Se(S, e, o, r) {
   );
   let s = S.expires_in;
   if (!s && S.access_token && e.jwtTokens.includes("access")) {
-    const t = J(S.access_token);
-    t.exp && (s = t.exp);
+    const i = J(S.access_token);
+    i.exp && (s = i.exp);
   }
   if (!s)
     throw new l(
       g.BadRequest,
       "OAuth server did not return an expiry for the access token"
     );
-  const i = Date.now() + s * 1e3;
-  let n = { ...S, expires_at: i };
+  const t = Date.now() + s * 1e3;
+  let n = { ...S, expires_at: t };
   if ("id_token" in S) {
-    let t = S.id_payload ?? j(S.id_token);
-    t && (n.id_token = t);
+    let i = S.id_payload ?? j(S.id_token);
+    i && (n.id_token = i);
   }
   await e.storeSessionData(n, o, r);
 }
@@ -5757,12 +5760,12 @@ async function qe(S, e, o, r) {
         errorCode: g.Configuration
       });
   } catch (s) {
-    const i = l.asCrossauthError(s);
-    if (d.logger.debug(c({ err: i })), d.logger.debug(c({ cerr: i, msg: "Error receiving tokens" })), r)
-      return r.status(i.httpStatus).view(e.errorPage, {
-        status: i.httpStatus,
-        errorMessage: i.message,
-        errorCodeName: i.codeName
+    const t = l.asCrossauthError(s);
+    if (d.logger.debug(c({ err: t })), d.logger.debug(c({ cerr: t, msg: "Error receiving tokens" })), r)
+      return r.status(t.httpStatus).view(e.errorPage, {
+        status: t.httpStatus,
+        errorMessage: t.message,
+        errorCodeName: t.codeName
       });
   }
 }
@@ -5774,7 +5777,7 @@ class we extends Oe {
    * @param options See {@link FastifyOAuthClientOptions}
    */
   constructor(o, r, s) {
-    var i, n, t;
+    var t, n, i;
     super(r, s);
     u(this, "server");
     u(this, "siteUrl", "/");
@@ -5814,7 +5817,7 @@ class we extends Oe {
     u(this, "bffEndpointName", "bff");
     u(this, "bffBaseUrl");
     u(this, "tokenEndpoints", []);
-    if (this.server = o, C("sessionDataName", k.String, this, s, "OAUTH_SESSION_DATA_NAME"), C("siteUrl", k.String, this, s, "SITE_URL", !0), C("tokenResponseType", k.String, this, s, "OAUTH_TOKEN_RESPONSE_TYPE"), C("errorResponseType", k.String, this, s, "OAUTH_ERROR_RESPONSE_TYPE"), C("prefix", k.String, this, s, "PREFIX"), this.prefix.endsWith("/") || (this.prefix += "/"), C("loginUrl", k.String, this, s, "LOGIN_URL"), C("errorPage", k.String, this, s, "ERROR_PAGE"), C("authorizedPage", k.String, this, s, "AUTHORIZED_PAGE"), C("authorizedUrl", k.String, this, s, "AUTHORIZED_URL"), C("loginProtectedFlows", k.JsonArray, this, s, "OAUTH_LOGIN_PROTECTED_FLOWS"), C("passwordFlowUrl", k.String, this, s, "OAUTH_PASSWORD_FLOW_URL"), C("passwordOtpUrl", k.String, this, s, "OAUTH_PASSWORD_OTP_URL"), C("passwordOobUrl", k.String, this, s, "OAUTH_PASSWORD_OOB_URL"), C("passwordFlowPage", k.String, this, s, "OAUTH_PASSWORD_FLOW_PAGE"), C("deviceCodeFlowPage", k.String, this, s, "OAUTH_DEVICECODE_FLOW_PAGE"), C("deleteTokensPage", k.String, this, s, "OAUTH_DELETE_TOKENS_PAGE"), C("deleteTokensGetUrl", k.String, this, s, "OAUTH_DELETE_TOKENS_GET_URL"), C("deleteTokensPostUrl", k.String, this, s, "OAUTH_DELETE_TOKENS_POST_URL"), C("apiDeleteTokensPostUrl", k.String, this, s, "OAUTHAPI__DELETE_TOKENS_POST_URL"), C("mfaOtpPage", k.String, this, s, "OAUTH_MFA_OTP_PAGE"), C("mfaOobPage", k.String, this, s, "OAUTH_MFA_OOB_PAGE"), C("deviceCodeFlowUrl", k.String, this, s, "OAUTH_DEVICECODE_FLOW_URL"), C("deviceCodePollUrl", k.String, this, s, "OAUTH_DEVICECODE_POLL_URL"), C("bffEndpointName", k.String, this, s, "OAUTH_BFF_ENDPOINT_NAME"), C("bffBaseUrl", k.String, this, s, "OAUTH_BFF_BASEURL"), C("validFlows", k.JsonArray, this, s, "OAUTH_VALIDFLOWS"), C("jwtTokens", k.JsonArray, this, s, "OAUTH_JWT_TOKENS"), (i = this.deleteTokensGetUrl) != null && i.startsWith("/") && (this.deleteTokensGetUrl = this.deleteTokensGetUrl.substring(1)), (n = this.deleteTokensPostUrl) != null && n.startsWith("/") && (this.deleteTokensPostUrl = this.deleteTokensPostUrl.substring(1)), (t = this.deleteTokensPostUrl) != null && t.startsWith("/") && (this.deleteTokensPostUrl = this.deleteTokensPostUrl.substring(1)), this.validFlows.length == 1 && this.validFlows[0] == E.All)
+    if (this.server = o, C("sessionDataName", k.String, this, s, "OAUTH_SESSION_DATA_NAME"), C("siteUrl", k.String, this, s, "SITE_URL", !0), C("tokenResponseType", k.String, this, s, "OAUTH_TOKEN_RESPONSE_TYPE"), C("errorResponseType", k.String, this, s, "OAUTH_ERROR_RESPONSE_TYPE"), C("prefix", k.String, this, s, "PREFIX"), this.prefix.endsWith("/") || (this.prefix += "/"), C("loginUrl", k.String, this, s, "LOGIN_URL"), C("errorPage", k.String, this, s, "ERROR_PAGE"), C("authorizedPage", k.String, this, s, "AUTHORIZED_PAGE"), C("authorizedUrl", k.String, this, s, "AUTHORIZED_URL"), C("loginProtectedFlows", k.JsonArray, this, s, "OAUTH_LOGIN_PROTECTED_FLOWS"), C("passwordFlowUrl", k.String, this, s, "OAUTH_PASSWORD_FLOW_URL"), C("passwordOtpUrl", k.String, this, s, "OAUTH_PASSWORD_OTP_URL"), C("passwordOobUrl", k.String, this, s, "OAUTH_PASSWORD_OOB_URL"), C("passwordFlowPage", k.String, this, s, "OAUTH_PASSWORD_FLOW_PAGE"), C("deviceCodeFlowPage", k.String, this, s, "OAUTH_DEVICECODE_FLOW_PAGE"), C("deleteTokensPage", k.String, this, s, "OAUTH_DELETE_TOKENS_PAGE"), C("deleteTokensGetUrl", k.String, this, s, "OAUTH_DELETE_TOKENS_GET_URL"), C("deleteTokensPostUrl", k.String, this, s, "OAUTH_DELETE_TOKENS_POST_URL"), C("apiDeleteTokensPostUrl", k.String, this, s, "OAUTHAPI__DELETE_TOKENS_POST_URL"), C("mfaOtpPage", k.String, this, s, "OAUTH_MFA_OTP_PAGE"), C("mfaOobPage", k.String, this, s, "OAUTH_MFA_OOB_PAGE"), C("deviceCodeFlowUrl", k.String, this, s, "OAUTH_DEVICECODE_FLOW_URL"), C("deviceCodePollUrl", k.String, this, s, "OAUTH_DEVICECODE_POLL_URL"), C("bffEndpointName", k.String, this, s, "OAUTH_BFF_ENDPOINT_NAME"), C("bffBaseUrl", k.String, this, s, "OAUTH_BFF_BASEURL"), C("validFlows", k.JsonArray, this, s, "OAUTH_VALIDFLOWS"), C("jwtTokens", k.JsonArray, this, s, "OAUTH_JWT_TOKENS"), (t = this.deleteTokensGetUrl) != null && t.startsWith("/") && (this.deleteTokensGetUrl = this.deleteTokensGetUrl.substring(1)), (n = this.deleteTokensPostUrl) != null && n.startsWith("/") && (this.deleteTokensPostUrl = this.deleteTokensPostUrl.substring(1)), (i = this.deleteTokensPostUrl) != null && i.startsWith("/") && (this.deleteTokensPostUrl = this.deleteTokensPostUrl.substring(1)), this.validFlows.length == 1 && this.validFlows[0] == E.All)
       this.validFlows = E.allFlows();
     else if (!E.areAllValidFlows(this.validFlows))
       throw new l(g.Configuration, "Invalid flows specificied in " + this.validFlows.join(","));
@@ -6465,14 +6468,14 @@ class we extends Oe {
     }
   }
   async passwordPost(o, r, s) {
-    var i;
+    var t;
     if (this.server.sessionAdapter) {
-      const { error: n, reply: t } = await this.server.errorIfCsrfInvalid(
+      const { error: n, reply: i } = await this.server.errorIfCsrfInvalid(
         r,
         s,
         this.errorFn
       );
-      if (n) return t;
+      if (n) return i;
     }
     try {
       let n = await this.passwordFlow(
@@ -6481,10 +6484,10 @@ class we extends Oe {
         r.body.scope
       );
       if (n.error == "mfa_required" && n.mfa_token && this.validFlows.includes(E.PasswordMfa)) {
-        const t = n.mfa_token;
+        const i = n.mfa_token;
         if (n = await this.passwordMfa(
           o,
-          t,
+          i,
           r.body.scope,
           r,
           s
@@ -6514,56 +6517,56 @@ class we extends Oe {
         }
         return await this.receiveTokenFn(n, this, r, s);
       } else if (n.error) {
-        const t = l.fromOAuthError(
+        const i = l.fromOAuthError(
           n.error,
           n.error_description
         );
-        return o ? await this.errorFn(this.server, r, s, t) : s.view(
+        return o ? await this.errorFn(this.server, r, s, i) : s.view(
           this.passwordFlowPage,
           {
             user: r.user,
             username: r.body.username,
             //password: request.body.password,
             scope: r.body.scope,
-            errorMessage: t.message,
-            errorCode: t.code,
-            errorCodeName: t.codeName,
+            errorMessage: i.message,
+            errorCode: i.code,
+            errorCodeName: i.codeName,
             csrfToken: r.csrfToken
           }
         );
       }
       return await this.receiveTokenFn(n, this, r, s);
     } catch (n) {
-      const t = l.asCrossauthError(n);
+      const i = l.asCrossauthError(n);
       return d.logger.error(c({
         msg: "Error receiving token",
-        cerr: t,
-        user: (i = r.user) == null ? void 0 : i.user
+        cerr: i,
+        user: (t = r.user) == null ? void 0 : t.user
       })), d.logger.debug(c({ err: n })), o ? await this.errorFn(
         this.server,
         r,
         s,
-        t
+        i
       ) : s.view(this.passwordFlowPage, {
         user: r.user,
         username: r.body.username,
         password: r.body.password,
         scope: r.body.scope,
-        errorMessage: t.message,
-        errorCode: t.code,
-        errorCodeName: t.codeName,
+        errorMessage: i.message,
+        errorCode: i.code,
+        errorCodeName: i.codeName,
         csrfToken: r.csrfToken
       });
     }
   }
-  async passwordMfa(o, r, s, i, n) {
-    const t = await this.mfaAuthenticators(r);
-    if (t.error || !t.authenticators || !Array.isArray(t.authenticators) || t.authenticators.length == 0 || t.authenticators.length > 1 && !t.authenticators[0].active)
-      return t.error ? t : {
+  async passwordMfa(o, r, s, t, n) {
+    const i = await this.mfaAuthenticators(r);
+    if (i.error || !i.authenticators || !Array.isArray(i.authenticators) || i.authenticators.length == 0 || i.authenticators.length > 1 && !i.authenticators[0].active)
+      return i.error ? i : {
         error: "access_denied",
         error_description: "No MFA authenticators available"
       };
-    const a = t.authenticators[0];
+    const a = i.authenticators[0];
     if (a.authenticator_type == "otp") {
       const f = await this.mfaOtpRequest(r, a.id);
       return f.error || f.challenge_type != "otp" ? {
@@ -6599,60 +6602,60 @@ class we extends Oe {
   }
   async passwordOtp(o, r, s) {
     var n;
-    const i = await this.mfaOtpComplete(
+    const t = await this.mfaOtpComplete(
       r.body.mfa_token,
       r.body.otp
     );
-    if (i.error) {
-      const t = l.fromOAuthError(
-        i.error,
-        i.error_description ?? "Error completing MFA"
+    if (t.error) {
+      const i = l.fromOAuthError(
+        t.error,
+        t.error_description ?? "Error completing MFA"
       );
       return d.logger.warn(c({
         msg: "Error completing MFA",
-        cerr: t,
+        cerr: i,
         user: (n = r.user) == null ? void 0 : n.user,
         hashedMfaToken: F.hash(r.body.mfa_token)
-      })), d.logger.debug(c({ err: t })), o ? await this.errorFn(
+      })), d.logger.debug(c({ err: i })), o ? await this.errorFn(
         this.server,
         r,
         s,
-        t
+        i
       ) : s.view(this.mfaOtpPage, {
         user: r.user,
         scope: r.body.scope,
         mfa_token: r.body.mfa_token,
         challenge_tpye: r.body.challenge_type,
-        errorMessage: t.message,
-        errorCode: t.code,
-        errorCodeName: t.codeName,
+        errorMessage: i.message,
+        errorCode: i.code,
+        errorCodeName: i.codeName,
         csrfToken: r.csrfToken
       });
     }
-    return await this.receiveTokenFn(i, this, r, s) ?? s;
+    return await this.receiveTokenFn(t, this, r, s) ?? s;
   }
   async passwordOob(o, r, s) {
     var n;
-    const i = await this.mfaOobComplete(
+    const t = await this.mfaOobComplete(
       r.body.mfa_token,
       r.body.oob_code,
       r.body.binding_code
     );
-    if (i.error) {
-      const t = l.fromOAuthError(
-        i.error,
-        i.error_description ?? "Error completing MFA"
+    if (t.error) {
+      const i = l.fromOAuthError(
+        t.error,
+        t.error_description ?? "Error completing MFA"
       );
       return d.logger.warn(c({
         msg: "Error completing MFA",
-        cerr: t,
+        cerr: i,
         user: (n = r.user) == null ? void 0 : n.user,
         hashedMfaToken: F.hash(r.body.mfa_token)
-      })), d.logger.debug(c({ err: t })), o ? await this.errorFn(
+      })), d.logger.debug(c({ err: i })), o ? await this.errorFn(
         this.server,
         r,
         s,
-        t
+        i
       ) : s.view(this.mfaOobPage, {
         user: r.user,
         scope: r.body.scope,
@@ -6660,70 +6663,70 @@ class we extends Oe {
         name: r.body.name,
         challenge_tpye: r.body.challenge_type,
         mfa_token: r.body.mfa_token,
-        errorMessage: t.message,
-        errorCode: t.code,
-        errorCodeName: t.codeName,
+        errorMessage: i.message,
+        errorCode: i.code,
+        errorCodeName: i.codeName,
         csrfToken: r.csrfToken
       });
     }
-    return await this.receiveTokenFn(i, this, r, s) ?? s;
+    return await this.receiveTokenFn(t, this, r, s) ?? s;
   }
   async deviceCodePost(o, r, s) {
-    var i;
+    var t;
     if (this.server.sessionAdapter) {
-      const { error: n, reply: t } = await this.server.errorIfCsrfInvalid(
+      const { error: n, reply: i } = await this.server.errorIfCsrfInvalid(
         r,
         s,
         this.errorFn
       );
-      if (n) return t;
+      if (n) return i;
     }
     try {
       if (!r.csrfToken)
         throw new l(g.Unauthorized, "CSRF token missing or invalid");
       let n = this.authServerBaseUrl;
       n.endsWith("/") || (n += "/"), n += this.deviceAuthorizationUrl;
-      const t = await this.startDeviceCodeFlow(n, r.body.scope);
-      if (t.error) {
-        const h = l.fromOAuthError(t.error, t.error_description), f = {
+      const i = await this.startDeviceCodeFlow(n, r.body.scope);
+      if (i.error) {
+        const h = l.fromOAuthError(i.error, i.error_description), f = {
           user: r.user,
           scope: r.body.scope,
           errorMessage: h.message,
           errorCode: h.code,
           errorCodeName: h.codeName,
           csrfToken: r.csrfToken,
-          error: t.error,
-          error_description: t.error_description
+          error: i.error,
+          error_description: i.error_description
         };
-        return o ? s.header(..._).status(h.httpStatus).send(t) : s.view(this.deviceCodeFlowPage, f);
+        return o ? s.header(..._).status(h.httpStatus).send(i) : s.view(this.deviceCodeFlowPage, f);
       }
       let a;
-      return t.verification_uri_complete && await Re.toDataURL(t.verification_uri_complete).then((h) => {
+      return i.verification_uri_complete && await Re.toDataURL(i.verification_uri_complete).then((h) => {
         a = h;
       }).catch((h) => {
         d.logger.debug(c({ err: h })), d.logger.warn(c({ msg: "Couldn't generate verification URL QR Code" }));
-      }), o ? s.header(..._).send(t) : s.view(
+      }), o ? s.header(..._).send(i) : s.view(
         this.deviceCodeFlowPage,
         {
           user: r.user,
           scope: r.body.scope,
           verification_uri_qrdata: a,
-          ...t
+          ...i
         }
       );
     } catch (n) {
-      const t = l.asCrossauthError(n);
+      const i = l.asCrossauthError(n);
       d.logger.error(c({
         msg: "Error receiving token",
-        cerr: t,
-        user: (i = r.user) == null ? void 0 : i.user
+        cerr: i,
+        user: (t = r.user) == null ? void 0 : t.user
       })), d.logger.debug(c({ err: n }));
       const a = {
-        errorMessage: t.message,
-        errorCode: t.code,
-        errorCodeName: t.codeName
+        errorMessage: i.message,
+        errorCode: i.code,
+        errorCodeName: i.codeName
       };
-      return o ? s.header(..._).status(t.httpStatus).send(a) : s.view(this.deviceCodeFlowPage, {
+      return o ? s.header(..._).status(i.httpStatus).send(a) : s.view(this.deviceCodeFlowPage, {
         user: r.user,
         csrfToken: r.csrfToken,
         scope: r.body.scope,
@@ -6732,7 +6735,7 @@ class we extends Oe {
     }
   }
   async deviceCodePoll(o, r, s) {
-    var i;
+    var t;
     try {
       const n = await this.pollDeviceCodeFlow(r.body.device_code);
       return n.error ? s.header(..._).send(n) : await this.receiveTokenFn(
@@ -6742,28 +6745,28 @@ class we extends Oe {
         o ? void 0 : s
       );
     } catch (n) {
-      const t = l.asCrossauthError(n);
+      const i = l.asCrossauthError(n);
       return d.logger.error(c({
         msg: "Error receiving token",
-        cerr: t,
-        user: (i = r.user) == null ? void 0 : i.user
+        cerr: i,
+        user: (t = r.user) == null ? void 0 : t.user
       })), d.logger.debug(c({ err: n })), await this.errorFn(
         this.server,
         r,
         s,
-        t
+        i
       );
     }
   }
-  async refresh(o, r, s, i, n, t) {
-    if (!t || !n)
+  async refresh(o, r, s, t, n, i) {
+    if (!i || !n)
       return s ? void 0 : await this.receiveTokenFn(
         {},
         this,
         o,
         s ? void 0 : r
       );
-    if (!i || t <= Date.now())
+    if (!t || i <= Date.now())
       try {
         const a = await this.refreshTokenFlow(n);
         if (!a.error && !a.access_token && (a.error = "server_error", a.error_description = "Unexpectedly did not receive error or access token"), !a.error) {
@@ -6815,7 +6818,7 @@ class we extends Oe {
         };
       }
   }
-  async refreshTokens(o, r, s, i) {
+  async refreshTokens(o, r, s, t) {
     if (!o.csrfToken)
       return r.header(..._).status(401).send({ ok: !1, msg: "No csrf token given" });
     if (!this.server.sessionAdapter) throw new l(
@@ -6839,20 +6842,20 @@ class we extends Oe {
         );
       }
     }
-    const t = await this.refresh(
+    const i = await this.refresh(
       o,
       r,
       s,
-      i,
+      t,
       n.refresh_token,
       //onlyIfExpired ? oauthData.expires_at : undefined
       n.expires_at
     );
     if (!s) {
-      if (t == null) return this.receiveTokenFn({}, this, o, r);
-      if (t != null) return t;
+      if (i == null) return this.receiveTokenFn({}, this, o, r);
+      if (i != null) return i;
     }
-    return r.header(..._).status(200).send({ ok: !0, expires_at: t == null ? void 0 : t.expires_at });
+    return r.header(..._).status(200).send({ ok: !0, expires_at: i == null ? void 0 : i.expires_at });
   }
   async deleteTokens(o) {
     if (!this.server.sessionAdapter) throw new l(
@@ -6871,14 +6874,14 @@ class we extends Oe {
     await this.server.sessionAdapter.deleteSessionData(o, this.sessionDataName);
   }
   async storeSessionData(o, r, s) {
-    var i;
+    var t;
     if (this.server.sessionServer) {
       let n = this.server.sessionServer.getSessionCookieValue(r);
       !n && s ? n = await this.server.createAnonymousSession(
         r,
         s,
         { [this.sessionDataName]: o }
-      ) : await ((i = this.server.sessionAdapter) == null ? void 0 : i.updateSessionData(r, this.sessionDataName, o));
+      ) : await ((t = this.server.sessionAdapter) == null ? void 0 : t.updateSessionData(r, this.sessionDataName, o));
     } else {
       if (!this.server.sessionAdapter) throw new l(
         g.Configuration,
@@ -6905,65 +6908,65 @@ class er extends Ie {
     u(this, "tokenLocations", ["header"]);
     u(this, "sessionAdapter");
     if (C("errorBody", k.Json, this, s, "OAUTH_RESSERVER_ACCESS_DENIED_BODY"), C("tokenLocations", k.JsonArray, this, s, "OAUTH_TOKEN_LOCATIONS"), C("sessionDataName", k.String, this, s, "OAUTH_SESSION_DATA_NAME"), this.userStorage = s.userStorage, this.sessionAdapter = s.sessionAdapter, s.protectedEndpoints) {
-      const i = /^[!#\$%&'\(\)\*\+,\.\/a-zA-Z\[\]\^_`-]+/;
-      for (const [n, t] of Object.entries(s.protectedEndpoints)) {
+      const t = /^[!#\$%&'\(\)\*\+,\.\/a-zA-Z\[\]\^_`-]+/;
+      for (const [n, i] of Object.entries(s.protectedEndpoints)) {
         if (!n.startsWith("/"))
           throw new l(g.Configuration, "protected endpoints must be absolute paths without the protocol and hostname");
-        t.scope && t.scope.forEach((a) => {
-          if (!i.test(a)) throw new l(g.Configuration, "Illegal characters in scope " + a);
+        i.scope && i.scope.forEach((a) => {
+          if (!t.test(a)) throw new l(g.Configuration, "Illegal characters in scope " + a);
         });
       }
       this.protectedEndpoints = { ...s.protectedEndpoints };
       for (let n in s.protectedEndpoints) {
-        let t = this.protectedEndpoints[n];
-        t.suburls == !0 && (n.endsWith("/") || (n += "/", this.protectedEndpoints[n] = t), this.protectedEndpointPrefixes.push(n));
+        let i = this.protectedEndpoints[n];
+        i.suburls == !0 && (n.endsWith("/") || (n += "/", this.protectedEndpoints[n] = i), this.protectedEndpointPrefixes.push(n));
       }
     }
-    s.protectedEndpoints && o.addHook("preHandler", async (i, n) => {
+    s.protectedEndpoints && o.addHook("preHandler", async (t, n) => {
       var p, v;
-      const t = i.url.split("?", 2)[0];
+      const i = t.url.split("?", 2)[0];
       let a = !1, h = "";
-      if (t in this.protectedEndpoints)
-        a = !0, h = t;
+      if (i in this.protectedEndpoints)
+        a = !0, h = i;
       else
         for (let m of this.protectedEndpointPrefixes)
-          t.startsWith(m) && (a = !0), h = m;
+          i.startsWith(m) && (a = !0), h = m;
       if (!a) return;
-      const f = await this.authorized(i);
-      if (!(i.user && i.authType == "cookie" && this.protectedEndpoints[h].acceptSessionAuthorization != !0)) {
+      const f = await this.authorized(t);
+      if (!(t.user && t.authType == "cookie" && this.protectedEndpoints[h].acceptSessionAuthorization != !0)) {
         if (!f) {
-          i.authError = "access_denied", i.authErrorDescription = "No access token";
-          const m = this.authenticateHeader(i);
+          t.authError = "access_denied", t.authErrorDescription = "No access token";
+          const m = this.authenticateHeader(t);
           return n.header("WWW-Authenticate", m).status(401).send(this.errorBody);
         }
         if (!f.authorized) {
-          const m = this.authenticateHeader(i);
+          const m = this.authenticateHeader(t);
           return n.header("WWW-Authenticate", m).status(401).send(this.errorBody);
         }
       }
       if (f) {
-        if (i.accessTokenPayload = f.tokenPayload, i.user = f.user, (p = f.tokenPayload) != null && p.scope)
+        if (t.accessTokenPayload = f.tokenPayload, t.user = f.user, (p = f.tokenPayload) != null && p.scope)
           if (Array.isArray(f.tokenPayload.scope)) {
             let m = [];
             for (let w of f.tokenPayload.scope)
               typeof w == "string" && m.push(w);
-            i.scope = m;
-          } else typeof f.tokenPayload.scope == "string" && (i.scope = f.tokenPayload.scope.split(" "));
+            t.scope = m;
+          } else typeof f.tokenPayload.scope == "string" && (t.scope = f.tokenPayload.scope.split(" "));
         if (this.protectedEndpoints[h].scope) {
           for (let m of this.protectedEndpoints[h].scope ?? [])
-            if (!i.scope || !i.scope.includes(m) && this.protectedEndpoints[h].acceptSessionAuthorization != !0)
+            if (!t.scope || !t.scope.includes(m) && this.protectedEndpoints[h].acceptSessionAuthorization != !0)
               return d.logger.warn(c({
                 msg: "Access token does not have sufficient scope",
-                username: (v = i.user) == null ? void 0 : v.username,
-                url: i.url
-              })), i.scope = void 0, i.accessTokenPayload = void 0, i.user = void 0, i.authError = "access_denied", i.authErrorDescription = "Access token does not have sufficient scope", n.status(401).send(this.errorBody);
+                username: (v = t.user) == null ? void 0 : v.username,
+                url: t.url
+              })), t.scope = void 0, t.accessTokenPayload = void 0, t.user = void 0, t.authError = "access_denied", t.authErrorDescription = "Access token does not have sufficient scope", n.status(401).send(this.errorBody);
         }
-        if (i.authType = "oauth", i.authError = f == null ? void 0 : f.error, (f == null ? void 0 : f.error) == "access_denied") {
-          const m = this.authenticateHeader(i);
+        if (t.authType = "oauth", t.authError = f == null ? void 0 : f.error, (f == null ? void 0 : f.error) == "access_denied") {
+          const m = this.authenticateHeader(t);
           return n.header("WWW-Authenticate", m).status(401).send(this.errorBody);
         } else if (f != null && f.error)
           return n.status(500).send(this.errorBody);
-        i.authErrorDescription = f == null ? void 0 : f.error_description, d.logger.debug(c({ msg: "Resource server url", url: i.url, authorized: i.accessTokenPayload != null }));
+        t.authErrorDescription = f == null ? void 0 : f.error_description, d.logger.debug(c({ msg: "Resource server url", url: t.url, authorized: t.accessTokenPayload != null }));
       }
     });
   }
@@ -6989,8 +6992,8 @@ class er extends Ie {
   async authorized(o) {
     try {
       let r;
-      for (let i of this.tokenLocations)
-        if (i == "header") {
+      for (let t of this.tokenLocations)
+        if (t == "header") {
           const n = await this.tokenFromHeader(o);
           if (n) {
             r = n;
@@ -7006,8 +7009,8 @@ class er extends Ie {
       let s;
       if (r) {
         if (r.sub && this.userStorage) {
-          const i = await this.userStorage.getUserByUsername(r.sub);
-          i && (s = i.user), o.user = s;
+          const t = await this.userStorage.getUserByUsername(r.sub);
+          t && (s = t.user), o.user = s;
         } else r.sub && (o.user = {
           id: r.userid ?? r.sub,
           username: r.sub,
@@ -7119,9 +7122,9 @@ const K = class K {
     sessionAdapter: o,
     apiKey: r,
     oAuthAuthServer: s,
-    oAuthClient: i,
+    oAuthClient: t,
     oAuthClients: n,
-    oAuthResServer: t
+    oAuthResServer: i
   }, a = {}) {
     u(this, "views", "views");
     /** The Fastify app, which was either passed in the constructor or
@@ -7201,12 +7204,12 @@ const K = class K {
         { ...f, ...a, ...s.options }
       );
     }
-    if (i && this.oAuthClients)
+    if (t && this.oAuthClients)
       throw new l(g.Configuration, "Do not use both oAuthClient and oAuthClients");
-    if (i && (this.oAuthClient = new we(
+    if (t && (this.oAuthClient = new we(
       this,
-      i.authServerBaseUrl,
-      { ...a, ...i.options }
+      t.authServerBaseUrl,
+      { ...a, ...t.options }
     )), n) {
       this.oAuthClients = [];
       for (let f of n)
@@ -7218,10 +7221,10 @@ const K = class K {
           )
         );
     }
-    t && (this.audience = "", C("audience", k.String, this, a, "OAUTH_AUDIENCE", !0), this.oAuthResServer = new er(
+    i && (this.audience = "", C("audience", k.String, this, a, "OAUTH_AUDIENCE", !0), this.oAuthResServer = new er(
       this.app,
       [new Me(this.audience, a)],
-      { sessionAdapter: this.sessionAdapter, ...t.options, ...a }
+      { sessionAdapter: this.sessionAdapter, ...i.options, ...a }
     ));
   }
   /**
@@ -7253,7 +7256,7 @@ const K = class K {
    * from calling `errorFn`.
    */
   async errorIfCsrfInvalid(e, o, r) {
-    var s, i;
+    var s, t;
     try {
       if (!e.csrfToken) throw new l(g.InvalidCsrf);
       return { error: !1, reply: o };
@@ -7264,23 +7267,23 @@ const K = class K {
       }));
       try {
         if (r) {
-          const t = l.asCrossauthError(n);
-          return { error: !0, reply: await r(this, e, o, t) };
+          const i = l.asCrossauthError(n);
+          return { error: !0, reply: await r(this, e, o, i) };
         } else if ((s = this.sessionServer) != null && s.errorPage) {
-          const t = new l(g.InvalidCsrf, "CSRF Token not provided");
+          const i = new l(g.InvalidCsrf, "CSRF Token not provided");
           return { error: !0, reply: o.status(401).view(
-            ((i = this.sessionServer) == null ? void 0 : i.errorPage) ?? "",
+            ((t = this.sessionServer) == null ? void 0 : t.errorPage) ?? "",
             {
-              errorMessage: t.message,
-              errorMessages: t.messages,
-              status: t.httpStatus,
+              errorMessage: i.message,
+              errorMessages: i.messages,
+              status: i.httpStatus,
               errorCode: g.InvalidCsrf,
               errorCodeName: g[g.InvalidCsrf]
             }
           ) };
         }
-      } catch (t) {
-        return d.logger.error(c({ err: t })), { error: !0, reply: o.status(401).send(z) };
+      } catch (i) {
+        return d.logger.error(c({ err: i })), { error: !0, reply: o.status(401).send(z) };
       }
       return { error: !0, reply: o.status(401).send(z) };
     }
@@ -7298,7 +7301,7 @@ const K = class K {
    * from calling `errorFn`.
    */
   async errorIfNotLoggedIn(e, o, r) {
-    var s, i, n;
+    var s, t, n;
     if (!e.user) {
       d.logger.warn(c({
         msg: "Attempt to access url without csrf token",
@@ -7306,14 +7309,14 @@ const K = class K {
       }));
       try {
         if (r) {
-          const t = new l(
+          const i = new l(
             g.Unauthorized,
             "User is not logged in"
           );
-          return await r(this, e, o, t);
+          return await r(this, e, o, i);
         } else if ((s = this.sessionServer) != null && s.errorPage)
           return o.status(401).view(
-            ((i = this.sessionServer) == null ? void 0 : i.errorPage) ?? "",
+            ((t = this.sessionServer) == null ? void 0 : t.errorPage) ?? "",
             {
               errorMessage: "User is not logged in",
               status: 401,
@@ -7321,9 +7324,9 @@ const K = class K {
               codeName: g[g.Unauthorized]
             }
           );
-      } catch (t) {
-        return d.logger.debug(c({ err: t })), d.logger.error(c({
-          cerr: t,
+      } catch (i) {
+        return d.logger.debug(c({ err: i })), d.logger.error(c({
+          cerr: i,
           hashedSessionCookie: (n = this.sessionServer) == null ? void 0 : n.getHashOfSessionId(e)
         })), o.status(401).send(z);
       }
@@ -7350,8 +7353,8 @@ const K = class K {
    * @returns the reply from rendering the error page.
    * 
    */
-  static sendPageError(e, o, r, s, i) {
-    if (!s || !i)
+  static sendPageError(e, o, r, s, t) {
+    if (!s || !t)
       return d.logger.warn(c({
         msg: s,
         errorCode: g.UnknownError,
@@ -7365,15 +7368,15 @@ const K = class K {
         }
       ) : e.status(o).send(o == 401 ? z : G);
     try {
-      let n = 0, t = "UnknownError";
-      if ("isCrossAuthError" in i) {
-        const a = l.asCrossauthError(i);
-        n = a.code, t = a.name, s || (s = i.message);
+      let n = 0, i = "UnknownError";
+      if ("isCrossAuthError" in t) {
+        const a = l.asCrossauthError(t);
+        n = a.code, i = a.name, s || (s = t.message);
       }
-      return s || (o == 401 ? (s = "You are not authorized to access this page", n = g.Unauthorized, t = g[n]) : o == 403 ? (s = "You do not have permission to access this page", n = g.Forbidden, t = g[n]) : s = "An unknwon error has occurred"), d.logger.warn(c({
+      return s || (o == 401 ? (s = "You are not authorized to access this page", n = g.Unauthorized, i = g[n]) : o == 403 ? (s = "You do not have permission to access this page", n = g.Forbidden, i = g[n]) : s = "An unknwon error has occurred"), d.logger.warn(c({
         msg: s,
         errorCode: n,
-        errorCodeName: t,
+        errorCodeName: i,
         httpStatus: o
       })), r ? e.status(o).view(
         r,
@@ -7381,7 +7384,7 @@ const K = class K {
           status: o,
           errorMessage: s,
           errorCode: n,
-          errorCodeName: t
+          errorCodeName: i
         }
       ) : e.status(o).send(o == 401 ? z : G);
     } catch (n) {