@crossauth/fastify 1.1.8 → 1.1.9

package/dist/index.js

@@ -7,11 +7,11 @@ import ye from "@fastify/formbody";
 import be from "@fastify/cors";
 import _e from "@fastify/cookie";
 import ue from "nunjucks";
-import { setParameter as C, ParamType as k, Crypto as F, TokenEmailer as xe, OAuthClientManager as L, SessionManager as Ae, ApiKeyManager as Y, KeyStorage as Fe, OAuthAuthorizationServer as Ne, DoubleSubmitCsrfToken as Ue, OAuthClientBackend as Oe, OAuthResourceServer as Ie, OAuthTokenConsumer as Me } from "@crossauth/backend";
-import { CrossauthLogger as d, j as c, CrossauthError as l, ErrorCode as g, UserState as O, OAuthFlows as E } from "@crossauth/common";
-import { jwtDecode as J } from "jwt-decode";
+import { setParameter as C, ParamType as k, Crypto as N, TokenEmailer as xe, OAuthClientManager as L, SessionManager as Ae, ApiKeyManager as Y, KeyStorage as Fe, OAuthAuthorizationServer as Ne, DoubleSubmitCsrfToken as Ue, OAuthClientBackend as Oe, OAuthResourceServer as Ie, OAuthTokenConsumer as Me } from "@crossauth/backend";
+import { CrossauthLogger as d, j as c, CrossauthError as l, ErrorCode as g, UserState as I, OAuthFlows as E } from "@crossauth/common";
+import { jwtDecode as K } from "jwt-decode";
 import Re from "qrcode";
-const U = ["Content-Type", "application/json; charset=utf-8"];
+const O = ["Content-Type", "application/json; charset=utf-8"];
 class De {
   /**
    * Constructor.
@@ -93,23 +93,23 @@ class De {
           return await this.updateUser(
             e,
             o,
-            (r, i, n) => {
-              const t = n ? "Please click on the link in your email to verify your email address." : "Your details have been updated";
+            (r, t, n) => {
+              const i = n ? "Please click on the link in your email to verify your email address." : "Your details have been updated";
               return r.view(this.updateUserPage, {
                 csrfToken: e.csrfToken,
-                message: t,
+                message: i,
                 urlPrefix: this.prefix,
                 allowedFactor2: this.sessionServer.allowedFactor2Details()
               });
             }
           );
         } catch (r) {
-          const i = l.asCrossauthError(r);
-          d.logger.error(c({ message: "Update user failure", user: e.body.username, errorCodeName: i.codeName, errorCode: i.code })), d.logger.debug(c({ err: r }));
+          const t = l.asCrossauthError(r);
+          d.logger.error(c({ message: "Update user failure", user: e.body.username, errorCodeName: t.codeName, errorCode: t.code })), d.logger.debug(c({ err: r }));
           let n = {};
-          for (let t in e.body)
-            t.startsWith("user_") && (n[t] = e.body[t]);
-          return this.sessionServer.handleError(r, e, o, (t, a) => t.view(this.updateUserPage, {
+          for (let i in e.body)
+            i.startsWith("user_") && (n[i] = e.body[i]);
+          return this.sessionServer.handleError(r, e, o, (i, a) => i.view(this.updateUserPage, {
             user: e.user,
             errorMessage: a.message,
             errorMessages: a.messages,
@@ -144,20 +144,20 @@ class De {
           return await this.updateUser(
             e,
             o,
-            (i, n, t) => i.header(...U).send({
+            (t, n, i) => t.header(...O).send({
               ok: !0,
-              emailVerificationRequired: t
+              emailVerificationRequired: i
             })
           );
-        } catch (i) {
-          const n = l.asCrossauthError(i);
+        } catch (t) {
+          const n = l.asCrossauthError(t);
           return d.logger.error(c({
             message: "Update user failure",
             user: (r = e.user) == null ? void 0 : r.username,
             errorCodeName: n.codeName,
             errorCode: n.code
-          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, a) => {
-            t.status(this.sessionServer.errorStatus(i)).header(...U).send({
+          })), d.logger.debug(c({ err: t })), this.sessionServer.handleError(t, e, o, (i, a) => {
+            i.status(this.sessionServer.errorStatus(t)).header(...O).send({
               ok: !1,
               errorMessage: a.message,
               errorMessages: a.messages,
@@ -176,7 +176,7 @@ class De {
     this.sessionServer.app.get(
       this.prefix + "changefactor2",
       async (e, o) => {
-        var r, i;
+        var r, t;
         if (d.logger.info(c({
           message: "Page visit",
           method: "GET",
@@ -197,7 +197,7 @@ class De {
           csrfToken: e.csrfToken,
           next: e.query.next ?? this.sessionServer.loginRedirect,
           allowedFactor2: this.sessionServer.allowedFactor2Details(),
-          factor2: ((i = e.user) == null ? void 0 : i.factor2) ?? "none",
+          factor2: ((t = e.user) == null ? void 0 : t.factor2) ?? "none",
           required: e.query.required ?? !1
         };
         return o.view(this.changeFactor2Page, s);
@@ -213,8 +213,8 @@ class De {
           ip: e.ip,
           user: (s = e.user) == null ? void 0 : s.username
         })), !this.sessionServer.isSessionUser(e) || !e.user) {
-          const i = await this.sessionServer.getSessionData(e, "factor2change");
-          if (!(i != null && i.username) && !this.sessionServer.isSessionUser(e))
+          const t = await this.sessionServer.getSessionData(e, "factor2change");
+          if (!(t != null && t.username) && !this.sessionServer.isSessionUser(e))
             return y.sendPageError(
               o,
               401,
@@ -225,26 +225,26 @@ class De {
           return await this.changeFactor2(
             e,
             o,
-            (i, n, t) => n.factor2 ? i.view(this.configureFactor2Page, {
+            (t, n, i) => n.factor2 ? t.view(this.configureFactor2Page, {
               csrfToken: n.csrfToken,
               next: e.body.next ?? this.sessionServer.loginRedirect,
               ...n.userData
-            }) : i.view(this.configureFactor2Page, {
+            }) : t.view(this.configureFactor2Page, {
               message: "Two factor authentication has been updated",
               next: e.body.next ?? this.sessionServer.loginRedirect,
               csrfToken: n.csrfToken
             })
           );
-        } catch (i) {
-          const n = l.asCrossauthError(i);
+        } catch (t) {
+          const n = l.asCrossauthError(t);
           return d.logger.error(c({
             message: "Change two factor authentication failure",
             user: (r = e.user) == null ? void 0 : r.username,
             errorCodeName: n.codeName,
             errorCode: n.code
-          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, a) => {
+          })), d.logger.debug(c({ err: t })), this.sessionServer.handleError(t, e, o, (i, a) => {
             var h;
-            return t.view(this.changeFactor2Page, {
+            return i.view(this.changeFactor2Page, {
               errorMessage: a.message,
               errorMessages: a.messages,
               errorCode: a.code,
@@ -280,19 +280,19 @@ class De {
           return await this.changeFactor2(
             e,
             o,
-            (i, n, t) => i.header(...U).send({
+            (t, n, i) => t.header(...O).send({
               ok: !0,
               ...n.userData
             })
           );
-        } catch (i) {
-          const n = l.asCrossauthError(i);
+        } catch (t) {
+          const n = l.asCrossauthError(t);
           return d.logger.error(c({
             message: "Change factor2 failure",
             user: (r = e.user) == null ? void 0 : r.username,
             errorCodeName: n.codeName,
             errorCode: n.code
-          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, a) => t.status(this.sessionServer.errorStatus(i)).header(...U).send({
+          })), d.logger.debug(c({ err: t })), this.sessionServer.handleError(t, e, o, (i, a) => i.status(this.sessionServer.errorStatus(t)).header(...O).send({
             ok: !1,
             errorMessage: a.message,
             errorMessages: a.messages,
@@ -318,8 +318,8 @@ class De {
           ip: e.ip,
           user: (r = e.user) == null ? void 0 : r.username
         })), !this.sessionServer.isSessionUser(e) || !e.user) {
-          const i = await this.sessionServer.getSessionData(e, "passwordchange");
-          if ((i == null ? void 0 : i.username) == null && !this.sessionServer.isSessionUser(e))
+          const t = await this.sessionServer.getSessionData(e, "passwordchange");
+          if ((t == null ? void 0 : t.username) == null && !this.sessionServer.isSessionUser(e))
             return y.sendPageError(
               o,
               401,
@@ -349,7 +349,7 @@ class De {
           return await this.changePassword(
             e,
             o,
-            (i, n) => e.body.next ? i.redirect(e.body.next) : i.view(this.changePasswordPage, {
+            (t, n) => e.body.next ? t.redirect(e.body.next) : t.view(this.changePasswordPage, {
               csrfToken: e.csrfToken,
               message: "Your password has been changed.",
               urlPrefix: this.prefix,
@@ -357,14 +357,14 @@ class De {
               required: e.body.required
             })
           );
-        } catch (i) {
-          const n = l.asCrossauthError(i);
+        } catch (t) {
+          const n = l.asCrossauthError(t);
           return d.logger.error(c({
             message: "Change password failure",
             user: (r = e.user) == null ? void 0 : r.username,
             errorCodeName: n.codeName,
             errorCode: n.code
-          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, a) => t.view(this.changePasswordPage, {
+          })), d.logger.debug(c({ err: t })), this.sessionServer.handleError(t, e, o, (i, a) => i.view(this.changePasswordPage, {
             errorMessage: a.message,
             errorMessages: a.messages,
             errorCode: a.code,
@@ -397,18 +397,18 @@ class De {
           return await this.changePassword(
             e,
             o,
-            (i, n) => i.header(...U).send({
+            (t, n) => t.header(...O).send({
               ok: !0
             })
           );
-        } catch (i) {
-          const n = l.asCrossauthError(i);
+        } catch (t) {
+          const n = l.asCrossauthError(t);
           return d.logger.error(c({
             message: "Change password failure",
             user: (r = e.user) == null ? void 0 : r.username,
             errorCodeName: n.codeName,
             errorCode: n.code
-          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, a) => t.status(this.sessionServer.errorStatus(i)).header(...U).send({
+          })), d.logger.debug(c({ err: t })), this.sessionServer.handleError(t, e, o, (i, a) => i.status(this.sessionServer.errorStatus(t)).header(...O).send({
             ok: !1,
             errorMessage: a.message,
             errorMessages: a.messages,
@@ -437,23 +437,23 @@ class De {
           return await this.reconfigureFactor2(
             e,
             o,
-            (r, i, n) => r.view(this.configureFactor2Page, {
-              ...i,
+            (r, t, n) => r.view(this.configureFactor2Page, {
+              ...t,
               next: e.query.next ?? this.sessionServer.loginRedirect
             })
           );
         } catch (r) {
-          const i = l.asCrossauthError(r);
+          const t = l.asCrossauthError(r);
           return d.logger.error(c({
             message: "Configure factor2 failure",
             user: (s = e.user) == null ? void 0 : s.username,
-            errorCodeName: i.codeName,
-            errorCode: i.code
-          })), d.logger.debug(c({ err: r })), this.sessionServer.handleError(r, e, o, (n, t) => n.view(this.configureFactor2Page, {
-            errorMessage: t.message,
-            errorMessages: t.messages,
-            errorCode: t.code,
-            errorCodeName: g[t.code],
+            errorCodeName: t.codeName,
+            errorCode: t.code
+          })), d.logger.debug(c({ err: r })), this.sessionServer.handleError(r, e, o, (n, i) => n.view(this.configureFactor2Page, {
+            errorMessage: i.message,
+            errorMessages: i.messages,
+            errorCode: i.code,
+            errorCodeName: g[i.code],
             next: e.query.next ?? this.sessionServer.loginRedirect,
             csrfToken: e.csrfToken,
             urlPrefix: this.prefix
@@ -474,8 +474,8 @@ class De {
           return d.logger.debug(c({ message: "Next page " + s })), await this.configureFactor2(
             e,
             o,
-            (r, i) => {
-              const n = i != null && i.factor2 ? this.sessionServer.authenticators[i.factor2] : void 0;
+            (r, t) => {
+              const n = t != null && t.factor2 ? this.sessionServer.authenticators[t.factor2] : void 0;
               return !this.sessionServer.isSessionUser(e) && this.enableEmailVerification && (n == null || n.skipEmailVerificationOnSignup() != !0) ? r.view(this.signupPage, {
                 next: s,
                 csrfToken: e.csrfToken,
@@ -497,10 +497,10 @@ class De {
               const a = l.asCrossauthError(r);
               return d.logger.error(c({ message: "Signup second factor failure", errorCodeName: a.codeName, errorCode: a.code })), d.logger.error(c({ message: "Session not defined during two factor process" })), o.status(500).view(this.sessionServer.errorPage, { status: 500, errorMessage: "An unknown error occurred", errorCode: g.UnknownError, errorCodeName: "UnknownError" });
             }
-            let i = (await this.sessionServer.sessionManager.dataForSessionId(e.sessionId))["2fa"];
+            let t = (await this.sessionServer.sessionManager.dataForSessionId(e.sessionId))["2fa"];
             const n = l.asCrossauthError(r);
-            d.logger.error(c({ message: "Signup two factor failure", user: i == null ? void 0 : i.username, errorCodeName: n.codeName, errorCode: n.code }));
-            const { userData: t } = await this.sessionServer.sessionManager.repeatTwoFactorSignup(e.sessionId);
+            d.logger.error(c({ message: "Signup two factor failure", user: t == null ? void 0 : t.username, errorCodeName: n.codeName, errorCode: n.code }));
+            const { userData: i } = await this.sessionServer.sessionManager.repeatTwoFactorSignup(e.sessionId);
             return this.sessionServer.handleError(r, e, o, (a, h) => a.view(this.configureFactor2Page, {
               errorMessage: h.message,
               errorMessages: h.messages,
@@ -508,11 +508,11 @@ class De {
               errorCodeName: g[h.code],
               urlPrefix: this.prefix,
               next: s,
-              ...t,
+              ...i,
               csrfToken: this.sessionServer.csrfToken(e, a)
             }));
-          } catch (i) {
-            return d.logger.error(c({ err: i })), o.status(500).view(this.sessionServer.errorPage, {
+          } catch (t) {
+            return d.logger.error(c({ err: t })), o.status(500).view(this.sessionServer.errorPage, {
               status: 500,
               errorMessage: "An unknown error occurred",
               errorCode: g.UnknownError,
@@ -542,20 +542,20 @@ class De {
           return await this.reconfigureFactor2(
             o,
             s,
-            (i, n, t) => i.header(...U).send({
+            (t, n, i) => t.header(...O).send({
               ok: !0,
               ...n
             })
           );
-        } catch (i) {
-          const n = l.asCrossauthError(i);
+        } catch (t) {
+          const n = l.asCrossauthError(t);
           d.logger.error(c({
             message: "Configure 2FA configuration failure",
             user: (r = o.user) == null ? void 0 : r.username,
             errorCodeName: n.codeName,
             errorCode: n.code
-          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, o, s, (t, a) => {
-            t.status(this.sessionServer.errorStatus(i)).header(...U).send({
+          })), d.logger.debug(c({ err: t })), this.sessionServer.handleError(t, o, s, (i, a) => {
+            i.status(this.sessionServer.errorStatus(t)).header(...O).send({
               ok: !1,
               errorMessage: a.message,
               errorMessages: a.messages,
@@ -579,23 +579,23 @@ class De {
           return await this.configureFactor2(
             o,
             s,
-            (i, n) => {
-              const t = {
+            (t, n) => {
+              const i = {
                 ok: !0,
                 user: n
               };
-              return this.sessionServer.isSessionUser(o) || (t.emailVerificationNeeded = this.enableEmailVerification), i.header(...U).send(t);
+              return this.sessionServer.isSessionUser(o) || (i.emailVerificationNeeded = this.enableEmailVerification), t.header(...O).send(i);
             }
           );
-        } catch (i) {
-          const n = l.asCrossauthError(i);
+        } catch (t) {
+          const n = l.asCrossauthError(t);
           d.logger.error(c({
             message: "Configure 2FA configuration failure",
             user: (r = o.user) == null ? void 0 : r.username,
             errorCodeName: n.codeName,
             errorCode: n.code
-          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, o, s, (t, a) => {
-            t.status(this.sessionServer.errorStatus(i)).header(...U).send({
+          })), d.logger.debug(c({ err: t })), this.sessionServer.handleError(t, o, s, (i, a) => {
+            i.status(this.sessionServer.errorStatus(t)).header(...O).send({
               ok: !1,
               errorMessage: a.message,
               errorMessages: a.messages,
@@ -640,7 +640,7 @@ class De {
           return await this.requestPasswordReset(
             e,
             o,
-            (r, i) => r.view(this.requestPasswordResetPage, {
+            (r, t) => r.view(this.requestPasswordResetPage, {
               csrfToken: e.csrfToken,
               message: s,
               urlPrefix: this.prefix
@@ -650,13 +650,13 @@ class De {
           return d.logger.error(c({
             message: "Request password reset faiulure user failure",
             email: e.body.email
-          })), d.logger.debug(c({ err: r })), this.sessionServer.handleError(r, e, o, (i, n) => n.code == g.EmailNotExist ? i.view(this.requestPasswordResetPage, {
+          })), d.logger.debug(c({ err: r })), this.sessionServer.handleError(r, e, o, (t, n) => n.code == g.EmailNotExist ? t.view(this.requestPasswordResetPage, {
             csrfToken: e.csrfToken,
             message: s,
             urlPrefix: this.prefix,
             required: e.body.required,
             next: e.body.next
-          }) : e.body.next ? i.redirect(e.body.next) : i.view(this.requestPasswordResetPage, {
+          }) : e.body.next ? t.redirect(e.body.next) : t.view(this.requestPasswordResetPage, {
             errorMessage: n.message,
             errorMessages: n.messages,
             errorCode: n.code,
@@ -686,7 +686,7 @@ class De {
           return await this.requestPasswordReset(
             e,
             o,
-            (s, r) => s.header(...U).send({
+            (s, r) => s.header(...O).send({
               ok: !0
             })
           );
@@ -697,8 +697,8 @@ class De {
             email: e.body.email,
             errorCodeName: r.codeName,
             errorCode: r.code
-          })), d.logger.debug(c({ err: s })), this.sessionServer.handleError(s, e, o, (i, n) => {
-            i.status(this.sessionServer.errorStatus(s)).header(...U).send({
+          })), d.logger.debug(c({ err: s })), this.sessionServer.handleError(s, e, o, (t, n) => {
+            t.status(this.sessionServer.errorStatus(s)).header(...O).send({
               ok: !1,
               errorMessage: n.message,
               errorMessages: n.messages,
@@ -761,10 +761,10 @@ class De {
           const r = l.asCrossauthError(s);
           return d.logger.error(c({
             message: "Reset password failure",
-            hashedToken: F.hash(e.body.token),
+            hashedToken: N.hash(e.body.token),
             errorCodeName: r.codeName,
             errorCode: r.code
-          })), d.logger.debug(c({ err: s })), this.sessionServer.handleError(s, e, o, (i, n) => i.view(this.resetPasswordPage, {
+          })), d.logger.debug(c({ err: s })), this.sessionServer.handleError(s, e, o, (t, n) => t.view(this.resetPasswordPage, {
             errorMessage: n.message,
             errorMessages: n.messages,
             errorCode: n.code,
@@ -794,7 +794,7 @@ class De {
           return await this.resetPassword(
             e,
             o,
-            (s, r) => s.header(...U).send({
+            (s, r) => s.header(...O).send({
               ok: !0
             })
           );
@@ -802,11 +802,11 @@ class De {
           const r = l.asCrossauthError(s);
           return d.logger.error(c({
             message: "Reset password failure",
-            hashedToken: F.hash(e.body.token),
+            hashedToken: N.hash(e.body.token),
             errorCodeName: r.codeName,
             errorCode: r.code
-          })), d.logger.debug(c({ err: s })), this.sessionServer.handleError(s, e, o, (i, n) => {
-            i.status(this.sessionServer.errorStatus(s)).header(...U).send({
+          })), d.logger.debug(c({ err: s })), this.sessionServer.handleError(s, e, o, (t, n) => {
+            t.status(this.sessionServer.errorStatus(s)).header(...O).send({
               ok: !1,
               errorMessage: n.message,
               errorMessages: n.messages,
@@ -844,10 +844,10 @@ class De {
           const r = l.asCrossauthError(s);
           return d.logger.error(c({
             message: "Verify email failed",
-            hashedToken: F.hash(e.params.token),
+            hashedToken: N.hash(e.params.token),
             errorCodeName: r.codeName,
             errorCode: r.code
-          })), d.logger.debug(c({ err: s })), this.sessionServer.handleError(s, e, o, (i, n) => i.view(this.sessionServer.errorPage, {
+          })), d.logger.debug(c({ err: s })), this.sessionServer.handleError(s, e, o, (t, n) => t.view(this.sessionServer.errorPage, {
             errorCode: n.code,
             errorCodeName: g[n.code],
             errorMessage: n.message,
@@ -875,7 +875,7 @@ class De {
           return await this.verifyEmail(
             e,
             o,
-            (s, r) => s.header(...U).send({
+            (s, r) => s.header(...O).send({
               ok: !0,
               user: r
             })
@@ -884,11 +884,11 @@ class De {
           const r = l.asCrossauthError(s);
           return d.logger.error(c({
             message: "Verify email failure",
-            hashedToken: F.hash(e.params.token),
+            hashedToken: N.hash(e.params.token),
             errorCodeName: r.codeName,
             errorCode: r.code
-          })), d.logger.debug(c({ err: s })), this.sessionServer.handleError(s, e, o, (i, n) => {
-            i.status(this.sessionServer.errorStatus(s)).header(...U).send({
+          })), d.logger.debug(c({ err: s })), this.sessionServer.handleError(s, e, o, (t, n) => {
+            t.status(this.sessionServer.errorStatus(s)).header(...O).send({
               ok: !1,
               errorMessage: n.message,
               errorMessages: n.messages,
@@ -920,28 +920,28 @@ class De {
           if (!this.sessionServer.userStorage) throw new l(g.Configuration, "Cannot call delete user unless a user storage is provided");
           s = (await this.sessionServer.userStorage.getUserById(e.user.id)).user;
         } catch (n) {
-          const t = l.asCrossauthError(n);
-          return d.logger.debug(c({ err: n })), o.status(t.httpStatus).view(this.sessionServer.errorPage, {
-            errorMessage: t.message,
-            errorMessages: t.messages,
-            errorCode: t.code,
-            errorCodeName: g[t.code]
+          const i = l.asCrossauthError(n);
+          return d.logger.debug(c({ err: n })), o.status(i.httpStatus).view(this.sessionServer.errorPage, {
+            errorMessage: i.message,
+            errorMessages: i.messages,
+            errorCode: i.code,
+            errorCodeName: g[i.code]
           });
         }
         const r = e.query.next ?? this.prefix;
-        let i = {
+        let t = {
           urlPrefix: this.prefix,
           csrfToken: e.csrfToken,
           next: r,
           isAdmin: !1,
           user: s
         };
-        return o.view(this.deleteUserPage, i);
+        return o.view(this.deleteUserPage, t);
       }
     ), this.sessionServer.app.post(
       this.prefix + "deleteuser",
       async (e, o) => {
-        var r, i;
+        var r, t;
         if (d.logger.info(c({
           message: "Page visit",
           method: "POST",
@@ -956,24 +956,24 @@ class De {
             e,
             o,
             (n) => {
-              var t;
+              var i;
               return n.view(this.deleteUserPage, {
                 message: "User deleted",
                 csrfToken: e.csrfToken,
                 urlPrefix: this.prefix,
-                userid: (t = e.user) == null ? void 0 : t.id,
+                userid: (i = e.user) == null ? void 0 : i.id,
                 isAdmin: !1,
                 next: s
               });
             }
           );
         } catch (n) {
-          const t = l.asCrossauthError(n);
+          const i = l.asCrossauthError(n);
           return d.logger.error(c({
             message: "Failed deleting user",
-            user: (i = e.user) == null ? void 0 : i.username,
-            errorCodeName: t.codeName,
-            errorCode: t.code
+            user: (t = e.user) == null ? void 0 : t.username,
+            errorCodeName: i.codeName,
+            errorCode: i.code
           })), d.logger.debug(c({ err: n })), this.sessionServer.handleError(n, e, o, (a, h) => {
             var v;
             const p = l.asCrossauthError(n).httpStatus;
@@ -1008,28 +1008,28 @@ class De {
           ip: e.ip,
           user: (s = e.user) == null ? void 0 : s.username
         })), !e.user)
-          return o.status(401).header(...U).send({ ok: !1 });
+          return o.status(401).header(...O).send({ ok: !1 });
         try {
           return await this.deleteUser(
             e,
             o,
-            (i) => {
+            (t) => {
               var n;
-              return i.header(...U).send({
+              return t.header(...O).send({
                 ok: !0,
                 userid: (n = e.user) == null ? void 0 : n.id
               });
             }
           );
-        } catch (i) {
-          const n = l.asCrossauthError(i);
+        } catch (t) {
+          const n = l.asCrossauthError(t);
           d.logger.error(c({
             message: "Delete user failure",
             user: (r = e.user) == null ? void 0 : r.username,
             errorCodeName: n.codeName,
             errorCode: n.code
-          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, a) => {
-            t.status(this.sessionServer.errorStatus(i)).header(...U).send({
+          })), d.logger.debug(c({ err: t })), this.sessionServer.handleError(t, e, o, (i, a) => {
+            i.status(this.sessionServer.errorStatus(t)).header(...O).send({
               ok: !1,
               errorMessage: a.message,
               errorMessages: a.messages,
@@ -1057,9 +1057,9 @@ class De {
       e,
       this.sessionServer.userStorage.userEditableFields
     );
-    let i = this.sessionServer.validateUserFn(r);
-    if (i.length > 0)
-      throw new l(g.FormEntry, i);
+    let t = this.sessionServer.validateUserFn(r);
+    if (t.length > 0)
+      throw new l(g.FormEntry, t);
     let n = await this.sessionServer.sessionManager.updateUser(e.user, r);
     return s(o, e.user, n.emailVerificationTokenSent);
   }
@@ -1086,26 +1086,26 @@ class De {
       throw new l(g.Unauthorized);
     if (!e.csrfToken)
       throw new l(g.InvalidCsrf);
-    let i = e.body.factor2;
+    let t = e.body.factor2;
     if (e.body.factor2 && !this.sessionServer.allowedFactor2.includes(e.body.factor2))
       throw new l(
         g.Forbidden,
         "Illegal second factor " + e.body.factor2 + " requested"
       );
-    (e.body.factor2 == "none" || e.body.factor2 == "") && (i = void 0);
-    const n = await this.sessionServer.sessionManager.initiateTwoFactorSetup(r, i, e.sessionId);
-    let t = {
-      factor2: i,
+    (e.body.factor2 == "none" || e.body.factor2 == "") && (t = void 0);
+    const n = await this.sessionServer.sessionManager.initiateTwoFactorSetup(r, t, e.sessionId);
+    let i = {
+      factor2: t,
       userData: n,
       username: n.username,
       next: e.body.next ?? this.sessionServer.loginRedirect,
       csrfToken: e.csrfToken
     };
-    return s(o, t);
+    return s(o, i);
   }
   async changePassword(e, o, s) {
     if (!this.sessionServer.userStorage) throw new l(g.Configuration, "Cannot call changePassword unless a user storage is provided");
-    let r, i = !1;
+    let r, t = !1;
     if (!this.sessionServer.isSessionUser(e) || !e.user) {
       const m = await this.sessionServer.getSessionData(e, "passwordchange");
       if (m != null && m.username) {
@@ -1115,7 +1115,7 @@ class De {
             skipActiveCheck: !0,
             skipEmailVerifiedCheck: !0
           }
-        )).user, i = !0, !e.csrfToken)
+        )).user, t = !0, !e.csrfToken)
           throw new l(g.InvalidCsrf);
       } else
         throw new l(g.Unauthorized);
@@ -1125,18 +1125,18 @@ class De {
       r = e.user;
     } else
       throw new l(g.InsufficientPriviledges);
-    const n = this.sessionServer.authenticators[r.factor1], t = n.secretNames();
+    const n = this.sessionServer.authenticators[r.factor1], i = n.secretNames();
     let a = {}, h = {}, f = {};
     for (let m in e.body)
       if (m.startsWith("new_")) {
         const w = m.replace(/^new_/, "");
-        t.includes(w) && (h[w] = e.body[m]);
+        i.includes(w) && (h[w] = e.body[m]);
       } else if (m.startsWith("old_")) {
         const w = m.replace(/^old_/, "");
-        t.includes(w) && (a[w] = e.body[m]);
+        i.includes(w) && (a[w] = e.body[m]);
       } else if (m.startsWith("repeat_")) {
         const w = m.replace(/^repeat_/, "");
-        t.includes(w) && (f[w] = e.body[m]);
+        i.includes(w) && (f[w] = e.body[m]);
       }
     Object.keys(f).length === 0 && (f = void 0);
     let p = n.validateSecrets(h);
@@ -1144,7 +1144,7 @@ class De {
       throw new l(g.PasswordFormat, p);
     const v = r.state;
     try {
-      i && (r.state = "active", await this.sessionServer.userStorage.updateUser({ id: r.id, state: r.state })), await this.sessionServer.sessionManager.changeSecrets(
+      t && (r.state = "active", await this.sessionServer.userStorage.updateUser({ id: r.id, state: r.state })), await this.sessionServer.sessionManager.changeSecrets(
         r.username,
         1,
         h,
@@ -1153,7 +1153,7 @@ class De {
       );
     } catch (m) {
       const w = l.asCrossauthError(m);
-      if (d.logger.debug(c({ err: m })), i)
+      if (d.logger.debug(c({ err: m })), t)
         try {
           await this.sessionServer.userStorage.updateUser({ id: r.id, state: v });
         } catch (P) {
@@ -1161,7 +1161,7 @@ class De {
         }
       throw w;
     }
-    return i ? await this.sessionServer.loginWithUser(r, !1, e, o, s) : s(o, void 0);
+    return t ? await this.sessionServer.loginWithUser(r, !1, e, o, s) : s(o, void 0);
   }
   async configureFactor2(e, o, s) {
     if (this.sessionServer.isSessionUser(e) && !e.csrfToken)
@@ -1179,20 +1179,20 @@ class De {
       !0,
       e,
       o,
-      (i, n) => s(i, n)
+      (t, n) => s(t, n)
     ) : s(o, r);
   }
   async reconfigureFactor2(e, o, s) {
     if (!e.user || !e.sessionId || !this.sessionServer.isSessionUser(e))
       throw new l(g.Unauthorized);
     let r = e.user.factor2;
-    const i = this.sessionServer.authenticators[r];
-    if (!i || i.secretNames().length == 0)
+    const t = this.sessionServer.authenticators[r];
+    if (!t || t.secretNames().length == 0)
       throw new l(
         g.BadRequest,
         "Selected second factor does not have configuration"
       );
-    let t = {
+    let i = {
       ...await this.sessionServer.sessionManager.initiateTwoFactorSetup(
         e.user,
         r,
@@ -1200,7 +1200,7 @@ class De {
       ),
       csrfToken: e.csrfToken
     };
-    return s(o, t);
+    return s(o, i);
   }
   async requestPasswordReset(e, o, s) {
     if (!this.enablePasswordReset)
@@ -1213,8 +1213,8 @@ class De {
     const r = e.body.email;
     try {
       await this.sessionServer.sessionManager.requestPasswordReset(r);
-    } catch (i) {
-      const n = l.asCrossauthError(i);
+    } catch (t) {
+      const n = l.asCrossauthError(t);
       if (n.code == g.UserNotExist)
         d.logger.warn(c({
           message: "Password reset requested for invalid email",
@@ -1222,7 +1222,7 @@ class De {
         }));
       else
         throw d.logger.error(c({
-          err: i,
+          err: t,
           message: "Couldn't send password reset email"
         })), n;
     }
@@ -1231,30 +1231,30 @@ class De {
   async resetPassword(e, o, s) {
     if (!e.csrfToken)
       throw new l(g.InvalidCsrf);
-    const r = e.body.token, i = await this.sessionServer.sessionManager.userForPasswordResetToken(r), n = this.sessionServer.authenticators[i.factor1], t = n.secretNames();
+    const r = e.body.token, t = await this.sessionServer.sessionManager.userForPasswordResetToken(r), n = this.sessionServer.authenticators[t.factor1], i = n.secretNames();
     let a = {}, h = {};
     for (let v in e.body)
       if (v.startsWith("new_")) {
         const m = v.replace(/^new_/, "");
-        t.includes(m) && (a[m] = e.body[v]);
+        i.includes(m) && (a[m] = e.body[v]);
       } else if (v.startsWith("repeat_")) {
         const m = v.replace(/^repeat_/, "");
-        t.includes(m) && (h[m] = e.body[v]);
+        i.includes(m) && (h[m] = e.body[v]);
       }
     Object.keys(h).length === 0 && (h = void 0);
     let f = n.validateSecrets(a);
     if (f.length > 0)
       throw new l(g.PasswordFormat, f);
     const p = await this.sessionServer.sessionManager.resetSecret(r, 1, a, h);
-    return p.state != O.factor2ResetNeeded ? this.sessionServer.loginWithUser(p, !0, e, o, s) : s(o);
+    return p.state != I.factor2ResetNeeded ? this.sessionServer.loginWithUser(p, !0, e, o, s) : s(o);
   }
   async verifyEmail(e, o, s) {
     if (!this.enableEmailVerification) throw new l(
       g.Configuration,
       "Email verification reset not enabled"
     );
-    const r = e.params.token, i = await this.sessionServer.sessionManager.applyEmailVerificationToken(r);
-    return await this.sessionServer.loginWithUser(i, !0, e, o, s);
+    const r = e.params.token, t = await this.sessionServer.sessionManager.applyEmailVerificationToken(r);
+    return await this.sessionServer.loginWithUser(t, !0, e, o, s);
   }
   async deleteUser(e, o, s) {
     if (!this.sessionServer.userStorage) throw new l(g.Configuration, "Cannot call deleteUser unless a user storage is provided");
@@ -1275,10 +1275,10 @@ async function ze(S, e) {
     if (r.code != g.UserNotExist)
       throw d.logger.debug(c({ err: r })), r;
     try {
-      const { user: i } = await e.getUserByEmail(S);
-      o.push(i);
-    } catch (i) {
-      const n = l.asCrossauthError(i);
+      const { user: t } = await e.getUserByEmail(S);
+      o.push(t);
+    } catch (t) {
+      const n = l.asCrossauthError(t);
       if (n.code != g.UserNotExist)
         throw d.logger.debug(c({ err: n })), r;
     }
@@ -1339,18 +1339,18 @@ class He {
           return d.logger.debug(c({ msg: "Next page " + s })), await this.createUser(
             e,
             o,
-            (i, n, t) => i.redirect(302, s)
+            (t, n, i) => t.redirect(302, s)
           );
-        } catch (i) {
-          const n = l.asCrossauthError(i);
+        } catch (t) {
+          const n = l.asCrossauthError(t);
           return d.logger.error(c({
             msg: "Signup failure",
             user: e.body.username,
             errorCodeName: n.codeName,
             errorCode: n.code
-          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, a) => {
-            const f = l.asCrossauthError(i).httpStatus;
-            return t.status(f).view(this.adminCreateUserPage, {
+          })), d.logger.debug(c({ err: t })), this.sessionServer.handleError(t, e, o, (i, a) => {
+            const f = l.asCrossauthError(t).httpStatus;
+            return i.status(f).view(this.adminCreateUserPage, {
               errorMessage: a.message,
               errorMessages: a.messages,
               errorCode: a.code,
@@ -1387,21 +1387,21 @@ class He {
           return await this.createUser(
             e,
             o,
-            (i, n, t) => i.header(...R).send({
+            (t, n, i) => t.header(...R).send({
               ok: !0,
-              user: t,
+              user: i,
               ...n.userData
             })
           );
-        } catch (i) {
-          const n = l.asCrossauthError(i);
+        } catch (t) {
+          const n = l.asCrossauthError(t);
           d.logger.error(c({
             msg: "Create user failure",
             user: (r = e.user) == null ? void 0 : r.username,
             errorCodeName: n.codeName,
             errorCode: n.code
-          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, a) => {
-            t.status(this.sessionServer.errorStatus(i)).header(...R).send({
+          })), d.logger.debug(c({ err: t })), this.sessionServer.handleError(t, e, o, (i, a) => {
+            i.status(this.sessionServer.errorStatus(t)).header(...R).send({
               ok: !1,
               errorMessage: a.message,
               errorMessages: a.messages,
@@ -1428,21 +1428,21 @@ class He {
         })), !(e != null && e.user) || !y.isAdmin(e.user))
           return this.accessDeniedPage(e, o);
         try {
-          let s = [], r = Number(e.query.skip), i = Number(e.query.take);
-          r < 0 && (i = -r, r = 0), r || (r = 0), i || (i = 10), e.query.search ? s = await this.userSearchFn(
+          let s = [], r = Number(e.query.skip), t = Number(e.query.take);
+          r < 0 && (t = -r, r = 0), r || (r = 0), t || (t = 10), e.query.search ? s = await this.userSearchFn(
             e.query.search,
             this.sessionServer.userStorage
           ) : s = await this.sessionServer.userStorage.getUsers(
             r,
-            i
+            t
           );
           let n = {
             urlPrefix: this.adminPrefix,
             skip: r,
-            take: i,
+            take: t,
             users: s,
             havePrevious: r > 0,
-            haveNext: i != null && s.length == i
+            haveNext: t != null && s.length == t
           };
           return e.query.next && (n.next = e.query.next), o.view(this.adminSelectUserPage, n);
         } catch (s) {
@@ -1512,12 +1512,12 @@ class He {
         let s;
         try {
           if (!this.sessionServer.userStorage) throw new l(g.Configuration, "Cannot call updateuser unless a user storage is provided");
-          const { user: i } = await this.sessionServer.userStorage.getUserById(e.params.id);
-          return s = i, await this.updateUser(
+          const { user: t } = await this.sessionServer.userStorage.getUserById(e.params.id);
+          return s = t, await this.updateUser(
             s,
             e,
             o,
-            (n, t, a, h) => {
+            (n, i, a, h) => {
               let f = "User's details have been updated.";
               return a ? f = "User's details have been updated and sent and an email verification link." : h && (f = "User's details have been updated and sent and a password reset token sent."), n.view(this.adminUpdateUserPage, {
                 csrfToken: e.csrfToken,
@@ -1527,9 +1527,9 @@ class He {
               });
             }
           );
-        } catch (i) {
-          const n = l.asCrossauthError(i);
-          return d.logger.error(c({ msg: "Update user failure", user: e.body.username, errorCodeName: n.codeName, errorCode: n.code })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, a) => s ? t.view(this.adminUpdateUserPage, {
+        } catch (t) {
+          const n = l.asCrossauthError(t);
+          return d.logger.error(c({ msg: "Update user failure", user: e.body.username, errorCodeName: n.codeName, errorCode: n.code })), d.logger.debug(c({ err: t })), this.sessionServer.handleError(t, e, o, (i, a) => s ? i.view(this.adminUpdateUserPage, {
             user: s,
             errorMessage: a.message,
             errorMessages: a.messages,
@@ -1540,7 +1540,7 @@ class He {
             allowedFactor2: this.sessionServer.allowedFactor2Details(),
             ...e.body
           }) : y.sendPageError(
-            t,
+            i,
             n.httpStatus,
             this.sessionServer.errorPage,
             n.message,
@@ -1570,28 +1570,28 @@ class He {
           if (!this.sessionServer.userStorage) throw new l(g.Configuration, "Cannot call deleteuser unless a user storage is provided");
           s = (await this.sessionServer.userStorage.getUserById(e.params.id)).user;
         } catch (n) {
-          const t = l.asCrossauthError(n);
-          return d.logger.debug(c({ err: n })), o.status(t.httpStatus).view(this.sessionServer.errorPage, {
-            errorMessage: t.message,
-            errorMessages: t.messages,
-            errorCode: t.code,
-            errorCodeName: g[t.code]
+          const i = l.asCrossauthError(n);
+          return d.logger.debug(c({ err: n })), o.status(i.httpStatus).view(this.sessionServer.errorPage, {
+            errorMessage: i.message,
+            errorMessages: i.messages,
+            errorCode: i.code,
+            errorCodeName: g[i.code]
           });
         }
         const r = e.query.next ?? this.adminPrefix + "selectuser";
-        let i = {
+        let t = {
           urlPrefix: this.adminPrefix,
           csrfToken: e.csrfToken,
           next: r,
           isAdmin: !0,
           user: s
         };
-        return o.view(this.deleteUserPage, i);
+        return o.view(this.deleteUserPage, t);
       }
     ), this.sessionServer.app.post(
       this.adminPrefix + "deleteuser/:id",
       async (e, o) => {
-        var r, i;
+        var r, t;
         d.logger.info(c({
           msg: "Page visit",
           method: "POST",
@@ -1614,12 +1614,12 @@ class He {
             })
           );
         } catch (n) {
-          const t = l.asCrossauthError(n);
+          const i = l.asCrossauthError(n);
           return d.logger.error(c({
             msg: "Failed deleting user",
-            user: (i = e.user) == null ? void 0 : i.username,
-            errorCodeName: t.codeName,
-            errorCode: t.code
+            user: (t = e.user) == null ? void 0 : t.username,
+            errorCodeName: i.codeName,
+            errorCode: i.code
           })), d.logger.debug(c({ err: n })), this.sessionServer.handleError(n, e, o, (a, h) => {
             const p = l.asCrossauthError(n).httpStatus;
             return a.status(p).view(this.deleteUserPage, {
@@ -1645,7 +1645,7 @@ class He {
     this.sessionServer.app.post(
       this.adminPrefix + "api/updateuser/:id",
       async (e, o) => {
-        var r, i;
+        var r, t;
         if (d.logger.info(c({
           msg: "API visit",
           method: "POST",
@@ -1662,18 +1662,18 @@ class He {
             s,
             e,
             o,
-            (t, a, h) => t.header(...R).send({
+            (i, a, h) => i.header(...R).send({
               ok: !0,
               emailVerificationRequired: h
             })
           );
         } catch (n) {
-          const t = l.asCrossauthError(n);
+          const i = l.asCrossauthError(n);
           return d.logger.error(c({
             msg: "Update user failure",
-            user: (i = e.user) == null ? void 0 : i.username,
-            errorCodeName: t.codeName,
-            errorCode: t.code
+            user: (t = e.user) == null ? void 0 : t.username,
+            errorCodeName: i.codeName,
+            errorCode: i.code
           })), d.logger.debug(c({ err: n })), this.sessionServer.handleError(n, e, o, (a, h) => {
             a.status(this.sessionServer.errorStatus(n)).header(...R).send({
               ok: !1,
@@ -1706,20 +1706,20 @@ class He {
           return this.accessDeniedPage(e, o);
         try {
           const { user: r } = await this.sessionServer.userStorage.getUserById(e.params.id);
-          let i = {
+          let t = {
             urlPrefix: this.adminPrefix,
             csrfToken: e.csrfToken,
             user: r
           };
-          return o.view(this.adminChangePasswordPage, i);
+          return o.view(this.adminChangePasswordPage, t);
         } catch (r) {
-          const i = l.asCrossauthError(r);
+          const t = l.asCrossauthError(r);
           return d.logger.error(c({ err: r })), y.sendPageError(
             o,
-            i.httpStatus,
+            t.httpStatus,
             this.sessionServer.errorPage,
-            i.message,
-            i
+            t.message,
+            t
           );
         }
       }
@@ -1737,12 +1737,12 @@ class He {
         let s;
         try {
           if (!this.sessionServer.userStorage) throw new l(g.Configuration, "Cannot call changepassword unless a user storage is provided");
-          const { user: i } = await this.sessionServer.userStorage.getUserById(e.params.id);
-          return s = i, await this.changePassword(
+          const { user: t } = await this.sessionServer.userStorage.getUserById(e.params.id);
+          return s = t, await this.changePassword(
             s,
             e,
             o,
-            (n, t) => e.body.next ? n.redirect(e.body.next) : n.view(this.adminChangePasswordPage, {
+            (n, i) => e.body.next ? n.redirect(e.body.next) : n.view(this.adminChangePasswordPage, {
               csrfToken: e.csrfToken,
               message: "User's password has been changed.",
               urlPrefix: this.adminPrefix,
@@ -1751,14 +1751,14 @@ class He {
               user: s
             })
           );
-        } catch (i) {
-          const n = l.asCrossauthError(i);
+        } catch (t) {
+          const n = l.asCrossauthError(t);
           return d.logger.error(c({
             msg: "Change password failure",
             userid: e.params.id,
             errorCodeName: n.codeName,
             errorCode: n.code
-          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, a) => t.view(this.adminChangePasswordPage, {
+          })), d.logger.debug(c({ err: t })), this.sessionServer.handleError(t, e, o, (i, a) => i.view(this.adminChangePasswordPage, {
             errorMessage: a.message,
             errorMessages: a.messages,
             errorCode: a.code,
@@ -1777,7 +1777,7 @@ class He {
     this.sessionServer.app.post(
       this.adminPrefix + "api/changepassword/:id",
       async (e, o) => {
-        var r, i;
+        var r, t;
         if (d.logger.info(c({
           msg: "API visit",
           method: "POST",
@@ -1794,17 +1794,17 @@ class He {
             s,
             e,
             o,
-            (t, a) => t.header(...R).send({
+            (i, a) => i.header(...R).send({
               ok: !0
             })
           );
         } catch (n) {
-          const t = l.asCrossauthError(n);
+          const i = l.asCrossauthError(n);
           return d.logger.error(c({
             msg: "Update user failure",
-            user: (i = e.user) == null ? void 0 : i.username,
-            errorCodeName: t.codeName,
-            errorCode: t.code
+            user: (t = e.user) == null ? void 0 : t.username,
+            errorCodeName: i.codeName,
+            errorCode: i.code
           })), d.logger.debug(c({ err: n })), this.sessionServer.handleError(n, e, o, (a, h) => {
             a.status(this.sessionServer.errorStatus(n)).header(...R).send({
               ok: !1,
@@ -1837,20 +1837,20 @@ class He {
           return await this.deleteUser(
             e,
             o,
-            (i) => i.header(...R).send({
+            (t) => t.header(...R).send({
               ok: !0,
               client_id: e.params.id
             })
           );
-        } catch (i) {
-          const n = l.asCrossauthError(i);
+        } catch (t) {
+          const n = l.asCrossauthError(t);
           d.logger.error(c({
             msg: "Delete user failure",
             user: (r = e.user) == null ? void 0 : r.username,
             errorCodeName: n.codeName,
             errorCode: n.code
-          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, a) => {
-            t.status(this.sessionServer.errorStatus(i)).header(...R).send({
+          })), d.logger.debug(c({ err: t })), this.sessionServer.handleError(t, e, o, (i, a) => {
+            i.status(this.sessionServer.errorStatus(t)).header(...R).send({
               ok: !1,
               errorMessage: a.message,
               errorMessages: a.messages,
@@ -1884,31 +1884,31 @@ class He {
       this.sessionServer.adminAllowedFactor1,
       this.sessionServer.allowedFactor2
     );
-    const i = this.sessionServer.authenticators[r.factor1].secretNames();
+    const t = this.sessionServer.authenticators[r.factor1].secretNames();
     let n = !0;
-    for (let v of i)
+    for (let v of t)
       !e.body[v] && !e.body["repeat_" + v] && (n = !1);
-    let t = [], a = {};
+    let i = [], a = {};
     if (n) {
-      t = this.sessionServer.authenticators[r.factor1].validateSecrets(e.body);
+      i = this.sessionServer.authenticators[r.factor1].validateSecrets(e.body);
       for (let v in e.body)
         if (v.startsWith("repeat_")) {
           const m = v.replace(/^repeat_/, "");
-          i.includes(m) && (a[m] = e.body[v]);
+          t.includes(m) && (a[m] = e.body[v]);
         }
       Object.keys(a).length === 0 && (a = void 0);
     }
-    n ? r.factor2 && r.factor2 != "none" && (r.state = O.factor2ResetNeeded, d.logger.warn(c({
-      msg: `Setting state for user to ${O.factor2ResetNeeded}`,
+    n ? r.factor2 && r.factor2 != "none" && (r.state = I.factor2ResetNeeded, d.logger.warn(c({
+      msg: `Setting state for user to ${I.factor2ResetNeeded}`,
       username: r.username
-    }))) : r.factor2 && r.factor2 != "none" ? (r.state = O.passwordAndFactor2ResetNeeded, d.logger.warn(c({
-      msg: `Setting state for user to ${O.passwordAndFactor2ResetNeeded}`,
+    }))) : r.factor2 && r.factor2 != "none" ? (r.state = I.passwordAndFactor2ResetNeeded, d.logger.warn(c({
+      msg: `Setting state for user to ${I.passwordAndFactor2ResetNeeded}`,
       username: r.username
-    }))) : (r.state = O.passwordResetNeeded, d.logger.warn(c({
-      msg: `Setting state for user to ${O.passwordResetNeeded}`,
+    }))) : (r.state = I.passwordResetNeeded, d.logger.warn(c({
+      msg: `Setting state for user to ${I.passwordResetNeeded}`,
       username: r.username
     })));
-    let f = [...this.sessionServer.validateUserFn(r), ...t];
+    let f = [...this.sessionServer.validateUserFn(r), ...i];
     if (f.length > 0)
       throw new l(g.FormEntry, f);
     const p = await this.sessionServer.sessionManager.createUser(
@@ -1931,11 +1931,11 @@ class He {
   }
   async accessDeniedPage(e, o) {
     const s = new l(g.InsufficientPriviledges);
-    return this.sessionServer.handleError(s, e, o, (r, i) => r.status(s.httpStatus).view(this.sessionServer.errorPage, {
-      errorMessage: i.message,
-      errorMessages: i.messages,
-      errorCode: i.code,
-      errorCodeName: g[i.code]
+    return this.sessionServer.handleError(s, e, o, (r, t) => r.status(s.httpStatus).view(this.sessionServer.errorPage, {
+      errorMessage: t.message,
+      errorMessages: t.messages,
+      errorCode: t.code,
+      errorCodeName: g[t.code]
     }));
   }
   async updateUser(e, o, s, r) {
@@ -1943,7 +1943,7 @@ class He {
     if (!o.user || !y.isAdmin(o.user))
       throw new l(g.Unauthorized);
     if (this.sessionServer.isSessionUser(o) && !o.csrfToken) throw new l(g.InvalidCsrf);
-    const i = e.factor2, n = e.state;
+    const t = e.factor2, n = e.state;
     e.state = o.body.state, e = this.sessionServer.updateUserFn(
       e,
       o,
@@ -1952,11 +1952,11 @@ class He {
         ...this.sessionServer.userStorage.adminEditableFields
       }
     );
-    const t = e.factor2 && e.factor2 != "none" && e.factor2 != i;
-    if (t && !(e.state == n || e.state == "factor2ResetNeeded"))
+    const i = e.factor2 && e.factor2 != "none" && e.factor2 != t;
+    if (i && !(e.state == n || e.state == "factor2ResetNeeded"))
       throw new l(g.BadRequest, "Cannot change both factor2 and state at the same time");
-    t && (e.state = O.factor2ResetNeeded, d.logger.warn(c({
-      msg: `Setting state for user to ${O.factor2ResetNeeded}`,
+    i && (e.state = I.factor2ResetNeeded, d.logger.warn(c({
+      msg: `Setting state for user to ${I.factor2ResetNeeded}`,
       username: e.username
     })));
     let a = this.sessionServer.validateUserFn(e);
@@ -1974,22 +1974,22 @@ class He {
     if (!o.user || !y.isAdmin(o.user))
       throw new l(g.Unauthorized);
     if (this.sessionServer.isSessionUser(o) && !o.csrfToken) throw new l(g.InvalidCsrf);
-    const i = this.sessionServer.authenticators[e.factor1], n = i.secretNames();
-    let t = {}, a = {};
+    const t = this.sessionServer.authenticators[e.factor1], n = t.secretNames();
+    let i = {}, a = {};
     for (let f in o.body)
       if (f.startsWith("new_")) {
         const p = f.replace(/^new_/, "");
-        n.includes(p) && (t[p] = o.body[f]);
+        n.includes(p) && (i[p] = o.body[f]);
       } else if (f.startsWith("repeat_")) {
         const p = f.replace(/^repeat_/, "");
         n.includes(p) && (a[p] = o.body[f]);
       }
-    if (Object.keys(a).length === 0 && (a = void 0), i.validateSecrets(t).length > 0)
+    if (Object.keys(a).length === 0 && (a = void 0), t.validateSecrets(i).length > 0)
       throw new l(g.PasswordFormat);
     return e.state = "active", await this.sessionServer.userStorage.updateUser({ id: e.id, state: e.state }), await this.sessionServer.sessionManager.changeSecrets(
       e.username,
       1,
-      t,
+      i,
       a
     ), r(s, void 0);
   }
@@ -2008,15 +2008,15 @@ async function ve(S, e, o) {
     const r = await e.getClientById(S);
     s.push(r);
   } catch (r) {
-    const i = l.asCrossauthError(r);
-    if (i.code != g.UserNotExist)
-      throw d.logger.debug(c({ err: i })), i;
+    const t = l.asCrossauthError(r);
+    if (t.code != g.UserNotExist)
+      throw d.logger.debug(c({ err: t })), t;
     try {
       s = await e.getClientByName(S, o);
     } catch (n) {
-      const t = l.asCrossauthError(n);
-      if (t.code != g.UserNotExist)
-        throw d.logger.debug(c({ err: t })), i;
+      const i = l.asCrossauthError(n);
+      if (i.code != g.UserNotExist)
+        throw d.logger.debug(c({ err: i })), t;
     }
   }
   return s;
@@ -2059,42 +2059,42 @@ class Le {
           return this.accessDeniedPage(e, o);
         const s = e.query.next ?? encodeURIComponent(e.url);
         try {
-          let r = [], i = Number(e.query.skip), n = Number(e.query.take);
-          i || (i = 0), n || (n = 10);
-          let t = null, a;
+          let r = [], t = Number(e.query.skip), n = Number(e.query.take);
+          t || (t = 0), n || (n = 10);
+          let i = null, a;
           if (e.query.userid) {
             if (!this.sessionServer.userStorage) throw new l(g.Configuration, "Cannot call selectclient with user unless a user storage is provided");
-            a = (await this.sessionServer.userStorage.getUserById(e.query.userid)).user, t = a.id;
+            a = (await this.sessionServer.userStorage.getUserById(e.query.userid)).user, i = a.id;
           }
           e.query.search ? r = await this.clientSearchFn(
             e.query.search,
             this.clientStorage,
-            t
+            i
           ) : r = await this.clientStorage.getClients(
-            i,
+            t,
             n,
-            t
+            i
           );
           let h = {
             urlPrefix: this.adminPrefix,
             user: a,
-            skip: i,
+            skip: t,
             take: n,
             clients: r,
-            havePrevious: i > 0,
+            havePrevious: t > 0,
             haveNext: n != null && r.length == n,
             isAdmin: !0,
             next: s
           };
           return e.query.next && (h.next = e.query.next), o.view(this.selectClientPage, h);
         } catch (r) {
-          const i = l.asCrossauthError(r);
+          const t = l.asCrossauthError(r);
           return d.logger.error(c({ err: r })), y.sendPageError(
             o,
-            i.httpStatus,
+            t.httpStatus,
             this.sessionServer.errorPage,
-            i.message,
-            i
+            t.message,
+            t
           );
         }
       }
@@ -2123,15 +2123,15 @@ class Le {
             r = (await this.sessionServer.userStorage.getUserById(e.query.userid)).user;
           }
         } catch (n) {
-          const t = l.asCrossauthError(n);
-          return d.logger.debug(c({ err: n })), o.status(t.httpStatus).view(this.sessionServer.errorPage, {
-            errorMessage: t.message,
-            errorMessages: t.messages,
-            errorCode: t.code,
-            errorCodeName: g[t.code]
+          const i = l.asCrossauthError(n);
+          return d.logger.debug(c({ err: n })), o.status(i.httpStatus).view(this.sessionServer.errorPage, {
+            errorMessage: i.message,
+            errorMessages: i.messages,
+            errorCode: i.code,
+            errorCodeName: g[i.code]
           });
         }
-        let i = {
+        let t = {
           urlPrefix: this.adminPrefix,
           csrfToken: e.csrfToken,
           validFlows: this.validFlows,
@@ -2140,18 +2140,18 @@ class Le {
           isAdmin: !0,
           next: s
         };
-        return o.view(this.createClientPage, i);
+        return o.view(this.createClientPage, t);
       }
     ), this.sessionServer.app.post(
       this.adminPrefix + "createclient",
       async (e, o) => {
-        var i, n;
+        var t, n;
         d.logger.info(c({
           msg: "Page visit",
           method: "POST",
           url: this.adminPrefix + "createclient",
           ip: e.ip,
-          user: (i = e.user) == null ? void 0 : i.username
+          user: (t = e.user) == null ? void 0 : t.username
         }));
         let s = e.body.next;
         s || (e.body.userid ? s = this.adminPrefix + "selectuser" : s = this.adminPrefix + "selectclient");
@@ -2164,7 +2164,7 @@ class Le {
           return await this.createClient(
             e,
             o,
-            (t, a) => t.view(this.createClientPage, {
+            (i, a) => i.view(this.createClientPage, {
               message: "Created client",
               client: a,
               csrfToken: e.csrfToken,
@@ -2178,15 +2178,15 @@ class Le {
             }),
             r
           );
-        } catch (t) {
-          const a = l.asCrossauthError(t);
+        } catch (i) {
+          const a = l.asCrossauthError(i);
           return d.logger.error(c({
             msg: "Failed creating OAuth client",
             user: (n = e.user) == null ? void 0 : n.username,
             errorCodeName: a.codeName,
             errorCode: a.code
-          })), d.logger.debug(c({ err: t })), this.sessionServer.handleError(t, e, o, (h, f) => {
-            const v = l.asCrossauthError(t).httpStatus;
+          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (h, f) => {
+            const v = l.asCrossauthError(i).httpStatus;
             return h.status(v).view(this.createClientPage, {
               errorMessage: f.message,
               errorMessages: f.messages,
@@ -2233,11 +2233,11 @@ class Le {
         }
         let r = e.query.next;
         r || (e.query.userid ? r = this.adminPrefix + "selectuser" : r = this.adminPrefix + "selectclient");
-        let i;
+        let t;
         try {
           if (s.userid) {
             if (!this.sessionServer.userStorage) throw new l(g.Configuration, "Cannot call updateclient with user unless a user storage is provided");
-            i = (await this.sessionServer.userStorage.getUserById(s.userid)).user;
+            t = (await this.sessionServer.userStorage.getUserById(s.userid)).user;
           }
         } catch (a) {
           const h = l.asCrossauthError(a);
@@ -2251,13 +2251,13 @@ class Le {
         let n = {};
         for (let a of this.validFlows)
           s.valid_flow.includes(a) && (n[a] = !0);
-        let t = {
+        let i = {
           urlPrefix: this.adminPrefix,
           csrfToken: e.csrfToken,
           validFlows: this.validFlows,
           flowNames: E.flowNames(this.validFlows),
           selectedFlows: n,
-          user: i,
+          user: t,
           client_id: s.client_id,
           client_name: s.client_name,
           confidential: s.confidential,
@@ -2265,18 +2265,18 @@ class Le {
           isAdmin: !0,
           next: r
         };
-        return o.view(this.updateClientPage, t);
+        return o.view(this.updateClientPage, i);
       }
     ), this.sessionServer.app.post(
       this.adminPrefix + "updateclient/:client_id",
       async (e, o) => {
-        var i, n;
+        var t, n;
         d.logger.info(c({
           msg: "Page visit",
           method: "POST",
           url: this.adminPrefix + "updateclient",
           ip: e.ip,
-          user: (i = e.user) == null ? void 0 : i.username
+          user: (t = e.user) == null ? void 0 : t.username
         }));
         let s = e.body.next;
         s || (e.body.userid ? s = this.adminPrefix + "selectuser" : s = this.adminPrefix + "selectclient");
@@ -2289,7 +2289,7 @@ class Le {
           return await this.updateClient(
             e,
             o,
-            (t, a, h) => t.view(this.updateClientPage, {
+            (i, a, h) => i.view(this.updateClientPage, {
               message: "Updated client",
               client: a,
               csrfToken: e.csrfToken,
@@ -2303,15 +2303,15 @@ class Le {
               ...e.body
             })
           );
-        } catch (t) {
-          const a = l.asCrossauthError(t);
+        } catch (i) {
+          const a = l.asCrossauthError(i);
           return d.logger.error(c({
             msg: "Failed updating OAuth client",
             user: (n = e.user) == null ? void 0 : n.username,
             errorCodeName: a.codeName,
             errorCode: a.code
-          })), d.logger.debug(c({ err: t })), this.sessionServer.handleError(t, e, o, (h, f) => {
-            const v = l.asCrossauthError(t).httpStatus;
+          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (h, f) => {
+            const v = l.asCrossauthError(i).httpStatus;
             let m = {};
             for (let w of this.validFlows)
               w in e.body && (m[w] = !0);
@@ -2353,27 +2353,27 @@ class Le {
         try {
           s = await this.clientStorage.getClientById(e.params.client_id);
         } catch (n) {
-          const t = l.asCrossauthError(n);
-          return d.logger.debug(c({ err: n })), o.status(t.httpStatus).view(this.sessionServer.errorPage, {
-            errorMessage: t.message,
-            errorMessages: t.messages,
-            errorCode: t.code,
-            errorCodeName: g[t.code]
+          const i = l.asCrossauthError(n);
+          return d.logger.debug(c({ err: n })), o.status(i.httpStatus).view(this.sessionServer.errorPage, {
+            errorMessage: i.message,
+            errorMessages: i.messages,
+            errorCode: i.code,
+            errorCodeName: g[i.code]
           });
         }
         const r = e.query.next ?? this.adminPrefix + "selectclient";
-        let i = {
+        let t = {
           urlPrefix: this.adminPrefix,
           csrfToken: e.csrfToken,
           next: r,
           client: s
         };
-        return o.view(this.deleteClientPage, i);
+        return o.view(this.deleteClientPage, t);
       }
     ), this.sessionServer.app.post(
       this.adminPrefix + "deleteclient/:client_id",
       async (e, o) => {
-        var r, i;
+        var r, t;
         d.logger.info(c({
           msg: "Page visit",
           method: "POST",
@@ -2396,12 +2396,12 @@ class Le {
             })
           );
         } catch (n) {
-          const t = l.asCrossauthError(n);
+          const i = l.asCrossauthError(n);
           return d.logger.error(c({
             msg: "Failed deleting OAuth client",
-            user: (i = e.user) == null ? void 0 : i.username,
-            errorCodeName: t.codeName,
-            errorCode: t.code
+            user: (t = e.user) == null ? void 0 : t.username,
+            errorCodeName: i.codeName,
+            errorCode: i.code
           })), d.logger.debug(c({ err: n })), this.sessionServer.handleError(n, e, o, (a, h) => {
             const p = l.asCrossauthError(n).httpStatus;
             return a.status(p).view(this.deleteClientPage, {
@@ -2427,7 +2427,7 @@ class Le {
     this.sessionServer.app.post(
       this.adminPrefix + "api/createclient",
       async (e, o) => {
-        var r, i;
+        var r, t;
         d.logger.info(c({
           msg: "API visit",
           method: "POST",
@@ -2444,19 +2444,19 @@ class Le {
           return await this.createClient(
             e,
             o,
-            (n, t) => n.header(...B).send({
+            (n, i) => n.header(...B).send({
               ok: !0,
-              client: t
+              client: i
             }),
             s
           );
         } catch (n) {
-          const t = l.asCrossauthError(n);
+          const i = l.asCrossauthError(n);
           d.logger.error(c({
             msg: "Create client failure",
-            user: (i = e.user) == null ? void 0 : i.username,
-            errorCodeName: t.codeName,
-            errorCode: t.code
+            user: (t = e.user) == null ? void 0 : t.username,
+            errorCodeName: i.codeName,
+            errorCode: i.code
           })), d.logger.debug(c({ err: n })), this.sessionServer.handleError(n, e, o, (a, h) => {
             a.status(this.sessionServer.errorStatus(n)).header(...B).send({
               ok: !1,
@@ -2492,22 +2492,22 @@ class Le {
           return await this.updateClient(
             e,
             o,
-            (i, n, t) => i.header(...B).send({
+            (t, n, i) => t.header(...B).send({
               ok: !0,
               client: n,
               csrfToken: e.csrfToken,
-              newSecret: t
+              newSecret: i
             })
           );
-        } catch (i) {
-          const n = l.asCrossauthError(i);
+        } catch (t) {
+          const n = l.asCrossauthError(t);
           return d.logger.error(c({
             msg: "Failed updating OAuth client",
             user: (r = e.user) == null ? void 0 : r.username,
             errorCodeName: n.codeName,
             errorCode: n.code
-          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, a) => {
-            t.status(this.sessionServer.errorStatus(i)).header(...B).send({
+          })), d.logger.debug(c({ err: t })), this.sessionServer.handleError(t, e, o, (i, a) => {
+            i.status(this.sessionServer.errorStatus(t)).header(...B).send({
               ok: !1,
               errorMessage: a.message,
               errorMessages: a.messages,
@@ -2538,20 +2538,20 @@ class Le {
           return await this.deleteClient(
             e,
             o,
-            (i) => i.header(...B).send({
+            (t) => t.header(...B).send({
               ok: !0,
               client_id: e.params.client_id
             })
           );
-        } catch (i) {
-          const n = l.asCrossauthError(i);
+        } catch (t) {
+          const n = l.asCrossauthError(t);
           d.logger.error(c({
             msg: "Delete client failure",
             user: (r = e.user) == null ? void 0 : r.username,
             errorCodeName: n.codeName,
             errorCode: n.code
-          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, a) => {
-            t.status(this.sessionServer.errorStatus(i)).header(...B).send({
+          })), d.logger.debug(c({ err: t })), this.sessionServer.handleError(t, e, o, (i, a) => {
+            i.status(this.sessionServer.errorStatus(t)).header(...B).send({
               ok: !1,
               errorMessage: a.message,
               errorMessages: a.messages,
@@ -2566,11 +2566,11 @@ class Le {
   // Internal functions
   async accessDeniedPage(e, o) {
     const s = new l(g.InsufficientPriviledges);
-    return this.sessionServer.handleError(s, e, o, (r, i) => r.status(s.httpStatus).view(this.sessionServer.errorPage, {
-      errorMessage: i.message,
-      errorMessages: i.messages,
-      errorCode: i.code,
-      errorCodeName: g[i.code]
+    return this.sessionServer.handleError(s, e, o, (r, t) => r.status(s.httpStatus).view(this.sessionServer.errorPage, {
+      errorMessage: t.message,
+      errorMessages: t.messages,
+      errorCode: t.code,
+      errorCodeName: g[t.code]
     }));
   }
   async createClient(e, o, s, r) {
@@ -2578,9 +2578,9 @@ class Le {
       throw new l(g.InvalidCsrf);
     if (!e.user || !y.isAdmin(e.user))
       throw new l(g.InsufficientPriviledges);
-    const i = e.body.confidential == "true", n = e.body.client_name, t = e.body.redirect_uris.trim().length == 0 ? [] : e.body.redirect_uris.trim().split(/[, ][ \t\n]*/);
+    const t = e.body.confidential == "true", n = e.body.client_name, i = e.body.redirect_uris.trim().length == 0 ? [] : e.body.redirect_uris.trim().split(/[, ][ \t\n]*/);
     let a = [];
-    for (let p of t)
+    for (let p of i)
       try {
         L.validateUri(p);
       } catch (v) {
@@ -2596,9 +2596,9 @@ class Le {
       p in e.body && h.push(p);
     const f = await this.clientManager.createClient(
       n,
-      t,
-      h,
       i,
+      h,
+      t,
       r == null ? void 0 : r.id
     );
     return s(o, f);
@@ -2609,26 +2609,26 @@ class Le {
     if (!e.user || !y.isAdmin(e.user))
       throw new l(g.InsufficientPriviledges);
     const r = e.body.redirect_uris.trim().length == 0 ? [] : e.body.redirect_uris.trim().split(/[, ][ \t\n]*/);
-    let i = [];
+    let t = [];
     for (let p of r)
       try {
         L.validateUri(p);
       } catch (v) {
-        d.logger.error(c({ err: v })), i.push("[" + p + "]");
+        d.logger.error(c({ err: v })), t.push("[" + p + "]");
       }
-    if (i.length > 0)
+    if (t.length > 0)
       throw new l(
         g.BadRequest,
-        "The following redirect URIs are invalid: " + i.join(" ")
+        "The following redirect URIs are invalid: " + t.join(" ")
       );
     let n = [];
     for (let p of this.validFlows)
       p in e.body && n.push(p);
-    const t = {};
-    t.client_name = e.body.client_name, t.confidential = e.body.confidential == "true", t.valid_flow = n, t.redirect_uri = r, t.userid = e.body.userid, t.userid == null && (t.userid = null);
+    const i = {};
+    i.client_name = e.body.client_name, i.confidential = e.body.confidential == "true", i.valid_flow = n, i.redirect_uri = r, i.userid = e.body.userid, i.userid == null && (i.userid = null);
     const a = e.body.resetSecret == "true", { client: h, newSecret: f } = await this.clientManager.updateClient(
       e.params.client_id,
-      t,
+      i,
       a
     );
     return s(o, h, f);
@@ -2683,29 +2683,29 @@ class Ge {
         })), !(e != null && e.user))
           return o.redirect(this.sessionServer.loginUrl + "?next=" + this.prefix + "selectclient");
         try {
-          let s = [], r = Number(e.query.skip), i = Number(e.query.take);
-          r || (r = 0), i || (i = 10), e.query.search ? s = await this.clientSearchFn(
+          let s = [], r = Number(e.query.skip), t = Number(e.query.take);
+          r || (r = 0), t || (t = 10), e.query.search ? s = await this.clientSearchFn(
             e.query.search,
             this.clientStorage,
             e.user.id
           ) : s = await this.clientStorage.getClients(
             r,
-            i,
+            t,
             e.user.id
           );
           const n = e.query.next ?? encodeURIComponent(e.url);
-          let t = {
+          let i = {
             urlPrefix: this.prefix,
             user: e.user,
             skip: r,
-            take: i,
+            take: t,
             clients: s,
             havePrevious: r > 0,
-            haveNext: i != null && s.length == i,
+            haveNext: t != null && s.length == t,
             isAdmin: !1,
             next: n
           };
-          return e.query.next && (t.next = e.query.next), o.view(this.selectClientPage, t);
+          return e.query.next && (i.next = e.query.next), o.view(this.selectClientPage, i);
         } catch (s) {
           const r = l.asCrossauthError(s);
           return d.logger.error(c({ err: s })), y.sendPageError(
@@ -2748,7 +2748,7 @@ class Ge {
     ), this.sessionServer.app.post(
       this.prefix + "createclient",
       async (e, o) => {
-        var r, i;
+        var r, t;
         if (d.logger.info(c({
           msg: "Page visit",
           method: "POST",
@@ -2762,9 +2762,9 @@ class Ge {
           return await this.createClient(
             e,
             o,
-            (n, t) => n.view(this.createClientPage, {
+            (n, i) => n.view(this.createClientPage, {
               message: "Created client",
-              client: t,
+              client: i,
               csrfToken: e.csrfToken,
               urlPrefix: this.prefix,
               validFlows: this.validFlows,
@@ -2777,12 +2777,12 @@ class Ge {
             e.user
           );
         } catch (n) {
-          const t = l.asCrossauthError(n);
+          const i = l.asCrossauthError(n);
           return d.logger.error(c({
             msg: "Failed creating OAuth client",
-            user: (i = e.user) == null ? void 0 : i.username,
-            errorCodeName: t.codeName,
-            errorCode: t.code
+            user: (t = e.user) == null ? void 0 : t.username,
+            errorCodeName: i.codeName,
+            errorCode: i.code
           })), d.logger.debug(c({ err: n })), this.sessionServer.handleError(n, e, o, (a, h) => {
             const p = l.asCrossauthError(n).httpStatus;
             return a.status(p).view(this.createClientPage, {
@@ -2823,21 +2823,21 @@ class Ge {
           return await this.createClient(
             e,
             o,
-            (i, n) => i.header(...D).send({
+            (t, n) => t.header(...D).send({
               ok: !0,
               client: n
             }),
             e.user
           );
-        } catch (i) {
-          const n = l.asCrossauthError(i);
+        } catch (t) {
+          const n = l.asCrossauthError(t);
           d.logger.error(c({
             msg: "Create client failure",
             user: (r = e.user) == null ? void 0 : r.username,
             errorCodeName: n.codeName,
             errorCode: n.code
-          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, a) => {
-            t.status(this.sessionServer.errorStatus(i)).header(...D).send({
+          })), d.logger.debug(c({ err: t })), this.sessionServer.handleError(t, e, o, (i, a) => {
+            i.status(this.sessionServer.errorStatus(t)).header(...D).send({
               ok: !1,
               errorMessage: a.message,
               errorMessages: a.messages,
@@ -2877,9 +2877,9 @@ class Ge {
         }
         let r = e.query.next;
         r || (e.query.userid ? r = this.prefix + "selectuser" : r = this.prefix + "selectclient");
-        let i;
+        let t;
         try {
-          e.query.userid && (i = (await this.sessionServer.userStorage.getUserById(e.query.userid)).user);
+          e.query.userid && (t = (await this.sessionServer.userStorage.getUserById(e.query.userid)).user);
         } catch (a) {
           const h = l.asCrossauthError(a);
           return d.logger.debug(c({ err: a })), o.status(h.httpStatus).view(this.sessionServer.errorPage, {
@@ -2892,13 +2892,13 @@ class Ge {
         let n = {};
         for (let a of this.validFlows)
           s.valid_flow.includes(a) && (n[a] = !0);
-        let t = {
+        let i = {
           urlPrefix: this.prefix,
           csrfToken: e.csrfToken,
           validFlows: this.validFlows,
           flowNames: E.flowNames(this.validFlows),
           selectedFlows: n,
-          user: i,
+          user: t,
           client_id: s.client_id,
           client_name: s.client_name,
           confidential: s.confidential,
@@ -2906,19 +2906,19 @@ class Ge {
           isAdmin: !0,
           next: r
         };
-        return o.view(this.updateClientPage, t);
+        return o.view(this.updateClientPage, i);
       }
     ), this.sessionServer.app.post(
       this.prefix + "updateclient/:client_id",
       async (e, o) => {
-        var i, n;
+        var t, n;
         if (!this.sessionServer.userStorage) throw new l(g.Configuration, "Cannot call updateclient unless a user storage is provided ");
         d.logger.info(c({
           msg: "Page visit",
           method: "POST",
           url: this.prefix + "updateclient",
           ip: e.ip,
-          user: (i = e.user) == null ? void 0 : i.username
+          user: (t = e.user) == null ? void 0 : t.username
         }));
         let s = e.body.next;
         s || (s = this.prefix + "selectuser");
@@ -2928,7 +2928,7 @@ class Ge {
           return e.body.userid && (r = (await this.sessionServer.userStorage.getUserById(e.body.userid)).user), await this.updateClient(
             e,
             o,
-            (t, a, h) => t.view(this.updateClientPage, {
+            (i, a, h) => i.view(this.updateClientPage, {
               message: "Updated client",
               client: a,
               csrfToken: e.csrfToken,
@@ -2942,15 +2942,15 @@ class Ge {
               ...e.body
             })
           );
-        } catch (t) {
-          const a = l.asCrossauthError(t);
+        } catch (i) {
+          const a = l.asCrossauthError(i);
           return d.logger.error(c({
             msg: "Failed updating OAuth client",
             user: (n = e.user) == null ? void 0 : n.username,
             errorCodeName: a.codeName,
             errorCode: a.code
-          })), d.logger.debug(c({ err: t })), this.sessionServer.handleError(t, e, o, (h, f) => {
-            const v = l.asCrossauthError(t).httpStatus;
+          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (h, f) => {
+            const v = l.asCrossauthError(i).httpStatus;
             let m = {};
             for (let w of this.validFlows)
               w in e.body && (m[w] = !0);
@@ -2993,22 +2993,22 @@ class Ge {
           return e.body.userid && await this.sessionServer.userStorage.getUserById(e.body.userid), await this.updateClient(
             e,
             o,
-            (i, n, t) => i.header(...D).send({
+            (t, n, i) => t.header(...D).send({
               ok: !0,
               client: n,
               csrfToken: e.csrfToken,
-              newSecret: t
+              newSecret: i
             })
           );
-        } catch (i) {
-          const n = l.asCrossauthError(i);
+        } catch (t) {
+          const n = l.asCrossauthError(t);
           return d.logger.error(c({
             msg: "Failed updating OAuth client",
             user: (r = e.user) == null ? void 0 : r.username,
             errorCodeName: n.codeName,
             errorCode: n.code
-          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, a) => {
-            t.status(this.sessionServer.errorStatus(i)).header(...D).send({
+          })), d.logger.debug(c({ err: t })), this.sessionServer.handleError(t, e, o, (i, a) => {
+            i.status(this.sessionServer.errorStatus(t)).header(...D).send({
               ok: !1,
               errorMessage: a.message,
               errorMessages: a.messages,
@@ -3043,28 +3043,28 @@ class Ge {
               "You may not delete this client"
             );
         } catch (n) {
-          const t = l.asCrossauthError(n);
-          return d.logger.debug(c({ err: n })), o.status(t.httpStatus).view(this.sessionServer.errorPage, {
-            errorMessage: t.message,
-            errorMessages: t.messages,
-            errorCode: t.code,
-            errorCodeName: g[t.code]
+          const i = l.asCrossauthError(n);
+          return d.logger.debug(c({ err: n })), o.status(i.httpStatus).view(this.sessionServer.errorPage, {
+            errorMessage: i.message,
+            errorMessages: i.messages,
+            errorCode: i.code,
+            errorCodeName: g[i.code]
           });
         }
         const r = e.query.next ?? "/";
-        let i = {
+        let t = {
           urlPrefix: this.prefix,
           csrfToken: e.csrfToken,
           backUrl: this.prefix + "selectclient",
           client: s,
           next: r
         };
-        return o.view(this.deleteClientPage, i);
+        return o.view(this.deleteClientPage, t);
       }
     ), this.sessionServer.app.post(
       this.prefix + "deleteclient/:client_id",
       async (e, o) => {
-        var r, i;
+        var r, t;
         if (d.logger.info(c({
           msg: "Page visit",
           method: "POST",
@@ -3088,12 +3088,12 @@ class Ge {
             e.user
           );
         } catch (n) {
-          const t = l.asCrossauthError(n);
+          const i = l.asCrossauthError(n);
           return d.logger.error(c({
             msg: "Failed deleting OAuth client",
-            user: (i = e.user) == null ? void 0 : i.username,
-            errorCodeName: t.codeName,
-            errorCode: t.code
+            user: (t = e.user) == null ? void 0 : t.username,
+            errorCodeName: i.codeName,
+            errorCode: i.code
           })), d.logger.debug(c({ err: n })), this.sessionServer.handleError(n, e, o, (a, h) => {
             const p = l.asCrossauthError(n).httpStatus;
             return a.status(p).view(this.deleteClientPage, {
@@ -3132,21 +3132,21 @@ class Ge {
           return await this.deleteClient(
             e,
             o,
-            (i) => i.header(...D).send({
+            (t) => t.header(...D).send({
               ok: !0,
               client_id: e.params.client_id
             }),
             e.user
           );
-        } catch (i) {
-          const n = l.asCrossauthError(i);
+        } catch (t) {
+          const n = l.asCrossauthError(t);
           d.logger.error(c({
             msg: "Delete client failure",
             user: (r = e.user) == null ? void 0 : r.username,
             errorCodeName: n.codeName,
             errorCode: n.code
-          })), d.logger.debug(c({ err: i })), this.sessionServer.handleError(i, e, o, (t, a) => {
-            t.status(this.sessionServer.errorStatus(i)).header(...D).send({
+          })), d.logger.debug(c({ err: t })), this.sessionServer.handleError(t, e, o, (i, a) => {
+            i.status(this.sessionServer.errorStatus(t)).header(...D).send({
               ok: !1,
               errorMessage: a.message,
               errorMessages: a.messages,
@@ -3164,9 +3164,9 @@ class Ge {
       throw new l(g.InvalidCsrf);
     if (!e.user)
       throw new l(g.InsufficientPriviledges);
-    const i = e.body.confidential == "true", n = e.body.client_name, t = e.body.redirect_uris.trim().length == 0 ? [] : e.body.redirect_uris.trim().split(/[, ][ \t\n]*/);
+    const t = e.body.confidential == "true", n = e.body.client_name, i = e.body.redirect_uris.trim().length == 0 ? [] : e.body.redirect_uris.trim().split(/[, ][ \t\n]*/);
     let a = [];
-    for (let p of t)
+    for (let p of i)
       try {
         L.validateUri(p);
       } catch (v) {
@@ -3181,9 +3181,9 @@ class Ge {
     e.body[E.AuthorizationCode] && h.push(E.AuthorizationCode), e.body[E.AuthorizationCodeWithPKCE] && h.push(E.AuthorizationCodeWithPKCE), e.body[E.ClientCredentials] && h.push(E.ClientCredentials), e.body[E.RefreshToken] && h.push(E.RefreshToken), e.body[E.DeviceCode] && h.push(E.DeviceCode), e.body[E.Password] && h.push(E.Password), e.body[E.PasswordMfa] && h.push(E.PasswordMfa), e.body[E.OidcAuthorizationCode] && h.push(E.OidcAuthorizationCode);
     const f = await this.clientManager.createClient(
       n,
-      t,
-      h,
       i,
+      h,
+      t,
       r == null ? void 0 : r.id
     );
     return s(o, f);
@@ -3194,26 +3194,26 @@ class Ge {
     if (!e.user)
       throw new l(g.InsufficientPriviledges);
     const r = e.body.redirect_uris.trim().length == 0 ? [] : e.body.redirect_uris.trim().split(/[, ][ \t\n]*/);
-    let i = [];
+    let t = [];
     for (let p of r)
       try {
         L.validateUri(p);
       } catch (v) {
-        d.logger.error(c({ err: v })), i.push("[" + p + "]");
+        d.logger.error(c({ err: v })), t.push("[" + p + "]");
       }
-    if (i.length > 0)
+    if (t.length > 0)
       throw new l(
         g.BadRequest,
-        "The following redirect URIs are invalid: " + i.join(" ")
+        "The following redirect URIs are invalid: " + t.join(" ")
       );
     let n = [];
     for (let p of this.validFlows)
       p in e.body && n.push(p);
-    const t = {};
-    t.client_name = e.body.client_name, t.confidential = e.body.confidential == "true", t.valid_flow = n, t.redirect_uri = r, t.userid = e.user.id;
+    const i = {};
+    i.client_name = e.body.client_name, i.confidential = e.body.confidential == "true", i.valid_flow = n, i.redirect_uri = r, i.userid = e.user.id;
     const a = e.body.resetSecret == "true", { client: h, newSecret: f } = await this.clientManager.updateClient(
       e.params.client_id,
-      t,
+      i,
       a
     );
     return s(o, h, f);
@@ -3231,7 +3231,7 @@ class Ge {
     return await this.clientStorage.deleteClient(e.params.client_id), s(o);
   }
 }
-const A = ["Content-Type", "application/json; charset=utf-8"], se = [
+const F = ["Content-Type", "application/json; charset=utf-8"], se = [
   "login",
   "logout",
   "changepassword",
@@ -3338,26 +3338,26 @@ function je(S) {
   return S.username == null ? e.push("Username must be given") : S.username.length < 2 ? e.push("Username must be at least 2 characters") : S.username.length > 254 && e.push("Username must be no longer than 254 characters"), e;
 }
 function We(S, e, o, s) {
-  let i = {
+  let t = {
     username: S.body.username,
     state: "active"
   };
   const n = S.user && y.isAdmin(S.user);
-  for (let t in S.body) {
-    let a = t.replace(/^user_/, "");
-    t.startsWith("user_") && (n || e.includes(a)) && (i[a] = S.body[t]);
+  for (let i in S.body) {
+    let a = i.replace(/^user_/, "");
+    i.startsWith("user_") && (n || e.includes(a)) && (t[a] = S.body[i]);
   }
-  return i.factor1 = "localpassword", S.body.factor1 && o.includes("" + S.body.factor1) && (i.factor1 = S.body.factor1), S.body.factor2 && s.includes("" + S.body.factor2) && (i.factor2 = S.body.factor2), i;
+  return t.factor1 = "localpassword", S.body.factor1 && o.includes("" + S.body.factor1) && (t.factor1 = S.body.factor1), S.body.factor2 && s.includes("" + S.body.factor2) && (t.factor2 = S.body.factor2), t;
 }
-function Je(S, e, o) {
+function Ke(S, e, o) {
   const s = e.user && y.isAdmin(e.user);
   for (let r in e.body) {
-    let i = r.replace(/^user_/, "");
-    r.startsWith("user_") && (s || o.includes(i)) && (S[i] = e.body[r]);
+    let t = r.replace(/^user_/, "");
+    r.startsWith("user_") && (s || o.includes(t)) && (S[t] = e.body[r]);
   }
   return S;
 }
-class Ke {
+class Je {
   /**
    * Constructor
    * 
@@ -3419,7 +3419,7 @@ class Ke {
      * construction or the default value.
      * See {@link FastifySessionServerOptions}.
      */
-    u(this, "updateUserFn", Je);
+    u(this, "updateUserFn", Ke);
     /**
      * User storage taken from constructor args.
      * See {@link FastifySessionServer.constructor}.
@@ -3473,102 +3473,115 @@ class Ke {
     u(this, "userAllowedFactor1", ["localpassword"]);
     u(this, "adminAllowedFactor1", ["localpassword"]);
     this.app = e, this.userEndpoints = new De(this, r), this.adminEndpoints = new He(this, r), C("prefix", k.String, this, r, "PREFIX"), this.prefix.endsWith("/") || (this.prefix += "/"), this.prefix.startsWith("/") || "" + this.prefix, this.loginUrl = this.prefix + "login", C("signupPage", k.String, this, r, "SIGNUP_PAGE"), C("loginPage", k.String, this, r, "LOGIN_PAGE"), C("factor2Page", k.String, this, r, "FACTOR2_PAGE"), C("configureFactor2Page", k.String, this, r, "SIGNUP_FACTOR2_PAGE"), C("errorPage", k.String, this, r, "ERROR_PAGE"), C("allowedFactor2", k.JsonArray, this, r, "ALLOWED_FACTOR2"), C("enableEmailVerification", k.Boolean, this, r, "ENABLE_EMAIL_VERIFICATION"), C("enablePasswordReset", k.Boolean, this, r, "ENABLE_PASSWORD_RESET"), C("factor2ProtectedPageEndpoints", k.JsonArray, this, r, "FACTOR2_PROTECTED_PAGE_ENDPOINTS"), C("factor2ProtectedApiEndpoints", k.JsonArray, this, r, "FACTOR2_PROTECTED_API_ENDPOINTS"), C("enableAdminEndpoints", k.Boolean, this, r, "ENABLE_ADMIN_ENDPOINTS"), C("enableOAuthClientManagement", k.Boolean, this, r, "ENABLE_OAUTH_CLIENT_MANAGEMENT"), C("editUserScope", k.String, this, r, "EDIT_USER_SCOPE"), C("userAllowedFactor1", k.JsonArray, this, r, "USER_ALLOWED_FACTOR1"), C("adminAllowedFactor1", k.JsonArray, this, r, "ADMIN_ALLOWED_FACTOR1"), C("loginRedirect", k.JsonArray, this, r, "LOGIN_REDIRECT"), C("logoutRedirect", k.JsonArray, this, r, "LOGOUT_REDIRECT"), r.validateUserFn && (this.validateUserFn = r.validateUserFn), r.createUserFn && (this.createUserFn = r.createUserFn), r.updateUserFn && (this.updateUserFn = r.updateUserFn), r.addToSession && (this.addToSession = r.addToSession), r.validateSession && (this.validateSession = r.validateSession), this.endpoints = [...he, ...le], this.endpoints = [...this.endpoints, ...se, ...ie], this.enableAdminEndpoints && (this.endpoints = [...this.endpoints, ...re, ...te]), this.enableOAuthClientManagement && (this.endpoints = [...this.endpoints, ...Z, ...ee, ...Q, ...q]), this.enableEmailVerification && (this.endpoints = [...this.endpoints, ...ae, ...ne]), this.enablePasswordReset && (this.endpoints = [...this.endpoints, ...de, ...ce]), r.endpoints && (C("endpoints", k.JsonArray, this, r, "SESSION_ENDPOINTS"), this.endpoints.length == 1 && this.endpoints[0] == "all" && (this.endpoints = Ve), this.endpoints.length == 1 && this.endpoints[0] == "allMinusOAuth" && (this.endpoints = Be)), this.allowedFactor2.length > 0 && (this.endpoints = [...this.endpoints, ...ge, ...oe]);
-    let i = !1;
-    for (let t of this.endpoints)
-      if (q.includes(t) || Q.includes(t)) {
-        i = !0;
+    let t = !1;
+    for (let i of this.endpoints)
+      if (q.includes(i) || Q.includes(i)) {
+        t = !0;
         break;
       }
-    i && (this.adminClientEndpoints = new Le(this, r));
+    t && (this.adminClientEndpoints = new Le(this, r));
     let n = !1;
-    for (let t of this.endpoints)
-      if (ee.includes(t) || Z.includes(t)) {
+    for (let i of this.endpoints)
+      if (ee.includes(i) || Z.includes(i)) {
         n = !0;
         break;
       }
-    n && (this.userClientEndpoints = new Ge(this, r)), this.addEndpoints(), C("endpoints", k.JsonArray, this, r, "ENDPOINTS"), r.userStorage && (this.userStorage = r.userStorage), this.authenticators = s, this.sessionManager = new Ae(o, s, r), e.addHook("preHandler", async (t, a) => {
+    n && (this.userClientEndpoints = new Ge(this, r)), this.addEndpoints(), C("endpoints", k.JsonArray, this, r, "ENDPOINTS"), r.userStorage && (this.userStorage = r.userStorage), this.authenticators = s, this.sessionManager = new Ae(o, s, r), e.addHook("preHandler", async (i, a) => {
       var v, m;
       d.logger.debug(c({ message: "Getting session cookie" }));
-      let h = this.getSessionCookieValue(t), f = {};
+      let h = this.getSessionCookieValue(i), f = {};
       if (h)
         try {
-          f.hashedSessionId = F.hash(this.sessionManager.getSessionId(h));
+          f.hashedSessionId = N.hash(this.sessionManager.getSessionId(h));
         } catch {
-          f.hashedSessionCookie = F.hash(h);
+          f.hashedSessionCookie = N.hash(h);
         }
       d.logger.debug(c({ message: "Getting csrf cookie" }));
       let p;
       try {
-        p = this.getCsrfCookieValue(t), p && this.sessionManager.validateCsrfCookie(p);
+        p = this.getCsrfCookieValue(i), p && this.sessionManager.validateCsrfCookie(p);
       } catch (w) {
-        d.logger.warn(c({ message: "Invalid csrf cookie received", cerr: w, hashedCsrfCookie: this.getHashOfCsrfCookie(t) })), a.clearCookie(this.sessionManager.csrfCookieName), p = void 0;
+        d.logger.warn(c({ message: "Invalid csrf cookie received", cerr: w, hashedCsrfCookie: this.getHashOfCsrfCookie(i) })), a.clearCookie(this.sessionManager.csrfCookieName), p = void 0;
       }
-      if (["GET", "OPTIONS", "HEAD"].includes(t.method))
+      if (["GET", "OPTIONS", "HEAD"].includes(i.method))
         try {
           if (p) {
             d.logger.debug(c({ message: "Valid CSRF cookie - creating token" }));
             const w = await this.sessionManager.createCsrfFormOrHeaderValue(p);
-            t.csrfToken = w;
+            i.csrfToken = w;
           } else {
             d.logger.debug(c({ message: "Invalid CSRF cookie - recreating" }));
             const { csrfCookie: w, csrfFormOrHeaderValue: P } = await this.sessionManager.createCsrfToken();
-            a.setCookie(w.name, w.value, w.options), t.csrfToken = P;
+            a.setCookie(w.name, w.value, w.options), i.csrfToken = P;
           }
-          a.header(this.sessionManager.csrfHeaderName, t.csrfToken);
+          a.header(this.sessionManager.csrfHeaderName, i.csrfToken);
         } catch (w) {
           d.logger.error(c({
             message: "Couldn't create CSRF token",
             cerr: w,
-            user: (v = t.user) == null ? void 0 : v.username,
+            user: (v = i.user) == null ? void 0 : v.username,
             ...f
           })), d.logger.debug(c({ err: w })), a.clearCookie(this.sessionManager.csrfCookieName);
         }
       else if (p)
         try {
-          this.csrfToken(t, a);
+          this.csrfToken(i, a);
         } catch (w) {
           d.logger.error(c({
             message: "Couldn't create CSRF token",
             cerr: w,
-            user: (m = t.user) == null ? void 0 : m.username,
+            user: (m = i.user) == null ? void 0 : m.username,
             ...f
           })), d.logger.debug(c({ err: w }));
         }
-      if (h = this.getSessionCookieValue(t), h)
+      if (h = this.getSessionCookieValue(i), h) {
         try {
-          const w = this.sessionManager.getSessionId(h);
-          let { key: P, user: T } = await this.sessionManager.userForSessionId(w);
+          const _ = this.sessionManager.getSessionId(h);
+          let { key: b, user: U } = await this.sessionManager.userForSessionId(_);
           this.validateSession && this.validateSession(
-            P,
-            T,
-            t
-          ), t.sessionId = w, t.user = T, t.authType = "cookie", d.logger.debug(c({
+            b,
+            U,
+            i
+          ), i.sessionId = _, i.user = U, i.authType = "cookie", d.logger.debug(c({
             message: "Valid session id",
-            user: T == null ? void 0 : T.username
+            user: U == null ? void 0 : U.username
           }));
         } catch {
           d.logger.warn(c({
             message: "Invalid session cookie received",
-            hashOfSessionId: this.getHashOfSessionId(t)
+            hashOfSessionId: this.getHashOfSessionId(i)
           })), a.clearCookie(this.sessionManager.sessionCookieName);
         }
+        let w = !1, P = {}, T;
+        if (!this.sessionManager.enableKnownDevices)
+          i.knownDevice = !1;
+        else {
+          d.logger.debug(c({ message: "Getting known device cookie" })), T = void 0;
+          try {
+            T = this.getKnownDeviceCookieValue(i), w = !0, T && (P = await this.sessionManager.getUsersForKnownDeviceKey(T) ?? {});
+          } catch (_) {
+            d.logger.warn(c({ message: "Invalid or expired known devive cookie received", cerr: _, knownDeviceCookieValue: T })), a.clearCookie(this.sessionManager.knownDeviceCookieName), p = void 0;
+          }
+        }
+        w && i.user && i.user.userid in P && T && (Date.now() > P[i.user.userid].getTime() ? (d.logger.info(c({ msg: "Known device has expired for user", username: i.user.username })), await this.sessionManager.removeUserFromKnownDevice(T, i.user.userid)) : i.knownDevice = !0);
+      }
     }), e.addHook(
       "preHandler",
-      async (t, a) => {
+      async (i, a) => {
         var f, p, v;
-        const h = this.getSessionCookieValue(t);
-        if (h && ((f = t.user) != null && f.factor2) && (this.factor2ProtectedPageEndpoints.includes(t.url) || this.factor2ProtectedApiEndpoints.includes(t.url))) {
+        const h = this.getSessionCookieValue(i);
+        if (h && ((f = i.user) != null && f.factor2) && (this.factor2ProtectedPageEndpoints.includes(i.url) || this.factor2ProtectedApiEndpoints.includes(i.url)) && (!this.sessionManager.enableKnownDevices || !i.knownDevice)) {
           const m = this.sessionManager.getSessionId(h);
-          if (["GET", "OPTIONS", "HEAD"].includes(t.method)) {
-            const w = this.getSessionCookieValue(t);
+          if (["GET", "OPTIONS", "HEAD"].includes(i.method)) {
+            const w = this.getSessionCookieValue(i);
             if (w) {
               const P = this.sessionManager.getSessionId(w);
               if ("pre2fa" in await this.sessionManager.dataForSessionId(P)) {
                 d.logger.debug("Cancelling 2FA");
                 try {
                   await this.sessionManager.cancelTwoFactorPageVisit(P);
-                } catch (N) {
-                  d.logger.debug(c({ err: N })), d.logger.error(c({ message: "Failed cancelling 2FA", cerr: N, user: (v = t.user) == null ? void 0 : v.username, hashOfSessionId: this.getHashOfSessionId(t) }));
+                } catch (_) {
+                  d.logger.debug(c({ err: _ })), d.logger.error(c({ message: "Failed cancelling 2FA", cerr: _, user: (v = i.user) == null ? void 0 : v.username, hashOfSessionId: this.getHashOfSessionId(i) }));
                 }
               }
             }
@@ -3577,40 +3590,40 @@ class Ke {
             if ("pre2fa" in w) {
               d.logger.debug("Completing 2FA");
               const T = [...this.authenticators[w.pre2fa.factor2].transientSecretNames()];
-              let N = {};
-              for (let M in t.body)
-                T.includes(M) && (N[M] = t.body[M]);
+              let _ = {};
+              for (let U in i.body)
+                T.includes(U) && (_[U] = i.body[U]);
               let b;
               try {
-                await this.sessionManager.completeTwoFactorPageVisit(N, m);
-              } catch (M) {
-                b = l.asCrossauthError(M), d.logger.debug(c({ err: M }));
-                const I = l.asCrossauthError(M);
+                await this.sessionManager.completeTwoFactorPageVisit(_, m);
+              } catch (U) {
+                b = l.asCrossauthError(U), d.logger.debug(c({ err: U }));
+                const M = l.asCrossauthError(U);
                 d.logger.error(c({
                   message: b.message,
-                  cerr: M,
-                  user: t.body.username,
-                  errorCode: I.code,
-                  errorCodeName: I.codeName
+                  cerr: U,
+                  user: i.body.username,
+                  errorCode: M.code,
+                  errorCodeName: M.codeName
                 }));
               }
-              if (t.body = w.pre2fa.body, b)
+              if (i.body = w.pre2fa.body, b)
                 if (b.code == g.Expired) {
                   d.logger.debug("Error - cancelling 2FA");
                   try {
                     await this.sessionManager.cancelTwoFactorPageVisit(m);
-                  } catch (M) {
-                    d.logger.error(c({ message: "Failed cancelling 2FA", cerr: M, user: (p = t.user) == null ? void 0 : p.username, hashOfSessionId: this.getHashOfSessionId(t) })), d.logger.debug(c({ err: M }));
+                  } catch (U) {
+                    d.logger.error(c({ message: "Failed cancelling 2FA", cerr: U, user: (p = i.user) == null ? void 0 : p.username, hashOfSessionId: this.getHashOfSessionId(i) })), d.logger.debug(c({ err: U }));
                   }
-                  t.body = {
-                    ...t.body,
+                  i.body = {
+                    ...i.body,
                     errorMessage: b.message,
                     errorMessages: b.message,
                     errorCode: "" + b.code,
                     errorCodeName: g[b.code]
                   };
                 } else
-                  return this.factor2ProtectedPageEndpoints.includes(t.url) ? a.redirect(this.prefix + "factor2?error=" + g[b.code]) : a.status(b.httpStatus).send(JSON.stringify({
+                  return this.factor2ProtectedPageEndpoints.includes(i.url) ? a.redirect(this.prefix + "factor2?error=" + g[b.code]) : a.status(b.httpStatus).send(JSON.stringify({
                     ok: !1,
                     errorMessage: b.message,
                     errorMessages: b.messages,
@@ -3618,7 +3631,7 @@ class Ke {
                     errorCodeName: g[b.code]
                   }));
             } else
-              return this.validateCsrfToken(t), d.logger.debug("Starting 2FA"), await this.sessionManager.initiateTwoFactorPageVisit(t.user, m, t.body, t.url.replace(/\?.*$/, "")), this.factor2ProtectedPageEndpoints.includes(t.url) ? a.redirect(this.prefix + "factor2") : a.send(JSON.stringify({
+              return this.validateCsrfToken(i), d.logger.debug("Starting 2FA"), await this.sessionManager.initiateTwoFactorPageVisit(i.user, m, i.body, i.url.replace(/\?.*$/, "")), this.factor2ProtectedPageEndpoints.includes(i.url) ? a.redirect(this.prefix + "factor2") : a.send(JSON.stringify({
                 ok: !0,
                 factor2Required: !0
               }));
@@ -3685,13 +3698,13 @@ class Ke {
           return await this.login(
             e,
             o,
-            (r, i) => {
-              if (i.state == O.passwordChangeNeeded) {
+            (r, t) => {
+              if (t.state == I.passwordChangeNeeded) {
                 if (this.endpoints.includes("changepassword"))
                   return d.logger.debug(c({ message: "Password change needed - sending redirect" })), r.redirect("/changepassword?required=true&next=" + encodeURIComponent("login?next=" + s));
                 {
                   const n = new l(g.PasswordChangeNeeded);
-                  return this.handleError(n, e, r, (t, a) => t.view(this.loginPage, {
+                  return this.handleError(n, e, r, (i, a) => i.view(this.loginPage, {
                     errorMessage: a.message,
                     errorMessages: a.messages,
                     errorCode: a.code,
@@ -3703,10 +3716,10 @@ class Ke {
                     urlPrefix: this.prefix
                   }));
                 }
-              } else if (i.state == O.passwordResetNeeded || i.state == O.passwordAndFactor2ResetNeeded) {
+              } else if (t.state == I.passwordResetNeeded || t.state == I.passwordAndFactor2ResetNeeded) {
                 d.logger.debug(c({ message: "Password reset needed - sending error" }));
                 const n = new l(g.PasswordResetNeeded);
-                return this.handleError(n, e, r, (t, a) => t.view(this.loginPage, {
+                return this.handleError(n, e, r, (i, a) => i.view(this.loginPage, {
                   errorMessage: a.message,
                   errorMessages: a.messages,
                   errorCode: a.code,
@@ -3717,15 +3730,15 @@ class Ke {
                   csrfToken: e.csrfToken,
                   urlPrefix: this.prefix
                 }));
-              } else if (this.allowedFactor2.length > 0 && (i.state == O.factor2ResetNeeded || !this.allowedFactor2.includes(i.factor2 ? i.factor2 : "none"))) {
+              } else if (this.allowedFactor2.length > 0 && (t.state == I.factor2ResetNeeded || !this.allowedFactor2.includes(t.factor2 ? t.factor2 : "none"))) {
                 if (d.logger.debug(c({
-                  message: `Factor2 reset needed.  Factor2 is ${i.factor2}, state is ${i.state}, allowed factor2 is [${this.allowedFactor2.join(", ")}]`,
-                  username: i.username
+                  message: `Factor2 reset needed.  Factor2 is ${t.factor2}, state is ${t.state}, allowed factor2 is [${this.allowedFactor2.join(", ")}]`,
+                  username: t.username
                 })), this.endpoints.includes("changefactor2"))
                   return d.logger.debug(c({ message: "Factor 2 reset needed - sending redirect" })), r.redirect("/changefactor2?required=true&next=" + encodeURIComponent("login?next=" + s));
                 {
                   const n = new l(g.Factor2ResetNeeded);
-                  return this.handleError(n, e, r, (t, a) => t.view(this.loginPage, {
+                  return this.handleError(n, e, r, (i, a) => i.view(this.loginPage, {
                     errorMessage: a.message,
                     errorMessages: a.messages,
                     errorCode: a.code,
@@ -3738,7 +3751,7 @@ class Ke {
                   }));
                 }
               } else {
-                if (!i.factor2 || i.factor2.length == 0)
+                if (!t.factor2 || t.factor2.length == 0)
                   return d.logger.debug(c({ message: "Successful login - sending redirect" })), r.redirect(s);
                 {
                   let n = {
@@ -3746,7 +3759,7 @@ class Ke {
                     next: e.body.next ?? this.loginRedirect,
                     persist: e.body.persist ? "on" : "",
                     urlPrefix: this.prefix,
-                    factor2: i.factor2,
+                    factor2: t.factor2,
                     action: "loginfactor2"
                   };
                   return r.view(this.factor2Page, n);
@@ -3755,7 +3768,7 @@ class Ke {
             }
           );
         } catch (r) {
-          return d.logger.debug(c({ err: r })), this.handleError(r, e, o, (i, n) => i.view(this.loginPage, {
+          return d.logger.debug(c({ err: r })), this.handleError(r, e, o, (t, n) => t.view(this.loginPage, {
             errorMessage: n.message,
             errorMessages: n.messages,
             errorCode: n.code,
@@ -3780,33 +3793,33 @@ class Ke {
           return d.logger.debug(c({ message: "Next page " + s })), await this.loginFactor2(
             e,
             o,
-            (r, i) => (d.logger.debug(c({ message: "Successful login - sending redirect to" })), r.redirect(s))
+            (r, t) => (d.logger.debug(c({ message: "Successful login - sending redirect to" })), r.redirect(s))
           );
         } catch (r) {
           d.logger.debug(c({ err: r }));
-          let i;
+          let t;
           try {
             const n = e.sessionId ? await this.sessionManager.dataForSessionId(e.sessionId) : void 0;
-            i = n == null ? void 0 : n.factor2;
+            t = n == null ? void 0 : n.factor2;
           } catch (n) {
             d.logger.error(c({ err: n }));
           }
-          return i && i in this.authenticators ? this.handleError(r, e, o, (n, t) => n.view(this.factor2Page, {
-            errorMessage: t.message,
-            errorMessages: t.messages,
-            errorCode: t.code,
-            errorCodeName: g[t.code],
+          return t && t in this.authenticators ? this.handleError(r, e, o, (n, i) => n.view(this.factor2Page, {
+            errorMessage: i.message,
+            errorMessages: i.messages,
+            errorCode: i.code,
+            errorCodeName: g[i.code],
             next: e.body.next,
             persist: e.body.persist ? "on" : "",
             csrfToken: e.csrfToken,
             urlPrefix: this.prefix,
-            factor2: i,
+            factor2: t,
             action: "loginfactor2"
-          })) : this.handleError(r, e, o, (n, t) => n.view(this.loginPage, {
-            errorMessage: t.message,
-            errorMessages: t.messages,
-            errorCode: t.code,
-            errorCodeName: g[t.code],
+          })) : this.handleError(r, e, o, (n, i) => n.view(this.loginPage, {
+            errorMessage: i.message,
+            errorMessages: i.messages,
+            errorCode: i.code,
+            errorCodeName: g[i.code],
             next: e.body.next,
             persist: e.body.persist ? "on" : "",
             csrfToken: e.csrfToken,
@@ -3829,17 +3842,17 @@ class Ke {
           g.Unauthorized,
           "No session cookie present"
         );
-        const s = this.getSessionCookieValue(e), r = this.sessionManager.getSessionId(s ?? ""), i = await this.sessionManager.dataForSessionId(r);
-        if (!(i != null && i.pre2fa)) throw new l(
+        const s = this.getSessionCookieValue(e), r = this.sessionManager.getSessionId(s ?? ""), t = await this.sessionManager.dataForSessionId(r);
+        if (!(t != null && t.pre2fa)) throw new l(
           g.Unauthorized,
           "2FA not initiated"
         );
         let n = {
           urlPrefix: this.prefix,
           csrfToken: e.csrfToken,
-          action: i.pre2fa.url,
+          action: t.pre2fa.url,
           errorCodeName: e.query.error,
-          factor2: i.pre2fa.factor2
+          factor2: t.pre2fa.factor2
         };
         return o.view(this.factor2Page, n);
       }
@@ -3877,39 +3890,39 @@ class Ke {
           return d.logger.debug(c({ message: "Next page " + s })), await this.signup(
             e,
             o,
-            (r, i, n) => {
+            (r, t, n) => {
               var a, h;
-              const t = (a = i == null ? void 0 : i.userData) != null && a.factor2 ? this.authenticators[i.userData.factor2] : void 0;
-              return (h = i.userData) != null && h.factor2 ? r.view(this.configureFactor2Page, {
-                csrfToken: i.csrfToken,
-                ...i.userData
-              }) : this.enableEmailVerification && (t == null || t.skipEmailVerificationOnSignup() != !0) ? r.view(this.signupPage, {
+              const i = (a = t == null ? void 0 : t.userData) != null && a.factor2 ? this.authenticators[t.userData.factor2] : void 0;
+              return (h = t.userData) != null && h.factor2 ? r.view(this.configureFactor2Page, {
+                csrfToken: t.csrfToken,
+                ...t.userData
+              }) : this.enableEmailVerification && (i == null || i.skipEmailVerificationOnSignup() != !0) ? r.view(this.signupPage, {
                 next: s,
                 csrfToken: e.csrfToken,
                 message: "Please check your email to finish signing up.",
                 allowedFactor2: this.allowedFactor2Details(),
                 urlPrefix: this.prefix,
                 factor2: e.body.factor2,
-                ...i.userData
+                ...t.userData
               }) : r.redirect(this.loginRedirect);
             }
           );
         } catch (r) {
-          const i = l.asCrossauthError(r);
+          const t = l.asCrossauthError(r);
           return d.logger.error(c({
             message: "Signup failure",
             user: e.body.username,
-            errorCodeName: i.codeName,
-            errorCode: i.code
-          })), d.logger.debug(c({ err: r })), this.handleError(r, e, o, (n, t) => {
+            errorCodeName: t.codeName,
+            errorCode: t.code
+          })), d.logger.debug(c({ err: r })), this.handleError(r, e, o, (n, i) => {
             let a = {};
             for (let h in e.body)
               h.startsWith("user_") && (a[h] = e.body[h]);
             return n.view(this.signupPage, {
-              errorMessage: t.message,
-              errorMessages: t.messages,
-              errorCode: t.code,
-              errorCodeName: g[t.code],
+              errorMessage: i.message,
+              errorMessages: i.messages,
+              errorCode: i.code,
+              errorCodeName: g[i.code],
               next: s,
               persist: e.body.persist,
               username: e.body.username,
@@ -3940,16 +3953,16 @@ class Ke {
           return await this.logout(
             e,
             o,
-            (i) => i.redirect(e.body.next ? e.body.next : this.logoutRedirect)
+            (t) => t.redirect(e.body.next ? e.body.next : this.logoutRedirect)
           );
-        } catch (i) {
-          const n = l.asCrossauthError(i);
+        } catch (t) {
+          const n = l.asCrossauthError(t);
           return d.logger.error(c({
             message: "Logout failure",
             user: (r = e.user) == null ? void 0 : r.username,
             errorCodeName: n.codeName,
             errorCode: n.code
-          })), d.logger.debug(c({ err: i })), this.handleError(i, e, o, (t, a) => t.view(this.errorPage, {
+          })), d.logger.debug(c({ err: t })), this.handleError(t, e, o, (i, a) => i.view(this.errorPage, {
             urlPrefix: this.prefix,
             errorMessage: a.message,
             errorMessages: a.messages,
@@ -3971,46 +3984,46 @@ class Ke {
           method: "POST",
           url: this.prefix + "api/login",
           ip: e.ip
-        })), e.user) return o.header(...A).send({ ok: !1, user: e.user });
+        })), e.user) return o.header(...F).send({ ok: !1, user: e.user });
         try {
           return await this.login(
             e,
             o,
             (s, r) => {
-              if (r.state == O.passwordChangeNeeded) {
-                const i = new l(g.PasswordChangeNeeded);
-                return this.handleError(i, e, s, (n, t) => {
-                  n.status(this.errorStatus(i)).header(...A).send({
+              if (r.state == I.passwordChangeNeeded) {
+                const t = new l(g.PasswordChangeNeeded);
+                return this.handleError(t, e, s, (n, i) => {
+                  n.status(this.errorStatus(t)).header(...F).send({
                     ok: !1,
-                    errorMessage: t.message,
-                    errorMessages: t.messages,
-                    errorCode: t.code,
-                    errorCodeName: g[t.code]
+                    errorMessage: i.message,
+                    errorMessages: i.messages,
+                    errorCode: i.code,
+                    errorCodeName: g[i.code]
                   });
                 });
-              } else if (r.state == O.passwordResetNeeded || r.state == O.passwordAndFactor2ResetNeeded) {
-                const i = new l(g.PasswordResetNeeded);
-                return this.handleError(i, e, s, (n, t) => {
-                  n.status(this.errorStatus(i)).header(...A).send({
+              } else if (r.state == I.passwordResetNeeded || r.state == I.passwordAndFactor2ResetNeeded) {
+                const t = new l(g.PasswordResetNeeded);
+                return this.handleError(t, e, s, (n, i) => {
+                  n.status(this.errorStatus(t)).header(...F).send({
                     ok: !1,
-                    errorMessage: t.message,
-                    errorMessages: t.messages,
-                    errorCode: t.code,
-                    errorCodeName: g[t.code]
+                    errorMessage: i.message,
+                    errorMessages: i.messages,
+                    errorCode: i.code,
+                    errorCodeName: g[i.code]
                   });
                 });
-              } else if (this.allowedFactor2.length > 0 && (r.state == O.factor2ResetNeeded || !this.allowedFactor2.includes(r.factor2 ? r.factor2 : "none"))) {
-                const i = new l(g.Factor2ResetNeeded);
-                return this.handleError(i, e, s, (n, t) => {
-                  n.status(this.errorStatus(i)).header(...A).send({
+              } else if (this.allowedFactor2.length > 0 && (r.state == I.factor2ResetNeeded || !this.allowedFactor2.includes(r.factor2 ? r.factor2 : "none"))) {
+                const t = new l(g.Factor2ResetNeeded);
+                return this.handleError(t, e, s, (n, i) => {
+                  n.status(this.errorStatus(t)).header(...F).send({
                     ok: !1,
-                    errorMessage: t.message,
-                    errorMessages: t.messages,
-                    errorCode: t.code,
-                    errorCodeName: g[t.code]
+                    errorMessage: i.message,
+                    errorMessages: i.messages,
+                    errorCode: i.code,
+                    errorCodeName: g[i.code]
                   });
                 });
-              } else return "factor2" in r && r.factor2 != "" && r.factor2 in this.authenticators ? s.header(...A).send({ ok: !0, twoFactorRequired: !0 }) : s.header(...A).send({ ok: !0, user: r });
+              } else return "factor2" in r && r.factor2 != "" && r.factor2 in this.authenticators ? s.header(...F).send({ ok: !0, twoFactorRequired: !0 }) : s.header(...F).send({ ok: !0, user: r });
             }
           );
         } catch (s) {
@@ -4020,8 +4033,8 @@ class Ke {
             user: e.body.username,
             errorCodeName: r.codeName,
             errorCode: r.code
-          })), d.logger.debug(c({ err: s })), this.handleError(s, e, o, (i, n) => {
-            i.status(this.errorStatus(s)).header(...A).send({
+          })), d.logger.debug(c({ err: s })), this.handleError(s, e, o, (t, n) => {
+            t.status(this.errorStatus(s)).header(...F).send({
               ok: !1,
               errorMessage: n.message,
               errorMessages: n.messages,
@@ -4042,22 +4055,22 @@ class Ke {
           method: "POST",
           url: this.prefix + "api/cancelfactor2",
           ip: e.ip
-        })), e.user) return o.header(...A).send({ ok: !1, user: e.user });
+        })), e.user) return o.header(...F).send({ ok: !1, user: e.user });
         try {
           return await this.cancelFactor2(
             e,
             o,
-            (s) => s.header(...A).send({ ok: !0 })
+            (s) => s.header(...F).send({ ok: !0 })
           );
         } catch (s) {
-          const i = e.user || "", n = l.asCrossauthError(s);
+          const t = e.user || "", n = l.asCrossauthError(s);
           return d.logger.error(c({
             message: "Cancel 2FA failure",
-            user: i,
+            user: t,
             errorCodeName: n.codeName,
             errorCode: n.code
-          })), d.logger.debug(c({ err: s })), this.handleError(s, e, o, (t, a) => {
-            t.status(this.errorStatus(s)).header(...A).send({
+          })), d.logger.debug(c({ err: s })), this.handleError(s, e, o, (i, a) => {
+            i.status(this.errorStatus(s)).header(...F).send({
               ok: !1,
               errorMessage: a.message,
               errorMessages: a.messages,
@@ -4078,12 +4091,12 @@ class Ke {
           method: "POST",
           url: this.prefix + "api/loginfactor2",
           ip: e.ip
-        })), e.user) return o.header(...A).send({ ok: !1, user: e.user });
+        })), e.user) return o.header(...F).send({ ok: !1, user: e.user });
         try {
           return await this.loginFactor2(
             e,
             o,
-            (s, r) => s.header(...A).send({ ok: !0, user: r })
+            (s, r) => s.header(...F).send({ ok: !0, user: r })
           );
         } catch (s) {
           const r = l.asCrossauthError(s);
@@ -4092,7 +4105,7 @@ class Ke {
             hashOfSessionId: this.getHashOfSessionId(e),
             errorCodeName: r.codeName,
             errorCode: r.code
-          })), d.logger.debug(c({ err: s })), this.handleError(s, e, o, (i, n) => i.status(this.errorStatus(s)).header(...A).send({
+          })), d.logger.debug(c({ err: s })), this.handleError(s, e, o, (t, n) => t.status(this.errorStatus(s)).header(...F).send({
             ok: !1,
             errorMessage: n.message,
             errorMessages: n.messages,
@@ -4119,17 +4132,17 @@ class Ke {
           return await this.logout(
             e,
             o,
-            (i) => i.header(...A).send({ ok: !0 })
+            (t) => t.header(...F).send({ ok: !0 })
           );
-        } catch (i) {
-          const n = l.asCrossauthError(i);
+        } catch (t) {
+          const n = l.asCrossauthError(t);
           return d.logger.error(c({
             message: "Logout failure",
             user: (r = e.user) == null ? void 0 : r.username,
             errorCodeName: n.codeName,
             errorCode: n.code
-          })), d.logger.debug(c({ err: i })), this.handleError(i, e, o, (t, a) => {
-            t.status(this.errorStatus(i)).header(...A).send({
+          })), d.logger.debug(c({ err: t })), this.handleError(t, e, o, (i, a) => {
+            i.status(this.errorStatus(t)).header(...F).send({
               ok: !1,
               errorMessage: a.message,
               errorMessages: a.messages,
@@ -4156,26 +4169,26 @@ class Ke {
           return await this.signup(
             e,
             o,
-            (r, i, n) => r.header(...A).send({
+            (r, t, n) => r.header(...F).send({
               ok: !0,
               user: n,
               emailVerificationNeeded: this.enableEmailVerification ?? !1,
-              ...i.userData
+              ...t.userData
             })
           );
         } catch (r) {
-          const i = l.asCrossauthError(r);
+          const t = l.asCrossauthError(r);
           d.logger.error(c({
             message: "Signup failure",
             user: (s = e.user) == null ? void 0 : s.username,
-            errorCodeName: i.codeName,
-            errorCode: i.code
-          })), d.logger.debug(c({ err: r })), this.handleError(r, e, o, (n, t) => {
-            n.status(this.errorStatus(r)).header(...A).send({
+            errorCodeName: t.codeName,
+            errorCode: t.code
+          })), d.logger.debug(c({ err: r })), this.handleError(r, e, o, (n, i) => {
+            n.status(this.errorStatus(r)).header(...F).send({
               ok: !1,
-              errorMessage: t.message,
-              errorMessages: t.messages,
-              errorCode: g[t.code]
+              errorMessage: i.message,
+              errorMessages: i.messages,
+              errorCode: g[i.code]
             });
           });
         }
@@ -4200,28 +4213,28 @@ class Ke {
           "No CSRF token present"
         );
         try {
-          let i;
-          return e.sessionId ? (i = (await this.sessionManager.userForSessionId(e.sessionId)).user, o.header(...A).send({ ok: !0, user: i })) : this.sendJsonError(
+          let t;
+          return e.sessionId ? (t = (await this.sessionManager.userForSessionId(e.sessionId)).user, o.header(...F).send({ ok: !0, user: t })) : this.sendJsonError(
             o,
             401,
             "User not logged in"
           );
-        } catch (i) {
-          const n = l.asCrossauthError(i);
-          let t = n.message, a = n.code, h = n.codeName;
+        } catch (t) {
+          const n = l.asCrossauthError(t);
+          let i = n.message, a = n.code, h = n.codeName;
           switch (n.code) {
             case g.UserNotExist:
             case g.PasswordInvalid:
-              t = "Invalid username or password", a = g.UsernameOrPasswordInvalid, h = g[a];
+              i = "Invalid username or password", a = g.UsernameOrPasswordInvalid, h = g[a];
               break;
           }
           return d.logger.error(c({
-            message: t,
+            message: i,
             user: (r = e.user) == null ? void 0 : r.username,
             hashOfSessionId: this.getHashOfSessionId(e),
             errorCodeName: h,
             errorCode: a
-          })), d.logger.debug(c({ err: i })), o.status(this.errorStatus(i)).header(...A).send({
+          })), d.logger.debug(c({ err: t })), o.status(this.errorStatus(t)).header(...F).send({
             ok: !1,
             errorCode: a,
             errorCodeName: h
@@ -4243,19 +4256,19 @@ class Ke {
           user: (s = e.user) == null ? void 0 : s.username
         }));
         try {
-          return o.header(...A).send({
+          return o.header(...F).send({
             ok: !0,
             csrfToken: e.csrfToken
           });
-        } catch (i) {
-          const n = l.asCrossauthError(i);
+        } catch (t) {
+          const n = l.asCrossauthError(t);
           return d.logger.error(c({
             message: "getcsrftoken failure",
             user: (r = e.user) == null ? void 0 : r.username,
             hashedCsrfCookie: this.getHashOfCsrfCookie(e),
             errorCode: n.code,
             errorCodeName: n.codeName
-          })), d.logger.debug(c({ err: i })), o.status(this.errorStatus(i)).header(...A).send({
+          })), d.logger.debug(c({ err: t })), o.status(this.errorStatus(t)).header(...F).send({
             ok: !1,
             errorCode: n.code,
             errorCodeName: n.codeName,
@@ -4272,10 +4285,10 @@ class Ke {
       o,
       e.user
     );
-    const r = e.body.username, i = e.body.persist;
+    const r = e.body.username, t = e.body.persist;
     if (!e.csrfToken) throw new l(g.InvalidCsrf);
     const n = this.getSessionCookieValue(e);
-    let t = this.addToSession ? this.addToSession(e) : {}, { sessionCookie: a, csrfCookie: h, user: f } = await this.sessionManager.login(r, e.body, t, i);
+    let i = this.addToSession ? this.addToSession(e) : {}, { sessionCookie: a, csrfCookie: h, user: f } = await this.sessionManager.login(r, e.body, i, t);
     if (d.logger.debug(c({
       message: "Login: set session cookie " + a.name + " opts " + JSON.stringify(a.options),
       user: e.body.username
@@ -4304,24 +4317,24 @@ class Ke {
     );
     const r = e.sessionId;
     if (!r) throw new l(g.Unauthorized);
-    const i = e.body.persist;
+    const t = e.body.persist;
     if (this.isSessionUser(e) && !e.csrfToken) throw new l(g.InvalidCsrf);
     let n = this.addToSession ? this.addToSession(e) : {};
-    const { sessionCookie: t, csrfCookie: a, user: h } = await this.sessionManager.completeTwoFactorLogin(
+    const { sessionCookie: i, csrfCookie: a, user: h } = await this.sessionManager.completeTwoFactorLogin(
       e.body,
       r,
       n,
-      i
+      t
     );
     return d.logger.debug(c({
-      message: "Login: set session cookie " + t.name + " opts " + JSON.stringify(t.options),
+      message: "Login: set session cookie " + i.name + " opts " + JSON.stringify(i.options),
       user: h == null ? void 0 : h.username
     })), o.cookie(
-      t.name,
-      t.value,
-      t.options
+      i.name,
+      i.value,
+      i.options
     ), d.logger.debug(c({
-      message: "Login: set csrf cookie " + a.name + " opts " + JSON.stringify(t.options),
+      message: "Login: set csrf cookie " + a.name + " opts " + JSON.stringify(i.options),
       user: h == null ? void 0 : h.username
     })), o.cookie(a.name, a.value, a.options), e.csrfToken = await this.sessionManager.createCsrfFormOrHeaderValue(a.value), s(o, h);
   }
@@ -4333,9 +4346,9 @@ class Ke {
   /**
    * This is called after the user has been validated to log the user in
    */
-  async loginWithUser(e, o, s, r, i) {
+  async loginWithUser(e, o, s, r, t) {
     const n = this.getSessionCookieValue(s);
-    let t = this.addToSession ? this.addToSession(s) : {}, { sessionCookie: a, csrfCookie: h } = await this.sessionManager.login("", {}, t, void 0, e, o);
+    let i = this.addToSession ? this.addToSession(s) : {}, { sessionCookie: a, csrfCookie: h } = await this.sessionManager.login("", {}, i, void 0, e, o);
     if (d.logger.debug(c({
       message: "Login: set session cookie " + a.name + " opts " + JSON.stringify(a.options),
       user: e.username
@@ -4355,19 +4368,19 @@ class Ke {
           hashOfSessionId: this.getHashOfSessionId(s)
         })), d.logger.debug(c({ err: f }));
       }
-    return i(r, e);
+    return t(r, e);
   }
   async signup(e, o, s) {
     if (!this.userStorage) throw new l(g.Configuration, "Cannot call signup unless you provide a user stotage");
     if (this.isSessionUser(e) && !e.csrfToken) throw new l(g.InvalidCsrf);
-    const r = e.body.username, i = e.body.next;
+    const r = e.body.username, t = e.body.next;
     if (e.body.factor2 || (e.body.factor2 = this.allowedFactor2[0]), e.body.factor2 && !this.allowedFactor2.includes(e.body.factor2 ?? "none"))
       throw new l(
         g.Forbidden,
         "Illegal second factor " + e.body.factor2 + " requested"
       );
     (e.body.factor2 == "none" || e.body.factor2 == "") && (e.body.factor2 = void 0);
-    let n = this.createUserFn(e, this.userStorage.userEditableFields, this.userAllowedFactor1, this.allowedFactor2), t = this.authenticators[n.factor1].validateSecrets(e.body);
+    let n = this.createUserFn(e, this.userStorage.userEditableFields, this.userAllowedFactor1, this.allowedFactor2), i = this.authenticators[n.factor1].validateSecrets(e.body);
     const a = this.authenticators[n.factor1].secretNames();
     let h = {};
     for (let m in e.body)
@@ -4375,8 +4388,8 @@ class Ke {
         const w = m.replace(/^repeat_/, "");
         a.includes(w) && (h[w] = e.body[m]);
       }
-    Object.keys(h).length === 0 && (h = void 0), n.state = "active", e.body.factor2 && e.body.factor2 != "none" ? this.enableEmailVerification ? n.state = O.awaitingTwoFactorSetupAndEmailVerification : n.state = O.awaitingTwoFactorSetup : this.enableEmailVerification && (n.state = "awaitingemailverification");
-    let p = [...this.validateUserFn(n), ...t];
+    Object.keys(h).length === 0 && (h = void 0), n.state = "active", e.body.factor2 && e.body.factor2 != "none" ? this.enableEmailVerification ? n.state = I.awaitingTwoFactorSetupAndEmailVerification : n.state = I.awaitingTwoFactorSetup : this.enableEmailVerification && (n.state = "awaitingemailverification");
+    let p = [...this.validateUserFn(n), ...i];
     if (p.length > 0)
       throw new l(g.FormEntry, p);
     let v = !1;
@@ -4410,7 +4423,7 @@ class Ke {
         let w = {
           userData: m,
           username: r,
-          next: i ?? this.loginRedirect,
+          next: t ?? this.loginRedirect,
           csrfToken: e.csrfToken
         };
         return s(o, w);
@@ -4453,14 +4466,14 @@ class Ke {
     d.logger.debug(c({ message: "Creating session ID" }));
     let r = this.addToSession ? this.addToSession(e) : {};
     s && (r.data = JSON.stringify(s));
-    let { sessionCookie: i, csrfCookie: n, csrfFormOrHeaderValue: t } = await this.sessionManager.createAnonymousSession(r);
+    let { sessionCookie: t, csrfCookie: n, csrfFormOrHeaderValue: i } = await this.sessionManager.createAnonymousSession(r);
     o.cookie(
-      i.name,
-      i.value,
-      i.options
-    ), e.csrfToken = t, o.setCookie(n.name, n.value, n.options), e.user = void 0;
-    const a = this.sessionManager.getSessionId(i.value);
-    return e.sessionId = a, i.value;
+      t.name,
+      t.value,
+      t.options
+    ), e.csrfToken = i, o.setCookie(n.name, n.value, n.options), e.user = void 0;
+    const a = this.sessionManager.getSessionId(t.value);
+    return e.sessionId = a, t.value;
   }
   /**
    * Called by each endpoint on error.  
@@ -4476,27 +4489,27 @@ class Ke {
    *        incorrect.  If false, report that the username or password is
    *        incorrect.  Default false.
    */
-  handleError(e, o, s, r, i = !1) {
+  handleError(e, o, s, r, t = !1) {
     var n;
     try {
-      let t = l.asCrossauthError(e);
-      if (!i)
-        switch (t.code) {
+      let i = l.asCrossauthError(e);
+      if (!t)
+        switch (i.code) {
           case g.UserNotExist:
           case g.PasswordInvalid:
-            t = new l(
+            i = new l(
               g.UsernameOrPasswordInvalid,
               "Invalid username or password"
             );
             break;
         }
-      return d.logger.debug(c({ err: t })), d.logger.error(c({
-        cerr: t,
+      return d.logger.debug(c({ err: i })), d.logger.error(c({
+        cerr: i,
         hashOfSessionId: this.getHashOfSessionId(o),
         user: (n = o.user) == null ? void 0 : n.username
-      })), r(s, t);
-    } catch (t) {
-      return d.logger.error(c({ err: t })), r(s, new l(g.UnknownError));
+      })), r(s, i);
+    } catch (i) {
+      return d.logger.error(c({ err: i })), r(s, new l(g.UnknownError));
     }
   }
   //////////////
@@ -4519,6 +4532,15 @@ class Ke {
     if (e.cookies && this.sessionManager.csrfCookieName in e.cookies)
       return e.cookies[this.sessionManager.csrfCookieName];
   }
+  /**
+   * Returns the known device cookie value from the request
+   * @param request the Fastify request
+   * @returns the CSRF token cookie value
+   */
+  getKnownDeviceCookieValue(e) {
+    if (e.cookies && this.sessionManager.knownDeviceCookieName in e.cookies)
+      return e.cookies[this.sessionManager.knownDeviceCookieName];
+  }
   /**
    * Returns a hash of the session ID.  Used for logging (for security,
    * the actual session ID is not logged)
@@ -4528,7 +4550,7 @@ class Ke {
   getHashOfSessionId(e) {
     if (!e.sessionId) return "";
     try {
-      return F.hash(e.sessionId);
+      return N.hash(e.sessionId);
     } catch {
     }
     return "";
@@ -4543,7 +4565,7 @@ class Ke {
     const o = this.getCsrfCookieValue(e);
     if (!o) return "";
     try {
-      return F.hash(o.split(".")[0]);
+      return N.hash(o.split(".")[0]);
     } catch {
     }
     return "";
@@ -4572,14 +4594,14 @@ class Ke {
    * @returns the Fastiy reply
    */
   csrfToken(e, o) {
-    var i;
+    var t;
     let s;
     const r = this.sessionManager.csrfHeaderName;
     if (e.headers && r.toLowerCase() in e.headers) {
       const n = e.headers[r.toLowerCase()];
       Array.isArray(n) ? s = n[0] : s = n;
     }
-    if (!s && ((i = e.body) != null && i.csrfToken) && (s = e.body.csrfToken), s)
+    if (!s && ((t = e.body) != null && t.csrfToken) && (s = e.body.csrfToken), s)
       try {
         this.sessionManager.validateDoubleSubmitCsrfToken(
           this.getCsrfCookieValue(e),
@@ -4605,18 +4627,18 @@ class Ke {
    */
   sendJsonError(e, o, s, r) {
     (!s || !r) && (s = "Unknown error");
-    const i = r ? l.asCrossauthError(r) : void 0;
+    const t = r ? l.asCrossauthError(r) : void 0;
     return d.logger.warn(c({
       message: s,
-      errorCode: i == null ? void 0 : i.code,
-      errorCodeName: i == null ? void 0 : i.codeName,
+      errorCode: t == null ? void 0 : t.code,
+      errorCodeName: t == null ? void 0 : t.codeName,
       httpStatus: o
-    })), e.header(...A).status(o).send({
+    })), e.header(...F).status(o).send({
       ok: !1,
       status: o,
       errorMessage: s,
-      errorCode: i == null ? void 0 : i.code,
-      errorCodeName: i == null ? void 0 : i.codeName
+      errorCode: t == null ? void 0 : t.code,
+      errorCodeName: t == null ? void 0 : t.codeName
     });
   }
   /**
@@ -4743,41 +4765,41 @@ class Ye {
     u(this, "apiKeyManager");
     this.app = e, this.userStorage = o, this.apiKeyManager = new Y(s, r), this.app.addHook(
       "preHandler",
-      async (i, n) => {
-        if (i.headers.authorization)
+      async (t, n) => {
+        if (t.headers.authorization)
           try {
             d.logger.debug(c({
               msg: "Received authorization header"
             }));
-            const t = await this.apiKeyManager.validateToken(
-              i.headers.authorization
+            const i = await this.apiKeyManager.validateToken(
+              t.headers.authorization
             );
             d.logger.debug(c({
               msg: "Valid API key",
-              hashedApiKey: Y.hashSignedApiKeyValue(t.value)
+              hashedApiKey: Y.hashSignedApiKeyValue(i.value)
             }));
-            const a = Fe.decodeData(t.data);
-            if (i.apiKey = { ...t, ...a }, "scope" in a && Array.isArray(a.scope)) {
+            const a = Fe.decodeData(i.data);
+            if (t.apiKey = { ...i, ...a }, "scope" in a && Array.isArray(a.scope)) {
               let h = [];
               for (let f of a.scope)
                 typeof f == "string" && h.push(f);
-              i.scope = h;
+              t.scope = h;
             }
-            if (t.userid)
+            if (i.userid)
               try {
-                const { user: h } = await this.userStorage.getUserById(t.userid);
-                i.user = h, i.authType = "apiKey", d.logger.debug(c({ msg: "API key is for user", userid: h.id, user: h.username, hashedApiKey: Y.hashSignedApiKeyValue(t.value) }));
+                const { user: h } = await this.userStorage.getUserById(i.userid);
+                t.user = h, t.authType = "apiKey", d.logger.debug(c({ msg: "API key is for user", userid: h.id, user: h.username, hashedApiKey: Y.hashSignedApiKeyValue(i.value) }));
               } catch (h) {
-                d.logger.error(c({ msg: "API key has invalid user", userid: t.userid, hashedApiKey: Y.hashSignedApiKeyValue(t.value) })), d.logger.debug(c({ err: h }));
+                d.logger.error(c({ msg: "API key has invalid user", userid: i.userid, hashedApiKey: Y.hashSignedApiKeyValue(i.value) })), d.logger.debug(c({ err: h }));
               }
-          } catch (t) {
-            d.logger.error(c({ msg: "Invalid authorization header received", header: i.headers.authorization })), d.logger.debug(c({ err: t }));
+          } catch (i) {
+            d.logger.error(c({ msg: "Invalid authorization header received", header: t.headers.authorization })), d.logger.debug(c({ err: i }));
           }
       }
     );
   }
 }
-const x = ["Content-Type", "application/json; charset=utf-8"];
+const A = ["Content-Type", "application/json; charset=utf-8"];
 class $e {
   /**
    * Constructor
@@ -4789,7 +4811,7 @@ class $e {
    *        for the password flow
    * @param options see {@link FastifyAuthorizationServerOptions}
    */
-  constructor(e, o, s, r, i, n = {}) {
+  constructor(e, o, s, r, t, n = {}) {
     /** The Fastify app passed to the constructor */
     u(this, "app");
     /** The underlying framework-independent authorization server */
@@ -4814,11 +4836,11 @@ class $e {
     this.app = e, this.fastifyServer = o, this.clientStorage = s, this.authServer = new Ne(
       this.clientStorage,
       r,
-      i,
+      t,
       n
     ), C("prefix", k.String, this, n, "PREFIX"), this.prefix.endsWith("/") || (this.prefix += "/"), C("errorPage", k.String, this, n, "ERROR_PAGE"), C("devicePage", k.String, this, n, "OAUTH_DEVICE_PAGE"), C("loginUrl", k.String, this, n, "LOGIN_URL"), C("oauthAuthorizePage", k.String, this, n, "OAUTH_AUTHORIZE_PAGE"), C("refreshTokenType", k.String, this, n, "OAUTH_REFRESH_TOKEN_TYPE"), C("refreshTokenCookieName", k.String, this, n, "OAUTH_REFRESH_TOKEN_COOKIE_NAME"), C("refreshTokenCookieDomain", k.String, this, n, "OAUTH_REFRESH_TOKEN_COOKIE_DOMAIN"), C("refreshTokenCookieHttpOnly", k.Boolean, this, n, "OAUTH_REFRESH_TOKEN_COOKIE_HTTPONLY"), C("refreshTokenCookiePath", k.String, this, n, "OAUTH_REFRESH_TOKEN_COOKIE_PATH"), C("refreshTokenCookieSecure", k.Boolean, this, n, "OAUTH_REFRESH_TOKEN_COOKIE_SECURE"), C("refreshTokenCookieSameSite", k.String, this, n, "OAUTH_REFRESH_TOKEN_COOKIE_SAMESITE"), C("createGetCsrfTokenEndpoint", k.String, this, n, "OAUTH_CREATE_GET_CSRF_TOKEN_ENDPOINT"), this.refreshTokenType != "json" && (this.createGetCsrfTokenEndpoint ? this.csrfTokens = new Ue(n.doubleSubmitCookieOptions) : this.fastifyServer.sessionServer && (this.csrfTokens = this.fastifyServer.sessionServer.sessionManager.csrfTokens)), this.createGetCsrfTokenEndpoint && this.addApiGetCsrfTokenEndpoints(), e.get(
       this.prefix + ".well-known/openid-configuration",
-      async (t, a) => a.header(...x).status(200).send(
+      async (i, a) => a.header(...A).status(200).send(
         this.authServer.oidcConfiguration({
           authorizeEndpoint: this.prefix + "authorize",
           tokenEndpoint: this.prefix + "token",
@@ -4828,32 +4850,32 @@ class $e {
       )
     ), e.get(
       this.prefix + "jwks",
-      async (t, a) => a.header(...x).status(200).send(
+      async (i, a) => a.header(...A).status(200).send(
         this.authServer.jwks()
       )
-    ), (this.authServer.validFlows.includes(E.AuthorizationCode) || this.authServer.validFlows.includes(E.AuthorizationCodeWithPKCE) || this.authServer.validFlows.includes(E.OidcAuthorizationCode)) && (e.get(this.prefix + "authorize", async (t, a) => {
+    ), (this.authServer.validFlows.includes(E.AuthorizationCode) || this.authServer.validFlows.includes(E.AuthorizationCodeWithPKCE) || this.authServer.validFlows.includes(E.OidcAuthorizationCode)) && (e.get(this.prefix + "authorize", async (i, a) => {
       var h;
-      return d.logger.info(c({ msg: "Page visit", method: "GET", url: this.prefix + "authorize", ip: t.ip, user: (h = t.user) == null ? void 0 : h.username })), await this.authorizeEndpoint(t, a, t.query);
-    }), e.post(this.prefix + "authorize", async (t, a) => {
+      return d.logger.info(c({ msg: "Page visit", method: "GET", url: this.prefix + "authorize", ip: i.ip, user: (h = i.user) == null ? void 0 : h.username })), await this.authorizeEndpoint(i, a, i.query);
+    }), e.post(this.prefix + "authorize", async (i, a) => {
       var h;
-      return d.logger.info(c({ msg: "Page visit", method: "POST", url: this.prefix + "authorize", ip: t.ip, user: (h = t.user) == null ? void 0 : h.username })), await this.authorizeEndpoint(t, a, t.body);
+      return d.logger.info(c({ msg: "Page visit", method: "POST", url: this.prefix + "authorize", ip: i.ip, user: (h = i.user) == null ? void 0 : h.username })), await this.authorizeEndpoint(i, a, i.body);
     }), this.app.post(
       this.prefix + "userauthorize",
-      async (t, a) => {
+      async (i, a) => {
         var p, v;
-        if (d.logger.info(c({ msg: "Page visit", method: "POST", url: this.prefix + "authorize", ip: t.ip, user: (p = t.user) == null ? void 0 : p.username })), !t.user) return y.sendPageError(
+        if (d.logger.info(c({ msg: "Page visit", method: "POST", url: this.prefix + "authorize", ip: i.ip, user: (p = i.user) == null ? void 0 : p.username })), !i.user) return y.sendPageError(
           a,
           401,
           this.errorPage
         );
         let h, f;
         try {
-          h = await this.fastifyServer.validateCsrfToken(t);
+          h = await this.fastifyServer.validateCsrfToken(i);
         } catch (m) {
           f = l.asCrossauthError(m), f.message = "Invalid csrf cookie received", d.logger.error(c({
             msg: f.message,
-            hashedCsrfCookie: h ? F.hash(h) : void 0,
-            user: (v = t.user) == null ? void 0 : v.username,
+            hashedCsrfCookie: h ? N.hash(h) : void 0,
+            user: (v = i.user) == null ? void 0 : v.username,
             cerr: f
           }));
         }
@@ -4882,45 +4904,45 @@ class $e {
           }
         }
         if (!f) {
-          const m = t.body.authorized == "true";
-          return await this.authorize(t, a, m, {
-            responseType: t.body.response_type,
-            client_id: t.body.client_id,
-            redirect_uri: t.body.redirect_uri,
-            scope: t.body.scope,
-            state: t.body.state,
-            codeChallenge: t.body.code_challenge,
-            codeChallengeMethod: t.body.code_challenge_method
+          const m = i.body.authorized == "true";
+          return await this.authorize(i, a, m, {
+            responseType: i.body.response_type,
+            client_id: i.body.client_id,
+            redirect_uri: i.body.redirect_uri,
+            scope: i.body.scope,
+            state: i.body.state,
+            codeChallenge: i.body.code_challenge,
+            codeChallengeMethod: i.body.code_challenge_method
           });
         }
       }
     )), (this.authServer.validFlows.includes(E.AuthorizationCode) || this.authServer.validFlows.includes(E.AuthorizationCodeWithPKCE) || this.authServer.validFlows.includes(E.OidcAuthorizationCode) || this.authServer.validFlows.includes(E.ClientCredentials) || this.authServer.validFlows.includes(E.RefreshToken) || this.authServer.validFlows.includes(E.Password) || this.authServer.validFlows.includes(E.PasswordMfa) || this.authServer.validFlows.includes(E.DeviceCode)) && this.app.post(
       this.prefix + "token",
-      async (t, a) => {
+      async (i, a) => {
         var m;
         d.logger.info(c({
           msg: "Page visit",
           method: "POST",
           url: this.prefix + "token",
-          ip: t.ip,
-          user: (m = t.user) == null ? void 0 : m.username
+          ip: i.ip,
+          user: (m = i.user) == null ? void 0 : m.username
         }));
-        let h = t.body.client_id, f = t.body.client_secret;
-        if (t.headers.authorization) {
+        let h = i.body.client_id, f = i.body.client_secret;
+        if (i.headers.authorization) {
           let w, P;
-          const T = t.headers.authorization.split(" ");
+          const T = i.headers.authorization.split(" ");
           if (T.length == 2 && T[0].toLocaleLowerCase() == "basic") {
-            const b = F.base64Decode(T[1]).split(":", 2);
+            const b = N.base64Decode(T[1]).split(":", 2);
             b.length == 2 && (w = b[0], P = b[1]);
           }
           w == null || P == null ? d.logger.warn(c({
-            msg: "Ignoring malform authenization header " + t.headers.authorization
+            msg: "Ignoring malform authenization header " + i.headers.authorization
           })) : (h = w, f = P);
         }
-        let p = t.body.refresh_token;
-        if ((this.refreshTokenType == "cookie" && t.cookies && this.refreshTokenCookieName in t.cookies || this.refreshTokenType == "both" && t.cookies && this.refreshTokenCookieName in t.cookies && p == null) && this.csrfTokens) {
-          const w = t.cookies[this.csrfTokens.cookieName];
-          let P = t.headers[this.csrfTokens.headerName.toLowerCase()];
+        let p = i.body.refresh_token;
+        if ((this.refreshTokenType == "cookie" && i.cookies && this.refreshTokenCookieName in i.cookies || this.refreshTokenType == "both" && i.cookies && this.refreshTokenCookieName in i.cookies && p == null) && this.csrfTokens) {
+          const w = i.cookies[this.csrfTokens.cookieName];
+          let P = i.headers[this.csrfTokens.headerName.toLowerCase()];
           if (Array.isArray(P) && (P = P[0]), !w || !P)
             return {
               error: "access_denied",
@@ -4929,166 +4951,166 @@ class $e {
           try {
             this.csrfTokens.validateDoubleSubmitCsrfToken(w, P);
           } catch (T) {
-            return d.logger.debug(c({ err: T })), d.logger.warn(c({ cerr: T, msg: "Invalid csrf token", client_id: t.body.client_id })), {
+            return d.logger.debug(c({ err: T })), d.logger.warn(c({ cerr: T, msg: "Invalid csrf token", client_id: i.body.client_id })), {
               error: "access_denied",
               error_description: "Invalid csrf token"
             };
           }
-          p = t.cookies[this.refreshTokenCookieName];
+          p = i.cookies[this.refreshTokenCookieName];
         }
         const v = await this.authServer.tokenEndpoint({
-          grantType: t.body.grant_type,
+          grantType: i.body.grant_type,
           client_id: h,
           client_secret: f,
-          scope: t.body.scope,
-          codeVerifier: t.body.code_verifier,
-          code: t.body.code,
-          username: t.body.username,
-          password: t.body.password,
-          mfaToken: t.body.mfa_token,
-          oobCode: t.body.oob_code,
-          bindingCode: t.body.binding_code,
-          otp: t.body.otp,
+          scope: i.body.scope,
+          codeVerifier: i.body.code_verifier,
+          code: i.body.code,
+          username: i.body.username,
+          password: i.body.password,
+          mfaToken: i.body.mfa_token,
+          oobCode: i.body.oob_code,
+          bindingCode: i.body.binding_code,
+          otp: i.body.otp,
           refreshToken: p,
-          deviceCode: t.body.device_code
+          deviceCode: i.body.device_code
         });
         if (v.error == "authorization_pending")
-          return a.header(...x).status(200).send(v);
+          return a.header(...A).status(200).send(v);
         if (v.refresh_token && this.refreshTokenType != "json" && this.setRefreshTokenCookie(a, v.refresh_token, v.expires_in), v.error || !v.access_token) {
           let w = "server_error", P = "Neither code nor error received when requesting authorization";
           v.error && (w = v.error), v.error_description && (P = v.error_description);
           const T = l.fromOAuthError(w, P);
-          return d.logger.error(c({ cerr: T })), a.header(...x).status(T.httpStatus).send(v);
+          return d.logger.error(c({ cerr: T })), a.header(...A).status(T.httpStatus).send(v);
         }
-        return a.header(...x).send(v);
+        return a.header(...A).send(v);
       }
     ), this.authServer.validFlows.includes(E.PasswordMfa) && (e.get(
       this.prefix + "mfa/authenticators",
-      async (t, a) => {
+      async (i, a) => {
         var h;
         return d.logger.info(c({
           msg: "Page visit",
           method: "GET",
           url: this.prefix + "mfa/authenticators",
-          ip: t.ip,
-          user: (h = t.user) == null ? void 0 : h.username
-        })), await this.mfaAuthenticatorsEndpoint(t, a);
+          ip: i.ip,
+          user: (h = i.user) == null ? void 0 : h.username
+        })), await this.mfaAuthenticatorsEndpoint(i, a);
       }
     ), e.post(
       this.prefix + "mfa/authenticators",
-      async (t, a) => {
+      async (i, a) => {
         var h;
         return d.logger.info(c({
           msg: "Page visit",
           method: "POST",
           url: this.prefix + "mfa/authenticators",
-          ip: t.ip,
-          user: (h = t.user) == null ? void 0 : h.username
-        })), await this.mfaAuthenticatorsEndpoint(t, a);
+          ip: i.ip,
+          user: (h = i.user) == null ? void 0 : h.username
+        })), await this.mfaAuthenticatorsEndpoint(i, a);
       }
     ), e.post(
       this.prefix + "mfa/challenge",
-      async (t, a) => {
+      async (i, a) => {
         var h;
         return d.logger.info(c({
           msg: "Page visit",
           method: "POST",
           url: this.prefix + "mfa/challenge",
-          ip: t.ip,
-          user: (h = t.user) == null ? void 0 : h.username
-        })), await this.mfaChallengeEndpoint(t, a, t.body);
+          ip: i.ip,
+          user: (h = i.user) == null ? void 0 : h.username
+        })), await this.mfaChallengeEndpoint(i, a, i.body);
       }
     )), this.authServer.validFlows.includes(E.DeviceCode) && (this.app.post(
       this.prefix + "device_authorization",
-      async (t, a) => {
+      async (i, a) => {
         var v;
         d.logger.info(c({
           msg: "Page visit",
           method: "POST",
           url: this.prefix + "device_authorization",
-          ip: t.ip,
-          user: (v = t.user) == null ? void 0 : v.username
+          ip: i.ip,
+          user: (v = i.user) == null ? void 0 : v.username
         }));
-        let h = t.body.client_id, f = t.body.client_secret;
-        if (t.headers.authorization) {
+        let h = i.body.client_id, f = i.body.client_secret;
+        if (i.headers.authorization) {
           let m, w;
-          const P = t.headers.authorization.split(" ");
+          const P = i.headers.authorization.split(" ");
           if (P.length == 2 && P[0].toLocaleLowerCase() == "basic") {
-            const N = F.base64Decode(P[1]).split(":", 2);
-            N.length == 2 && (m = N[0], w = N[1]);
+            const _ = N.base64Decode(P[1]).split(":", 2);
+            _.length == 2 && (m = _[0], w = _[1]);
           }
           m == null || w == null ? d.logger.warn(c({
-            msg: "Ignoring malform authenization header " + t.headers.authorization
+            msg: "Ignoring malform authenization header " + i.headers.authorization
           })) : (h = m, f = w);
         }
         const p = await this.authServer.deviceAuthorizationEndpoint({
           client_id: h,
           client_secret: f,
-          scope: t.body.scope
+          scope: i.body.scope
         });
         if (p.error || !p.device_code || !p.user_code) {
           let m = "server_error", w = "Neither code nor error received when requesting authorization";
           p.error && (m = p.error), p.error_description && (w = p.error_description);
           const P = l.fromOAuthError(m, w);
-          return d.logger.error(c({ cerr: P })), a.header(...x).status(P.httpStatus).send(p);
+          return d.logger.error(c({ cerr: P })), a.header(...A).status(P.httpStatus).send(p);
         }
-        return a.header(...x).send(p);
+        return a.header(...A).send(p);
       }
     ), e.get(
       this.prefix + "device",
-      async (t, a) => {
+      async (i, a) => {
         var h;
         return d.logger.info(c({
           msg: "Page visit",
           method: "GET",
           url: this.prefix + "device",
-          ip: t.ip,
-          user: (h = t.user) == null ? void 0 : h.username
-        })), t.user ? await this.deviceGet(!1, t, a, t.user) : a.redirect(this.loginUrl + "?next=" + encodeURIComponent(t.url), 302);
+          ip: i.ip,
+          user: (h = i.user) == null ? void 0 : h.username
+        })), i.user ? await this.deviceGet(!1, i, a, i.user) : a.redirect(this.loginUrl + "?next=" + encodeURIComponent(i.url), 302);
       }
     ), e.get(
       this.prefix + "api/device",
-      async (t, a) => {
+      async (i, a) => {
         var h;
         if (d.logger.info(c({
           msg: "Page visit",
           method: "GET",
           url: this.prefix + "device",
-          ip: t.ip,
-          user: (h = t.user) == null ? void 0 : h.username
-        })), !t.user) {
+          ip: i.ip,
+          user: (h = i.user) == null ? void 0 : h.username
+        })), !i.user) {
           const f = new l(g.Unauthorized, "Not logged in");
-          return a.header(...x).status(401).send({
+          return a.header(...A).status(401).send({
             errorMessage: f.message,
             errorCode: f.code,
             errorCodeName: f.codeName
           });
         }
-        return await this.deviceGet(!0, t, a, t.user);
+        return await this.deviceGet(!0, i, a, i.user);
       }
     ), this.app.post(
       this.prefix + "device",
-      async (t, a) => {
+      async (i, a) => {
         var h;
         return d.logger.info(c({
           msg: "Page visit",
           method: "POST",
           url: this.prefix + "device",
-          ip: t.ip,
-          user: (h = t.user) == null ? void 0 : h.username
-        })), t.user ? await this.deviceCodePost(!1, t, a) : a.redirect(this.loginUrl + "?next=" + encodeURIComponent(t.url), 302);
+          ip: i.ip,
+          user: (h = i.user) == null ? void 0 : h.username
+        })), i.user ? await this.deviceCodePost(!1, i, a) : a.redirect(this.loginUrl + "?next=" + encodeURIComponent(i.url), 302);
       }
     ), this.app.post(
       this.prefix + "api/device",
-      async (t, a) => {
+      async (i, a) => {
         var h;
         return d.logger.info(c({
           msg: "Page visit",
           method: "POST",
           url: this.prefix + "device",
-          ip: t.ip,
-          user: (h = t.user) == null ? void 0 : h.username
-        })), await this.deviceCodePost(!0, t, a);
+          ip: i.ip,
+          user: (h = i.user) == null ? void 0 : h.username
+        })), await this.deviceCodePost(!0, i, a);
       }
     ));
   }
@@ -5109,7 +5131,7 @@ class $e {
     this.csrfTokens && this.app.get(
       this.prefix + "getcsrftoken",
       async (e, o) => {
-        var r, i;
+        var r, t;
         if (d.logger.info(c({
           msg: "API visit",
           method: "POST",
@@ -5121,56 +5143,56 @@ class $e {
         try {
           const {
             csrfCookie: n,
-            csrfFormOrHeaderValue: t
+            csrfFormOrHeaderValue: i
           } = await this.createCsrfToken();
-          return s = n.value, o.setCookie(n.name, n.value, n.options), o.header(...x).send({
+          return s = n.value, o.setCookie(n.name, n.value, n.options), o.header(...A).send({
             ok: !0,
-            csrfToken: t
+            csrfToken: i
           });
         } catch (n) {
-          const t = l.asCrossauthError(n);
+          const i = l.asCrossauthError(n);
           return d.logger.error(c({
             msg: "getcsrftoken failure",
-            user: (i = e.user) == null ? void 0 : i.username,
-            hashedCsrfCookie: F.hash(s.split(".")[0]),
-            errorCode: t.code,
-            errorCodeName: t.codeName
-          })), d.logger.debug(c({ err: n })), o.status(t.httpStatus).header(...x).send({
+            user: (t = e.user) == null ? void 0 : t.username,
+            hashedCsrfCookie: N.hash(s.split(".")[0]),
+            errorCode: i.code,
+            errorCodeName: i.codeName
+          })), d.logger.debug(c({ err: n })), o.status(i.httpStatus).header(...A).send({
             ok: !1,
-            errorCode: t.code,
-            errorCodeName: t.codeName,
-            error: t.message
+            errorCode: i.code,
+            errorCodeName: i.codeName,
+            error: i.message
           });
         }
       }
     );
   }
   async authorizeEndpoint(e, o, s) {
-    var t, a, h;
+    var i, a, h;
     if (!e.user) return o.redirect(this.loginUrl + "?next=" + encodeURIComponent(e.url), 302);
     d.logger.debug(c({ msg: "validating authorize parameters" }));
-    let { error_description: r } = this.authServer.validateAuthorizeParameters(s), i;
-    if (r ? (i = new l(g.BadRequest, r), d.logger.error(c({
+    let { error_description: r } = this.authServer.validateAuthorizeParameters(s), t;
+    if (r ? (t = new l(g.BadRequest, r), d.logger.error(c({
       msg: "authorize parameter invalid",
-      cerr: i,
-      user: (t = e.user) == null ? void 0 : t.username
+      cerr: t,
+      user: (i = e.user) == null ? void 0 : i.username
     }))) : d.logger.error(c({
       msg: "authorize parameter valid",
       user: (a = e.user) == null ? void 0 : a.username
-    })), i) {
+    })), t) {
       if (this.errorPage)
-        return o.status(i.httpStatus).view(
+        return o.status(t.httpStatus).view(
           this.errorPage,
           {
-            status: i.httpStatus,
-            errorMessage: i.message,
-            errorCode: i.code,
-            errorCodeName: i.codeName
+            status: t.httpStatus,
+            errorMessage: t.message,
+            errorCode: t.code,
+            errorCodeName: t.codeName
           }
         );
       {
         let f = "500";
-        switch (i.httpStatus) {
+        switch (t.httpStatus) {
           case 401:
             f = "401";
             break;
@@ -5178,7 +5200,7 @@ class $e {
             f = "400";
             break;
         }
-        return o.status(i.httpStatus).send($[f] ?? G);
+        return o.status(t.httpStatus).send($[f] ?? G);
       }
     }
     let n = !1;
@@ -5240,9 +5262,9 @@ class $e {
   }
   async authorize(e, o, s, {
     responseType: r,
-    client_id: i,
+    client_id: t,
     redirect_uri: n,
-    scope: t,
+    scope: i,
     state: a,
     codeChallenge: h,
     codeChallengeMethod: f
@@ -5251,9 +5273,9 @@ class $e {
     if (s) {
       const w = await this.authServer.authorizeGetEndpoint({
         responseType: r,
-        client_id: i,
+        client_id: t,
         redirect_uri: n,
-        scope: t,
+        scope: i,
         state: a,
         codeChallenge: h,
         codeChallengeMethod: f,
@@ -5312,18 +5334,18 @@ class $e {
     }
   }
   async mfaAuthenticatorsEndpoint(e, o) {
-    var t;
-    const s = (t = e.headers.authorization) == null ? void 0 : t.split(" ");
+    var i;
+    const s = (i = e.headers.authorization) == null ? void 0 : i.split(" ");
     if (!s || s.length != 2)
       return {
         error: "access_denied",
         error_desciption: "Invalid authorization header"
       };
-    const r = s[1], i = await this.authServer.mfaAuthenticatorsEndpoint(r);
-    if (i.authenticators)
-      return o.header(...x).status(200).send(i.authenticators);
-    const n = l.fromOAuthError(i.error ?? "server_error");
-    return o.header(...x).status(n.httpStatus).send(i);
+    const r = s[1], t = await this.authServer.mfaAuthenticatorsEndpoint(r);
+    if (t.authenticators)
+      return o.header(...A).status(200).send(t.authenticators);
+    const n = l.fromOAuthError(t.error ?? "server_error");
+    return o.header(...A).status(n.httpStatus).send(t);
   }
   async mfaChallengeEndpoint(e, o, s) {
     const r = await this.authServer.mfaChallengeEndpoint(
@@ -5334,15 +5356,15 @@ class $e {
       s.authenticator_id
     );
     if (r.error) {
-      const i = l.fromOAuthError(r.error);
-      return o.header(...x).status(i.httpStatus).send(r);
+      const t = l.fromOAuthError(r.error);
+      return o.header(...A).status(t.httpStatus).send(r);
     }
-    return o.header(...x).status(200).send(r);
+    return o.header(...A).status(200).send(r);
   }
   setRefreshTokenCookie(e, o, s) {
     if (!this.refreshTokenCookieName) return;
-    let r = s ? new Date(Date.now() + s * 1e3).toUTCString() : void 0, i = this.refreshTokenCookieName + "=" + o;
-    r && (i += "; expires=" + new Date(r).toUTCString()), this.refreshTokenCookieSameSite && (i += "; SameSite=" + this.refreshTokenCookieSameSite), this.refreshTokenCookieDomain && (i += "; domain=" + this.refreshTokenCookieDomain), this.refreshTokenCookiePath && (i += "; path=" + this.refreshTokenCookiePath), this.refreshTokenCookieHttpOnly == !0 && (i += "; httpOnly"), this.refreshTokenCookieSecure == !0 && (i += "; secure"), e.setCookie(this.refreshTokenCookieName, i);
+    let r = s ? new Date(Date.now() + s * 1e3).toUTCString() : void 0, t = this.refreshTokenCookieName + "=" + o;
+    r && (t += "; expires=" + new Date(r).toUTCString()), this.refreshTokenCookieSameSite && (t += "; SameSite=" + this.refreshTokenCookieSameSite), this.refreshTokenCookieDomain && (t += "; domain=" + this.refreshTokenCookieDomain), this.refreshTokenCookiePath && (t += "; path=" + this.refreshTokenCookiePath), this.refreshTokenCookieHttpOnly == !0 && (t += "; httpOnly"), this.refreshTokenCookieSecure == !0 && (t += "; secure"), e.setCookie(this.refreshTokenCookieName, t);
   }
   /**
    * Returns this server's OIDC configuration.  Just wraps
@@ -5360,52 +5382,52 @@ class $e {
   /////
   // Device code flow
   async applyUserCode(e, o, s) {
-    var r, i, n;
+    var r, t, n;
     try {
-      const t = await this.authServer.deviceEndpoint({ userCode: e, user: s });
-      if (t.error)
+      const i = await this.authServer.deviceEndpoint({ userCode: e, user: s });
+      if (i.error)
         return {
           ok: !1,
           completed: !1,
           retryAllowed: !1,
-          error: t.error,
-          error_description: t.error_description
+          error: i.error,
+          error_description: i.error_description
         };
-      if (!t.client_id)
-        return d.logger.error(c({ msg: "No client id found for user code", userCodeHash: F.hash(e), ip: o.ip, username: (r = o.user) == null ? void 0 : r.username })), {
+      if (!i.client_id)
+        return d.logger.error(c({ msg: "No client id found for user code", userCodeHash: N.hash(e), ip: o.ip, username: (r = o.user) == null ? void 0 : r.username })), {
           ok: !1,
           completed: !1,
           retryAllowed: !1,
           error: "server_error",
           error_description: "No client id found for user code"
         };
-      if (t.error == "access_denied")
-        return d.logger.error(c({ msg: "Incorrect user code given", userCodeHash: F.hash(e), ip: o.ip, username: (i = o.user) == null ? void 0 : i.username })), this.authServer.userCodeThrottle > 0 && await ((f) => new Promise((p) => setTimeout(p, f)))(this.authServer.userCodeThrottle), {
+      if (i.error == "access_denied")
+        return d.logger.error(c({ msg: "Incorrect user code given", userCodeHash: N.hash(e), ip: o.ip, username: (t = o.user) == null ? void 0 : t.username })), this.authServer.userCodeThrottle > 0 && await ((f) => new Promise((p) => setTimeout(p, f)))(this.authServer.userCodeThrottle), {
           ok: !1,
           completed: !1,
           retryAllowed: !0,
-          error: t.error,
-          error_description: t.error_description
+          error: i.error,
+          error_description: i.error_description
         };
-      if (t.error == "expired_token")
-        return d.logger.error(c({ msg: "Expired user code", userCodeHash: F.hash(e), ip: o.ip, username: (n = o.user) == null ? void 0 : n.username })), {
+      if (i.error == "expired_token")
+        return d.logger.error(c({ msg: "Expired user code", userCodeHash: N.hash(e), ip: o.ip, username: (n = o.user) == null ? void 0 : n.username })), {
           ok: !1,
           completed: !1,
           retryAllowed: !1,
-          error: t.error,
-          error_description: t.error_description
+          error: i.error,
+          error_description: i.error_description
         };
-      const a = await this.clientStorage.getClientById(t.client_id);
-      return t.scopeAuthorizationNeeded ? {
+      const a = await this.clientStorage.getClientById(i.client_id);
+      return i.scopeAuthorizationNeeded ? {
         ok: !0,
         completed: !1,
         retryAllowed: !0,
         authorizationNeeded: {
           user: s,
-          client_id: t.client_id,
+          client_id: i.client_id,
           client_name: a.client_name,
-          scope: t.scope,
-          scopes: t.scope ? t.scope.split(" ") : [],
+          scope: i.scope,
+          scopes: i.scope ? i.scope.split(" ") : [],
           csrfToken: o.csrfToken
         },
         user: o.user,
@@ -5418,8 +5440,8 @@ class $e {
         user: o.user,
         csrfToken: o.csrfToken
       };
-    } catch (t) {
-      const a = l.asCrossauthError(t);
+    } catch (i) {
+      const a = l.asCrossauthError(i);
       return d.logger.debug(c({ err: a })), d.logger.error(c({ msg: a.message, cerr: a })), {
         ok: !1,
         completed: !1,
@@ -5431,52 +5453,52 @@ class $e {
   }
   async deviceGet(e, o, s, r) {
     if (o.query.user_code) {
-      let i = await this.applyUserCode(o.query.user_code, o, r);
-      if (i.error) {
-        const t = l.fromOAuthError(i.error, i.error_description);
-        d.logger.debug({ err: t }), d.logger.error({ cerr: t });
+      let t = await this.applyUserCode(o.query.user_code, o, r);
+      if (t.error) {
+        const i = l.fromOAuthError(t.error, t.error_description);
+        d.logger.debug({ err: i }), d.logger.error({ cerr: i });
         const a = {
           ok: !1,
           completed: !1,
-          status: t.httpStatus,
-          errorMessage: t.message,
-          errorCode: t.code,
-          errorCodeName: t.codeName,
-          retryAllowed: i.retryAllowed
+          status: i.httpStatus,
+          errorMessage: i.message,
+          errorCode: i.code,
+          errorCodeName: i.codeName,
+          retryAllowed: t.retryAllowed
         };
-        return e ? s.header(...x).status(t.httpStatus).send(a) : s.status(t.httpStatus).view(this.devicePage, {
+        return e ? s.header(...A).status(i.httpStatus).send(a) : s.status(i.httpStatus).view(this.devicePage, {
           csrfToken: o.csrfToken,
           ...a
         });
-      } else if (i.authorizationNeeded) {
-        const t = {
+      } else if (t.authorizationNeeded) {
+        const i = {
           ok: !0,
           completed: !1,
-          retryAllowed: i.retryAllowed,
-          authorizationNeeded: i.authorizationNeeded,
-          user_code: i.user_code
+          retryAllowed: t.retryAllowed,
+          authorizationNeeded: t.authorizationNeeded,
+          user_code: t.user_code
         };
-        return e ? s.header(...x).status(200).send(t) : s.status(200).view(this.devicePage, {
+        return e ? s.header(...A).status(200).send(i) : s.status(200).view(this.devicePage, {
           csrfToken: o.csrfToken,
-          ...t
+          ...i
         });
       }
       const n = {
         ok: !0,
         completed: !0
       };
-      return e ? s.header(...x).status(401).send(n) : s.status(200).view(this.devicePage, {
+      return e ? s.header(...A).status(401).send(n) : s.status(200).view(this.devicePage, {
         csrfToken: o.csrfToken,
         ...n
       });
     } else {
-      const i = {
+      const t = {
         ok: !1,
         completed: !1,
         user_code: o.query.user_code,
         csrfToken: o.csrfToken
       };
-      return e ? s.header(...x).status(200).send(i) : s.status(200).view(this.devicePage, i);
+      return e ? s.header(...A).status(200).send(t) : s.status(200).view(this.devicePage, t);
     }
   }
   async deviceCodePost(e, o, s) {
@@ -5489,7 +5511,7 @@ class $e {
           if (r.error) {
             const n = l.fromOAuthError(r.error, r.error_description);
             d.logger.debug({ err: n }), d.logger.error({ cerr: n });
-            const t = {
+            const i = {
               ok: !1,
               completed: !1,
               status: n.httpStatus,
@@ -5498,9 +5520,9 @@ class $e {
               errorCodeName: n.codeName,
               retryAllowed: r.retryAllowed
             };
-            return e ? s.header(...x).status(200).send(t) : s.status(n.httpStatus).view(this.devicePage, {
+            return e ? s.header(...A).status(200).send(i) : s.status(n.httpStatus).view(this.devicePage, {
               csrfToken: o.csrfToken,
-              ...t
+              ...i
             });
           } else if (r.authorizationNeeded) {
             const n = {
@@ -5510,19 +5532,19 @@ class $e {
               authorizationNeeded: r.authorizationNeeded,
               user_code: r.user_code
             };
-            return e ? s.header(...x).status(200).send(n) : s.status(200).view(this.devicePage, {
+            return e ? s.header(...A).status(200).send(n) : s.status(200).view(this.devicePage, {
               csrfToken: o.csrfToken,
               ...n
             });
           }
-          const i = {
+          const t = {
             ok: !0,
             completed: !0,
             csrfToken: o.csrfToken
           };
-          return e ? s.header(...x).status(200).send(i) : s.status(200).view(this.devicePage, i);
+          return e ? s.header(...A).status(200).send(t) : s.status(200).view(this.devicePage, t);
         } else {
-          const r = l.fromOAuthError("unauthorized", "Please enter the code"), i = {
+          const r = l.fromOAuthError("unauthorized", "Please enter the code"), t = {
             ok: !1,
             completed: !1,
             user_code: o.body.user_code,
@@ -5533,50 +5555,50 @@ class $e {
             errorCode: r.code,
             errorCodeName: r.codeName
           };
-          return e ? s.header(...x).status(401).send(i) : s.status(200).view(this.devicePage, {
+          return e ? s.header(...A).status(401).send(t) : s.status(200).view(this.devicePage, {
             csrfToken: o.csrfToken,
-            ...i
+            ...t
           });
         }
       else if (o.body.authorized == "true") {
-        let r = o.body.user_code, i = o.body.scope;
-        i == "";
+        let r = o.body.user_code, t = o.body.scope;
+        t == "";
         const n = o.body.client_id;
         if (!r) throw new l(g.BadRequest, "user_code missing");
         if (!n) throw new l(g.BadRequest, "client_id missing");
-        let t = await this.authServer.validateAndPersistScope(n, i, o.user);
-        if (t.error)
-          throw l.fromOAuthError(t.error, t.error_description);
-        if (t = await this.applyUserCode(r, o, o.user), t.error)
-          throw l.fromOAuthError(t.error, t.error_description);
+        let i = await this.authServer.validateAndPersistScope(n, t, o.user);
+        if (i.error)
+          throw l.fromOAuthError(i.error, i.error_description);
+        if (i = await this.applyUserCode(r, o, o.user), i.error)
+          throw l.fromOAuthError(i.error, i.error_description);
         const a = {
           ok: !0,
           completed: !0,
           csrfToken: o.csrfToken
         };
-        return e ? s.header(...x).status(401).send(a) : s.status(200).view(this.devicePage, a);
+        return e ? s.header(...A).status(401).send(a) : s.status(200).view(this.devicePage, a);
       } else
         throw new l(g.Unauthorized, "You did not authorize the client");
     } catch (r) {
-      const i = l.asCrossauthError(r);
-      d.logger.debug({ err: i }), d.logger.error({ cerr: i });
+      const t = l.asCrossauthError(r);
+      d.logger.debug({ err: t }), d.logger.error({ cerr: t });
       const n = {
         ok: !1,
-        status: i.httpStatus,
-        errorMessage: i.message,
-        errorCode: i.code,
-        errorCodeName: i.codeName
+        status: t.httpStatus,
+        errorMessage: t.message,
+        errorCode: t.code,
+        errorCodeName: t.codeName
       };
-      return e ? s.header(...x).status(401).send(n) : s.status(i.httpStatus).view(this.devicePage, {
+      return e ? s.header(...A).status(401).send(n) : s.status(t.httpStatus).view(this.devicePage, {
         csrfToken: o.csrfToken,
         ...n
       });
     }
   }
 }
-const _ = ["Content-Type", "application/json; charset=utf-8"];
+const x = ["Content-Type", "application/json; charset=utf-8"];
 async function pe(S, e, o, s) {
-  return d.logger.debug(c({ err: s })), o.header(..._).status(s.httpStatus).send({
+  return d.logger.debug(c({ err: s })), o.header(...x).status(s.httpStatus).send({
     ok: !1,
     status: s.httpStatus,
     errorMessage: s.message,
@@ -5598,7 +5620,7 @@ function V(S) {
   let e;
   if (S)
     try {
-      e = JSON.parse(F.base64Decode(S.split(".")[1]));
+      e = JSON.parse(N.base64Decode(S.split(".")[1]));
     } catch (o) {
       const s = l.asCrossauthError(o);
       d.logger.debug(c({ err: s })), d.logger.error(c({ msg: "Couldn't decode id token", cerr: s }));
@@ -5608,7 +5630,7 @@ function V(S) {
 async function me(S, e, o, s) {
   if (s) {
     let r = { ok: !0, ...S };
-    return e.jwtTokens.includes("id") && (r.id_payload = S.id_payload ?? V(S.id_token)), s.header(..._).status(200).send(r);
+    return e.jwtTokens.includes("id") && (r.id_payload = S.id_payload ?? V(S.id_token)), s.header(...x).status(200).send(r);
   }
 }
 function fe(S, e) {
@@ -5616,10 +5638,10 @@ function fe(S, e) {
   if (S.access_token)
     try {
       if (S.access_token && e.includes("access")) {
-        const s = J(S.access_token), r = s.jti ? s.jti : s.sid ? s.sid : "", i = r ? F.hash(r) : void 0;
+        const s = K(S.access_token), r = s.jti ? s.jti : s.sid ? s.sid : "", t = r ? N.hash(r) : void 0;
         d.logger.debug(c({
           msg: "Got access token",
-          accessTokenHash: i
+          accessTokenHash: t
         }));
       }
     } catch (s) {
@@ -5628,12 +5650,12 @@ function fe(S, e) {
   if (S.id_token)
     try {
       if (S.id_token && e.includes("id")) {
-        let s = S.id_payload ?? J(S.id_token);
+        let s = S.id_payload ?? K(S.id_token);
         if (s) {
-          const r = s.jti ? s.jti : s.sid ? s.sid : "", i = r ? F.hash(r) : void 0;
+          const r = s.jti ? s.jti : s.sid ? s.sid : "", t = r ? N.hash(r) : void 0;
           d.logger.debug(c({
             msg: "Got id token",
-            idTokenHash: i
+            idTokenHash: t
           }));
         }
       }
@@ -5643,7 +5665,7 @@ function fe(S, e) {
   if (S.refresh_token && e.includes("refresh"))
     try {
       if (S.refresh_token) {
-        const s = (o = J(S.refresh_token)) == null ? void 0 : o.jti, r = s ? F.hash(s) : void 0;
+        const s = (o = K(S.refresh_token)) == null ? void 0 : o.jti, r = s ? N.hash(s) : void 0;
         d.logger.debug(c({
           msg: "Got refresh token",
           refreshTokenHash: r
@@ -5672,11 +5694,11 @@ async function Qe(S, e, o, s) {
       let r = { ...S };
       return e.jwtTokens.includes("id") && S.id_token && (r.id_payload = S.id_payload ?? V(S.id_token)), s.status(200).view(e.authorizedPage, r);
     } catch (r) {
-      const i = l.asCrossauthError(r);
-      return s.status(i.httpStatus).view(e.errorPage, {
-        status: i.httpStatus,
-        errorMessage: i.message,
-        errorCodeName: i.codeName
+      const t = l.asCrossauthError(r);
+      return s.status(t.httpStatus).view(e.errorPage, {
+        status: t.httpStatus,
+        errorMessage: t.message,
+        errorCodeName: t.codeName
       });
     }
 }
@@ -5708,12 +5730,12 @@ async function Ze(S, e, o, s) {
       return e.jwtTokens.includes("id") && (r.id_payload = S.id_payload ?? V(S.id_token)), s.status(200).view(e.authorizedPage, r);
     }
   } catch (r) {
-    const i = l.asCrossauthError(r);
-    if (d.logger.debug(c({ err: i })), d.logger.debug(c({ cerr: i, msg: "Error receiving tokens" })), s)
-      return s.status(i.httpStatus).view(e.errorPage, {
-        status: i.httpStatus,
-        errorMessage: i.message,
-        errorCodeName: i.codeName
+    const t = l.asCrossauthError(r);
+    if (d.logger.debug(c({ err: t })), d.logger.debug(c({ cerr: t, msg: "Error receiving tokens" })), s)
+      return s.status(t.httpStatus).view(e.errorPage, {
+        status: t.httpStatus,
+        errorMessage: t.message,
+        errorCodeName: t.codeName
       });
   }
 }
@@ -5722,23 +5744,23 @@ async function Se(S, e, o, s, r) {
     g.Configuration,
     "Cannot update session data if sessions not enabled"
   );
-  let i = S.expires_in;
-  if (!i && S.access_token && e.jwtTokens.includes("access")) {
-    const a = J(S.access_token);
-    a.exp && (i = a.exp);
+  let t = S.expires_in;
+  if (!t && S.access_token && e.jwtTokens.includes("access")) {
+    const a = K(S.access_token);
+    a.exp && (t = a.exp);
   }
-  if (!i)
+  if (!t)
     throw new l(
       g.BadRequest,
       "OAuth server did not return an expiry for the access token"
     );
-  const n = Date.now() + i * 1e3;
-  let t = {};
-  if (t = { ...S, expires_at: n }, "id_token" in S) {
+  const n = Date.now() + t * 1e3;
+  let i = {};
+  if (i = { ...S, expires_at: n }, "id_token" in S) {
     let a = S.id_payload ?? V(S.id_token);
-    a && (t.id_token = a);
+    a && (i.id_token = a);
   }
-  await e.storeSessionData(t, o, s);
+  await e.storeSessionData(i, o, s);
 }
 async function qe(S, e, o, s) {
   if (S.error) {
@@ -5764,12 +5786,12 @@ async function qe(S, e, o, s) {
         errorCode: g.Configuration
       });
   } catch (r) {
-    const i = l.asCrossauthError(r);
-    if (d.logger.debug(c({ err: i })), d.logger.debug(c({ cerr: i, msg: "Error receiving tokens" })), s)
-      return s.status(i.httpStatus).view(e.errorPage, {
-        status: i.httpStatus,
-        errorMessage: i.message,
-        errorCodeName: i.codeName
+    const t = l.asCrossauthError(r);
+    if (d.logger.debug(c({ err: t })), d.logger.debug(c({ cerr: t, msg: "Error receiving tokens" })), s)
+      return s.status(t.httpStatus).view(e.errorPage, {
+        status: t.httpStatus,
+        errorMessage: t.message,
+        errorCodeName: t.codeName
       });
   }
 }
@@ -5781,7 +5803,7 @@ class we extends Oe {
    * @param options See {@link FastifyOAuthClientOptions}
    */
   constructor(o, s, r) {
-    var i, n, t;
+    var t, n, i;
     super(s, r);
     u(this, "server");
     u(this, "siteUrl", "/");
@@ -5821,7 +5843,7 @@ class we extends Oe {
     u(this, "bffEndpointName", "bff");
     u(this, "bffBaseUrl");
     u(this, "tokenEndpoints", []);
-    if (this.server = o, C("sessionDataName", k.String, this, r, "OAUTH_SESSION_DATA_NAME"), C("siteUrl", k.String, this, r, "SITE_URL", !0), C("tokenResponseType", k.String, this, r, "OAUTH_TOKEN_RESPONSE_TYPE"), C("errorResponseType", k.String, this, r, "OAUTH_ERROR_RESPONSE_TYPE"), C("prefix", k.String, this, r, "PREFIX"), this.prefix.endsWith("/") || (this.prefix += "/"), C("loginUrl", k.String, this, r, "LOGIN_URL"), C("errorPage", k.String, this, r, "ERROR_PAGE"), C("authorizedPage", k.String, this, r, "AUTHORIZED_PAGE"), C("authorizedUrl", k.String, this, r, "AUTHORIZED_URL"), C("loginProtectedFlows", k.JsonArray, this, r, "OAUTH_LOGIN_PROTECTED_FLOWS"), C("passwordFlowUrl", k.String, this, r, "OAUTH_PASSWORD_FLOW_URL"), C("passwordOtpUrl", k.String, this, r, "OAUTH_PASSWORD_OTP_URL"), C("passwordOobUrl", k.String, this, r, "OAUTH_PASSWORD_OOB_URL"), C("passwordFlowPage", k.String, this, r, "OAUTH_PASSWORD_FLOW_PAGE"), C("deviceCodeFlowPage", k.String, this, r, "OAUTH_DEVICECODE_FLOW_PAGE"), C("deleteTokensPage", k.String, this, r, "OAUTH_DELETE_TOKENS_PAGE"), C("deleteTokensGetUrl", k.String, this, r, "OAUTH_DELETE_TOKENS_GET_URL"), C("deleteTokensPostUrl", k.String, this, r, "OAUTH_DELETE_TOKENS_POST_URL"), C("apiDeleteTokensPostUrl", k.String, this, r, "OAUTHAPI__DELETE_TOKENS_POST_URL"), C("mfaOtpPage", k.String, this, r, "OAUTH_MFA_OTP_PAGE"), C("mfaOobPage", k.String, this, r, "OAUTH_MFA_OOB_PAGE"), C("deviceCodeFlowUrl", k.String, this, r, "OAUTH_DEVICECODE_FLOW_URL"), C("deviceCodePollUrl", k.String, this, r, "OAUTH_DEVICECODE_POLL_URL"), C("bffEndpointName", k.String, this, r, "OAUTH_BFF_ENDPOINT_NAME"), C("bffBaseUrl", k.String, this, r, "OAUTH_BFF_BASEURL"), C("validFlows", k.JsonArray, this, r, "OAUTH_VALIDFLOWS"), C("jwtTokens", k.JsonArray, this, r, "OAUTH_JWT_TOKENS"), (i = this.deleteTokensGetUrl) != null && i.startsWith("/") && (this.deleteTokensGetUrl = this.deleteTokensGetUrl.substring(1)), (n = this.deleteTokensPostUrl) != null && n.startsWith("/") && (this.deleteTokensPostUrl = this.deleteTokensPostUrl.substring(1)), (t = this.deleteTokensPostUrl) != null && t.startsWith("/") && (this.deleteTokensPostUrl = this.deleteTokensPostUrl.substring(1)), this.validFlows.length == 1 && this.validFlows[0] == E.All)
+    if (this.server = o, C("sessionDataName", k.String, this, r, "OAUTH_SESSION_DATA_NAME"), C("siteUrl", k.String, this, r, "SITE_URL", !0), C("tokenResponseType", k.String, this, r, "OAUTH_TOKEN_RESPONSE_TYPE"), C("errorResponseType", k.String, this, r, "OAUTH_ERROR_RESPONSE_TYPE"), C("prefix", k.String, this, r, "PREFIX"), this.prefix.endsWith("/") || (this.prefix += "/"), C("loginUrl", k.String, this, r, "LOGIN_URL"), C("errorPage", k.String, this, r, "ERROR_PAGE"), C("authorizedPage", k.String, this, r, "AUTHORIZED_PAGE"), C("authorizedUrl", k.String, this, r, "AUTHORIZED_URL"), C("loginProtectedFlows", k.JsonArray, this, r, "OAUTH_LOGIN_PROTECTED_FLOWS"), C("passwordFlowUrl", k.String, this, r, "OAUTH_PASSWORD_FLOW_URL"), C("passwordOtpUrl", k.String, this, r, "OAUTH_PASSWORD_OTP_URL"), C("passwordOobUrl", k.String, this, r, "OAUTH_PASSWORD_OOB_URL"), C("passwordFlowPage", k.String, this, r, "OAUTH_PASSWORD_FLOW_PAGE"), C("deviceCodeFlowPage", k.String, this, r, "OAUTH_DEVICECODE_FLOW_PAGE"), C("deleteTokensPage", k.String, this, r, "OAUTH_DELETE_TOKENS_PAGE"), C("deleteTokensGetUrl", k.String, this, r, "OAUTH_DELETE_TOKENS_GET_URL"), C("deleteTokensPostUrl", k.String, this, r, "OAUTH_DELETE_TOKENS_POST_URL"), C("apiDeleteTokensPostUrl", k.String, this, r, "OAUTHAPI__DELETE_TOKENS_POST_URL"), C("mfaOtpPage", k.String, this, r, "OAUTH_MFA_OTP_PAGE"), C("mfaOobPage", k.String, this, r, "OAUTH_MFA_OOB_PAGE"), C("deviceCodeFlowUrl", k.String, this, r, "OAUTH_DEVICECODE_FLOW_URL"), C("deviceCodePollUrl", k.String, this, r, "OAUTH_DEVICECODE_POLL_URL"), C("bffEndpointName", k.String, this, r, "OAUTH_BFF_ENDPOINT_NAME"), C("bffBaseUrl", k.String, this, r, "OAUTH_BFF_BASEURL"), C("validFlows", k.JsonArray, this, r, "OAUTH_VALIDFLOWS"), C("jwtTokens", k.JsonArray, this, r, "OAUTH_JWT_TOKENS"), (t = this.deleteTokensGetUrl) != null && t.startsWith("/") && (this.deleteTokensGetUrl = this.deleteTokensGetUrl.substring(1)), (n = this.deleteTokensPostUrl) != null && n.startsWith("/") && (this.deleteTokensPostUrl = this.deleteTokensPostUrl.substring(1)), (i = this.deleteTokensPostUrl) != null && i.startsWith("/") && (this.deleteTokensPostUrl = this.deleteTokensPostUrl.substring(1)), this.validFlows.length == 1 && this.validFlows[0] == E.All)
       this.validFlows = E.allFlows();
     else if (!E.areAllValidFlows(this.validFlows))
       throw new l(g.Configuration, "Invalid flows specificied in " + this.validFlows.join(","));
@@ -5909,13 +5931,13 @@ class we extends Oe {
     }), this.validFlows.includes(E.AuthorizationCodeWithPKCE) && this.server.app.get(
       this.prefix + "authzcodeflowpkce",
       async (a, h) => {
-        var N;
+        var _;
         if (d.logger.info(c({
           msg: "Page visit",
           method: "GET",
           url: this.prefix + "authzcodeflowpkce",
           ip: a.ip,
-          user: (N = a.user) == null ? void 0 : N.username
+          user: (_ = a.user) == null ? void 0 : _.username
         })), !a.user && this.loginProtectedFlows.includes(E.AuthorizationCodeWithPKCE))
           return h.redirect(this.loginUrl + "?next=" + encodeURIComponent(a.url), 302);
         const f = this.randomValue(this.stateLength), { codeChallenge: p, codeVerifier: v } = await this.codeChallengeAndVerifier(), m = { scope: a.query.scope, state: f, codeChallenge: p, codeVerifier: v };
@@ -6000,7 +6022,7 @@ class we extends Oe {
           if (m) return w;
         }
         if (!a.user && this.loginProtectedFlows.includes(E.ClientCredentials))
-          return h.status(401).header(..._).send({ ok: !1, msg: "Access denied" });
+          return h.status(401).header(...x).send({ ok: !1, msg: "Access denied" });
         try {
           const m = await this.clientCredentialsFlow((p = a.body) == null ? void 0 : p.scope);
           if (m.error) {
@@ -6076,7 +6098,7 @@ class we extends Oe {
           );
         }
         if (!a.user && this.loginProtectedFlows.includes(E.RefreshToken))
-          return h.status(401).header(..._).send({ ok: !1, msg: "Access denied" });
+          return h.status(401).header(...x).send({ ok: !1, msg: "Access denied" });
         try {
           const P = await this.refreshTokenFlow(v);
           if (P.error) {
@@ -6317,10 +6339,10 @@ class we extends Oe {
           user: (f = a.user) == null ? void 0 : f.username
         }));
         try {
-          return await this.deleteTokens(a), h.header(..._).send('{"ok": true}');
+          return await this.deleteTokens(a), h.header(...x).send('{"ok": true}');
         } catch (p) {
           const v = l.asCrossauthError(p);
-          return d.logger.debug(c({ err: v })), d.logger.error(c({ msg: "Couldn't delete oauth tokens", cerr: v })), h.header(..._).status(v.httpStatus).send(JSON.stringify({
+          return d.logger.debug(c({ err: v })), d.logger.error(c({ msg: "Couldn't delete oauth tokens", cerr: v })), h.header(...x).status(v.httpStatus).send(JSON.stringify({
             ok: !1,
             errorMessage: v.message,
             errorCode: v.code,
@@ -6334,15 +6356,15 @@ class we extends Oe {
       this.server.app.post(
         this.prefix + a,
         async (h, f) => {
-          var N;
+          var _;
           if (d.logger.info(c({
             msg: "Page visit",
             method: "POST",
             url: this.prefix + a,
             ip: h.ip,
-            user: (N = h.user) == null ? void 0 : N.username
+            user: (_ = h.user) == null ? void 0 : _.username
           })), !h.csrfToken)
-            return f.header(..._).status(401).send({ ok: !1, msg: "No csrf token given" });
+            return f.header(...x).status(401).send({ ok: !1, msg: "No csrf token given" });
           let p = !1, v = a;
           a.startsWith("have_") && (v = a.replace("have_", ""), p = !0);
           let m = v.replace("_token", ""), w = !1;
@@ -6352,9 +6374,9 @@ class we extends Oe {
           );
           const P = await this.server.sessionAdapter.getSessionData(h, this.sessionDataName);
           if (!P)
-            return p ? f.header(..._).status(200).send({ ok: !1 }) : f.header(..._).status(204).send();
+            return p ? f.header(...x).status(200).send({ ok: !1 }) : f.header(...x).status(204).send();
           let T = P[v];
-          return w && (T = V(P[v])), T ? p ? f.header(..._).status(200).send({ ok: !0 }) : f.header(..._).status(200).send({ ...T }) : p ? f.header(..._).status(200).send({ ok: !1 }) : f.header(..._).status(204).send();
+          return w && (T = V(P[v])), T ? p ? f.header(...x).status(200).send({ ok: !0 }) : f.header(...x).status(200).send({ ...T }) : p ? f.header(...x).status(200).send({ ok: !1 }) : f.header(...x).status(204).send();
         }
       );
     if (this.server.app.post(
@@ -6368,25 +6390,25 @@ class we extends Oe {
           ip: a.ip,
           user: (v = a.user) == null ? void 0 : v.username
         })), !a.csrfToken)
-          return h.header(..._).status(401).send({ ok: !1, msg: "No csrf token given" });
+          return h.header(...x).status(401).send({ ok: !1, msg: "No csrf token given" });
         if (!this.server.sessionAdapter) throw new l(
           g.Configuration,
           "Cannot get session data if sessions not enabled"
         );
         const f = await this.server.sessionAdapter.getSessionData(a, this.sessionDataName);
         if (!f)
-          return h.header(..._).status(204).send();
+          return h.header(...x).status(204).send();
         let p = {};
         for (let m of this.tokenEndpoints) {
           let w = !1, P = m;
           m.startsWith("have_") && (P = m.replace("have_", ""), w = !0);
-          let T = P.replace("_token", ""), N = !1;
-          if (this.jwtTokens.includes(T) && (N = a.body.decode ?? !0), P in f) {
+          let T = P.replace("_token", ""), _ = !1;
+          if (this.jwtTokens.includes(T) && (_ = a.body.decode ?? !0), P in f) {
             let b = f[P];
-            N && (b = V(f[P])), b && (p[m] = w ? !0 : b);
+            _ && (b = V(f[P])), b && (p[m] = w ? !0 : b);
           } else w && (p[m] = !1);
         }
-        return h.header(..._).status(200).send({ ...p });
+        return h.header(...x).status(200).send({ ...p });
       }
     ), this.bffEndpoints.length > 0 && !this.bffBaseUrl)
       throw new l(g.Configuration, "If enabling BFF endpoints, must also define bffBaseUrl");
@@ -6406,7 +6428,7 @@ class we extends Oe {
           url: this.prefix + this.bffEndpointName + v,
           // was url
           handler: async (w, P) => {
-            var b, M;
+            var b, U;
             d.logger.info(c({
               msg: "Page visit",
               method: w.method,
@@ -6416,32 +6438,32 @@ class we extends Oe {
             }));
             const T = w.url.substring(this.prefix.length + this.bffEndpointName.length);
             d.logger.debug(c({ msg: "Resource server URL " + T }));
-            const N = f[m] != "GET" && f[m] != "HEAD" && f[m] != "OPTIONS";
-            if (this.server.sessionAdapter && N) {
-              const { error: I, reply: j } = await o.errorIfCsrfInvalid(
+            const _ = f[m] != "GET" && f[m] != "HEAD" && f[m] != "OPTIONS";
+            if (this.server.sessionAdapter && _) {
+              const { error: M, reply: j } = await o.errorIfCsrfInvalid(
                 w,
                 P,
                 this.errorFn
               );
-              if (I) return j;
+              if (M) return j;
             }
             try {
               if (!this.server.sessionAdapter) throw new l(
                 g.Configuration,
                 "Cannot get session data if sessions not enabled"
               );
-              const I = await this.server.sessionAdapter.getSessionData(w, this.sessionDataName);
-              if (!I)
-                return P.header(..._).status(401).send({ ok: !1 });
-              let j = I == null ? void 0 : I.access_token;
-              if (I && I.access_token) {
-                const H = await ((M = o.oAuthClient) == null ? void 0 : M.refresh(
+              const M = await this.server.sessionAdapter.getSessionData(w, this.sessionDataName);
+              if (!M)
+                return P.header(...x).status(401).send({ ok: !1 });
+              let j = M == null ? void 0 : M.access_token;
+              if (M && M.access_token) {
+                const H = await ((U = o.oAuthClient) == null ? void 0 : U.refresh(
                   w,
                   P,
                   !0,
                   !0,
-                  I.refresh_token,
-                  I.expires_at
+                  M.refresh_token,
+                  M.expires_at
                 ));
                 H != null && H.access_token && (j = H.access_token);
               }
@@ -6462,23 +6484,23 @@ class we extends Oe {
               const Ce = await W.json();
               for (const H of W.headers.entries())
                 P = P.header(H[0], H[1]);
-              return P.header(..._).status(W.status).send(Ce);
-            } catch (I) {
-              return d.logger.error(c({ err: I })), P.header(..._).status(500).send({});
+              return P.header(...x).status(W.status).send(Ce);
+            } catch (M) {
+              return d.logger.error(c({ err: M })), P.header(...x).status(500).send({});
             }
           }
         });
     }
   }
   async passwordPost(o, s, r) {
-    var i;
+    var t;
     if (this.server.sessionAdapter) {
-      const { error: n, reply: t } = await this.server.errorIfCsrfInvalid(
+      const { error: n, reply: i } = await this.server.errorIfCsrfInvalid(
         s,
         r,
         this.errorFn
       );
-      if (n) return t;
+      if (n) return i;
     }
     try {
       let n = await this.passwordFlow(
@@ -6487,10 +6509,10 @@ class we extends Oe {
         s.body.scope
       );
       if (n.error == "mfa_required" && n.mfa_token && this.validFlows.includes(E.PasswordMfa)) {
-        const t = n.mfa_token;
+        const i = n.mfa_token;
         if (n = await this.passwordMfa(
           o,
-          t,
+          i,
           s.body.scope,
           s,
           r
@@ -6520,56 +6542,56 @@ class we extends Oe {
         }
         return await this.receiveTokenFn(n, this, s, r);
       } else if (n.error) {
-        const t = l.fromOAuthError(
+        const i = l.fromOAuthError(
           n.error,
           n.error_description
         );
-        return o ? await this.errorFn(this.server, s, r, t) : r.view(
+        return o ? await this.errorFn(this.server, s, r, i) : r.view(
           this.passwordFlowPage,
           {
             user: s.user,
             username: s.body.username,
             //password: request.body.password,
             scope: s.body.scope,
-            errorMessage: t.message,
-            errorCode: t.code,
-            errorCodeName: t.codeName,
+            errorMessage: i.message,
+            errorCode: i.code,
+            errorCodeName: i.codeName,
             csrfToken: s.csrfToken
           }
         );
       }
       return await this.receiveTokenFn(n, this, s, r);
     } catch (n) {
-      const t = l.asCrossauthError(n);
+      const i = l.asCrossauthError(n);
       return d.logger.error(c({
         msg: "Error receiving token",
-        cerr: t,
-        user: (i = s.user) == null ? void 0 : i.user
+        cerr: i,
+        user: (t = s.user) == null ? void 0 : t.user
       })), d.logger.debug(c({ err: n })), o ? await this.errorFn(
         this.server,
         s,
         r,
-        t
+        i
       ) : r.view(this.passwordFlowPage, {
         user: s.user,
         username: s.body.username,
         password: s.body.password,
         scope: s.body.scope,
-        errorMessage: t.message,
-        errorCode: t.code,
-        errorCodeName: t.codeName,
+        errorMessage: i.message,
+        errorCode: i.code,
+        errorCodeName: i.codeName,
         csrfToken: s.csrfToken
       });
     }
   }
-  async passwordMfa(o, s, r, i, n) {
-    const t = await this.mfaAuthenticators(s);
-    if (t.error || !t.authenticators || !Array.isArray(t.authenticators) || t.authenticators.length == 0 || t.authenticators.length > 1 && !t.authenticators[0].active)
-      return t.error ? t : {
+  async passwordMfa(o, s, r, t, n) {
+    const i = await this.mfaAuthenticators(s);
+    if (i.error || !i.authenticators || !Array.isArray(i.authenticators) || i.authenticators.length == 0 || i.authenticators.length > 1 && !i.authenticators[0].active)
+      return i.error ? i : {
         error: "access_denied",
         error_description: "No MFA authenticators available"
       };
-    const a = t.authenticators[0];
+    const a = i.authenticators[0];
     if (a.authenticator_type == "otp") {
       const f = await this.mfaOtpRequest(s, a.id);
       return f.error || f.challenge_type != "otp" ? {
@@ -6605,60 +6627,60 @@ class we extends Oe {
   }
   async passwordOtp(o, s, r) {
     var n;
-    const i = await this.mfaOtpComplete(
+    const t = await this.mfaOtpComplete(
       s.body.mfa_token,
       s.body.otp
     );
-    if (i.error) {
-      const t = l.fromOAuthError(
-        i.error,
-        i.error_description ?? "Error completing MFA"
+    if (t.error) {
+      const i = l.fromOAuthError(
+        t.error,
+        t.error_description ?? "Error completing MFA"
       );
       return d.logger.warn(c({
         msg: "Error completing MFA",
-        cerr: t,
+        cerr: i,
         user: (n = s.user) == null ? void 0 : n.user,
-        hashedMfaToken: F.hash(s.body.mfa_token)
-      })), d.logger.debug(c({ err: t })), o ? await this.errorFn(
+        hashedMfaToken: N.hash(s.body.mfa_token)
+      })), d.logger.debug(c({ err: i })), o ? await this.errorFn(
         this.server,
         s,
         r,
-        t
+        i
       ) : r.view(this.mfaOtpPage, {
         user: s.user,
         scope: s.body.scope,
         mfa_token: s.body.mfa_token,
         challenge_tpye: s.body.challenge_type,
-        errorMessage: t.message,
-        errorCode: t.code,
-        errorCodeName: t.codeName,
+        errorMessage: i.message,
+        errorCode: i.code,
+        errorCodeName: i.codeName,
         csrfToken: s.csrfToken
       });
     }
-    return await this.receiveTokenFn(i, this, s, r) ?? r;
+    return await this.receiveTokenFn(t, this, s, r) ?? r;
   }
   async passwordOob(o, s, r) {
     var n;
-    const i = await this.mfaOobComplete(
+    const t = await this.mfaOobComplete(
       s.body.mfa_token,
       s.body.oob_code,
       s.body.binding_code
     );
-    if (i.error) {
-      const t = l.fromOAuthError(
-        i.error,
-        i.error_description ?? "Error completing MFA"
+    if (t.error) {
+      const i = l.fromOAuthError(
+        t.error,
+        t.error_description ?? "Error completing MFA"
       );
       return d.logger.warn(c({
         msg: "Error completing MFA",
-        cerr: t,
+        cerr: i,
         user: (n = s.user) == null ? void 0 : n.user,
-        hashedMfaToken: F.hash(s.body.mfa_token)
-      })), d.logger.debug(c({ err: t })), o ? await this.errorFn(
+        hashedMfaToken: N.hash(s.body.mfa_token)
+      })), d.logger.debug(c({ err: i })), o ? await this.errorFn(
         this.server,
         s,
         r,
-        t
+        i
       ) : r.view(this.mfaOobPage, {
         user: s.user,
         scope: s.body.scope,
@@ -6666,70 +6688,70 @@ class we extends Oe {
         name: s.body.name,
         challenge_tpye: s.body.challenge_type,
         mfa_token: s.body.mfa_token,
-        errorMessage: t.message,
-        errorCode: t.code,
-        errorCodeName: t.codeName,
+        errorMessage: i.message,
+        errorCode: i.code,
+        errorCodeName: i.codeName,
         csrfToken: s.csrfToken
       });
     }
-    return await this.receiveTokenFn(i, this, s, r) ?? r;
+    return await this.receiveTokenFn(t, this, s, r) ?? r;
   }
   async deviceCodePost(o, s, r) {
-    var i;
+    var t;
     if (this.server.sessionAdapter) {
-      const { error: n, reply: t } = await this.server.errorIfCsrfInvalid(
+      const { error: n, reply: i } = await this.server.errorIfCsrfInvalid(
         s,
         r,
         this.errorFn
       );
-      if (n) return t;
+      if (n) return i;
     }
     try {
       if (!s.csrfToken)
         throw new l(g.Unauthorized, "CSRF token missing or invalid");
       let n = this.authServerBaseUrl;
       n.endsWith("/") || (n += "/"), n += this.deviceAuthorizationUrl;
-      const t = await this.startDeviceCodeFlow(n, s.body.scope);
-      if (t.error) {
-        const h = l.fromOAuthError(t.error, t.error_description), f = {
+      const i = await this.startDeviceCodeFlow(n, s.body.scope);
+      if (i.error) {
+        const h = l.fromOAuthError(i.error, i.error_description), f = {
           user: s.user,
           scope: s.body.scope,
           errorMessage: h.message,
           errorCode: h.code,
           errorCodeName: h.codeName,
           csrfToken: s.csrfToken,
-          error: t.error,
-          error_description: t.error_description
+          error: i.error,
+          error_description: i.error_description
         };
-        return o ? r.header(..._).status(h.httpStatus).send(t) : r.view(this.deviceCodeFlowPage, f);
+        return o ? r.header(...x).status(h.httpStatus).send(i) : r.view(this.deviceCodeFlowPage, f);
       }
       let a;
-      return t.verification_uri_complete && await Re.toDataURL(t.verification_uri_complete).then((h) => {
+      return i.verification_uri_complete && await Re.toDataURL(i.verification_uri_complete).then((h) => {
         a = h;
       }).catch((h) => {
         d.logger.debug(c({ err: h })), d.logger.warn(c({ msg: "Couldn't generate verification URL QR Code" }));
-      }), o ? r.header(..._).send(t) : r.view(
+      }), o ? r.header(...x).send(i) : r.view(
         this.deviceCodeFlowPage,
         {
           user: s.user,
           scope: s.body.scope,
           verification_uri_qrdata: a,
-          ...t
+          ...i
         }
       );
     } catch (n) {
-      const t = l.asCrossauthError(n);
+      const i = l.asCrossauthError(n);
       d.logger.error(c({
         msg: "Error receiving token",
-        cerr: t,
-        user: (i = s.user) == null ? void 0 : i.user
+        cerr: i,
+        user: (t = s.user) == null ? void 0 : t.user
       })), d.logger.debug(c({ err: n }));
       const a = {
-        errorMessage: t.message,
-        errorCode: t.code,
-        errorCodeName: t.codeName
+        errorMessage: i.message,
+        errorCode: i.code,
+        errorCodeName: i.codeName
       };
-      return o ? r.header(..._).status(t.httpStatus).send(a) : r.view(this.deviceCodeFlowPage, {
+      return o ? r.header(...x).status(i.httpStatus).send(a) : r.view(this.deviceCodeFlowPage, {
         user: s.user,
         csrfToken: s.csrfToken,
         scope: s.body.scope,
@@ -6738,38 +6760,38 @@ class we extends Oe {
     }
   }
   async deviceCodePoll(o, s, r) {
-    var i;
+    var t;
     try {
       const n = await this.pollDeviceCodeFlow(s.body.device_code);
-      return n.error ? r.header(..._).send(n) : await this.receiveTokenFn(
+      return n.error ? r.header(...x).send(n) : await this.receiveTokenFn(
         n,
         this,
         s,
         o ? void 0 : r
       );
     } catch (n) {
-      const t = l.asCrossauthError(n);
+      const i = l.asCrossauthError(n);
       return d.logger.error(c({
         msg: "Error receiving token",
-        cerr: t,
-        user: (i = s.user) == null ? void 0 : i.user
+        cerr: i,
+        user: (t = s.user) == null ? void 0 : t.user
       })), d.logger.debug(c({ err: n })), await this.errorFn(
         this.server,
         s,
         r,
-        t
+        i
       );
     }
   }
-  async refresh(o, s, r, i, n, t) {
-    if (!t || !n)
+  async refresh(o, s, r, t, n, i) {
+    if (!i || !n)
       return r ? void 0 : await this.receiveTokenFn(
         {},
         this,
         o,
         r ? void 0 : s
       );
-    if (!i || t <= Date.now())
+    if (!t || i <= Date.now())
       try {
         const a = await this.refreshTokenFlow(n);
         if (!a.error && !a.access_token && (a.error = "server_error", a.error_description = "Unexpectedly did not receive error or access token"), !a.error) {
@@ -6790,7 +6812,7 @@ class we extends Oe {
         }
         let h = a.expires_in;
         if (!h && a.access_token) {
-          const p = J(a.access_token);
+          const p = K(a.access_token);
           p.exp && (h = p.exp);
         }
         if (!h)
@@ -6821,9 +6843,9 @@ class we extends Oe {
         };
       }
   }
-  async refreshTokens(o, s, r, i) {
+  async refreshTokens(o, s, r, t) {
     if (!o.csrfToken)
-      return s.header(..._).status(401).send({ ok: !1, msg: "No csrf token given" });
+      return s.header(...x).status(401).send({ ok: !1, msg: "No csrf token given" });
     if (!this.server.sessionAdapter) throw new l(
       g.Configuration,
       "Cannot get session data if sessions not enabled"
@@ -6831,7 +6853,7 @@ class we extends Oe {
     const n = await this.server.sessionAdapter.getSessionData(o, this.sessionDataName);
     if (!(n != null && n.refresh_token)) {
       if (r)
-        return s.header(..._).status(204).send();
+        return s.header(...x).status(204).send();
       {
         const a = new l(
           g.InvalidSession,
@@ -6845,20 +6867,20 @@ class we extends Oe {
         );
       }
     }
-    const t = await this.refresh(
+    const i = await this.refresh(
       o,
       s,
       r,
-      i,
+      t,
       n.refresh_token,
       //onlyIfExpired ? oauthData.expires_at : undefined
       n.expires_at
     );
     if (!r) {
-      if (t == null) return this.receiveTokenFn({}, this, o, s);
-      if (t != null) return t;
+      if (i == null) return this.receiveTokenFn({}, this, o, s);
+      if (i != null) return i;
     }
-    return s.header(..._).status(200).send({ ok: !0, expires_at: t == null ? void 0 : t.expires_at });
+    return s.header(...x).status(200).send({ ok: !0, expires_at: i == null ? void 0 : i.expires_at });
   }
   async deleteTokens(o) {
     if (!this.server.sessionAdapter) throw new l(
@@ -6877,14 +6899,14 @@ class we extends Oe {
     await this.server.sessionAdapter.deleteSessionData(o, this.sessionDataName);
   }
   async storeSessionData(o, s, r) {
-    var i;
+    var t;
     if (this.server.sessionServer) {
       let n = this.server.sessionServer.getSessionCookieValue(s);
       !n && r ? n = await this.server.createAnonymousSession(
         s,
         r,
         { [this.sessionDataName]: o }
-      ) : await ((i = this.server.sessionAdapter) == null ? void 0 : i.updateSessionData(s, this.sessionDataName, o));
+      ) : await ((t = this.server.sessionAdapter) == null ? void 0 : t.updateSessionData(s, this.sessionDataName, o));
     } else {
       if (!this.server.sessionAdapter) throw new l(
         g.Configuration,
@@ -6911,65 +6933,65 @@ class es extends Ie {
     u(this, "tokenLocations", ["header"]);
     u(this, "sessionAdapter");
     if (C("errorBody", k.Json, this, r, "OAUTH_RESSERVER_ACCESS_DENIED_BODY"), C("tokenLocations", k.JsonArray, this, r, "OAUTH_TOKEN_LOCATIONS"), C("sessionDataName", k.String, this, r, "OAUTH_SESSION_DATA_NAME"), this.userStorage = r.userStorage, this.sessionAdapter = r.sessionAdapter, r.protectedEndpoints) {
-      const i = /^[!#\$%&'\(\)\*\+,\.\/a-zA-Z\[\]\^_`-]+/;
-      for (const [n, t] of Object.entries(r.protectedEndpoints)) {
+      const t = /^[!#\$%&'\(\)\*\+,\.\/a-zA-Z\[\]\^_`-]+/;
+      for (const [n, i] of Object.entries(r.protectedEndpoints)) {
         if (!n.startsWith("/"))
           throw new l(g.Configuration, "protected endpoints must be absolute paths without the protocol and hostname");
-        t.scope && t.scope.forEach((a) => {
-          if (!i.test(a)) throw new l(g.Configuration, "Illegal characters in scope " + a);
+        i.scope && i.scope.forEach((a) => {
+          if (!t.test(a)) throw new l(g.Configuration, "Illegal characters in scope " + a);
         });
       }
       this.protectedEndpoints = { ...r.protectedEndpoints };
       for (let n in r.protectedEndpoints) {
-        let t = this.protectedEndpoints[n];
-        t.suburls == !0 && (n.endsWith("/") || (n += "/", this.protectedEndpoints[n] = t), this.protectedEndpointPrefixes.push(n));
+        let i = this.protectedEndpoints[n];
+        i.suburls == !0 && (n.endsWith("/") || (n += "/", this.protectedEndpoints[n] = i), this.protectedEndpointPrefixes.push(n));
       }
     }
-    r.protectedEndpoints && o.addHook("preHandler", async (i, n) => {
+    r.protectedEndpoints && o.addHook("preHandler", async (t, n) => {
       var p, v;
-      const t = i.url.split("?", 2)[0];
+      const i = t.url.split("?", 2)[0];
       let a = !1, h = "";
-      if (t in this.protectedEndpoints)
-        a = !0, h = t;
+      if (i in this.protectedEndpoints)
+        a = !0, h = i;
       else
         for (let m of this.protectedEndpointPrefixes)
-          t.startsWith(m) && (a = !0), h = m;
+          i.startsWith(m) && (a = !0), h = m;
       if (!a) return;
-      const f = await this.authorized(i);
-      if (!(i.user && i.authType == "cookie" && this.protectedEndpoints[h].acceptSessionAuthorization != !0)) {
+      const f = await this.authorized(t);
+      if (!(t.user && t.authType == "cookie" && this.protectedEndpoints[h].acceptSessionAuthorization != !0)) {
         if (!f) {
-          i.authError = "access_denied", i.authErrorDescription = "No access token";
-          const m = this.authenticateHeader(i);
+          t.authError = "access_denied", t.authErrorDescription = "No access token";
+          const m = this.authenticateHeader(t);
           return n.header("WWW-Authenticate", m).status(401).send(this.errorBody);
         }
         if (!f.authorized) {
-          const m = this.authenticateHeader(i);
+          const m = this.authenticateHeader(t);
           return n.header("WWW-Authenticate", m).status(401).send(this.errorBody);
         }
       }
       if (f) {
-        if (i.accessTokenPayload = f.tokenPayload, i.user = f.user, (p = f.tokenPayload) != null && p.scope)
+        if (t.accessTokenPayload = f.tokenPayload, t.user = f.user, (p = f.tokenPayload) != null && p.scope)
           if (Array.isArray(f.tokenPayload.scope)) {
             let m = [];
             for (let w of f.tokenPayload.scope)
               typeof w == "string" && m.push(w);
-            i.scope = m;
-          } else typeof f.tokenPayload.scope == "string" && (i.scope = f.tokenPayload.scope.split(" "));
+            t.scope = m;
+          } else typeof f.tokenPayload.scope == "string" && (t.scope = f.tokenPayload.scope.split(" "));
         if (this.protectedEndpoints[h].scope) {
           for (let m of this.protectedEndpoints[h].scope ?? [])
-            if (!i.scope || !i.scope.includes(m) && this.protectedEndpoints[h].acceptSessionAuthorization != !0)
+            if (!t.scope || !t.scope.includes(m) && this.protectedEndpoints[h].acceptSessionAuthorization != !0)
               return d.logger.warn(c({
                 msg: "Access token does not have sufficient scope",
-                username: (v = i.user) == null ? void 0 : v.username,
-                url: i.url
-              })), i.scope = void 0, i.accessTokenPayload = void 0, i.user = void 0, i.authError = "access_denied", i.authErrorDescription = "Access token does not have sufficient scope", n.status(401).send(this.errorBody);
+                username: (v = t.user) == null ? void 0 : v.username,
+                url: t.url
+              })), t.scope = void 0, t.accessTokenPayload = void 0, t.user = void 0, t.authError = "access_denied", t.authErrorDescription = "Access token does not have sufficient scope", n.status(401).send(this.errorBody);
         }
-        if (i.authType = "oauth", i.authError = f == null ? void 0 : f.error, (f == null ? void 0 : f.error) == "access_denied") {
-          const m = this.authenticateHeader(i);
+        if (t.authType = "oauth", t.authError = f == null ? void 0 : f.error, (f == null ? void 0 : f.error) == "access_denied") {
+          const m = this.authenticateHeader(t);
           return n.header("WWW-Authenticate", m).status(401).send(this.errorBody);
         } else if (f != null && f.error)
           return n.status(500).send(this.errorBody);
-        i.authErrorDescription = f == null ? void 0 : f.error_description, d.logger.debug(c({ msg: "Resource server url", url: i.url, authorized: i.accessTokenPayload != null }));
+        t.authErrorDescription = f == null ? void 0 : f.error_description, d.logger.debug(c({ msg: "Resource server url", url: t.url, authorized: t.accessTokenPayload != null }));
       }
     });
   }
@@ -6995,8 +7017,8 @@ class es extends Ie {
   async authorized(o) {
     try {
       let s;
-      for (let i of this.tokenLocations)
-        if (i == "header") {
+      for (let t of this.tokenLocations)
+        if (t == "header") {
           const n = await this.tokenFromHeader(o);
           if (n) {
             s = n;
@@ -7012,8 +7034,8 @@ class es extends Ie {
       let r;
       if (s) {
         if (s.sub && this.userStorage) {
-          const i = await this.userStorage.getUserByUsername(s.sub);
-          i && (r = i.user), o.user = r;
+          const t = await this.userStorage.getUserByUsername(s.sub);
+          t && (r = t.user), o.user = r;
         } else s.sub && (o.user = {
           id: s.userid ?? s.sub,
           username: s.sub,
@@ -7074,7 +7096,7 @@ const ss = `<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
 function rs(S) {
   return S.admin == !0;
 }
-const K = class K {
+const J = class J {
   /**
    * Integrates fastify session, API key and OAuth servers
    * @param config object with entries as follow:
@@ -7125,9 +7147,9 @@ const K = class K {
     sessionAdapter: o,
     apiKey: s,
     oAuthAuthServer: r,
-    oAuthClient: i,
+    oAuthClient: t,
     oAuthClients: n,
-    oAuthResServer: t
+    oAuthResServer: i
   }, a = {}) {
     u(this, "views", "views");
     /** The Fastify app, which was either passed in the constructor or
@@ -7153,7 +7175,7 @@ const K = class K {
     /** Config for `@fastify/cors` */
     u(this, "cors");
     u(this, "audience", "");
-    C("views", k.String, this, a, "VIEWS"), C("cors", k.Json, this, a, "CORS"), a.isAdminFn && (K.isAdminFn = a.isAdminFn), a.app ? this.app = a.app : (this.views && ue.configure(this.views, {
+    C("views", k.String, this, a, "VIEWS"), C("cors", k.Json, this, a, "CORS"), a.isAdminFn && (J.isAdminFn = a.isAdminFn), a.app ? this.app = a.app : (this.views && ue.configure(this.views, {
       autoescape: !0
     }), this.app = Ee({ logger: !1 }), this.app.register(Te, {
       engine: {
@@ -7179,7 +7201,7 @@ const K = class K {
           g.Configuration,
           "If using session management, must also supply authenticators"
         );
-      const f = new Ke(
+      const f = new Je(
         this.app,
         e.keyStorage,
         h,
@@ -7207,12 +7229,12 @@ const K = class K {
         { ...f, ...a, ...r.options }
       );
     }
-    if (i && this.oAuthClients)
+    if (t && this.oAuthClients)
       throw new l(g.Configuration, "Do not use both oAuthClient and oAuthClients");
-    if (i && (this.oAuthClient = new we(
+    if (t && (this.oAuthClient = new we(
       this,
-      i.authServerBaseUrl,
-      { ...a, ...i.options }
+      t.authServerBaseUrl,
+      { ...a, ...t.options }
     )), n) {
       this.oAuthClients = [];
       for (let f of n)
@@ -7224,10 +7246,10 @@ const K = class K {
           )
         );
     }
-    t && (this.audience = "", C("audience", k.String, this, a, "OAUTH_AUDIENCE", !0), this.oAuthResServer = new es(
+    i && (this.audience = "", C("audience", k.String, this, a, "OAUTH_AUDIENCE", !0), this.oAuthResServer = new es(
       this.app,
       [new Me(this.audience, a)],
-      { sessionAdapter: this.sessionAdapter, ...t.options, ...a }
+      { sessionAdapter: this.sessionAdapter, ...i.options, ...a }
     ));
   }
   /**
@@ -7259,7 +7281,7 @@ const K = class K {
    * from calling `errorFn`.
    */
   async errorIfCsrfInvalid(e, o, s) {
-    var r, i;
+    var r, t;
     try {
       if (!e.csrfToken) throw new l(g.InvalidCsrf);
       return { error: !1, reply: o };
@@ -7270,23 +7292,23 @@ const K = class K {
       }));
       try {
         if (s) {
-          const t = l.asCrossauthError(n);
-          return { error: !0, reply: await s(this, e, o, t) };
+          const i = l.asCrossauthError(n);
+          return { error: !0, reply: await s(this, e, o, i) };
         } else if ((r = this.sessionServer) != null && r.errorPage) {
-          const t = new l(g.InvalidCsrf, "CSRF Token not provided");
+          const i = new l(g.InvalidCsrf, "CSRF Token not provided");
           return { error: !0, reply: o.status(401).view(
-            ((i = this.sessionServer) == null ? void 0 : i.errorPage) ?? "",
+            ((t = this.sessionServer) == null ? void 0 : t.errorPage) ?? "",
             {
-              errorMessage: t.message,
-              errorMessages: t.messages,
-              status: t.httpStatus,
+              errorMessage: i.message,
+              errorMessages: i.messages,
+              status: i.httpStatus,
               errorCode: g.InvalidCsrf,
               errorCodeName: g[g.InvalidCsrf]
             }
           ) };
         }
-      } catch (t) {
-        return d.logger.error(c({ err: t })), { error: !0, reply: o.status(401).send(z) };
+      } catch (i) {
+        return d.logger.error(c({ err: i })), { error: !0, reply: o.status(401).send(z) };
       }
       return { error: !0, reply: o.status(401).send(z) };
     }
@@ -7304,7 +7326,7 @@ const K = class K {
    * from calling `errorFn`.
    */
   async errorIfNotLoggedIn(e, o, s) {
-    var r, i, n;
+    var r, t, n;
     if (!e.user) {
       d.logger.warn(c({
         msg: "Attempt to access url without csrf token",
@@ -7312,14 +7334,14 @@ const K = class K {
       }));
       try {
         if (s) {
-          const t = new l(
+          const i = new l(
             g.Unauthorized,
             "User is not logged in"
           );
-          return await s(this, e, o, t);
+          return await s(this, e, o, i);
         } else if ((r = this.sessionServer) != null && r.errorPage)
           return o.status(401).view(
-            ((i = this.sessionServer) == null ? void 0 : i.errorPage) ?? "",
+            ((t = this.sessionServer) == null ? void 0 : t.errorPage) ?? "",
             {
               errorMessage: "User is not logged in",
               status: 401,
@@ -7327,9 +7349,9 @@ const K = class K {
               codeName: g[g.Unauthorized]
             }
           );
-      } catch (t) {
-        return d.logger.debug(c({ err: t })), d.logger.error(c({
-          cerr: t,
+      } catch (i) {
+        return d.logger.debug(c({ err: i })), d.logger.error(c({
+          cerr: i,
           hashedSessionCookie: (n = this.sessionServer) == null ? void 0 : n.getHashOfSessionId(e)
         })), o.status(401).send(z);
       }
@@ -7356,8 +7378,8 @@ const K = class K {
    * @returns the reply from rendering the error page.
    * 
    */
-  static sendPageError(e, o, s, r, i) {
-    if (!r || !i)
+  static sendPageError(e, o, s, r, t) {
+    if (!r || !t)
       return d.logger.warn(c({
         msg: r,
         errorCode: g.UnknownError,
@@ -7371,15 +7393,15 @@ const K = class K {
         }
       ) : e.status(o).send(o == 401 ? z : G);
     try {
-      let n = 0, t = "UnknownError";
-      if ("isCrossAuthError" in i) {
-        const a = l.asCrossauthError(i);
-        n = a.code, t = a.name, r || (r = i.message);
+      let n = 0, i = "UnknownError";
+      if ("isCrossAuthError" in t) {
+        const a = l.asCrossauthError(t);
+        n = a.code, i = a.name, r || (r = t.message);
       }
-      return r || (o == 401 ? (r = "You are not authorized to access this page", n = g.Unauthorized, t = g[n]) : o == 403 ? (r = "You do not have permission to access this page", n = g.Forbidden, t = g[n]) : r = "An unknwon error has occurred"), d.logger.warn(c({
+      return r || (o == 401 ? (r = "You are not authorized to access this page", n = g.Unauthorized, i = g[n]) : o == 403 ? (r = "You do not have permission to access this page", n = g.Forbidden, i = g[n]) : r = "An unknwon error has occurred"), d.logger.warn(c({
         msg: r,
         errorCode: n,
-        errorCodeName: t,
+        errorCodeName: i,
         httpStatus: o
       })), s ? e.status(o).view(
         s,
@@ -7387,7 +7409,7 @@ const K = class K {
           status: o,
           errorMessage: r,
           errorCode: n,
-          errorCodeName: t
+          errorCodeName: i
         }
       ) : e.status(o).send(o == 401 ? z : G);
     } catch (n) {
@@ -7427,18 +7449,19 @@ const K = class K {
    * @returns true if the passed user is an admin, false otherwise.
    */
   static isAdmin(e) {
-    return K.isAdminFn(e);
+    return J.isAdminFn(e);
   }
   /**
    * Starts the Fastify app on the given port.  
    * @param port the port to listen on
    */
-  start(e = 3e3) {
+  start(e = 3e3, o = "0.0.0.0") {
     this.app.listen(
       { port: e },
       () => d.logger.info(c({
         msg: "Starting fastify server",
-        port: e
+        port: e,
+        hostname: o
       }))
     );
   }
@@ -7451,14 +7474,14 @@ const K = class K {
   getHashOfSessionId(e) {
     if (!e.sessionId) return "";
     try {
-      return F.hash(e.sessionId);
+      return N.hash(e.sessionId);
     } catch {
     }
     return "";
   }
 };
-u(K, "isAdminFn", rs);
-let y = K;
+u(J, "isAdminFn", rs);
+let y = J;
 class us {
 }
 export {
@@ -7470,7 +7493,7 @@ export {
   es as FastifyOAuthResourceServer,
   y as FastifyServer,
   us as FastifySessionAdapter,
-  Ke as FastifySessionServer,
+  Je as FastifySessionServer,
   Ge as FastifyUserClientEndpoints,
   De as FastifyUserEndpoints
 };