@hilbras/keystone 1.6.0 → 2.5.0

package/src/routes/serviceAccounts.ts

@@ -1,124 +0,0 @@
-import { z } from "zod";
-import type { FastifyInstance, FastifyRequest, FastifyReply } from "fastify";
-import {
-  createServiceAccount,
-  findServiceAccountsByOrgId,
-  findServiceAccountById,
-  updateServiceAccount,
-  listServiceAccountApiKeys,
-} from "../services/serviceAccounts.js";
-import { generateApiKey, hashApiKey } from "../services/tokens.js";
-
-const CreateSchema = z.object({
-  name: z.string().min(1).max(100),
-  description: z.string().max(500).optional(),
-});
-
-const UpdateSchema = z.object({
-  name: z.string().min(1).max(100).optional(),
-  description: z.string().max(500).optional(),
-  isActive: z.boolean().optional(),
-});
-
-const CreateKeySchema = z.object({
-  name: z.string().min(1).max(100),
-  scopes: z.array(z.string()).optional(),
-  expiresAt: z.string().datetime().optional(),
-});
-
-export default async function serviceAccountRoutes(app: FastifyInstance) {
-  app.post(
-    "/organizations/:id/service-accounts",
-    { preHandler: [app.requirePermission("service_account", "create")] },
-    async (request: FastifyRequest, reply: FastifyReply) => {
-      const { id } = request.params as { id: string };
-      const body = CreateSchema.parse(request.body);
-
-      const record = await createServiceAccount({
-        orgId: id,
-        name: body.name,
-        description: body.description,
-      });
-
-      await request.audit("service_account_created", { orgId: id, serviceAccountId: record.id });
-      return reply.status(201).send(record);
-    }
-  );
-
-  app.get(
-    "/organizations/:id/service-accounts",
-    { preHandler: [app.requirePermission("service_account", "read")] },
-    async (request: FastifyRequest) => {
-      const { id } = request.params as { id: string };
-      const accounts = await findServiceAccountsByOrgId(id);
-      return { serviceAccounts: accounts };
-    }
-  );
-
-  app.get(
-    "/organizations/:id/service-accounts/:accountId",
-    { preHandler: [app.requirePermission("service_account", "read")] },
-    async (request: FastifyRequest, reply: FastifyReply) => {
-      const { id, accountId } = request.params as { id: string; accountId: string };
-      const record = await findServiceAccountById(accountId, id);
-      if (!record) {
-        return reply.status(404).send({ error: "Service account not found" });
-      }
-      const keys = await listServiceAccountApiKeys(accountId);
-      return { ...record, apiKeys: keys };
-    }
-  );
-
-  app.patch(
-    "/organizations/:id/service-accounts/:accountId",
-    { preHandler: [app.requirePermission("service_account", "update")] },
-    async (request: FastifyRequest, reply: FastifyReply) => {
-      const { id, accountId } = request.params as { id: string; accountId: string };
-      const body = UpdateSchema.parse(request.body);
-
-      const updated = await updateServiceAccount(accountId, id, body);
-      if (!updated) {
-        return reply.status(404).send({ error: "Service account not found" });
-      }
-
-      await request.audit("service_account_updated", {
-        orgId: id,
-        serviceAccountId: updated.id,
-      });
-      return updated;
-    }
-  );
-
-  app.post(
-    "/organizations/:id/service-accounts/:accountId/api-keys",
-    { preHandler: [app.requirePermission("api_key", "create")] },
-    async (request: FastifyRequest, reply: FastifyReply) => {
-      const { id, accountId } = request.params as { id: string; accountId: string };
-      const body = CreateKeySchema.parse(request.body);
-
-      const account = await findServiceAccountById(accountId, id);
-      if (!account) {
-        return reply.status(404).send({ error: "Service account not found" });
-      }
-
-      const { key, prefix } = generateApiKey();
-      const record = await app.container.apiKeyRepository.create({
-        serviceAccountId: account.id,
-        orgId: id,
-        name: body.name,
-        prefix,
-        keyHash: hashApiKey(key),
-        scopes: body.scopes?.length ? body.scopes : ["api:read"],
-        expiresAt: body.expiresAt ? new Date(body.expiresAt) : null,
-      });
-
-      await request.audit("api_key_created", {
-        orgId: id,
-        serviceAccountId: account.id,
-        keyId: record.id,
-      });
-
-      return { key, apiKey: record };
-    }
-  );
-}

package/src/routes/sessions.ts

@@ -1,62 +0,0 @@
-import crypto from "node:crypto";
-import type { FastifyInstance, FastifyRequest, FastifyReply } from "fastify";
-import { config } from "../config.js";
-import { SessionRepository } from "../repositories/session.js";
-
-const sessions = new SessionRepository();
-
-function hashToken(token: string): string {
-  return crypto.createHash("sha256").update(token).digest("hex");
-}
-
-export default async function sessionRoutes(app: FastifyInstance) {
-  app.get("/sessions", { preHandler: [app.authenticate] }, async (request: FastifyRequest) => {
-    const userId = request.user?.id;
-    if (!userId) return { sessions: [] };
-    const list = await sessions.listByUser(userId);
-    return {
-      sessions: list.map((s) => ({
-        id: s.id,
-        deviceFingerprint: s.deviceFingerprint,
-        ipAddress: s.ipAddress,
-        userAgent: s.userAgent,
-        lastSeenAt: s.lastSeenAt,
-        expiresAt: s.expiresAt,
-        createdAt: s.createdAt,
-      })),
-    };
-  });
-
-  app.delete("/sessions/:id", { preHandler: [app.authenticate] }, async (request: FastifyRequest, reply: FastifyReply) => {
-    const userId = request.user?.id;
-    const { id } = request.params as { id: string };
-    if (!userId) return reply.status(401).send({ error: "Unauthorized" });
-
-    const session = await sessions.findById(id);
-    if (!session || session.userId !== userId) {
-      return reply.status(404).send({ error: "Session not found" });
-    }
-
-    await sessions.revokeRefreshToken(session.refreshTokenId);
-    await sessions.deleteById(id, userId);
-
-    await request.audit("session_revoked", { sessionId: id });
-    return { success: true };
-  });
-
-  app.post("/sessions/revoke-all", { preHandler: [app.authenticate] }, async (request: FastifyRequest, reply: FastifyReply) => {
-    const userId = request.user?.id;
-    if (!userId) return reply.status(401).send({ error: "Unauthorized" });
-
-    const currentRefreshToken = request.cookies?.[config.COOKIE_NAME];
-    let currentRefreshTokenId: string | undefined;
-    if (currentRefreshToken) {
-      const row = await sessions.findRefreshTokenByHash(hashToken(currentRefreshToken));
-      currentRefreshTokenId = row?.id;
-    }
-
-    await sessions.deleteAllForUser(userId, currentRefreshTokenId);
-    await request.audit("sessions_revoked_all", { exceptSessionId: currentRefreshTokenId });
-    return { success: true };
-  });
-}

package/src/routes/setup.ts

@@ -1,315 +0,0 @@
-import { z } from "zod";
-import type { FastifyInstance, FastifyRequest, FastifyReply } from "fastify";
-import { eq, count } from "drizzle-orm";
-import { migrate } from "drizzle-orm/postgres-js/migrator";
-import fs from "node:fs/promises";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import { db, initDb } from "../db/index.js";
-import { users } from "../db/schema.js";
-import { AuthenticationDomainService } from "../services/domain/authentication.js";
-import { DrizzleUserRepository, DrizzleApplicationRepository } from "../repositories/index.js";
-import { validateDatabase, validateRedis, validateEmail, validateSms } from "../services/setup/validation.js";
-import { createConfigWriter } from "../services/setup/configWriter.js";
-import { getSetupToken, validateSetupToken } from "../services/setup/token.js";
-import { runSetupDiagnostics } from "../services/setup/diagnostics.js";
-import { queue } from "../services/queue/index.js";
-
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
-const SETUP_MARKER_PATH = path.resolve(__dirname, "../../.keystone-setup-complete");
-
-const SetupInitSchema = z.object({
-  email: z.string().email(),
-  password: z.string().min(8),
-  name: z.string().optional(),
-  username: z.string().optional(),
-});
-
-const ValidateDatabaseSchema = z.object({
-  databaseUrl: z.string().min(1),
-});
-
-const ValidateRedisSchema = z.object({
-  redisUrl: z.string().min(1),
-});
-
-const ValidateEmailSchema = z.object({
-  provider: z.enum(["none", "console", "smtp", "sendgrid", "mailgun"]),
-  from: z.string().email(),
-  smtpHost: z.string().optional(),
-  smtpPort: z.coerce.number().optional(),
-  smtpUser: z.string().optional(),
-  smtpPass: z.string().optional(),
-  smtpSecure: z.boolean().optional(),
-  sendgridApiKey: z.string().optional(),
-  mailgunApiKey: z.string().optional(),
-  mailgunDomain: z.string().optional(),
-  to: z.string().email(),
-});
-
-const ValidateSmsSchema = z.object({
-  provider: z.enum(["none", "console", "twilio"]),
-  twilioAccountSid: z.string().optional(),
-  twilioAuthToken: z.string().optional(),
-  twilioFromNumber: z.string().optional(),
-  twilioMessagingServiceSid: z.string().optional(),
-  to: z.string().min(1),
-});
-
-const SetupConfigSchema = z.object({
-  env: z.record(z.string(), z.string()),
-});
-
-function parseBody<T>(schema: z.ZodSchema<T>, body: unknown, reply: FastifyReply): T | null {
-  const result = schema.safeParse(body);
-  if (!result.success) {
-    const issues = result.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ");
-    reply.status(400).send({ error: `Invalid input: ${issues}`, code: "VALIDATION_ERROR" });
-    return null;
-  }
-  return result.data;
-}
-
-async function hasNoUsers(): Promise<boolean> {
-  if (!db) return true;
-  try {
-    const [result] = await db.select({ total: count() }).from(users);
-    return (result?.total ?? 0) === 0;
-  } catch {
-    // Database exists but migrations have not run yet; setup is still required.
-    return true;
-  }
-}
-
-async function hasNoOwners(): Promise<boolean> {
-  if (!db) return true;
-  try {
-    const [result] = await db.select({ total: count() }).from(users).where(eq(users.role, "owner"));
-    return (result?.total ?? 0) === 0;
-  } catch {
-    return true;
-  }
-}
-
-async function ensureDbInitialized(request: FastifyRequest, reply: FastifyReply): Promise<boolean> {
-  if (db) return true;
-  try {
-    const writer = createConfigWriter();
-    const values = await writer.read();
-    const databaseUrl = values.DATABASE_URL;
-    if (!databaseUrl) {
-      request.log.warn({ configKeys: Object.keys(values) }, "DATABASE_URL missing when initializing database");
-      reply.status(400).send({ error: "DATABASE_URL is not configured. Apply configuration first.", code: "DATABASE_URL_MISSING" });
-      return false;
-    }
-    process.env.DATABASE_URL = databaseUrl;
-    initDb();
-    return true;
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    request.log.error({ err }, "Database initialization failed");
-    reply.status(500).send({ error: message, code: "DB_INIT_FAILED" });
-    return false;
-  }
-}
-
-function assertSetupToken(request: FastifyRequest, reply: FastifyReply): boolean {
-  const token = request.headers["x-setup-token"] as string | undefined;
-  if (!validateSetupToken(token)) {
-    request.log.warn(
-      { hasToken: Boolean(token), tokenLength: token?.length, expectedLength: getSetupToken()?.length },
-      "Invalid or missing setup token"
-    );
-    reply.status(401).send({ error: "Invalid or missing setup token" });
-    return false;
-  }
-  return true;
-}
-
-export default async function setupRoutes(app: FastifyInstance) {
-  app.get("/status", async () => {
-    return {
-      needsSetup: await hasNoOwners(),
-      setupToken: Boolean(getSetupToken()),
-    };
-  });
-
-  app.get("/diagnostics", async (request: FastifyRequest, reply: FastifyReply) => {
-    if (!assertSetupToken(request, reply)) return;
-    const checks = await runSetupDiagnostics();
-    return { checks, ready: checks.every((c) => c.status === "ok" || c.status === "skipped") };
-  });
-
-  app.post("/config/dry-run", async (request: FastifyRequest, reply: FastifyReply) => {
-    if (!assertSetupToken(request, reply)) return;
-    const body = parseBody(SetupConfigSchema, request.body, reply);
-    if (!body) return;
-
-    const writer = createConfigWriter();
-    const existing = await writer.read();
-    const merged = { ...existing, ...body.env };
-
-    const validationErrors: string[] = [];
-    if (!merged.DATABASE_URL) validationErrors.push("DATABASE_URL is required");
-    if (!merged.REDIS_URL) validationErrors.push("REDIS_URL is required");
-    if (!merged.AUTH_API_PUBLIC_URL) validationErrors.push("AUTH_API_PUBLIC_URL is required");
-
-    return {
-      ok: validationErrors.length === 0,
-      validationErrors,
-      wouldWrite: Object.keys(body.env),
-      mergedPreview: Object.fromEntries(
-        Object.entries(merged).map(([k, v]) => [k, k.includes("KEY") || k.includes("SECRET") || k.includes("PASS") ? "***" : v])
-      ),
-    };
-  });
-
-  app.post("/validate/db", async (request: FastifyRequest, reply: FastifyReply) => {
-    if (!assertSetupToken(request, reply)) return;
-    const body = parseBody(ValidateDatabaseSchema, request.body, reply);
-    if (!body) return;
-    const result = await validateDatabase(body);
-    if (!result.success) {
-      request.log.warn({ code: result.error.code, message: result.error.message }, "Database validation failed");
-      return reply.status(result.error.statusCode || 400).send({ error: result.error.message, code: result.error.code });
-    }
-    return { ok: true };
-  });
-
-  app.post("/validate/redis", async (request: FastifyRequest, reply: FastifyReply) => {
-    if (!assertSetupToken(request, reply)) return;
-    const body = parseBody(ValidateRedisSchema, request.body, reply);
-    if (!body) return;
-    const result = await validateRedis(body);
-    if (!result.success) {
-      request.log.warn({ code: result.error.code, message: result.error.message }, "Redis validation failed");
-      return reply.status(result.error.statusCode || 400).send({ error: result.error.message, code: result.error.code });
-    }
-    return { ok: true };
-  });
-
-  app.post("/validate/email", async (request: FastifyRequest, reply: FastifyReply) => {
-    if (!assertSetupToken(request, reply)) return;
-    const body = parseBody(ValidateEmailSchema, request.body, reply);
-    if (!body) return;
-    const { to, ...input } = body;
-    const result = await validateEmail(input, to);
-    if (!result.success) {
-      return reply.status(result.error.statusCode || 400).send({ error: result.error.message, code: result.error.code });
-    }
-    return { ok: true };
-  });
-
-  app.post("/validate/sms", async (request: FastifyRequest, reply: FastifyReply) => {
-    if (!assertSetupToken(request, reply)) return;
-    const body = parseBody(ValidateSmsSchema, request.body, reply);
-    if (!body) return;
-    const { to, ...input } = body;
-    const result = await validateSms(input, to);
-    if (!result.success) {
-      return reply.status(result.error.statusCode || 400).send({ error: result.error.message, code: result.error.code });
-    }
-    return { ok: true };
-  });
-
-  app.post("/config", async (request: FastifyRequest, reply: FastifyReply) => {
-    if (!assertSetupToken(request, reply)) return;
-
-    const body = parseBody(SetupConfigSchema, request.body, reply);
-    if (!body) return;
-    const writer = createConfigWriter();
-
-    const backup = await writer.backup();
-    if (!backup.success) {
-      return reply.status(backup.error.statusCode || 500).send({ error: backup.error.message, code: backup.error.code });
-    }
-
-    const writeResult = await writer.write(body.env);
-    if (!writeResult.success) {
-      return reply.status(writeResult.error.statusCode || 500).send({ error: writeResult.error.message, code: writeResult.error.code });
-    }
-
-    return { ok: true, backupPath: backup.data || undefined };
-  });
-
-  app.post("/migrate", async (request: FastifyRequest, reply: FastifyReply) => {
-    if (!assertSetupToken(request, reply)) return;
-    if (!(await ensureDbInitialized(request, reply))) return;
-    try {
-      await migrate(db, { migrationsFolder: path.resolve(__dirname, "../db/migrations") });
-      return { ok: true };
-    } catch (err) {
-      request.log.error({ err }, "Migration failed");
-      const message = err instanceof Error ? err.message : String(err);
-      return reply.status(500).send({ error: message, code: "MIGRATION_FAILED" });
-    }
-  });
-
-  app.post("/restart", async (request: FastifyRequest, reply: FastifyReply) => {
-    if (!assertSetupToken(request, reply)) return;
-    reply.status(202).send({ ok: true, message: "Server is restarting" });
-    try {
-      await queue.close?.();
-    } catch {
-      // ignore
-    }
-    setTimeout(() => process.exit(0), 500);
-  });
-
-  app.post("/init", async (request: FastifyRequest, reply: FastifyReply) => {
-    if (!assertSetupToken(request, reply)) return;
-    if (!(await ensureDbInitialized(request, reply))) return;
-    if (!(await hasNoOwners())) {
-      return reply.status(403).send({ error: "Setup has already been completed" });
-    }
-
-    const body = parseBody(SetupInitSchema, request.body, reply);
-    if (!body) return;
-
-    // If a user with this email already exists (e.g. from an interrupted setup),
-    // promote them to owner instead of failing with a duplicate-key error.
-    const [existing] = await db.select().from(users).where(eq(users.email, body.email)).limit(1);
-
-    let ownerUser;
-    if (existing) {
-      await db.update(users).set({ role: "owner" }).where(eq(users.id, existing.id));
-      ownerUser = existing;
-    } else {
-      const authService = new AuthenticationDomainService(new DrizzleUserRepository(), new DrizzleApplicationRepository());
-      const result = await authService.register({
-        email: body.email,
-        password: body.password,
-        name: body.name,
-        username:
-          body.username ||
-          body.email
-            .split("@")[0]
-            .toLowerCase()
-            .replace(/[^a-z0-9_-]/g, "-")
-            .slice(0, 32),
-      });
-
-      if (!result.success) {
-        return reply.status(400).send({ error: result.error.message });
-      }
-
-      await db.update(users).set({ role: "owner" }).where(eq(users.id, result.data.user.id));
-      ownerUser = result.data.user;
-    }
-
-    try {
-      await fs.writeFile(SETUP_MARKER_PATH, new Date().toISOString(), "utf-8");
-    } catch (err) {
-      request.log.warn({ err }, "Could not write setup completion marker");
-    }
-
-    return {
-      user: {
-        id: ownerUser.id,
-        email: ownerUser.email,
-        username: ownerUser.username,
-        role: "owner",
-      },
-    };
-  });
-}

package/src/routes/smsOtp.ts

@@ -1,67 +0,0 @@
-import { z } from "zod";
-import type { FastifyInstance, FastifyRequest, FastifyReply } from "fastify";
-import { sendSmsOtp, verifySmsOtp, markPhoneVerified } from "../services/smsOtp.js";
-import { rateLimit } from "../plugins/rateLimit.js";
-
-const SendSchema = z.object({
-  phoneNumber: z.string().min(5).max(32),
-});
-
-const VerifySchema = z.object({
-  phoneNumber: z.string().min(5).max(32),
-  code: z.string().min(4).max(8),
-});
-
-export default async function smsOtpRoutes(app: FastifyInstance) {
-  app.post(
-    "/sms-otp/send",
-    {
-      preHandler: [
-        app.authenticate,
-        rateLimit({
-          keyPrefix: "sms-otp-send",
-          maxAttempts: 3,
-          windowSeconds: 300,
-        }),
-      ],
-    },
-    async (request: FastifyRequest, reply: FastifyReply) => {
-      const user = request.user!;
-      const body = SendSchema.parse(request.body);
-
-      await sendSmsOtp(user, body.phoneNumber);
-      await request.audit("sms_otp_sent", { userId: user.id, phoneNumber: body.phoneNumber });
-
-      return { success: true };
-    }
-  );
-
-  app.post(
-    "/sms-otp/verify",
-    {
-      preHandler: [
-        app.authenticate,
-        rateLimit({
-          keyPrefix: "sms-otp-verify",
-          maxAttempts: 5,
-          windowSeconds: 300,
-        }),
-      ],
-    },
-    async (request: FastifyRequest, reply: FastifyReply) => {
-      const user = request.user!;
-      const body = VerifySchema.parse(request.body);
-
-      const valid = await verifySmsOtp(user.id, body.code);
-      if (!valid) {
-        await request.audit("sms_otp_verify_failed", { userId: user.id });
-        return reply.status(400).send({ error: "Invalid or expired code" });
-      }
-
-      await markPhoneVerified(user.id, body.phoneNumber);
-      await request.audit("sms_otp_verified", { userId: user.id, phoneNumber: body.phoneNumber });
-
-      return { success: true };
-    }
-  );
-}

package/src/routes/totp.ts

@@ -1,122 +0,0 @@
-import { z } from "zod";
-import type { FastifyInstance, FastifyRequest, FastifyReply } from "fastify";
-import { config } from "../config.js";
-import {
-  generateSecret,
-  buildProvisioningUri,
-  verifyTOTP,
-  encryptSecret,
-  decryptSecret,
-  generateBackupCodes,
-  storeBackupCodes,
-  verifyBackupCode,
-} from "../services/totp.js";
-
-const CodeSchema = z.object({
-  code: z.string().min(6).max(8),
-});
-
-const BackupCodeSchema = z.object({
-  code: z.string().min(8).max(16),
-});
-
-export default async function totpRoutes(app: FastifyInstance) {
-  app.post(
-    "/totp/enroll",
-    { preHandler: [app.authenticate] },
-    async (request: FastifyRequest, reply: FastifyReply) => {
-      const user = request.user!;
-      if (user.totpEnabled) {
-        return reply.status(409).send({ error: "TOTP already enrolled" });
-      }
-
-      const secret = generateSecret();
-      const encrypted = encryptSecret(secret);
-      const { codes, hashes } = generateBackupCodes();
-
-      await app.container.userRepository.setTotpSecret(user.id, encrypted);
-      await storeBackupCodes(user.id, hashes);
-
-      const provisioningUri = buildProvisioningUri({
-        secret,
-        email: user.email,
-        issuer: config.TOTP_ISSUER,
-      });
-
-      await request.audit("totp_enrolled", { userId: user.id });
-
-      return {
-        secret,
-        provisioningUri,
-        backupCodes: codes,
-      };
-    }
-  );
-
-  app.post(
-    "/totp/backup",
-    { preHandler: [app.authenticate] },
-    async (request: FastifyRequest, reply: FastifyReply) => {
-      const user = request.user!;
-      if (!user.totpSecret || !user.totpEnabled) {
-        return reply.status(400).send({ error: "TOTP not enabled" });
-      }
-
-      const body = BackupCodeSchema.parse(request.body);
-      const valid = await verifyBackupCode(user.id, body.code);
-      if (!valid) {
-        await request.audit("totp_verify_failed", { userId: user.id, method: "backup_code" });
-        return reply.status(400).send({ error: "Invalid backup code" });
-      }
-
-      await request.audit("totp_enabled", { userId: user.id, method: "backup_code" });
-      return { success: true };
-    }
-  );
-
-  app.post(
-    "/totp/verify",
-    { preHandler: [app.authenticate] },
-    async (request: FastifyRequest, reply: FastifyReply) => {
-      const user = request.user!;
-      if (!user.totpSecret) {
-        return reply.status(400).send({ error: "TOTP not enrolled" });
-      }
-
-      const body = CodeSchema.parse(request.body);
-      const secret = decryptSecret(user.totpSecret);
-      if (!verifyTOTP(secret, body.code)) {
-        await request.audit("totp_verify_failed", { userId: user.id });
-        return reply.status(400).send({ error: "Invalid code" });
-      }
-
-      await app.container.userRepository.enableTotp(user.id);
-      await request.audit("totp_enabled", { userId: user.id });
-
-      return { success: true };
-    }
-  );
-
-  app.post(
-    "/totp/disable",
-    { preHandler: [app.authenticate] },
-    async (request: FastifyRequest, reply: FastifyReply) => {
-      const user = request.user!;
-      if (!user.totpSecret || !user.totpEnabled) {
-        return reply.status(400).send({ error: "TOTP not enabled" });
-      }
-
-      const body = CodeSchema.parse(request.body);
-      const secret = decryptSecret(user.totpSecret);
-      if (!verifyTOTP(secret, body.code)) {
-        await request.audit("totp_disable_failed", { userId: user.id });
-        return reply.status(400).send({ error: "Invalid code" });
-      }
-
-      await app.container.userRepository.disableTotp(user.id);
-      await request.audit("totp_disabled", { userId: user.id });
-
-      return { success: true };
-    }
-  );
-}