@hilbras/keystone 1.1.0

package/src/routes/serviceAccounts.ts

@@ -0,0 +1,124 @@
+import { z } from "zod";
+import type { FastifyInstance, FastifyRequest, FastifyReply } from "fastify";
+import {
+  createServiceAccount,
+  findServiceAccountsByOrgId,
+  findServiceAccountById,
+  updateServiceAccount,
+  listServiceAccountApiKeys,
+} from "../services/serviceAccounts.js";
+import { generateApiKey, hashApiKey } from "../services/tokens.js";
+
+const CreateSchema = z.object({
+  name: z.string().min(1).max(100),
+  description: z.string().max(500).optional(),
+});
+
+const UpdateSchema = z.object({
+  name: z.string().min(1).max(100).optional(),
+  description: z.string().max(500).optional(),
+  isActive: z.boolean().optional(),
+});
+
+const CreateKeySchema = z.object({
+  name: z.string().min(1).max(100),
+  scopes: z.array(z.string()).optional(),
+  expiresAt: z.string().datetime().optional(),
+});
+
+export default async function serviceAccountRoutes(app: FastifyInstance) {
+  app.post(
+    "/organizations/:id/service-accounts",
+    { preHandler: [app.requirePermission("service_account", "create")] },
+    async (request: FastifyRequest, reply: FastifyReply) => {
+      const { id } = request.params as { id: string };
+      const body = CreateSchema.parse(request.body);
+
+      const record = await createServiceAccount({
+        orgId: id,
+        name: body.name,
+        description: body.description,
+      });
+
+      await request.audit("service_account_created", { orgId: id, serviceAccountId: record.id });
+      return reply.status(201).send(record);
+    }
+  );
+
+  app.get(
+    "/organizations/:id/service-accounts",
+    { preHandler: [app.requirePermission("service_account", "read")] },
+    async (request: FastifyRequest) => {
+      const { id } = request.params as { id: string };
+      const accounts = await findServiceAccountsByOrgId(id);
+      return { serviceAccounts: accounts };
+    }
+  );
+
+  app.get(
+    "/organizations/:id/service-accounts/:accountId",
+    { preHandler: [app.requirePermission("service_account", "read")] },
+    async (request: FastifyRequest, reply: FastifyReply) => {
+      const { id, accountId } = request.params as { id: string; accountId: string };
+      const record = await findServiceAccountById(accountId, id);
+      if (!record) {
+        return reply.status(404).send({ error: "Service account not found" });
+      }
+      const keys = await listServiceAccountApiKeys(accountId);
+      return { ...record, apiKeys: keys };
+    }
+  );
+
+  app.patch(
+    "/organizations/:id/service-accounts/:accountId",
+    { preHandler: [app.requirePermission("service_account", "update")] },
+    async (request: FastifyRequest, reply: FastifyReply) => {
+      const { id, accountId } = request.params as { id: string; accountId: string };
+      const body = UpdateSchema.parse(request.body);
+
+      const updated = await updateServiceAccount(accountId, id, body);
+      if (!updated) {
+        return reply.status(404).send({ error: "Service account not found" });
+      }
+
+      await request.audit("service_account_updated", {
+        orgId: id,
+        serviceAccountId: updated.id,
+      });
+      return updated;
+    }
+  );
+
+  app.post(
+    "/organizations/:id/service-accounts/:accountId/api-keys",
+    { preHandler: [app.requirePermission("api_key", "create")] },
+    async (request: FastifyRequest, reply: FastifyReply) => {
+      const { id, accountId } = request.params as { id: string; accountId: string };
+      const body = CreateKeySchema.parse(request.body);
+
+      const account = await findServiceAccountById(accountId, id);
+      if (!account) {
+        return reply.status(404).send({ error: "Service account not found" });
+      }
+
+      const { key, prefix } = generateApiKey();
+      const record = await app.container.apiKeyRepository.create({
+        serviceAccountId: account.id,
+        orgId: id,
+        name: body.name,
+        prefix,
+        keyHash: hashApiKey(key),
+        scopes: body.scopes?.length ? body.scopes : ["api:read"],
+        expiresAt: body.expiresAt ? new Date(body.expiresAt) : null,
+      });
+
+      await request.audit("api_key_created", {
+        orgId: id,
+        serviceAccountId: account.id,
+        keyId: record.id,
+      });
+
+      return { key, apiKey: record };
+    }
+  );
+}

package/src/routes/sessions.ts

@@ -0,0 +1,62 @@
+import crypto from "node:crypto";
+import type { FastifyInstance, FastifyRequest, FastifyReply } from "fastify";
+import { config } from "../config.js";
+import { SessionRepository } from "../repositories/session.js";
+
+const sessions = new SessionRepository();
+
+function hashToken(token: string): string {
+  return crypto.createHash("sha256").update(token).digest("hex");
+}
+
+export default async function sessionRoutes(app: FastifyInstance) {
+  app.get("/sessions", { preHandler: [app.authenticate] }, async (request: FastifyRequest) => {
+    const userId = request.user?.id;
+    if (!userId) return { sessions: [] };
+    const list = await sessions.listByUser(userId);
+    return {
+      sessions: list.map((s) => ({
+        id: s.id,
+        deviceFingerprint: s.deviceFingerprint,
+        ipAddress: s.ipAddress,
+        userAgent: s.userAgent,
+        lastSeenAt: s.lastSeenAt,
+        expiresAt: s.expiresAt,
+        createdAt: s.createdAt,
+      })),
+    };
+  });
+
+  app.delete("/sessions/:id", { preHandler: [app.authenticate] }, async (request: FastifyRequest, reply: FastifyReply) => {
+    const userId = request.user?.id;
+    const { id } = request.params as { id: string };
+    if (!userId) return reply.status(401).send({ error: "Unauthorized" });
+
+    const session = await sessions.findById(id);
+    if (!session || session.userId !== userId) {
+      return reply.status(404).send({ error: "Session not found" });
+    }
+
+    await sessions.revokeRefreshToken(session.refreshTokenId);
+    await sessions.deleteById(id, userId);
+
+    await request.audit("session_revoked", { sessionId: id });
+    return { success: true };
+  });
+
+  app.post("/sessions/revoke-all", { preHandler: [app.authenticate] }, async (request: FastifyRequest, reply: FastifyReply) => {
+    const userId = request.user?.id;
+    if (!userId) return reply.status(401).send({ error: "Unauthorized" });
+
+    const currentRefreshToken = request.cookies?.[config.COOKIE_NAME];
+    let currentRefreshTokenId: string | undefined;
+    if (currentRefreshToken) {
+      const row = await sessions.findRefreshTokenByHash(hashToken(currentRefreshToken));
+      currentRefreshTokenId = row?.id;
+    }
+
+    await sessions.deleteAllForUser(userId, currentRefreshTokenId);
+    await request.audit("sessions_revoked_all", { exceptSessionId: currentRefreshTokenId });
+    return { success: true };
+  });
+}

package/src/routes/setup.ts

@@ -0,0 +1,315 @@
+import { z } from "zod";
+import type { FastifyInstance, FastifyRequest, FastifyReply } from "fastify";
+import { eq, count } from "drizzle-orm";
+import { migrate } from "drizzle-orm/postgres-js/migrator";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { db, initDb } from "../db/index.js";
+import { users } from "../db/schema.js";
+import { AuthenticationDomainService } from "../services/domain/authentication.js";
+import { DrizzleUserRepository, DrizzleApplicationRepository } from "../repositories/index.js";
+import { validateDatabase, validateRedis, validateEmail, validateSms } from "../services/setup/validation.js";
+import { createConfigWriter } from "../services/setup/configWriter.js";
+import { getSetupToken, validateSetupToken } from "../services/setup/token.js";
+import { runSetupDiagnostics } from "../services/setup/diagnostics.js";
+import { queue } from "../services/queue/index.js";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const SETUP_MARKER_PATH = path.resolve(__dirname, "../../.keystone-setup-complete");
+
+const SetupInitSchema = z.object({
+  email: z.string().email(),
+  password: z.string().min(8),
+  name: z.string().optional(),
+  username: z.string().optional(),
+});
+
+const ValidateDatabaseSchema = z.object({
+  databaseUrl: z.string().min(1),
+});
+
+const ValidateRedisSchema = z.object({
+  redisUrl: z.string().min(1),
+});
+
+const ValidateEmailSchema = z.object({
+  provider: z.enum(["none", "console", "smtp", "sendgrid", "mailgun"]),
+  from: z.string().email(),
+  smtpHost: z.string().optional(),
+  smtpPort: z.coerce.number().optional(),
+  smtpUser: z.string().optional(),
+  smtpPass: z.string().optional(),
+  smtpSecure: z.boolean().optional(),
+  sendgridApiKey: z.string().optional(),
+  mailgunApiKey: z.string().optional(),
+  mailgunDomain: z.string().optional(),
+  to: z.string().email(),
+});
+
+const ValidateSmsSchema = z.object({
+  provider: z.enum(["none", "console", "twilio"]),
+  twilioAccountSid: z.string().optional(),
+  twilioAuthToken: z.string().optional(),
+  twilioFromNumber: z.string().optional(),
+  twilioMessagingServiceSid: z.string().optional(),
+  to: z.string().min(1),
+});
+
+const SetupConfigSchema = z.object({
+  env: z.record(z.string()),
+});
+
+function parseBody<T>(schema: z.ZodSchema<T>, body: unknown, reply: FastifyReply): T | null {
+  const result = schema.safeParse(body);
+  if (!result.success) {
+    const issues = result.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ");
+    reply.status(400).send({ error: `Invalid input: ${issues}`, code: "VALIDATION_ERROR" });
+    return null;
+  }
+  return result.data;
+}
+
+async function hasNoUsers(): Promise<boolean> {
+  if (!db) return true;
+  try {
+    const [result] = await db.select({ total: count() }).from(users);
+    return (result?.total ?? 0) === 0;
+  } catch {
+    // Database exists but migrations have not run yet; setup is still required.
+    return true;
+  }
+}
+
+async function hasNoOwners(): Promise<boolean> {
+  if (!db) return true;
+  try {
+    const [result] = await db.select({ total: count() }).from(users).where(eq(users.role, "owner"));
+    return (result?.total ?? 0) === 0;
+  } catch {
+    return true;
+  }
+}
+
+async function ensureDbInitialized(request: FastifyRequest, reply: FastifyReply): Promise<boolean> {
+  if (db) return true;
+  try {
+    const writer = createConfigWriter();
+    const values = await writer.read();
+    const databaseUrl = values.DATABASE_URL;
+    if (!databaseUrl) {
+      request.log.warn({ configKeys: Object.keys(values) }, "DATABASE_URL missing when initializing database");
+      reply.status(400).send({ error: "DATABASE_URL is not configured. Apply configuration first.", code: "DATABASE_URL_MISSING" });
+      return false;
+    }
+    process.env.DATABASE_URL = databaseUrl;
+    initDb();
+    return true;
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    request.log.error({ err }, "Database initialization failed");
+    reply.status(500).send({ error: message, code: "DB_INIT_FAILED" });
+    return false;
+  }
+}
+
+function assertSetupToken(request: FastifyRequest, reply: FastifyReply): boolean {
+  const token = request.headers["x-setup-token"] as string | undefined;
+  if (!validateSetupToken(token)) {
+    request.log.warn(
+      { hasToken: Boolean(token), tokenLength: token?.length, expectedLength: getSetupToken()?.length },
+      "Invalid or missing setup token"
+    );
+    reply.status(401).send({ error: "Invalid or missing setup token" });
+    return false;
+  }
+  return true;
+}
+
+export default async function setupRoutes(app: FastifyInstance) {
+  app.get("/status", async () => {
+    return {
+      needsSetup: await hasNoOwners(),
+      setupToken: Boolean(getSetupToken()),
+    };
+  });
+
+  app.get("/diagnostics", async (request: FastifyRequest, reply: FastifyReply) => {
+    if (!assertSetupToken(request, reply)) return;
+    const checks = await runSetupDiagnostics();
+    return { checks, ready: checks.every((c) => c.status === "ok" || c.status === "skipped") };
+  });
+
+  app.post("/config/dry-run", async (request: FastifyRequest, reply: FastifyReply) => {
+    if (!assertSetupToken(request, reply)) return;
+    const body = parseBody(SetupConfigSchema, request.body, reply);
+    if (!body) return;
+
+    const writer = createConfigWriter();
+    const existing = await writer.read();
+    const merged = { ...existing, ...body.env };
+
+    const validationErrors: string[] = [];
+    if (!merged.DATABASE_URL) validationErrors.push("DATABASE_URL is required");
+    if (!merged.REDIS_URL) validationErrors.push("REDIS_URL is required");
+    if (!merged.AUTH_API_PUBLIC_URL) validationErrors.push("AUTH_API_PUBLIC_URL is required");
+
+    return {
+      ok: validationErrors.length === 0,
+      validationErrors,
+      wouldWrite: Object.keys(body.env),
+      mergedPreview: Object.fromEntries(
+        Object.entries(merged).map(([k, v]) => [k, k.includes("KEY") || k.includes("SECRET") || k.includes("PASS") ? "***" : v])
+      ),
+    };
+  });
+
+  app.post("/validate/db", async (request: FastifyRequest, reply: FastifyReply) => {
+    if (!assertSetupToken(request, reply)) return;
+    const body = parseBody(ValidateDatabaseSchema, request.body, reply);
+    if (!body) return;
+    const result = await validateDatabase(body);
+    if (!result.success) {
+      request.log.warn({ code: result.error.code, message: result.error.message }, "Database validation failed");
+      return reply.status(result.error.statusCode || 400).send({ error: result.error.message, code: result.error.code });
+    }
+    return { ok: true };
+  });
+
+  app.post("/validate/redis", async (request: FastifyRequest, reply: FastifyReply) => {
+    if (!assertSetupToken(request, reply)) return;
+    const body = parseBody(ValidateRedisSchema, request.body, reply);
+    if (!body) return;
+    const result = await validateRedis(body);
+    if (!result.success) {
+      request.log.warn({ code: result.error.code, message: result.error.message }, "Redis validation failed");
+      return reply.status(result.error.statusCode || 400).send({ error: result.error.message, code: result.error.code });
+    }
+    return { ok: true };
+  });
+
+  app.post("/validate/email", async (request: FastifyRequest, reply: FastifyReply) => {
+    if (!assertSetupToken(request, reply)) return;
+    const body = parseBody(ValidateEmailSchema, request.body, reply);
+    if (!body) return;
+    const { to, ...input } = body;
+    const result = await validateEmail(input, to);
+    if (!result.success) {
+      return reply.status(result.error.statusCode || 400).send({ error: result.error.message, code: result.error.code });
+    }
+    return { ok: true };
+  });
+
+  app.post("/validate/sms", async (request: FastifyRequest, reply: FastifyReply) => {
+    if (!assertSetupToken(request, reply)) return;
+    const body = parseBody(ValidateSmsSchema, request.body, reply);
+    if (!body) return;
+    const { to, ...input } = body;
+    const result = await validateSms(input, to);
+    if (!result.success) {
+      return reply.status(result.error.statusCode || 400).send({ error: result.error.message, code: result.error.code });
+    }
+    return { ok: true };
+  });
+
+  app.post("/config", async (request: FastifyRequest, reply: FastifyReply) => {
+    if (!assertSetupToken(request, reply)) return;
+
+    const body = parseBody(SetupConfigSchema, request.body, reply);
+    if (!body) return;
+    const writer = createConfigWriter();
+
+    const backup = await writer.backup();
+    if (!backup.success) {
+      return reply.status(backup.error.statusCode || 500).send({ error: backup.error.message, code: backup.error.code });
+    }
+
+    const writeResult = await writer.write(body.env);
+    if (!writeResult.success) {
+      return reply.status(writeResult.error.statusCode || 500).send({ error: writeResult.error.message, code: writeResult.error.code });
+    }
+
+    return { ok: true, backupPath: backup.data || undefined };
+  });
+
+  app.post("/migrate", async (request: FastifyRequest, reply: FastifyReply) => {
+    if (!assertSetupToken(request, reply)) return;
+    if (!(await ensureDbInitialized(request, reply))) return;
+    try {
+      await migrate(db, { migrationsFolder: path.resolve(__dirname, "../db/migrations") });
+      return { ok: true };
+    } catch (err) {
+      request.log.error({ err }, "Migration failed");
+      const message = err instanceof Error ? err.message : String(err);
+      return reply.status(500).send({ error: message, code: "MIGRATION_FAILED" });
+    }
+  });
+
+  app.post("/restart", async (request: FastifyRequest, reply: FastifyReply) => {
+    if (!assertSetupToken(request, reply)) return;
+    reply.status(202).send({ ok: true, message: "Server is restarting" });
+    try {
+      await queue.close?.();
+    } catch {
+      // ignore
+    }
+    setTimeout(() => process.exit(0), 500);
+  });
+
+  app.post("/init", async (request: FastifyRequest, reply: FastifyReply) => {
+    if (!assertSetupToken(request, reply)) return;
+    if (!(await ensureDbInitialized(request, reply))) return;
+    if (!(await hasNoOwners())) {
+      return reply.status(403).send({ error: "Setup has already been completed" });
+    }
+
+    const body = parseBody(SetupInitSchema, request.body, reply);
+    if (!body) return;
+
+    // If a user with this email already exists (e.g. from an interrupted setup),
+    // promote them to owner instead of failing with a duplicate-key error.
+    const [existing] = await db.select().from(users).where(eq(users.email, body.email)).limit(1);
+
+    let ownerUser;
+    if (existing) {
+      await db.update(users).set({ role: "owner" }).where(eq(users.id, existing.id));
+      ownerUser = existing;
+    } else {
+      const authService = new AuthenticationDomainService(new DrizzleUserRepository(), new DrizzleApplicationRepository());
+      const result = await authService.register({
+        email: body.email,
+        password: body.password,
+        name: body.name,
+        username:
+          body.username ||
+          body.email
+            .split("@")[0]
+            .toLowerCase()
+            .replace(/[^a-z0-9_-]/g, "-")
+            .slice(0, 32),
+      });
+
+      if (!result.success) {
+        return reply.status(400).send({ error: result.error.message });
+      }
+
+      await db.update(users).set({ role: "owner" }).where(eq(users.id, result.data.user.id));
+      ownerUser = result.data.user;
+    }
+
+    try {
+      await fs.writeFile(SETUP_MARKER_PATH, new Date().toISOString(), "utf-8");
+    } catch (err) {
+      request.log.warn({ err }, "Could not write setup completion marker");
+    }
+
+    return {
+      user: {
+        id: ownerUser.id,
+        email: ownerUser.email,
+        username: ownerUser.username,
+        role: "owner",
+      },
+    };
+  });
+}

package/src/routes/smsOtp.ts

@@ -0,0 +1,67 @@
+import { z } from "zod";
+import type { FastifyInstance, FastifyRequest, FastifyReply } from "fastify";
+import { sendSmsOtp, verifySmsOtp, markPhoneVerified } from "../services/smsOtp.js";
+import { rateLimit } from "../plugins/rateLimit.js";
+
+const SendSchema = z.object({
+  phoneNumber: z.string().min(5).max(32),
+});
+
+const VerifySchema = z.object({
+  phoneNumber: z.string().min(5).max(32),
+  code: z.string().min(4).max(8),
+});
+
+export default async function smsOtpRoutes(app: FastifyInstance) {
+  app.post(
+    "/sms-otp/send",
+    {
+      preHandler: [
+        app.authenticate,
+        rateLimit({
+          keyPrefix: "sms-otp-send",
+          maxAttempts: 3,
+          windowSeconds: 300,
+        }),
+      ],
+    },
+    async (request: FastifyRequest, reply: FastifyReply) => {
+      const user = request.user!;
+      const body = SendSchema.parse(request.body);
+
+      await sendSmsOtp(user, body.phoneNumber);
+      await request.audit("sms_otp_sent", { userId: user.id, phoneNumber: body.phoneNumber });
+
+      return { success: true };
+    }
+  );
+
+  app.post(
+    "/sms-otp/verify",
+    {
+      preHandler: [
+        app.authenticate,
+        rateLimit({
+          keyPrefix: "sms-otp-verify",
+          maxAttempts: 5,
+          windowSeconds: 300,
+        }),
+      ],
+    },
+    async (request: FastifyRequest, reply: FastifyReply) => {
+      const user = request.user!;
+      const body = VerifySchema.parse(request.body);
+
+      const valid = await verifySmsOtp(user.id, body.code);
+      if (!valid) {
+        await request.audit("sms_otp_verify_failed", { userId: user.id });
+        return reply.status(400).send({ error: "Invalid or expired code" });
+      }
+
+      await markPhoneVerified(user.id, body.phoneNumber);
+      await request.audit("sms_otp_verified", { userId: user.id, phoneNumber: body.phoneNumber });
+
+      return { success: true };
+    }
+  );
+}

package/src/routes/totp.ts

@@ -0,0 +1,122 @@
+import { z } from "zod";
+import type { FastifyInstance, FastifyRequest, FastifyReply } from "fastify";
+import { config } from "../config.js";
+import {
+  generateSecret,
+  buildProvisioningUri,
+  verifyTOTP,
+  encryptSecret,
+  decryptSecret,
+  generateBackupCodes,
+  storeBackupCodes,
+  verifyBackupCode,
+} from "../services/totp.js";
+
+const CodeSchema = z.object({
+  code: z.string().min(6).max(8),
+});
+
+const BackupCodeSchema = z.object({
+  code: z.string().min(8).max(16),
+});
+
+export default async function totpRoutes(app: FastifyInstance) {
+  app.post(
+    "/totp/enroll",
+    { preHandler: [app.authenticate] },
+    async (request: FastifyRequest, reply: FastifyReply) => {
+      const user = request.user!;
+      if (user.totpEnabled) {
+        return reply.status(409).send({ error: "TOTP already enrolled" });
+      }
+
+      const secret = generateSecret();
+      const encrypted = encryptSecret(secret);
+      const { codes, hashes } = generateBackupCodes();
+
+      await app.container.userRepository.setTotpSecret(user.id, encrypted);
+      await storeBackupCodes(user.id, hashes);
+
+      const provisioningUri = buildProvisioningUri({
+        secret,
+        email: user.email,
+        issuer: config.TOTP_ISSUER,
+      });
+
+      await request.audit("totp_enrolled", { userId: user.id });
+
+      return {
+        secret,
+        provisioningUri,
+        backupCodes: codes,
+      };
+    }
+  );
+
+  app.post(
+    "/totp/backup",
+    { preHandler: [app.authenticate] },
+    async (request: FastifyRequest, reply: FastifyReply) => {
+      const user = request.user!;
+      if (!user.totpSecret || !user.totpEnabled) {
+        return reply.status(400).send({ error: "TOTP not enabled" });
+      }
+
+      const body = BackupCodeSchema.parse(request.body);
+      const valid = await verifyBackupCode(user.id, body.code);
+      if (!valid) {
+        await request.audit("totp_verify_failed", { userId: user.id, method: "backup_code" });
+        return reply.status(400).send({ error: "Invalid backup code" });
+      }
+
+      await request.audit("totp_enabled", { userId: user.id, method: "backup_code" });
+      return { success: true };
+    }
+  );
+
+  app.post(
+    "/totp/verify",
+    { preHandler: [app.authenticate] },
+    async (request: FastifyRequest, reply: FastifyReply) => {
+      const user = request.user!;
+      if (!user.totpSecret) {
+        return reply.status(400).send({ error: "TOTP not enrolled" });
+      }
+
+      const body = CodeSchema.parse(request.body);
+      const secret = decryptSecret(user.totpSecret);
+      if (!verifyTOTP(secret, body.code)) {
+        await request.audit("totp_verify_failed", { userId: user.id });
+        return reply.status(400).send({ error: "Invalid code" });
+      }
+
+      await app.container.userRepository.enableTotp(user.id);
+      await request.audit("totp_enabled", { userId: user.id });
+
+      return { success: true };
+    }
+  );
+
+  app.post(
+    "/totp/disable",
+    { preHandler: [app.authenticate] },
+    async (request: FastifyRequest, reply: FastifyReply) => {
+      const user = request.user!;
+      if (!user.totpSecret || !user.totpEnabled) {
+        return reply.status(400).send({ error: "TOTP not enabled" });
+      }
+
+      const body = CodeSchema.parse(request.body);
+      const secret = decryptSecret(user.totpSecret);
+      if (!verifyTOTP(secret, body.code)) {
+        await request.audit("totp_disable_failed", { userId: user.id });
+        return reply.status(400).send({ error: "Invalid code" });
+      }
+
+      await app.container.userRepository.disableTotp(user.id);
+      await request.audit("totp_disabled", { userId: user.id });
+
+      return { success: true };
+    }
+  );
+}