@lastshotlabs/bunshot 0.0.27 → 0.0.28

package/dist/{services → packages/bunshot-auth/src/services}/mfa.js

@@ -1,26 +1,27 @@
-import { getAuthAdapter } from "../lib/authAdapter";
-import { HttpError } from "../lib/HttpError";
-import { getMfaIssuer, getMfaAlgorithm, getMfaDigits, getMfaPeriod, getMfaRecoveryCodeCount, getMfaEmailOtpConfig, getMfaEmailOtpCodeLength, getMfaWebAuthnConfig, getAppName } from "../lib/appConfig";
-import { createMfaChallenge } from "../lib/mfaChallenge";
+import { createMfaChallenge } from '../lib/mfaChallenge';
+import { HttpError } from '../../../bunshot-core/src/index.js';
+import { decryptField, encryptField, isEncryptedField, sha256, timingSafeEqual, } from '../../../bunshot-core/src/index.js';
 // Lazy-load otpauth to keep it as an optional peer dependency
-let _otpauth = null;
 async function getOtpAuth() {
-    if (!_otpauth)
-        _otpauth = await import("otpauth");
-    return _otpauth;
+    return import('otpauth');
 }
-import { sha256, timingSafeEqual } from "../lib/crypto";
 function generateRandomCode(length) {
-    const chars = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789"; // no ambiguous chars: I/1/O/0
-    let code = "";
+    const chars = 'ABCDEFGHJKLMNPQRSTUVWXYZ23456789'; // no ambiguous chars: I/1/O/0
+    const charLen = chars.length; // 31
+    const maxUnbiased = 248; // largest multiple of 31 below 256 (31 * 8 = 248)
+    let code = '';
     const bytes = crypto.getRandomValues(new Uint8Array(length));
     for (let i = 0; i < length; i++) {
-        code += chars[bytes[i] % chars.length];
+        let byte = bytes[i];
+        while (byte >= maxUnbiased) {
+            byte = crypto.getRandomValues(new Uint8Array(1))[0];
+        }
+        code += chars[byte % charLen];
     }
     return code;
 }
-function generateRecoveryCodes() {
-    const count = getMfaRecoveryCodeCount();
+function generateRecoveryCodes(runtime) {
+    const count = runtime.config.mfa?.recoveryCodes ?? 10;
     const plainCodes = [];
     const hashedCodes = [];
     for (let i = 0; i < count; i++) {
@@ -30,96 +31,118 @@ function generateRecoveryCodes() {
     }
     return { plainCodes, hashedCodes };
 }
-export const setupMfa = async (userId) => {
-    const adapter = getAuthAdapter();
+export const setupMfa = async (userId, runtime) => {
+    const { adapter, config } = runtime;
     if (!adapter.setMfaSecret)
-        throw new HttpError(501, "Auth adapter does not support MFA");
+        throw new HttpError(501, 'Auth adapter does not support MFA');
     const otpauth = await getOtpAuth();
     const secret = new otpauth.Secret();
+    const mfaCfg = config.mfa;
     const totp = new otpauth.TOTP({
-        issuer: getMfaIssuer(),
+        issuer: mfaCfg?.issuer ?? config.appName,
         label: userId,
-        algorithm: getMfaAlgorithm(),
-        digits: getMfaDigits(),
-        period: getMfaPeriod(),
+        algorithm: mfaCfg?.algorithm ?? 'SHA1',
+        digits: mfaCfg?.digits ?? 6,
+        period: mfaCfg?.period ?? 30,
         secret,
     });
     // Store the secret but don't enable MFA yet — user must confirm with a code
-    await adapter.setMfaSecret(userId, secret.base32);
+    // Encrypt at rest when encryption keys are available; store plaintext in dev otherwise.
+    const deks = [...runtime.dataEncryptionKeys];
+    const storedSecret = deks.length > 0 ? await encryptField(secret.base32, deks) : secret.base32;
+    await adapter.setMfaSecret(userId, storedSecret);
     return {
         secret: secret.base32,
         uri: totp.toString(),
     };
 };
-export const verifySetup = async (userId, code) => {
-    const adapter = getAuthAdapter();
+/**
+ * Resolve a stored MFA secret: decrypt it if it looks like an encrypted ciphertext
+ * (produced by encryptField), otherwise return as-is (plaintext — allowed in dev).
+ */
+async function resolveStoredSecret(stored, runtime) {
+    if (isEncryptedField(stored)) {
+        const deks = [...runtime.dataEncryptionKeys];
+        if (deks.length === 0) {
+            throw new HttpError(500, 'TOTP secret is encrypted but BUNSHOT_DATA_ENCRYPTION_KEY is not set');
+        }
+        return decryptField(stored, deks);
+    }
+    return stored;
+}
+export const verifySetup = async (userId, code, runtime) => {
+    const { adapter, config } = runtime;
     if (!adapter.getMfaSecret || !adapter.setMfaEnabled || !adapter.setRecoveryCodes) {
-        throw new HttpError(501, "Auth adapter does not support MFA");
+        throw new HttpError(501, 'Auth adapter does not support MFA');
     }
-    const secretStr = await adapter.getMfaSecret(userId);
-    if (!secretStr)
-        throw new HttpError(400, "MFA setup not initiated. Call POST /auth/mfa/setup first.");
+    const storedSecretStr = await adapter.getMfaSecret(userId);
+    if (!storedSecretStr)
+        throw new HttpError(400, 'MFA setup not initiated. Call POST /auth/mfa/setup first.');
+    const secretStr = await resolveStoredSecret(storedSecretStr, runtime);
+    const mfaCfg = config.mfa;
     const otpauth = await getOtpAuth();
     const totp = new otpauth.TOTP({
-        issuer: getMfaIssuer(),
-        algorithm: getMfaAlgorithm(),
-        digits: getMfaDigits(),
-        period: getMfaPeriod(),
+        issuer: mfaCfg?.issuer ?? config.appName,
+        algorithm: mfaCfg?.algorithm ?? 'SHA1',
+        digits: mfaCfg?.digits ?? 6,
+        period: mfaCfg?.period ?? 30,
         secret: otpauth.Secret.fromBase32(secretStr),
     });
     const delta = totp.validate({ token: code, window: 1 });
     if (delta === null)
-        throw new HttpError(401, "Invalid TOTP code");
+        throw new HttpError(401, 'Invalid TOTP code');
     // Generate recovery codes (regenerates if enabling a second method)
-    const { plainCodes, hashedCodes } = generateRecoveryCodes();
+    const { plainCodes, hashedCodes } = generateRecoveryCodes(runtime);
     await adapter.setRecoveryCodes(userId, hashedCodes);
     await adapter.setMfaEnabled(userId, true);
     // Add "totp" to mfaMethods
     if (adapter.getMfaMethods && adapter.setMfaMethods) {
         const methods = await adapter.getMfaMethods(userId);
-        if (!methods.includes("totp")) {
-            await adapter.setMfaMethods(userId, [...methods, "totp"]);
+        if (!methods.includes('totp')) {
+            await adapter.setMfaMethods(userId, [...methods, 'totp']);
         }
     }
     return plainCodes;
 };
-export const verifyTotp = async (userId, code) => {
-    const adapter = getAuthAdapter();
+export const verifyTotp = async (userId, code, runtime) => {
+    const { adapter, config } = runtime;
     if (!adapter.getMfaSecret)
-        throw new HttpError(501, "Auth adapter does not support MFA");
-    const secretStr = await adapter.getMfaSecret(userId);
-    if (!secretStr)
+        throw new HttpError(501, 'Auth adapter does not support MFA');
+    const storedSecretStr = await adapter.getMfaSecret(userId);
+    if (!storedSecretStr)
         return false;
+    const secretStr = await resolveStoredSecret(storedSecretStr, runtime);
+    const mfaCfg = config.mfa;
     const otpauth = await getOtpAuth();
     const totp = new otpauth.TOTP({
-        issuer: getMfaIssuer(),
-        algorithm: getMfaAlgorithm(),
-        digits: getMfaDigits(),
-        period: getMfaPeriod(),
+        issuer: mfaCfg?.issuer ?? config.appName,
+        algorithm: mfaCfg?.algorithm ?? 'SHA1',
+        digits: mfaCfg?.digits ?? 6,
+        period: mfaCfg?.period ?? 30,
         secret: otpauth.Secret.fromBase32(secretStr),
     });
     return totp.validate({ token: code, window: 1 }) !== null;
 };
-export const verifyRecoveryCode = async (userId, code) => {
-    const adapter = getAuthAdapter();
-    if (!adapter.getRecoveryCodes || !adapter.removeRecoveryCode)
-        return false;
-    const hashedCodes = await adapter.getRecoveryCodes(userId);
+export const verifyRecoveryCode = async (userId, code, runtime) => {
+    const { adapter } = runtime;
+    // consumeRecoveryCode is a required method on all adapters that support MFA.
+    // It atomically finds and removes the code in a single operation, eliminating the race
+    // condition where two concurrent requests could both match the same code.
+    // Note: timing is now at the DB level rather than using timingSafeEqual in application code.
+    // This is acceptable — the code is SHA-256 hashed before storage, so constant-time
+    // comparison in app code was only preventing hash enumeration, not timing-based attacks
+    // on the plaintext (which is already protected by the hash itself).
     const hashedInput = sha256(code.toUpperCase());
-    const match = hashedCodes.find((h) => timingSafeEqual(h, hashedInput));
-    if (!match)
-        return false;
-    await adapter.removeRecoveryCode(userId, match);
-    return true;
+    return adapter.consumeRecoveryCode(userId, hashedInput);
 };
-export const disableMfa = async (userId, code) => {
-    const adapter = getAuthAdapter();
+export const disableMfa = async (userId, code, runtime) => {
+    const { adapter } = runtime;
     if (!adapter.setMfaEnabled || !adapter.setMfaSecret || !adapter.setRecoveryCodes) {
-        throw new HttpError(501, "Auth adapter does not support MFA");
+        throw new HttpError(501, 'Auth adapter does not support MFA');
     }
-    const valid = await verifyTotp(userId, code);
+    const valid = await verifyTotp(userId, code, runtime);
     if (!valid)
-        throw new HttpError(401, "Invalid TOTP code");
+        throw new HttpError(401, 'Invalid TOTP code');
     await adapter.setMfaEnabled(userId, false);
     await adapter.setMfaSecret(userId, null);
     await adapter.setRecoveryCodes(userId, []);
@@ -128,14 +151,14 @@ export const disableMfa = async (userId, code) => {
         await adapter.setMfaMethods(userId, []);
     }
 };
-export const regenerateRecoveryCodes = async (userId, code) => {
-    const adapter = getAuthAdapter();
+export const regenerateRecoveryCodes = async (userId, code, runtime) => {
+    const { adapter } = runtime;
     if (!adapter.setRecoveryCodes)
-        throw new HttpError(501, "Auth adapter does not support MFA");
-    const valid = await verifyTotp(userId, code);
+        throw new HttpError(501, 'Auth adapter does not support MFA');
+    const valid = await verifyTotp(userId, code, runtime);
     if (!valid)
-        throw new HttpError(401, "Invalid TOTP code");
-    const { plainCodes, hashedCodes } = generateRecoveryCodes();
+        throw new HttpError(401, 'Invalid TOTP code');
+    const { plainCodes, hashedCodes } = generateRecoveryCodes(runtime);
     await adapter.setRecoveryCodes(userId, hashedCodes);
     return plainCodes;
 };
@@ -143,12 +166,17 @@ export const regenerateRecoveryCodes = async (userId, code) => {
 // Email OTP
 // ---------------------------------------------------------------------------
 /** Generate a cryptographically random numeric OTP code. Returns { code, hash }. */
-export const generateEmailOtpCode = (length) => {
-    const len = length ?? getMfaEmailOtpCodeLength();
+export const generateEmailOtpCode = (runtime, length) => {
+    const len = length ?? runtime.config.mfa?.emailOtp?.codeLength ?? 6;
+    const maxUnbiased = 250; // largest multiple of 10 below 256 (10 * 25 = 250)
     const bytes = crypto.getRandomValues(new Uint8Array(len));
-    let code = "";
+    let code = '';
     for (let i = 0; i < len; i++) {
-        code += (bytes[i] % 10).toString();
+        let byte = bytes[i];
+        while (byte >= maxUnbiased) {
+            byte = crypto.getRandomValues(new Uint8Array(1))[0];
+        }
+        code += (byte % 10).toString();
     }
     return { code, hash: sha256(code) };
 };
@@ -160,59 +188,59 @@ export const verifyEmailOtp = (emailOtpHash, code) => {
  * Initiate email OTP setup: sends a verification code to the user's email.
  * Returns a setup challenge token that must be confirmed via confirmEmailOtp.
  */
-export const initiateEmailOtp = async (userId) => {
-    const adapter = getAuthAdapter();
-    const emailOtpConfig = getMfaEmailOtpConfig();
+export const initiateEmailOtp = async (userId, runtime) => {
+    const { adapter, eventBus, config } = runtime;
+    const emailOtpConfig = config.mfa?.emailOtp ?? null;
     if (!emailOtpConfig)
-        throw new HttpError(501, "Email OTP is not configured");
+        throw new HttpError(501, 'Email OTP is not configured');
     const user = adapter.getUser ? await adapter.getUser(userId) : null;
     if (!user?.email)
-        throw new HttpError(400, "No email address on account");
-    const { code, hash } = generateEmailOtpCode();
-    await emailOtpConfig.onSend(user.email, code);
+        throw new HttpError(400, 'No email address on account');
+    const { code, hash } = generateEmailOtpCode(runtime);
+    eventBus.emit('auth:delivery.email_otp', { email: user.email, code });
     // Store the hash in a challenge token for verification
-    const setupToken = await createMfaChallenge(userId, { emailOtpHash: hash });
+    const setupToken = await createMfaChallenge(runtime.repos.mfaChallenge, userId, { emailOtpHash: hash }, config);
     return setupToken;
 };
 /**
  * Confirm email OTP setup: verifies the code sent during initiateEmailOtp.
  * Enables email OTP as an MFA method. Returns recovery codes if MFA was not previously active.
  */
-export const confirmEmailOtp = async (userId, setupToken, code) => {
-    const adapter = getAuthAdapter();
+export const confirmEmailOtp = async (userId, setupToken, code, runtime) => {
+    const { adapter } = runtime;
     if (!adapter.setMfaEnabled || !adapter.setRecoveryCodes) {
-        throw new HttpError(501, "Auth adapter does not support MFA");
+        throw new HttpError(501, 'Auth adapter does not support MFA');
     }
     // Import consumeMfaChallenge here to avoid circular dependency issues at module level
-    const { consumeMfaChallenge } = await import("../lib/mfaChallenge");
-    const challenge = await consumeMfaChallenge(setupToken);
+    const { consumeMfaChallenge } = await import('../lib/mfaChallenge');
+    const challenge = await consumeMfaChallenge(runtime.repos.mfaChallenge, setupToken);
     if (!challenge)
-        throw new HttpError(401, "Invalid or expired setup token");
+        throw new HttpError(401, 'Invalid or expired setup token');
     if (challenge.userId !== userId)
-        throw new HttpError(401, "Token does not match user");
+        throw new HttpError(401, 'Token does not match user');
     if (!challenge.emailOtpHash)
-        throw new HttpError(400, "Invalid setup token — no OTP hash");
+        throw new HttpError(400, 'Invalid setup token — no OTP hash');
     if (!verifyEmailOtp(challenge.emailOtpHash, code)) {
-        throw new HttpError(401, "Invalid verification code");
+        throw new HttpError(401, 'Invalid verification code');
     }
     // Check if MFA was already active
     const wasEnabled = adapter.isMfaEnabled ? await adapter.isMfaEnabled(userId) : false;
     // Add "emailOtp" to mfaMethods
     if (adapter.getMfaMethods && adapter.setMfaMethods) {
         const methods = await adapter.getMfaMethods(userId);
-        if (!methods.includes("emailOtp")) {
-            await adapter.setMfaMethods(userId, [...methods, "emailOtp"]);
+        if (!methods.includes('emailOtp')) {
+            await adapter.setMfaMethods(userId, [...methods, 'emailOtp']);
         }
     }
     await adapter.setMfaEnabled(userId, true);
     // Generate recovery codes if MFA was not previously active
     if (!wasEnabled) {
-        const { plainCodes, hashedCodes } = generateRecoveryCodes();
+        const { plainCodes, hashedCodes } = generateRecoveryCodes(runtime);
         await adapter.setRecoveryCodes(userId, hashedCodes);
         return plainCodes;
     }
     // Regenerate recovery codes when adding a second method
-    const { plainCodes, hashedCodes } = generateRecoveryCodes();
+    const { plainCodes, hashedCodes } = generateRecoveryCodes(runtime);
     await adapter.setRecoveryCodes(userId, hashedCodes);
     return plainCodes;
 };
@@ -220,37 +248,31 @@ export const confirmEmailOtp = async (userId, setupToken, code) => {
  * Disable email OTP for a user.
  * If TOTP is also enabled, requires a TOTP code. Otherwise requires password.
  */
-export const disableEmailOtp = async (userId, params) => {
-    const adapter = getAuthAdapter();
+export const disableEmailOtp = async (userId, params, runtime) => {
+    const { adapter } = runtime;
     if (!adapter.setMfaEnabled)
-        throw new HttpError(501, "Auth adapter does not support MFA");
+        throw new HttpError(501, 'Auth adapter does not support MFA');
     // Get current methods
     const methods = adapter.getMfaMethods ? await adapter.getMfaMethods(userId) : [];
-    const hasTotpEnabled = methods.includes("totp");
+    const hasTotpEnabled = methods.includes('totp');
     // Verify identity
     if (hasTotpEnabled) {
         if (!params.code)
-            throw new HttpError(400, "TOTP code required to disable email OTP");
-        const valid = await verifyTotp(userId, params.code);
+            throw new HttpError(400, 'TOTP code required to disable email OTP');
+        const valid = await verifyTotp(userId, params.code, runtime);
         if (!valid)
-            throw new HttpError(401, "Invalid TOTP code");
+            throw new HttpError(401, 'Invalid TOTP code');
     }
     else {
         if (!params.password)
-            throw new HttpError(400, "Password required to disable email OTP");
-        // Verify password — look up the user's hash and compare
-        const user = adapter.findByIdentifier
-            ? await adapter.findByIdentifier((await adapter.getUser?.(userId))?.email ?? "")
-            : await adapter.findByEmail((await adapter.getUser?.(userId))?.email ?? "");
-        if (!user)
-            throw new HttpError(404, "User not found");
-        const valid = await Bun.password.verify(params.password, user.passwordHash);
+            throw new HttpError(400, 'Password required to disable email OTP');
+        const valid = await adapter.verifyPassword(userId, params.password);
         if (!valid)
-            throw new HttpError(401, "Invalid password");
+            throw new HttpError(401, 'Invalid password');
     }
     // Remove "emailOtp" from methods
     if (adapter.setMfaMethods) {
-        const updated = methods.filter((m) => m !== "emailOtp");
+        const updated = methods.filter(m => m !== 'emailOtp');
         await adapter.setMfaMethods(userId, updated);
         // If no methods remain, disable MFA entirely
         if (updated.length === 0) {
@@ -261,45 +283,39 @@ export const disableEmailOtp = async (userId, params) => {
     }
 };
 /** Get the MFA methods enabled for a user. */
-export const getMfaMethods = async (userId) => {
-    const adapter = getAuthAdapter();
+export const getMfaMethods = async (userId, runtime) => {
+    const { adapter } = runtime;
     if (adapter.getMfaMethods)
         return adapter.getMfaMethods(userId);
-    // Backward compat
-    if (adapter.isMfaEnabled && await adapter.isMfaEnabled(userId))
-        return ["totp"];
     return [];
 };
 // ---------------------------------------------------------------------------
 // WebAuthn / FIDO2
 // ---------------------------------------------------------------------------
 // Lazy-load @simplewebauthn/server to keep it as an optional peer dependency
-let _simplewebauthn = null;
 async function getSimpleWebAuthn() {
-    if (!_simplewebauthn)
-        _simplewebauthn = await import("@simplewebauthn/server");
-    return _simplewebauthn;
+    return import('@simplewebauthn/server');
 }
 /**
  * Eager startup check — call at route mount time to fail fast if the peer dependency is missing.
  */
 export const assertWebAuthnDependency = async () => {
     try {
-        await import("@simplewebauthn/server");
+        await import('@simplewebauthn/server');
     }
     catch {
-        throw new Error("@simplewebauthn/server is required when mfa.webauthn is configured. Install it: bun add @simplewebauthn/server");
+        throw new Error('@simplewebauthn/server is required when mfa.webauthn is configured. Install it: bun add @simplewebauthn/server');
     }
 };
 /**
  * Generate WebAuthn authentication options for the login MFA flow.
  * Called from auth.ts login when the user has "webauthn" in their methods.
  */
-export const generateWebAuthnAuthenticationOptions = async (userId) => {
-    const config = getMfaWebAuthnConfig();
+export const generateWebAuthnAuthenticationOptions = async (userId, runtime) => {
+    const config = runtime.config.mfa?.webauthn ?? null;
     if (!config)
         return null;
-    const adapter = getAuthAdapter();
+    const { adapter } = runtime;
     if (!adapter.getWebAuthnCredentials)
         return null;
     const credentials = await adapter.getWebAuthnCredentials(userId);
@@ -308,11 +324,11 @@ export const generateWebAuthnAuthenticationOptions = async (userId) => {
     const { generateAuthenticationOptions } = await getSimpleWebAuthn();
     const options = await generateAuthenticationOptions({
         rpID: config.rpId,
-        allowCredentials: credentials.map((c) => ({
+        allowCredentials: credentials.map(c => ({
             id: c.credentialId,
             transports: c.transports,
         })),
-        userVerification: config.userVerification ?? "preferred",
+        userVerification: config.userVerification ?? 'preferred',
         timeout: config.timeout ?? 60000,
     });
     return { challenge: options.challenge, options: options };
@@ -321,55 +337,55 @@ export const generateWebAuthnAuthenticationOptions = async (userId) => {
  * Initiate WebAuthn registration: generates registration options for the client.
  * Returns options + a registration challenge token.
  */
-export const initiateWebAuthnRegistration = async (userId) => {
-    const config = getMfaWebAuthnConfig();
+export const initiateWebAuthnRegistration = async (userId, runtime) => {
+    const config = runtime.config.mfa?.webauthn ?? null;
     if (!config)
-        throw new HttpError(501, "WebAuthn is not configured");
-    const adapter = getAuthAdapter();
+        throw new HttpError(501, 'WebAuthn is not configured');
+    const { adapter } = runtime;
     if (!adapter.getWebAuthnCredentials)
-        throw new HttpError(501, "Auth adapter does not support WebAuthn");
+        throw new HttpError(501, 'Auth adapter does not support WebAuthn');
     const user = adapter.getUser ? await adapter.getUser(userId) : null;
     // Get existing credentials to exclude (prevent re-registration)
     const existingCreds = await adapter.getWebAuthnCredentials(userId);
     const { generateRegistrationOptions } = await getSimpleWebAuthn();
     const options = await generateRegistrationOptions({
-        rpName: config.rpName ?? getAppName(),
+        rpName: config.rpName ?? runtime.config.appName,
         rpID: config.rpId,
         userName: user?.email ?? userId,
-        attestationType: config.attestationType ?? "none",
-        excludeCredentials: existingCreds.map((c) => ({
+        attestationType: config.attestationType ?? 'none',
+        excludeCredentials: existingCreds.map(c => ({
             id: c.credentialId,
             transports: c.transports,
         })),
         authenticatorSelection: {
             authenticatorAttachment: config.authenticatorAttachment,
-            userVerification: config.userVerification ?? "required",
-            residentKey: "required",
+            userVerification: config.userVerification ?? 'required',
+            residentKey: 'required',
         },
         timeout: config.timeout ?? 60000,
     });
-    const { createWebAuthnRegistrationChallenge } = await import("../lib/mfaChallenge");
-    const registrationToken = await createWebAuthnRegistrationChallenge(userId, options.challenge);
+    const { createWebAuthnRegistrationChallenge } = await import('../lib/mfaChallenge');
+    const registrationToken = await createWebAuthnRegistrationChallenge(runtime.repos.mfaChallenge, userId, options.challenge, runtime.config);
     return { options: options, registrationToken };
 };
 /**
  * Complete WebAuthn registration: verifies attestation and stores the credential.
  * Returns recovery codes if this is the first MFA method.
  */
-export const completeWebAuthnRegistration = async (userId, registrationToken, attestationResponse, name) => {
-    const config = getMfaWebAuthnConfig();
+export const completeWebAuthnRegistration = async (userId, registrationToken, attestationResponse, runtime, name) => {
+    const config = runtime.config.mfa?.webauthn ?? null;
     if (!config)
-        throw new HttpError(501, "WebAuthn is not configured");
-    const adapter = getAuthAdapter();
+        throw new HttpError(501, 'WebAuthn is not configured');
+    const { adapter } = runtime;
     if (!adapter.addWebAuthnCredential || !adapter.setMfaEnabled || !adapter.setRecoveryCodes) {
-        throw new HttpError(501, "Auth adapter does not support WebAuthn");
+        throw new HttpError(501, 'Auth adapter does not support WebAuthn');
     }
-    const { consumeWebAuthnRegistrationChallenge } = await import("../lib/mfaChallenge");
-    const challenge = await consumeWebAuthnRegistrationChallenge(registrationToken);
+    const { consumeWebAuthnRegistrationChallenge } = await import('../lib/mfaChallenge');
+    const challenge = await consumeWebAuthnRegistrationChallenge(runtime.repos.mfaChallenge, registrationToken);
     if (!challenge)
-        throw new HttpError(401, "Invalid or expired registration token");
+        throw new HttpError(401, 'Invalid or expired registration token');
     if (challenge.userId !== userId)
-        throw new HttpError(401, "Token does not match user");
+        throw new HttpError(401, 'Token does not match user');
     const { verifyRegistrationResponse } = await getSimpleWebAuthn();
     const verification = await verifyRegistrationResponse({
         response: attestationResponse,
@@ -378,7 +394,7 @@ export const completeWebAuthnRegistration = async (userId, registrationToken, at
         expectedRPID: config.rpId,
     });
     if (!verification.verified || !verification.registrationInfo) {
-        throw new HttpError(401, "WebAuthn registration verification failed");
+        throw new HttpError(401, 'WebAuthn registration verification failed');
     }
     const { credential } = verification.registrationInfo;
     const credentialId = credential.id;
@@ -386,12 +402,12 @@ export const completeWebAuthnRegistration = async (userId, registrationToken, at
     if (adapter.findUserByWebAuthnCredentialId) {
         const existingOwner = await adapter.findUserByWebAuthnCredentialId(credentialId);
         if (existingOwner && existingOwner !== userId) {
-            throw new HttpError(409, "This security key is already registered to another account");
+            throw new HttpError(409, 'This security key is already registered to another account');
         }
     }
     const newCredential = {
         credentialId,
-        publicKey: Buffer.from(credential.publicKey).toString("base64url"),
+        publicKey: Buffer.from(credential.publicKey).toString('base64url'),
         signCount: credential.counter,
         transports: attestationResponse.response?.transports ?? [],
         name: name ?? undefined,
@@ -401,29 +417,29 @@ export const completeWebAuthnRegistration = async (userId, registrationToken, at
     // Add "webauthn" to methods
     if (adapter.getMfaMethods && adapter.setMfaMethods) {
         const methods = await adapter.getMfaMethods(userId);
-        if (!methods.includes("webauthn")) {
-            await adapter.setMfaMethods(userId, [...methods, "webauthn"]);
+        if (!methods.includes('webauthn')) {
+            await adapter.setMfaMethods(userId, [...methods, 'webauthn']);
         }
     }
     // Enable MFA + generate/regenerate recovery codes
     await adapter.setMfaEnabled(userId, true);
-    const { plainCodes, hashedCodes } = generateRecoveryCodes();
+    const { plainCodes, hashedCodes } = generateRecoveryCodes(runtime);
     await adapter.setRecoveryCodes(userId, hashedCodes);
     return { credentialId, recoveryCodes: plainCodes };
 };
 /**
  * Verify a WebAuthn authentication assertion during login MFA.
  */
-export const verifyWebAuthn = async (userId, assertionResponse, expectedChallenge) => {
-    const config = getMfaWebAuthnConfig();
+export const verifyWebAuthn = async (userId, assertionResponse, expectedChallenge, runtime) => {
+    const config = runtime.config.mfa?.webauthn ?? null;
     if (!config)
         return false;
-    const adapter = getAuthAdapter();
+    const { adapter } = runtime;
     if (!adapter.getWebAuthnCredentials || !adapter.updateWebAuthnCredentialSignCount)
         return false;
     const credentials = await adapter.getWebAuthnCredentials(userId);
     const credentialId = assertionResponse.id;
-    const matchedCred = credentials.find((c) => c.credentialId === credentialId);
+    const matchedCred = credentials.find(c => c.credentialId === credentialId);
     if (!matchedCred)
         return false;
     const { verifyAuthenticationResponse } = await getSimpleWebAuthn();
@@ -435,7 +451,7 @@ export const verifyWebAuthn = async (userId, assertionResponse, expectedChalleng
             expectedRPID: config.rpId,
             credential: {
                 id: matchedCred.credentialId,
-                publicKey: new Uint8Array(Buffer.from(matchedCred.publicKey, "base64url")),
+                publicKey: new Uint8Array(Buffer.from(matchedCred.publicKey, 'base64url')),
                 counter: matchedCred.signCount,
                 transports: matchedCred.transports,
             },
@@ -462,26 +478,26 @@ export const verifyWebAuthn = async (userId, assertionResponse, expectedChalleng
  * Remove a single WebAuthn credential.
  * Only requires identity verification when removing the last credential of the last MFA method.
  */
-export const removeWebAuthnCredential = async (userId, credentialId, params) => {
-    const adapter = getAuthAdapter();
+export const removeWebAuthnCredential = async (userId, credentialId, params, runtime) => {
+    const { adapter } = runtime;
     if (!adapter.getWebAuthnCredentials || !adapter.removeWebAuthnCredential) {
-        throw new HttpError(501, "Auth adapter does not support WebAuthn");
+        throw new HttpError(501, 'Auth adapter does not support WebAuthn');
     }
     const credentials = await adapter.getWebAuthnCredentials(userId);
-    if (!credentials.some((c) => c.credentialId === credentialId)) {
-        throw new HttpError(404, "Credential not found");
+    if (!credentials.some(c => c.credentialId === credentialId)) {
+        throw new HttpError(404, 'Credential not found');
     }
     const methods = adapter.getMfaMethods ? await adapter.getMfaMethods(userId) : [];
-    const otherMethodsExist = methods.some((m) => m !== "webauthn");
+    const otherMethodsExist = methods.some(m => m !== 'webauthn');
     const otherCredsExist = credentials.length > 1;
     // Only require verification when removing the last credential of the last method
     if (!otherMethodsExist && !otherCredsExist) {
-        await verifyIdentity(userId, params);
+        await verifyIdentity(userId, params, runtime);
     }
     await adapter.removeWebAuthnCredential(userId, credentialId);
     // If that was the last credential, remove "webauthn" from methods
     if (!otherCredsExist && adapter.setMfaMethods) {
-        const updated = methods.filter((m) => m !== "webauthn");
+        const updated = methods.filter(m => m !== 'webauthn');
         await adapter.setMfaMethods(userId, updated);
         // If no methods remain, disable MFA entirely
         if (updated.length === 0 && adapter.setMfaEnabled) {
@@ -494,12 +510,12 @@ export const removeWebAuthnCredential = async (userId, credentialId, params) =>
 /**
  * Disable WebAuthn entirely: removes all credentials and the method.
  */
-export const disableWebAuthn = async (userId, params) => {
-    const adapter = getAuthAdapter();
+export const disableWebAuthn = async (userId, params, runtime) => {
+    const { adapter } = runtime;
     if (!adapter.getWebAuthnCredentials || !adapter.removeWebAuthnCredential) {
-        throw new HttpError(501, "Auth adapter does not support WebAuthn");
+        throw new HttpError(501, 'Auth adapter does not support WebAuthn');
     }
-    await verifyIdentity(userId, params);
+    await verifyIdentity(userId, params, runtime);
     const credentials = await adapter.getWebAuthnCredentials(userId);
     for (const cred of credentials) {
         await adapter.removeWebAuthnCredential(userId, cred.credentialId);
@@ -507,7 +523,7 @@ export const disableWebAuthn = async (userId, params) => {
     // Remove "webauthn" from methods
     if (adapter.getMfaMethods && adapter.setMfaMethods) {
         const methods = await adapter.getMfaMethods(userId);
-        const updated = methods.filter((m) => m !== "webauthn");
+        const updated = methods.filter(m => m !== 'webauthn');
         await adapter.setMfaMethods(userId, updated);
         if (updated.length === 0 && adapter.setMfaEnabled) {
             await adapter.setMfaEnabled(userId, false);
@@ -516,28 +532,88 @@ export const disableWebAuthn = async (userId, params) => {
         }
     }
 };
+// ---------------------------------------------------------------------------
+// verifyAnyFactor — unified factor verification for reauth / destructive actions
+// ---------------------------------------------------------------------------
+/**
+ * Verify any supported authentication factor for a given user + session.
+ * Used by step-up, account deletion, and MFA disable flows.
+ *
+ * - "totp": TOTP code
+ * - "recovery": recovery code (only when method is explicitly "recovery")
+ * - "password": account password
+ * - "emailOtp": email OTP via reauth challenge token
+ * - "webauthn": WebAuthn assertion via reauth challenge token
+ *
+ * Hard boundaries:
+ *  - "recovery" is ONLY checked when method is explicitly "recovery"
+ *  - emailOtp / webauthn consume a reauth challenge bound to sessionId
+ *
+ * Returns false (never throws) when required params are missing.
+ */
+export async function verifyAnyFactor(userId, sessionId, runtime, params) {
+    const { method, code, password, reauthToken, webauthnResponse } = params;
+    if (!method)
+        return false;
+    const { adapter } = runtime;
+    try {
+        if (method === 'totp') {
+            if (!code)
+                return false;
+            return verifyTotp(userId, code, runtime);
+        }
+        if (method === 'recovery') {
+            if (!code)
+                return false;
+            const hashedInput = sha256(code.toUpperCase());
+            return adapter.consumeRecoveryCode(userId, hashedInput);
+        }
+        if (method === 'password') {
+            if (!password)
+                return false;
+            return adapter.verifyPassword(userId, password);
+        }
+        if (method === 'emailOtp') {
+            if (!reauthToken || !code)
+                return false;
+            const { consumeReauthChallenge } = await import('../lib/mfaChallenge');
+            const challenge = await consumeReauthChallenge(runtime.repos.mfaChallenge, reauthToken, sessionId);
+            if (!challenge || !challenge.emailOtpHash)
+                return false;
+            return timingSafeEqual(sha256(code), challenge.emailOtpHash);
+        }
+        if (method === 'webauthn') {
+            if (!reauthToken || !webauthnResponse)
+                return false;
+            const { consumeReauthChallenge } = await import('../lib/mfaChallenge');
+            const challenge = await consumeReauthChallenge(runtime.repos.mfaChallenge, reauthToken, sessionId);
+            if (!challenge || !challenge.webauthnChallenge)
+                return false;
+            return verifyWebAuthn(userId, webauthnResponse, challenge.webauthnChallenge, runtime);
+        }
+        return false;
+    }
+    catch {
+        return false;
+    }
+}
 /** Internal: verify identity via TOTP code or password. */
-async function verifyIdentity(userId, params) {
-    const adapter = getAuthAdapter();
+async function verifyIdentity(userId, params, runtime) {
+    const { adapter } = runtime;
     const methods = adapter.getMfaMethods ? await adapter.getMfaMethods(userId) : [];
-    const hasTotpEnabled = methods.includes("totp");
+    const hasTotpEnabled = methods.includes('totp');
     if (hasTotpEnabled) {
         if (!params.code)
-            throw new HttpError(400, "TOTP code required");
-        const valid = await verifyTotp(userId, params.code);
+            throw new HttpError(400, 'TOTP code required');
+        const valid = await verifyTotp(userId, params.code, runtime);
         if (!valid)
-            throw new HttpError(401, "Invalid TOTP code");
+            throw new HttpError(401, 'Invalid TOTP code');
     }
     else {
         if (!params.password)
-            throw new HttpError(400, "Password required");
-        const user = adapter.findByIdentifier
-            ? await adapter.findByIdentifier((await adapter.getUser?.(userId))?.email ?? "")
-            : await adapter.findByEmail((await adapter.getUser?.(userId))?.email ?? "");
-        if (!user)
-            throw new HttpError(404, "User not found");
-        const valid = await Bun.password.verify(params.password, user.passwordHash);
+            throw new HttpError(400, 'Password required');
+        const valid = await adapter.verifyPassword(userId, params.password);
         if (!valid)
-            throw new HttpError(401, "Invalid password");
+            throw new HttpError(401, 'Invalid password');
     }
 }