@madauth/server 0.4.0-beta.1 → 0.5.0-beta.2

package/dist/{chunk-3PACOYTG.js → chunk-6SF2WNOC.js}

@@ -13,7 +13,10 @@ import {
 } from "./chunk-A7UYZRBL.js";
 import {
   ADMIN_ROLE,
+  DEFAULT_PASSWORD_RULES,
+  MAX_MIN_LENGTH,
   MAX_PASSWORD_LENGTH,
+  METHODS,
   METHODS_WITH_SECOND_FACTOR,
   SIGN_IN_METHODS,
   Settings,
@@ -24,7 +27,10 @@ import {
   checkPasswordPolicy,
   claimsFromJson,
   deriveCodeKey,
+  emailLinkAccountKey,
+  githubAccountKey,
   googleAccountKey,
+  hasSecondFactor,
   hashCode,
   hashPassword,
   initialMethods,
@@ -37,16 +43,18 @@ import {
   normalizeEmail,
   parseClaims,
   parseMethodSettings,
+  parsePasswordRules,
   passwordAccountKey,
   policyOf,
   safeEqual,
   sameClaims,
   sendsVerificationEmails,
+  smsAccountKey,
   toMadauthUser,
   totpAccountKey,
   verifyAgainstDummy,
   verifyPassword
-} from "./chunk-ISJGOCF3.js";
+} from "./chunk-NYIEFI4B.js";
 import {
   importSigningKeys
 } from "./chunk-JDQLSL36.js";
@@ -54,11 +62,503 @@ import {
   WEBHOOK_TIMEOUT_MS,
   createWebhookClient,
   localeOf
-} from "./chunk-Y7ZSUROX.js";
+} from "./chunk-SISM7YUZ.js";
 
-// src/routes/google.ts
+// src/routes/oauth.ts
 import { deleteCookie, getCookie, setCookie } from "hono/cookie";
 import { base64url } from "jose";
+var REDIRECT_ERROR_PARAM = "madauth_error";
+var REDIRECT_NEXT_PARAM = "madauth_next";
+var REDIRECT_FACTORS_PARAM = "madauth_factors";
+var REDIRECT_METHOD_PARAM = "madauth_method";
+var OAUTH_COOKIE = "madauth_oauth";
+var OAUTH_TYP = "madauth-oauth-state+jwt";
+var OAUTH_TTL = 10 * 60;
+async function pkceChallenge(verifier) {
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+  return base64url.encode(new Uint8Array(digest));
+}
+async function startOAuth(c, ctx, cookiePath, returnTo) {
+  const oauth = {
+    state: randomString(),
+    nonce: randomString(),
+    verifier: randomString(),
+    returnTo: returnTo.href,
+    locale: localeOf(c.req.query("locale"))
+  };
+  const token = await signToken(await ctx.keys, ctx.config.issuer, OAUTH_TYP, { ...oauth }, OAUTH_TTL);
+  setCookie(c, OAUTH_COOKIE, token, {
+    path: cookiePath,
+    httpOnly: true,
+    secure: ctx.secure,
+    sameSite: "Lax",
+    maxAge: OAUTH_TTL
+  });
+  return oauth;
+}
+async function takeOAuthState(c, ctx, cookiePath) {
+  const oauth = await readToken(await ctx.keys, ctx.config.issuer, OAUTH_TYP, getCookie(c, OAUTH_COOKIE));
+  if (!oauth) return null;
+  deleteCookie(c, OAUTH_COOKIE, { path: cookiePath, secure: ctx.secure });
+  return {
+    state: oauth.state,
+    nonce: oauth.nonce,
+    verifier: oauth.verifier,
+    returnTo: oauth.returnTo,
+    ...typeof oauth.locale === "string" ? { locale: oauth.locale } : {}
+  };
+}
+function redirectBack(c, returnTo, method) {
+  return (error2, next, factors = []) => {
+    const url = new URL(returnTo);
+    if (error2) url.hash = `${REDIRECT_ERROR_PARAM}=${error2}&${REDIRECT_METHOD_PARAM}=${method}`;
+    if (next) url.hash = `${REDIRECT_NEXT_PARAM}=${next}${factors.length ? `&${REDIRECT_FACTORS_PARAM}=${factors.join(",")}` : ""}&${REDIRECT_METHOD_PARAM}=${method}`;
+    return c.redirect(url.href, 302);
+  };
+}
+var METHOD_NAMES = {
+  google: "Google",
+  github: "GitHub",
+  password: "a password",
+  totp: "an authenticator app",
+  "email-link": "an e-mail link"
+};
+async function resolveProviderUser(ctx, provider, profile, locale) {
+  const { users } = ctx;
+  const { key } = profile;
+  const emailNormalized = normalizeEmail(profile.email);
+  const signedIn = (user) => ({ ok: true, user });
+  const account = await users.findAccountByKey(key);
+  if (account) {
+    const user = await users.findById(account.userId);
+    if (user) {
+      const patch = {
+        ...account.email !== profile.email ? { email: profile.email } : {},
+        ...profile.secret ? { secret: profile.secret } : {}
+      };
+      if (Object.keys(patch).length) await users.updateAccount(account.id, patch);
+      return signedIn(user);
+    }
+    await users.deleteAccount(account.id);
+  }
+  for (let attempt = 0; attempt < 2; attempt++) {
+    const existing = await users.findByEmail(emailNormalized);
+    if (existing) {
+      if (existing.emailVerified && await users.hasSignInMethod(existing.id)) {
+        const methods = await users.signInMethods(existing.id, await ctx.settings.methods());
+        const how = methods.map((method) => METHOD_NAMES[method]).join(" or ");
+        return {
+          ok: false,
+          error: "other_method",
+          message: `This e-mail address signs in with ${how || "another method"}. Use that instead of ${provider.name}.`,
+          methods
+        };
+      }
+      const taken = await users.reopenSignUp(existing);
+      await users.verifyByProvider(taken);
+      if (!await users.linkAccount(taken.id, { key, email: profile.email, secret: profile.secret })) {
+        const linked = await users.findAccountByKey(key);
+        const owner = linked && await users.findById(linked.userId);
+        if (!owner) return { ok: false, error: "temporarily_unavailable", message: "Please try again." };
+        return signedIn(owner);
+      }
+      return signedIn({ ...taken, emailVerified: true });
+    }
+    if (attempt === 0) {
+      const check = await ctx.checkSignup({ email: profile.email, name: profile.name, locale, method: provider.method });
+      if (!check.ok) {
+        return check.reason === "rejected" ? { ok: false, error: "signup_rejected", message: check.message } : { ok: false, error: "temporarily_unavailable", message: "Signing up is not possible right now. Please try again later." };
+      }
+    }
+    const user = await users.createUser({
+      email: profile.email,
+      emailNormalized,
+      name: profile.name ?? null,
+      emailVerified: true,
+      account: { key, email: profile.email, secret: profile.secret }
+    });
+    if (user) return signedIn(user);
+  }
+  return { ok: false, error: "temporarily_unavailable", message: "Please try again." };
+}
+
+// src/app.ts
+import { Hono } from "hono";
+import { deleteCookie as deleteCookie6, getCookie as getCookie6, setCookie as setCookie6 } from "hono/cookie";
+import { cors } from "hono/cors";
+
+// src/routes/helpers.ts
+async function body(c) {
+  const data = await c.req.json().catch(() => null);
+  return data && typeof data === "object" ? data : {};
+}
+function error(c, status, code, message) {
+  return c.json({ error: code, message }, status);
+}
+var unavailable = (c) => error(c, 503, "temporarily_unavailable", "E-mails can not be sent right now. Please try again later.");
+var smsUnavailable = (c) => error(c, 503, "temporarily_unavailable", "The SMS can not be sent right now. Please try again later.");
+function originHost(ctx, c) {
+  const origin = c.req.header("origin");
+  return URL.canParse(origin ?? "") ? new URL(origin).hostname : new URL(ctx.config.issuer).hostname;
+}
+var accepted = (c) => c.json({}, 202);
+var noSession = (c) => error(c, 401, "no_session", "Please sign in first.");
+function redirectTarget(ctx, c, value) {
+  const url = ctx.allowedUrl(value);
+  return url ?? error(c, 400, "invalid_options", "redirectTo must be an absolute URL whose origin is in ALLOWED_ORIGINS.");
+}
+var MAX_NAME_LENGTH = 100;
+function nameOf(value) {
+  return typeof value === "string" && value.trim() ? value.trim().slice(0, MAX_NAME_LENGTH) : null;
+}
+function signInAnswer(c, step) {
+  if ("disabled" in step) return error(c, 403, "method_disabled", "This way of signing in is switched off.");
+  if ("next" in step) {
+    const rest = { method: step.method, factors: step.factors };
+    if (step.next === "totp") return c.json({ error: "totp_required", message: "Enter the code from your authenticator app to finish signing in.", ...rest }, 401);
+    if (step.next === "sms") return c.json({ error: "sms_required", message: "Enter the code we sent to your phone to finish signing in.", ...rest }, 401);
+    return c.json({ error: "totp_setup_required", message: "Set up an authenticator app to finish signing in.", ...rest }, 401);
+  }
+  return c.json({ user: step.user });
+}
+
+// src/routes/emails.ts
+var MAIL_INTERVAL_MS = 60 * 1e3;
+var VERIFY_TTL_MS = 24 * 60 * 60 * 1e3;
+var RESET_TTL_MS = 30 * 60 * 1e3;
+var SIGNIN_TTL_MS = 15 * 60 * 1e3;
+var VERIFY_LINK_PARAM = "madauth_verify";
+var RESET_LINK_PARAM = "madauth_reset";
+var SIGNIN_LINK_PARAM = "madauth_signin";
+var LINKS = {
+  verify: { ttl: VERIFY_TTL_MS, param: VERIFY_LINK_PARAM, type: "email.send_verification" },
+  reset: { ttl: RESET_TTL_MS, param: RESET_LINK_PARAM, type: "email.send_password_reset" },
+  signin: { ttl: SIGNIN_TTL_MS, param: SIGNIN_LINK_PARAM, type: "email.send_signin_link" }
+};
+function createEmails(ctx, users, webhook) {
+  const sendEmail = async (user, type, data) => {
+    if (Date.now() - user.lastMailAt < MAIL_INTERVAL_MS) return true;
+    const result = await webhook.call(type, { to: user.email, user: { id: user.id, name: user.name ?? void 0 }, ...data }, WEBHOOK_TIMEOUT_MS);
+    if (!result.ok) {
+      console.error(`[madauth] Webhook "${type}" for ${user.email} failed: ${result.reason}`);
+      return false;
+    }
+    await users.updateUser(user.id, { lastMailAt: Date.now() });
+    return true;
+  };
+  return {
+    sendEmail,
+    async sendLinkEmail(user, purpose, target, locale) {
+      if (Date.now() - user.lastMailAt < MAIL_INTERVAL_MS) return true;
+      const { ttl, param, type } = LINKS[purpose];
+      const { token, code } = await users.issueVerification(user.id, purpose, ttl);
+      const link = new URL(target);
+      link.hash = `${param}=${token}`;
+      return sendEmail(user, type, { link: link.href, code, expiresAt: Date.now() + ttl, site: target.host, locale });
+    },
+    async sendAccountEmail(user, type, target, locale) {
+      if (!webhook.wants(type)) return true;
+      const methods = await users.signInMethods(user.id, await ctx.settings.methods());
+      return sendEmail(user, type, { link: target.href, site: target.host, locale, methods });
+    },
+    async consume(data, purpose) {
+      if (typeof data.token === "string" && data.token) {
+        return { userId: await users.consumeLinkToken(data.token, purpose), via: "link" };
+      }
+      if (isValidEmail(data.email) && typeof data.code === "string") {
+        const user = await users.findByEmail(normalizeEmail(data.email));
+        if (!user) return { userId: null, via: "code" };
+        return { ...await users.consumeCode(user, purpose, data.code.replace(/\s/g, "")), via: "code" };
+      }
+      return { userId: null, via: "code" };
+    },
+    invalidVerification(c, { via, locked }) {
+      if (locked) {
+        return error(c, 429, "codes_locked", "Too many wrong codes. Please ask for a new e-mail and use the link in it.");
+      }
+      return via === "link" ? error(c, 400, "link_invalid", "The link is invalid, expired or was already used.") : error(c, 400, "code_invalid", "The code is wrong or expired.");
+    }
+  };
+}
+
+// src/routes/email.ts
+function emailRoutes(app, ctx, users, webhook) {
+  const emails = createEmails(ctx, users, webhook);
+  const signUpMethod = async (userId) => await users.passwordAccount(userId) ? "password" : "totp";
+  app.post("/auth/email/send-verification", async (c) => {
+    const data = await body(c);
+    const target = redirectTarget(ctx, c, data.redirectTo);
+    if (target instanceof Response) return target;
+    if (!isValidEmail(data.email)) return error(c, 400, "invalid_email", "This is not a valid e-mail address.");
+    const user = await users.findByEmail(normalizeEmail(data.email));
+    if (user && !user.emailVerified && await ctx.enabled(c, await signUpMethod(user.id))) {
+      if (!await emails.sendLinkEmail(user, "verify", target, localeOf(data.locale))) return unavailable(c);
+    }
+    return accepted(c);
+  });
+  const disabled = (c) => error(c, 403, "method_disabled", "This way of signing in is switched off.");
+  app.post("/auth/email/verify", async (c) => {
+    const data = await body(c);
+    const waiting = typeof data.token === "string" && data.token ? await users.peekLinkToken(data.token, "verify") : isValidEmail(data.email) ? (await users.findByEmail(normalizeEmail(data.email)))?.id ?? null : null;
+    if (waiting && !await ctx.enabled(c, await signUpMethod(waiting))) return disabled(c);
+    const consumed = await emails.consume(data, "verify");
+    const { userId, via } = consumed;
+    const user = userId ? await users.findById(userId) : null;
+    if (!user) return emails.invalidVerification(c, consumed);
+    const method = await signUpMethod(user.id);
+    if (!await ctx.enabled(c, method)) return disabled(c);
+    if (!user.emailVerified) await users.dropUnprovenAccounts(user.id, method === "password" ? "password" : void 0);
+    await users.updateUser(user.id, { emailVerified: true, wrongCodes: 0 });
+    const verified = { ...user.emailVerified ? user : await users.reopenSignUp(user), emailVerified: true, wrongCodes: 0 };
+    await ctx.emit("user.email_verified", { user: toMadauthUser(verified), method, via });
+    return signInAnswer(c, await ctx.secondStep(c, verified, method === "password" ? ["pwd"] : [], method));
+  });
+}
+
+// src/routes/email-link.ts
+function emailLinkRoutes(app, ctx, users, webhook) {
+  const emails = createEmails(ctx, users, webhook);
+  app.use("/auth/email-link/*", async (c, next) => {
+    if (!await ctx.enabled(c, "email-link")) {
+      return error(c, 403, "method_disabled", "Signing in with an e-mail link is switched off.");
+    }
+    await next();
+  });
+  app.post("/auth/email-link/send", async (c) => {
+    const data = await body(c);
+    const target = redirectTarget(ctx, c, data.redirectTo);
+    if (target instanceof Response) return target;
+    if (!isValidEmail(data.email)) return error(c, 400, "invalid_email", "This is not a valid e-mail address.");
+    const email = data.email.trim();
+    const locale = localeOf(data.locale);
+    const send = async (user2) => await emails.sendLinkEmail(user2, "signin", target, locale) ? accepted(c) : unavailable(c);
+    const existing = await users.findByEmail(normalizeEmail(email));
+    if (existing && await users.emailLinkAccount(existing.id)) return send(existing);
+    if (existing?.emailVerified && await users.hasSignInMethod(existing.id)) {
+      return await emails.sendAccountEmail(existing, "email.send_already_registered", target, locale) ? accepted(c) : unavailable(c);
+    }
+    const check = await ctx.checkSignup({ email, locale, method: "email-link" });
+    if (!check.ok) return check.reason === "rejected" ? error(c, 403, "signup_rejected", check.message) : unavailable(c);
+    if (existing) {
+      if (Date.now() - existing.lastMailAt < MAIL_INTERVAL_MS) return accepted(c);
+      if (!existing.emailVerified) await users.dropUnprovenAccounts(existing.id, "email-link");
+      if (!await users.linkAccount(existing.id, { key: emailLinkAccountKey(existing.id) })) return accepted(c);
+      return send(await users.reopenSignUp(existing));
+    }
+    const user = await users.createUser({
+      email,
+      emailNormalized: normalizeEmail(email),
+      name: null,
+      emailVerified: false,
+      account: (userId) => ({ key: emailLinkAccountKey(userId) })
+    });
+    if (!user) return accepted(c);
+    return send(user);
+  });
+  app.post("/auth/email-link/verify", async (c) => {
+    const consumed = await emails.consume(await body(c), "signin");
+    const found = consumed.userId ? await users.findById(consumed.userId) : null;
+    if (!found || !await users.emailLinkAccount(found.id)) return emails.invalidVerification(c, consumed);
+    const user = found.emailVerified ? found : await users.reopenSignUp(found);
+    if (!user.emailVerified) {
+      await users.verifyByProvider(user, "email-link");
+      await ctx.emit("user.email_verified", { user: toMadauthUser({ ...user, emailVerified: true }), method: "email-link", via: consumed.via });
+    } else {
+      await users.updateUser(user.id, { wrongCodes: 0 });
+    }
+    const verified = { ...user, emailVerified: true, wrongCodes: 0 };
+    return signInAnswer(c, await ctx.secondStep(c, verified, ["email"], "email-link"));
+  });
+}
+
+// src/crypto.ts
+import { createCipheriv, createDecipheriv, hkdfSync, randomBytes } from "crypto";
+var ENCRYPTION_VERSION = "v1";
+var IV_BYTES = 12;
+var TAG_BYTES = 16;
+function deriveKey(signingKeyD, info) {
+  return Buffer.from(hkdfSync("sha256", Buffer.from(signingKeyD, "base64url"), "", info, 32));
+}
+function encrypt(key, secret) {
+  const iv = randomBytes(IV_BYTES);
+  const cipher = createCipheriv("aes-256-gcm", key, iv);
+  const encrypted = Buffer.concat([cipher.update(secret), cipher.final()]);
+  const parts = [iv, encrypted, cipher.getAuthTag()].map((part) => part.toString("base64url"));
+  return [ENCRYPTION_VERSION, ...parts].join(".");
+}
+function decrypt(key, stored) {
+  const [version, iv, encrypted, tag, ...rest] = stored.split(".");
+  if (version !== ENCRYPTION_VERSION || !iv || !encrypted || !tag || rest.length) return null;
+  const ivBytes = Buffer.from(iv, "base64url");
+  const tagBytes = Buffer.from(tag, "base64url");
+  if (ivBytes.length !== IV_BYTES || tagBytes.length !== TAG_BYTES) return null;
+  try {
+    const decipher = createDecipheriv("aes-256-gcm", key, ivBytes);
+    decipher.setAuthTag(tagBytes);
+    return Buffer.concat([decipher.update(Buffer.from(encrypted, "base64url")), decipher.final()]);
+  } catch {
+    return null;
+  }
+}
+
+// src/github.ts
+var TOKEN_ENDPOINT = "https://github.com/login/oauth/access_token";
+var API = "https://api.github.com";
+var API_VERSION = "2022-11-28";
+var USER_AGENT = "madauth";
+var NOREPLY_DOMAIN = "@users.noreply.github.com";
+var TIMEOUT_MS = 1e4;
+var REVOKE_TIMEOUT_MS = 5e3;
+function deriveTokenKey(signingKeyD) {
+  return deriveKey(signingKeyD, "madauth provider token");
+}
+var apiHeaders = (token) => ({
+  Authorization: `Bearer ${token}`,
+  Accept: "application/vnd.github+json",
+  "X-GitHub-Api-Version": API_VERSION,
+  "User-Agent": USER_AGENT
+});
+async function exchangeGitHubCode(app, code, redirectUri, verifier) {
+  try {
+    const res = await fetch(TOKEN_ENDPOINT, {
+      method: "POST",
+      headers: { Accept: "application/json", "Content-Type": "application/x-www-form-urlencoded", "User-Agent": USER_AGENT },
+      body: new URLSearchParams({
+        client_id: app.clientId,
+        client_secret: app.clientSecret,
+        code,
+        redirect_uri: redirectUri,
+        code_verifier: verifier
+      }),
+      signal: AbortSignal.timeout(TIMEOUT_MS)
+    });
+    if (!res.ok) {
+      await res.body?.cancel();
+      return null;
+    }
+    const body2 = await res.json();
+    return typeof body2.access_token === "string" && body2.access_token ? body2.access_token : null;
+  } catch {
+    return null;
+  }
+}
+async function fetchGitHubAccount(token) {
+  const failed = (reason) => ({ ok: false, error: "verification_failed", reason });
+  let user;
+  let emails;
+  try {
+    const [userRes, emailsRes] = await Promise.all([
+      fetch(`${API}/user`, { headers: apiHeaders(token), signal: AbortSignal.timeout(TIMEOUT_MS) }),
+      fetch(`${API}/user/emails`, { headers: apiHeaders(token), signal: AbortSignal.timeout(TIMEOUT_MS) })
+    ]);
+    if (!userRes.ok || !emailsRes.ok) {
+      await Promise.all([userRes.body?.cancel(), emailsRes.body?.cancel()]);
+      return failed(!userRes.ok ? `GET /user answered ${userRes.status}` : `GET /user/emails answered ${emailsRes.status}`);
+    }
+    user = await userRes.json();
+    emails = await emailsRes.json();
+  } catch (e) {
+    return failed(e.message);
+  }
+  const id = typeof user.id === "number" ? String(user.id) : typeof user.id === "string" ? user.id : "";
+  if (!id || typeof user.login !== "string") return failed("GET /user did not return an account");
+  if (!Array.isArray(emails)) return failed("GET /user/emails did not return a list");
+  const verified = emails.filter((e) => typeof e.email === "string" && e.email && e.verified === true && !e.email.endsWith(NOREPLY_DOMAIN));
+  const address = verified.find((e) => e.primary === true) ?? verified[0];
+  if (!address) return { ok: false, error: "email_unverified", reason: "the GitHub account has no verified e-mail address" };
+  const account = {
+    id,
+    email: address.email,
+    name: typeof user.name === "string" && user.name.trim() ? user.name.trim() : user.login
+  };
+  if (typeof user.avatar_url === "string" && user.avatar_url) account.picture = user.avatar_url;
+  return { ok: true, account };
+}
+async function revokeGitHubGrant(app, token) {
+  try {
+    const res = await fetch(`${API}/applications/${encodeURIComponent(app.clientId)}/grant`, {
+      method: "DELETE",
+      headers: {
+        Authorization: `Basic ${Buffer.from(`${app.clientId}:${app.clientSecret}`).toString("base64")}`,
+        Accept: "application/vnd.github+json",
+        "Content-Type": "application/json",
+        "X-GitHub-Api-Version": API_VERSION,
+        "User-Agent": USER_AGENT
+      },
+      body: JSON.stringify({ access_token: token }),
+      signal: AbortSignal.timeout(REVOKE_TIMEOUT_MS)
+    });
+    await res.body?.cancel();
+    return res.status;
+  } catch {
+    return null;
+  }
+}
+
+// src/routes/github.ts
+var GITHUB_AUTH_ENDPOINT = "https://github.com/login/oauth/authorize";
+var COOKIE_PATH = "/auth/github";
+var GITHUB = { method: "github", name: "GitHub" };
+function githubRoutes(app, ctx, github, tokenKey) {
+  const callbackUrl = `${ctx.config.issuer}/auth/github/callback`;
+  app.get("/auth/github/start", async (c) => {
+    const returnUrl = ctx.allowedUrl(c.req.query("return_to"));
+    if (!returnUrl) return c.text("return_to must be an absolute URL whose origin is in ALLOWED_ORIGINS", 400);
+    if (!await ctx.enabled(c, "github")) return redirectBack(c, returnUrl.href, "github")("method_disabled");
+    const oauth = await startOAuth(c, ctx, COOKIE_PATH, returnUrl);
+    const url = new URL(GITHUB_AUTH_ENDPOINT);
+    url.search = new URLSearchParams({
+      client_id: github.clientId,
+      redirect_uri: callbackUrl,
+      // Only the addresses: the profile's id, name and picture come with any token.
+      scope: "user:email",
+      state: oauth.state,
+      code_challenge: await pkceChallenge(oauth.verifier),
+      code_challenge_method: "S256"
+    }).toString();
+    return c.redirect(url.href, 302);
+  });
+  app.get("/auth/github/callback", async (c) => {
+    const oauth = await takeOAuthState(c, ctx, COOKIE_PATH);
+    if (!oauth) return c.text("Sign-in expired or was started in another browser. Please try again.", 400);
+    const back = redirectBack(c, oauth.returnTo, "github");
+    if (!await ctx.enabled(c, "github")) return back("method_disabled");
+    if (c.req.query("error")) return back(c.req.query("error") === "access_denied" ? "cancelled" : "verification_failed");
+    const code = c.req.query("code");
+    if (!code || c.req.query("state") !== oauth.state) return back("verification_failed");
+    const token = await exchangeGitHubCode(github, code, callbackUrl, oauth.verifier);
+    if (!token) return back("verification_failed");
+    const result = await fetchGitHubAccount(token);
+    if (!result.ok) return back(result.error);
+    const { account } = result;
+    const resolved = await resolveProviderUser(
+      ctx,
+      GITHUB,
+      { key: githubAccountKey(account.id), email: account.email, name: account.name, secret: encrypt(tokenKey, Buffer.from(token)) },
+      oauth.locale
+    );
+    if (!resolved.ok) return back(resolved.error);
+    const step = await ctx.secondStep(c, resolved.user, ["github"], "github", { name: account.name, picture: account.picture });
+    if ("disabled" in step) return back("method_disabled");
+    if ("next" in step) return back(void 0, step.next, step.factors);
+    return back();
+  });
+}
+async function revokeGrant(github, tokenKey, account) {
+  if (!account) return;
+  const token = account.secret ? decrypt(tokenKey, account.secret) : null;
+  if (!token) {
+    console.error(`[madauth] The GitHub token of user ${account.userId} can't be read (was MADAUTH_SIGNING_KEY changed?): the authorization stays at GitHub until the user removes it.`);
+    return;
+  }
+  const status = await revokeGitHubGrant(github, token.toString());
+  if (status !== 204 && status !== 404) {
+    console.error(`[madauth] GitHub did not revoke the authorization of user ${account.userId}${status ? ` (HTTP ${status})` : ""}: it stays until the user removes it.`);
+  }
+}
+
+// src/routes/google.ts
+import { deleteCookie as deleteCookie2, getCookie as getCookie2, setCookie as setCookie2 } from "hono/cookie";
 
 // src/google.ts
 import { createRemoteJWKSet, jwtVerify } from "jose";
@@ -94,109 +594,26 @@ async function verifyGoogleIdToken(idToken, opts) {
   return { ok: true, profile };
 }
 
-// src/routes/helpers.ts
-async function body(c) {
-  const data = await c.req.json().catch(() => null);
-  return data && typeof data === "object" ? data : {};
-}
-function error(c, status, code, message) {
-  return c.json({ error: code, message }, status);
-}
-var unavailable = (c) => error(c, 503, "temporarily_unavailable", "E-mails can not be sent right now. Please try again later.");
-var accepted = (c) => c.json({}, 202);
-var noSession = (c) => error(c, 401, "no_session", "Please sign in first.");
-function redirectTarget(ctx, c, value) {
-  const url = ctx.allowedUrl(value);
-  return url ?? error(c, 400, "invalid_options", "redirectTo must be an absolute URL whose origin is in ALLOWED_ORIGINS.");
-}
-var MAX_NAME_LENGTH = 100;
-function nameOf(value) {
-  return typeof value === "string" && value.trim() ? value.trim().slice(0, MAX_NAME_LENGTH) : null;
-}
-function signInAnswer(c, step) {
-  if ("disabled" in step) return error(c, 403, "method_disabled", "This way of signing in is switched off.");
-  if ("next" in step) {
-    return step.next === "totp" ? c.json({ error: "totp_required", message: "Enter the code from your authenticator app to finish signing in.", method: step.method }, 401) : c.json({ error: "totp_setup_required", message: "Set up an authenticator app to finish signing in.", method: step.method }, 401);
-  }
-  return c.json({ user: step.user });
-}
-
 // src/routes/google.ts
 var NONCE_COOKIE = "madauth_nonce";
 var NONCE_TYP = "madauth-nonce+jwt";
 var NONCE_TTL = 5 * 60;
-var OAUTH_COOKIE = "madauth_oauth";
-var OAUTH_TYP = "madauth-oauth-state+jwt";
-var OAUTH_TTL = 10 * 60;
+var COOKIE_PATH2 = "/auth/google";
 var GOOGLE_AUTH_ENDPOINT = "https://accounts.google.com/o/oauth2/v2/auth";
 var GOOGLE_TOKEN_ENDPOINT = "https://oauth2.googleapis.com/token";
-var REDIRECT_ERROR_PARAM = "madauth_error";
-var REDIRECT_NEXT_PARAM = "madauth_next";
-async function pkceChallenge(verifier) {
-  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
-  return base64url.encode(new Uint8Array(digest));
-}
+var GOOGLE = { method: "google", name: "Google" };
+var toProfile = (profile) => ({ key: googleAccountKey(profile.sub), email: profile.email, name: profile.name });
 function googleRoutes(app, ctx, google) {
-  const { config, keys, secure, users } = ctx;
+  const { config, keys, secure } = ctx;
   const { issuer } = config;
   const callbackUrl = `${issuer}/auth/google/callback`;
-  const resolveUser = async (profile, locale) => {
-    const key = googleAccountKey(profile.sub);
-    const emailNormalized = normalizeEmail(profile.email);
-    const signedIn = (user) => ({ ok: true, user });
-    const account = await users.findAccountByKey(key);
-    if (account) {
-      const user = await users.findById(account.userId);
-      if (user) {
-        if (account.email !== profile.email) await users.updateAccount(account.id, { email: profile.email });
-        return signedIn(user);
-      }
-      await users.deleteAccount(account.id);
-    }
-    for (let attempt = 0; attempt < 2; attempt++) {
-      const existing = await users.findByEmail(emailNormalized);
-      if (existing) {
-        if (existing.emailVerified && await users.hasAccounts(existing.id)) {
-          const methods = await users.signInMethods(existing.id, await ctx.settings.methods());
-          const how = methods.map((method) => ({ password: "a password", totp: "an authenticator app", google: "Google" })[method]).join(" or ");
-          return { ok: false, error: "other_method", message: `This e-mail address signs in with ${how || "another method"}. Use that instead of Google.`, methods };
-        }
-        await users.verifyByProvider(existing);
-        if (!await users.linkAccount(existing.id, { key, email: profile.email })) {
-          const linked = await users.findAccountByKey(key);
-          const owner = linked && await users.findById(linked.userId);
-          if (!owner) return { ok: false, error: "temporarily_unavailable", message: "Please try again." };
-          return signedIn(owner);
-        }
-        return signedIn(existing);
-      }
-      if (attempt === 0) {
-        const check = await ctx.checkSignup({ email: profile.email, name: profile.name, locale, method: "google" });
-        if (!check.ok) {
-          return check.reason === "rejected" ? { ok: false, error: "signup_rejected", message: check.message } : { ok: false, error: "temporarily_unavailable", message: "Signing up is not possible right now. Please try again later." };
-        }
-      }
-      const user = await users.createUser({
-        email: profile.email,
-        emailNormalized,
-        name: profile.name ?? null,
-        emailVerified: true,
-        account: { key, email: profile.email }
-      });
-      if (user) {
-        await ctx.emit("user.created", { user: toMadauthUser(user), method: "google" });
-        return signedIn(user);
-      }
-    }
-    return { ok: false, error: "temporarily_unavailable", message: "Please try again." };
-  };
   const disabled = (c) => c.json({ error: "method_disabled", message: "Google sign-in is switched off." }, 403);
   app.post("/auth/google/nonce", async (c) => {
     if (!await ctx.enabled(c, "google")) return disabled(c);
     const nonce = randomString();
     const token = await signToken(await keys, issuer, NONCE_TYP, { nonce }, NONCE_TTL);
-    setCookie(c, NONCE_COOKIE, token, {
-      path: "/auth/google",
+    setCookie2(c, NONCE_COOKIE, token, {
+      path: COOKIE_PATH2,
       httpOnly: true,
       secure,
       sameSite: "Strict",
@@ -210,7 +627,7 @@ function googleRoutes(app, ctx, google) {
     if (typeof body2.credential !== "string" || !body2.credential) {
       return c.json({ error: "verification_failed", message: "credential is missing" }, 400);
     }
-    const nonceClaims = await readToken(await keys, issuer, NONCE_TYP, getCookie(c, NONCE_COOKIE));
+    const nonceClaims = await readToken(await keys, issuer, NONCE_TYP, getCookie2(c, NONCE_COOKIE));
     if (!nonceClaims) {
       return c.json({ error: "verification_failed", message: "nonce cookie missing or expired" }, 401);
     }
@@ -222,8 +639,8 @@ function googleRoutes(app, ctx, google) {
     if (!result.ok) {
       return c.json({ error: result.error, message: result.reason }, result.error === "email_unverified" ? 403 : 401);
     }
-    deleteCookie(c, NONCE_COOKIE, { path: "/auth/google", secure });
-    const resolved = await resolveUser(result.profile, localeOf(body2.locale));
+    deleteCookie2(c, NONCE_COOKIE, { path: COOKIE_PATH2, secure });
+    const resolved = await resolveProviderUser(ctx, GOOGLE, toProfile(result.profile), localeOf(body2.locale));
     if (!resolved.ok) {
       if (resolved.error === "other_method") return c.json({ error: resolved.error, message: resolved.message, methods: resolved.methods }, 403);
       return c.json({ error: resolved.error, message: resolved.message }, resolved.error === "signup_rejected" ? 403 : 503);
@@ -232,27 +649,13 @@ function googleRoutes(app, ctx, google) {
   });
   const requireCodeFlow = async (c, next) => {
     if (!google.clientSecret) return c.json({ error: "not_found" }, 404);
-    if (!await ctx.enabled(c, "google")) return disabled(c);
     await next();
   };
   app.get("/auth/google/start", requireCodeFlow, async (c) => {
     const returnUrl = ctx.allowedUrl(c.req.query("return_to"));
     if (!returnUrl) return c.text("return_to must be an absolute URL whose origin is in ALLOWED_ORIGINS", 400);
-    const oauth = {
-      state: randomString(),
-      nonce: randomString(),
-      verifier: randomString(),
-      returnTo: returnUrl.href,
-      locale: localeOf(c.req.query("locale"))
-    };
-    const token = await signToken(await keys, issuer, OAUTH_TYP, { ...oauth }, OAUTH_TTL);
-    setCookie(c, OAUTH_COOKIE, token, {
-      path: "/auth/google",
-      httpOnly: true,
-      secure,
-      sameSite: "Lax",
-      maxAge: OAUTH_TTL
-    });
+    if (!await ctx.enabled(c, "google")) return redirectBack(c, returnUrl.href, "google")("method_disabled");
+    const oauth = await startOAuth(c, ctx, COOKIE_PATH2, returnUrl);
     const url = new URL(GOOGLE_AUTH_ENDPOINT);
     url.search = new URLSearchParams({
       client_id: google.clientId,
@@ -267,15 +670,10 @@ function googleRoutes(app, ctx, google) {
     return c.redirect(url.href, 302);
   });
   app.get("/auth/google/callback", requireCodeFlow, async (c) => {
-    const oauth = await readToken(await keys, issuer, OAUTH_TYP, getCookie(c, OAUTH_COOKIE));
+    const oauth = await takeOAuthState(c, ctx, COOKIE_PATH2);
     if (!oauth) return c.text("Sign-in expired or was started in another browser. Please try again.", 400);
-    deleteCookie(c, OAUTH_COOKIE, { path: "/auth/google", secure });
-    const back = (error2, next) => {
-      const url = new URL(oauth.returnTo);
-      if (error2) url.hash = `${REDIRECT_ERROR_PARAM}=${error2}`;
-      if (next) url.hash = `${REDIRECT_NEXT_PARAM}=${next}`;
-      return c.redirect(url.href, 302);
-    };
+    const back = redirectBack(c, oauth.returnTo, "google");
+    if (!await ctx.enabled(c, "google")) return back("method_disabled");
     if (c.req.query("error")) return back(c.req.query("error") === "access_denied" ? "cancelled" : "verification_failed");
     const code = c.req.query("code");
     if (!code || c.req.query("state") !== oauth.state) return back("verification_failed");
@@ -305,111 +703,15 @@ function googleRoutes(app, ctx, google) {
       keys: config.jwksResolver
     });
     if (!result.ok) return back(result.error);
-    const resolved = await resolveUser(result.profile, typeof oauth.locale === "string" ? oauth.locale : void 0);
+    const resolved = await resolveProviderUser(ctx, GOOGLE, toProfile(result.profile), oauth.locale);
     if (!resolved.ok) return back(resolved.error);
     const step = await ctx.secondStep(c, resolved.user, ["google"], "google", result.profile);
     if ("disabled" in step) return back("method_disabled");
-    if ("next" in step) return back(void 0, step.next);
+    if ("next" in step) return back(void 0, step.next, step.factors);
     return back();
   });
 }
 
-// src/app.ts
-import { Hono } from "hono";
-import { deleteCookie as deleteCookie3, getCookie as getCookie3, setCookie as setCookie3 } from "hono/cookie";
-import { cors } from "hono/cors";
-
-// src/routes/emails.ts
-var MAIL_INTERVAL_MS = 60 * 1e3;
-var VERIFY_TTL_MS = 24 * 60 * 60 * 1e3;
-var RESET_TTL_MS = 30 * 60 * 1e3;
-var VERIFY_LINK_PARAM = "madauth_verify";
-var RESET_LINK_PARAM = "madauth_reset";
-function createEmails(ctx, users, webhook) {
-  const sendEmail = async (user, type, data) => {
-    if (Date.now() - user.lastMailAt < MAIL_INTERVAL_MS) return true;
-    const result = await webhook.call(type, { to: user.email, user: { id: user.id, name: user.name ?? void 0 }, ...data }, WEBHOOK_TIMEOUT_MS);
-    if (!result.ok) {
-      console.error(`[madauth] Webhook "${type}" for ${user.email} failed: ${result.reason}`);
-      return false;
-    }
-    await users.updateUser(user.id, { lastMailAt: Date.now() });
-    return true;
-  };
-  return {
-    sendEmail,
-    async sendLinkEmail(user, purpose, target, locale) {
-      if (Date.now() - user.lastMailAt < MAIL_INTERVAL_MS) return true;
-      const ttl = purpose === "verify" ? VERIFY_TTL_MS : RESET_TTL_MS;
-      const { token, code } = await users.issueVerification(user.id, purpose, ttl);
-      const link = new URL(target);
-      link.hash = `${purpose === "verify" ? VERIFY_LINK_PARAM : RESET_LINK_PARAM}=${token}`;
-      return sendEmail(user, purpose === "verify" ? "email.verify" : "email.reset", {
-        link: link.href,
-        code,
-        expiresAt: Date.now() + ttl,
-        site: target.host,
-        locale
-      });
-    },
-    async sendAccountEmail(user, type, target, locale) {
-      if (!webhook.wants(type)) return true;
-      const methods = await users.signInMethods(user.id, await ctx.settings.methods());
-      return sendEmail(user, type, { link: target.href, site: target.host, locale, methods });
-    },
-    async consume(data, purpose) {
-      if (typeof data.token === "string" && data.token) {
-        return { userId: await users.consumeLinkToken(data.token, purpose), via: "link" };
-      }
-      if (isValidEmail(data.email) && typeof data.code === "string") {
-        const user = await users.findByEmail(normalizeEmail(data.email));
-        if (!user) return { userId: null, via: "code" };
-        return { ...await users.consumeCode(user, purpose, data.code.replace(/\s/g, "")), via: "code" };
-      }
-      return { userId: null, via: "code" };
-    },
-    invalidVerification(c, { via, locked }) {
-      if (locked) {
-        return error(c, 429, "codes_locked", "Too many wrong codes. Please ask for a new e-mail and use the link in it.");
-      }
-      return via === "link" ? error(c, 400, "link_invalid", "The link is invalid, expired or was already used.") : error(c, 400, "code_invalid", "The code is wrong or expired.");
-    }
-  };
-}
-
-// src/routes/email.ts
-function emailRoutes(app, ctx, users, webhook) {
-  const emails = createEmails(ctx, users, webhook);
-  const signUpMethod = async (userId) => await users.passwordAccount(userId) ? "password" : "totp";
-  app.post("/auth/email/send-verification", async (c) => {
-    const data = await body(c);
-    const target = redirectTarget(ctx, c, data.redirectTo);
-    if (target instanceof Response) return target;
-    if (!isValidEmail(data.email)) return error(c, 400, "invalid_email", "This is not a valid e-mail address.");
-    const user = await users.findByEmail(normalizeEmail(data.email));
-    if (user && !user.emailVerified && await ctx.enabled(c, await signUpMethod(user.id))) {
-      if (!await emails.sendLinkEmail(user, "verify", target, localeOf(data.locale))) return unavailable(c);
-    }
-    return accepted(c);
-  });
-  const disabled = (c) => error(c, 403, "method_disabled", "This way of signing in is switched off.");
-  app.post("/auth/email/verify", async (c) => {
-    const data = await body(c);
-    const waiting = typeof data.token === "string" && data.token ? await users.peekLinkToken(data.token, "verify") : isValidEmail(data.email) ? (await users.findByEmail(normalizeEmail(data.email)))?.id ?? null : null;
-    if (waiting && !await ctx.enabled(c, await signUpMethod(waiting))) return disabled(c);
-    const consumed = await emails.consume(data, "verify");
-    const { userId, via } = consumed;
-    const user = userId ? await users.findById(userId) : null;
-    if (!user) return emails.invalidVerification(c, consumed);
-    const method = await signUpMethod(user.id);
-    if (!await ctx.enabled(c, method)) return disabled(c);
-    await users.updateUser(user.id, { emailVerified: true, wrongCodes: 0 });
-    const verified = { ...user, emailVerified: true, wrongCodes: 0 };
-    await ctx.emit("email.verified", { user: toMadauthUser(verified), via });
-    return signInAnswer(c, await ctx.secondStep(c, verified, method === "password" ? ["pwd"] : [], method));
-  });
-}
-
 // src/routes/lockout.ts
 var FREE_ATTEMPTS = 5;
 var MAX_LOCK_MS = 15 * 60 * 1e3;
@@ -428,8 +730,16 @@ async function countSignInAttempt(c, users, account, now = Date.now()) {
 }
 
 // src/routes/password.ts
-function passwordRoutes(app, ctx, password, users, webhook) {
-  const { minLength } = password;
+function weakPassword(c, problem) {
+  const { message, ...details } = problem;
+  return c.json({ error: "weak_password", message, ...details }, 400);
+}
+function passwordRoutes(app, ctx, users, webhook) {
+  const refused = async (c, password, userInputs) => {
+    const words = userInputs.filter((word) => !!word);
+    const problem = await checkPasswordPolicy(password, await ctx.settings.passwordRules(), words);
+    return problem ? weakPassword(c, problem) : null;
+  };
   const emails = createEmails(ctx, users, webhook);
   app.use("/auth/password/*", async (c, next) => {
     if (!await ctx.enabled(c, "password")) return error(c, 403, "method_disabled", "E-mail & password sign-in is switched off.");
@@ -446,8 +756,8 @@ function passwordRoutes(app, ctx, password, users, webhook) {
       await verifyAgainstDummy(pw);
       return wrong();
     }
-    const refused = await countSignInAttempt(c, users, account);
-    if (refused) return refused;
+    const refused2 = await countSignInAttempt(c, users, account);
+    if (refused2) return refused2;
     const { ok, needsRehash } = await verifyPassword(pw, account.secret);
     if (!ok) return wrong();
     await users.updateAccount(account.id, {
@@ -465,23 +775,29 @@ function passwordRoutes(app, ctx, password, users, webhook) {
     const target = redirectTarget(ctx, c, data.redirectTo);
     if (target instanceof Response) return target;
     if (!isValidEmail(data.email)) return error(c, 400, "invalid_email", "This is not a valid e-mail address.");
-    const policy = checkPasswordPolicy(data.password, minLength);
-    if (policy) return error(c, 400, "weak_password", policy);
     const name = nameOf(data.name);
     const email = data.email.trim();
+    const weak = await refused(c, data.password, [email, name]);
+    if (weak) return weak;
     const locale = localeOf(data.locale);
     const check = await ctx.checkSignup({ email, name: name ?? void 0, locale, method: "password" });
     if (!check.ok) return check.reason === "rejected" ? error(c, 403, "signup_rejected", check.message) : unavailable(c);
     const passwordHash = await hashPassword(data.password);
     const existing = await users.findByEmail(normalizeEmail(email));
-    if (existing?.emailVerified && await users.hasAccounts(existing.id)) {
-      return await emails.sendAccountEmail(existing, "email.already_registered", target, locale) ? accepted(c) : unavailable(c);
+    if (existing?.emailVerified && await users.hasSignInMethod(existing.id)) {
+      return await emails.sendAccountEmail(existing, "email.send_already_registered", target, locale) ? accepted(c) : unavailable(c);
     }
     if (existing) {
       if (Date.now() - existing.lastMailAt < MAIL_INTERVAL_MS) return accepted(c);
+      if (!existing.emailVerified) await users.dropUnprovenAccounts(existing.id, "password");
+      if (existing.emailVerified) await users.updateUser(existing.id, { emailVerified: false });
       const account = await users.passwordAccount(existing.id);
       if (account) await users.updateAccount(account.id, { secret: passwordHash, failedAttempts: 0, lockedUntil: 0 });
-      else await users.linkAccount(existing.id, { key: passwordAccountKey(existing.id), secret: passwordHash });
+      else if (!await users.linkAccount(existing.id, { key: passwordAccountKey(existing.id), secret: passwordHash })) {
+        if (existing.emailVerified && !await users.passwordAccount(existing.id)) await users.updateUser(existing.id, { emailVerified: true });
+        return accepted(c);
+      }
+      await users.reopenSignUp(existing);
       await users.updateUser(existing.id, { name });
       return await emails.sendLinkEmail({ ...existing, name }, "verify", target, locale) ? accepted(c) : unavailable(c);
     }
@@ -493,7 +809,6 @@ function passwordRoutes(app, ctx, password, users, webhook) {
       account: (userId) => ({ key: passwordAccountKey(userId), secret: passwordHash })
     });
     if (!user) return accepted(c);
-    await ctx.emit("user.created", { user: toMadauthUser(user), method: "password" });
     return await emails.sendLinkEmail(user, "verify", target, locale) ? accepted(c) : unavailable(c);
   });
   app.post("/auth/password/send-reset", async (c) => {
@@ -506,14 +821,14 @@ function passwordRoutes(app, ctx, password, users, webhook) {
     if (user && await users.passwordAccount(user.id)) {
       if (!await emails.sendLinkEmail(user, "reset", target, locale)) return unavailable(c);
     } else if (user) {
-      if (!await emails.sendAccountEmail(user, "email.no_password", target, locale)) return unavailable(c);
+      if (!await emails.sendAccountEmail(user, "email.send_password_reset_no_password", target, locale)) return unavailable(c);
     }
     return accepted(c);
   });
   app.post("/auth/password/reset", async (c) => {
     const data = await body(c);
-    const policy = checkPasswordPolicy(data.password, minLength);
-    if (policy) return error(c, 400, "weak_password", policy);
+    const weak = await refused(c, data.password, [isValidEmail(data.email) ? data.email.trim() : null]);
+    if (weak) return weak;
     const consumed = await emails.consume(data, "reset");
     const user = consumed.userId ? await users.findById(consumed.userId) : null;
     const account = user ? await users.passwordAccount(user.id) : null;
@@ -523,17 +838,216 @@ function passwordRoutes(app, ctx, password, users, webhook) {
     const sessionVersion = user.sessionVersion + 1;
     await users.updateUser(user.id, { emailVerified: true, sessionVersion, wrongCodes: 0 });
     await users.clearVerifications(user.id);
-    const reset = { ...user, emailVerified: true, sessionVersion, wrongCodes: 0 };
-    await ctx.emit("email.password_reset", { user: toMadauthUser(reset) });
+    const reset = { ...user.emailVerified ? user : await users.reopenSignUp(user), emailVerified: true, sessionVersion, wrongCodes: 0 };
+    await ctx.emit("user.password_reset", { user: toMadauthUser(reset) });
     return signInAnswer(c, await ctx.secondStep(c, reset, ["pwd"], "password"));
   });
 }
 
+// src/routes/challenge.ts
+import { deleteCookie as deleteCookie3, getCookie as getCookie3, setCookie as setCookie3 } from "hono/cookie";
+var CHALLENGE_COOKIE = "madauth_challenge";
+var CHALLENGE_TYP = "madauth-challenge+jwt";
+var CHALLENGE_TTL = 10 * 60;
+var COOKIE_PATH3 = "/auth";
+var LEGACY_COOKIE_PATH = "/auth/totp";
+var cookieOptions = (secure) => ({ path: COOKIE_PATH3, httpOnly: true, secure, sameSite: "Strict" });
+async function setChallenge(c, ctx, challenge) {
+  const token = await signToken(await ctx.keys, ctx.config.issuer, CHALLENGE_TYP, { ...challenge }, CHALLENGE_TTL);
+  setCookie3(c, CHALLENGE_COOKIE, token, { ...cookieOptions(ctx.secure), maxAge: CHALLENGE_TTL });
+}
+function clearChallenge(c, secure) {
+  deleteCookie3(c, CHALLENGE_COOKIE, cookieOptions(secure));
+  deleteCookie3(c, CHALLENGE_COOKIE, { ...cookieOptions(secure), path: LEGACY_COOKIE_PATH });
+}
+async function readChallenge(c, ctx, step) {
+  const claims = await readToken(await ctx.keys, ctx.config.issuer, CHALLENGE_TYP, getCookie3(c, CHALLENGE_COOKIE));
+  if (!claims || typeof claims.sub !== "string" || !Array.isArray(claims.amr)) return null;
+  const factors = Array.isArray(claims.factors) ? claims.factors : [];
+  const fits = step === "totp-setup" ? claims.next === "totp-setup" : factors.includes(step);
+  return fits ? claims : null;
+}
+var methodStillOn = async (c, ctx, challenge) => isOn(challenge.method, ctx.configured, await ctx.methods(c));
+var methodOff = (c) => error(c, 403, "method_disabled", "This way of signing in is switched off.");
+async function pendingOrSignedIn(c, ctx) {
+  const challenge = await readChallenge(c, ctx, "totp-setup");
+  const waiting = challenge ? await ctx.users.findById(challenge.sub) : null;
+  if (challenge && waiting && waiting.sessionVersion === challenge.sv) return { user: waiting, challenge };
+  const session = await ctx.currentUser(c);
+  const user = session ? await ctx.users.findById(session.id) : null;
+  return user ? { user, challenge: null } : null;
+}
+async function finishSignIn(c, ctx, user, challenge, amr, via) {
+  const result = await ctx.startSession(c, toMadauthUser(user, challenge.profile), [...challenge.amr, amr], { method: challenge.method, signedUpAt: user.signedUpAt }, { sv: user.sessionVersion });
+  await ctx.emit("user.signed_in", { user: result, method: challenge.method, ...challenge.amr.length ? { secondFactor: via } : {} });
+  return result;
+}
+
+// src/routes/sms.ts
+import { deleteCookie as deleteCookie4, getCookie as getCookie4, setCookie as setCookie4 } from "hono/cookie";
+var SMS_TTL_MS = 10 * 60 * 1e3;
+var SETUP_COOKIE = "madauth_sms_setup";
+var SETUP_TYP = "madauth-sms-setup+jwt";
+var SETUP_TTL = 10 * 60;
+var ROUTE_PATH = "/auth/sms";
+function normalizePhone(value) {
+  if (typeof value !== "string") return null;
+  const digits = value.replace(/[\s().-]/g, "");
+  return /^\+[1-9]\d{6,14}$/.test(digits) ? digits : null;
+}
+function maskPhone(phone) {
+  return `${phone.slice(0, 3)} ${"\u2022".repeat(Math.max(0, phone.length - 5))} ${phone.slice(-2)}`;
+}
+function smsRoutes(app, ctx, users, webhook) {
+  const { config, secure } = ctx;
+  const cookie = { path: ROUTE_PATH, httpOnly: true, secure, sameSite: "Strict" };
+  app.use(`${ROUTE_PATH}/*`, async (c, next) => {
+    if (!isOn("sms", ctx.configured, await ctx.methods(c))) return error(c, 403, "method_disabled", "SMS codes are switched off.");
+    await next();
+  });
+  const expired = (c) => error(c, 401, "challenge_expired", "The sign-in has expired. Please sign in again.");
+  const tooSoon = (c) => error(c, 429, "too_soon", "A code was sent to your phone less than a minute ago: enter that one, or wait a minute for a new one.");
+  const sendCode = async (c, user, phone, purpose, locale) => {
+    const { code } = await users.issueVerification(user.id, "sms", SMS_TTL_MS);
+    const data = { to: phone, code, purpose, expiresAt: Date.now() + SMS_TTL_MS, site: originHost(ctx, c), locale, user: { id: user.id, name: user.name ?? void 0 } };
+    const result = await webhook.call("sms.send_code", data, WEBHOOK_TIMEOUT_MS);
+    if (!result.ok) {
+      console.error(`[madauth] Webhook "sms.send_code" for user ${user.id} failed: ${result.reason}`);
+      return false;
+    }
+    await users.updateUser(user.id, { lastSmsAt: Date.now() });
+    return true;
+  };
+  const sentRecently = (user) => Date.now() - (user.lastSmsAt ?? 0) < MAIL_INTERVAL_MS;
+  const checkCode2 = async (c, user, account, data) => {
+    if (account) {
+      const refused = await countSignInAttempt(c, users, account);
+      if (refused) return refused;
+    }
+    const code = typeof data.code === "string" ? data.code.replace(/\s/g, "") : "";
+    const { userId } = code ? await users.consumeCode(user, "sms", code) : { userId: null };
+    if (!userId) return error(c, 401, "code_invalid", "The code is wrong or has expired.");
+    if (account) await users.updateAccount(account.id, { failedAttempts: 0, lockedUntil: 0 });
+    return null;
+  };
+  const whoSetsUp = async (c) => {
+    const who = await pendingOrSignedIn(c, ctx);
+    if (!who || who.challenge && !who.challenge.amr.length) return { answer: noSession(c) };
+    if (who.challenge && !await methodStillOn(c, ctx, who.challenge)) return { answer: methodOff(c) };
+    return who;
+  };
+  app.post(`${ROUTE_PATH}/setup`, async (c) => {
+    const who = await whoSetsUp(c);
+    if ("answer" in who) return who.answer;
+    const { user } = who;
+    const data = await body(c);
+    const phone = normalizePhone(data.phone);
+    if (!phone) return error(c, 400, "invalid_phone", "Enter a mobile number with the country code, e.g. +41 79 123 45 67.");
+    const existing = await users.smsAccount(user.id);
+    let approved;
+    let justApproved = false;
+    if (existing) {
+      const previous = await readToken(await ctx.keys, config.issuer, SETUP_TYP, getCookie4(c, SETUP_COOKIE));
+      const holds = previous?.sub === user.id && typeof previous.approved === "number" && Date.now() - previous.approved < SETUP_TTL * 1e3;
+      if (holds) {
+        approved = previous.approved;
+      } else {
+        if (data.code === void 0) return error(c, 401, "code_required", "Enter the code we sent to your current number to replace it.");
+        const wrong = await checkCode2(c, user, existing, data);
+        if (wrong) return wrong;
+        approved = Date.now();
+        justApproved = true;
+      }
+    }
+    if (!justApproved && sentRecently(user)) return tooSoon(c);
+    if (!await sendCode(c, user, phone, "setup", localeOf(data.locale))) return smsUnavailable(c);
+    const token = await signToken(await ctx.keys, config.issuer, SETUP_TYP, { sub: user.id, phone, ...approved ? { approved } : {} }, SETUP_TTL);
+    setCookie4(c, SETUP_COOKIE, token, { ...cookie, maxAge: SETUP_TTL });
+    return c.json({ phone: maskPhone(phone) }, 202);
+  });
+  app.post(`${ROUTE_PATH}/confirm`, async (c) => {
+    const who = await whoSetsUp(c);
+    if ("answer" in who) return who.answer;
+    const { user, challenge } = who;
+    const setup = await readToken(await ctx.keys, config.issuer, SETUP_TYP, getCookie4(c, SETUP_COOKIE));
+    if (!setup || setup.sub !== user.id || typeof setup.phone !== "string") {
+      return error(c, 400, "setup_expired", "The setup has expired or was started in another browser. Please start again.");
+    }
+    const existing = await users.smsAccount(user.id);
+    if (existing && typeof setup.approved !== "number") {
+      deleteCookie4(c, SETUP_COOKIE, cookie);
+      return error(c, 400, "setup_expired", "Your phone number was changed elsewhere meanwhile. Please start again.");
+    }
+    const wrong = await checkCode2(c, user, existing, await body(c));
+    if (wrong) return wrong;
+    const written = existing ? await users.updateAccount(existing.id, { phone: setup.phone, failedAttempts: 0, lockedUntil: 0 }) : !!await users.linkAccount(user.id, { key: smsAccountKey(user.id), phone: setup.phone });
+    deleteCookie4(c, SETUP_COOKIE, cookie);
+    if (!written) return error(c, 400, "setup_expired", "Your phone number was changed elsewhere meanwhile. Please start again.");
+    await ctx.emit("user.second_factor_enabled", { user: toMadauthUser(user), method: "sms", phone: setup.phone });
+    if (!challenge) return c.json({});
+    return c.json({ user: await finishSignIn(c, ctx, user, challenge, "sms", "sms") });
+  });
+  app.post(`${ROUTE_PATH}/send`, async (c) => {
+    const data = await body(c);
+    const challenge = await readChallenge(c, ctx, "sms");
+    let user;
+    if (challenge) {
+      if (!await methodStillOn(c, ctx, challenge)) return methodOff(c);
+      const waiting = await users.findById(challenge.sub);
+      user = waiting && waiting.sessionVersion === challenge.sv ? waiting : null;
+      if (!user) return expired(c);
+    } else {
+      const session = await ctx.currentUser(c);
+      user = session ? await users.findById(session.id) : null;
+      if (!user) return noSession(c);
+    }
+    const account = await users.smsAccount(user.id);
+    if (!account?.phone) return challenge ? expired(c) : error(c, 400, "no_phone", "No phone number is set up.");
+    if (sentRecently(user)) return tooSoon(c);
+    if (!await sendCode(c, user, account.phone, challenge ? "signin" : "approve", localeOf(data.locale))) return smsUnavailable(c);
+    return c.json({ phone: maskPhone(account.phone) }, 202);
+  });
+  app.post(`${ROUTE_PATH}/verify`, async (c) => {
+    const challenge = await readChallenge(c, ctx, "sms");
+    if (!challenge) return expired(c);
+    if (!await methodStillOn(c, ctx, challenge)) return methodOff(c);
+    const user = await users.findById(challenge.sub);
+    const account = user && user.sessionVersion === challenge.sv ? await users.smsAccount(user.id) : null;
+    if (!user || !account) return expired(c);
+    const wrong = await checkCode2(c, user, account, await body(c));
+    if (wrong) return wrong;
+    return c.json({ user: await finishSignIn(c, ctx, user, challenge, "sms", "sms") });
+  });
+  app.post(`${ROUTE_PATH}/remove`, async (c) => {
+    const session = await ctx.currentUser(c);
+    const user = session ? await users.findById(session.id) : null;
+    if (!user) return noSession(c);
+    const account = await users.smsAccount(user.id);
+    if (!account) return error(c, 400, "no_phone", "No phone number is set up.");
+    const methods = await ctx.methods(c);
+    const required = METHODS_WITH_SECOND_FACTOR.some((method) => isOn(method, ctx.configured, methods) && policyOf(method, methods) === "required");
+    if (required && !await users.totpAccount(user.id)) {
+      return error(c, 403, "required_by_policy", "Signing in requires a second factor, so the phone number can't be removed without an authenticator app.");
+    }
+    const wrong = await checkCode2(c, user, account, await body(c));
+    if (wrong) return wrong;
+    await users.removeSms(user.id);
+    await ctx.emit("user.second_factor_disabled", { user: toMadauthUser(user), method: "sms" });
+    return c.json({});
+  });
+  app.get(`${ROUTE_PATH}/status`, async (c) => {
+    const session = await ctx.currentUser(c);
+    if (!session) return noSession(c);
+    const account = await users.smsAccount(session.id);
+    return c.json({ enabled: !!account?.phone, phone: account?.phone ? maskPhone(account.phone) : null });
+  });
+}
+
 // src/routes/totp.ts
-import { deleteCookie as deleteCookie2, getCookie as getCookie2, setCookie as setCookie2 } from "hono/cookie";
+import { deleteCookie as deleteCookie5, getCookie as getCookie5, setCookie as setCookie5 } from "hono/cookie";
 
 // src/totp.ts
-import { createCipheriv, createDecipheriv, createHmac, hkdfSync, randomBytes, randomInt } from "crypto";
+import { createHmac, randomBytes as randomBytes2, randomInt } from "crypto";
 var TOTP_STEP_SECONDS = 30;
 var TOTP_DIGITS = 6;
 var TOTP_WINDOW = 1;
@@ -542,9 +1056,6 @@ var SECRET_BYTES = 20;
 var BASE32 = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
 var RECOVERY_ALPHABET = "abcdefghijklmnopqrstuvwxyz234567";
 var RECOVERY_CODE_LENGTH = 10;
-var ENCRYPTION_VERSION = "v1";
-var IV_BYTES = 12;
-var TAG_BYTES = 16;
 function base32Encode(bytes) {
   let bits = 0;
   let value = 0;
@@ -585,7 +1096,7 @@ function verifyTotp(secret, code, nowMs, window = TOTP_WINDOW) {
   return found;
 }
 function generateTotpSecret() {
-  return randomBytes(SECRET_BYTES);
+  return randomBytes2(SECRET_BYTES);
 }
 function otpauthUri(options) {
   const issuer = encodeURIComponent(options.issuer);
@@ -594,28 +1105,7 @@ function otpauthUri(options) {
   return `otpauth://totp/${issuer}:${account}?secret=${secret}&issuer=${issuer}&algorithm=SHA1&digits=${TOTP_DIGITS}&period=${TOTP_STEP_SECONDS}`;
 }
 function deriveTotpKey(signingKeyD) {
-  return Buffer.from(hkdfSync("sha256", Buffer.from(signingKeyD, "base64url"), "", "madauth totp secret", 32));
-}
-function encryptSecret(key, secret) {
-  const iv = randomBytes(IV_BYTES);
-  const cipher = createCipheriv("aes-256-gcm", key, iv);
-  const encrypted = Buffer.concat([cipher.update(secret), cipher.final()]);
-  const parts = [iv, encrypted, cipher.getAuthTag()].map((part) => part.toString("base64url"));
-  return [ENCRYPTION_VERSION, ...parts].join(".");
-}
-function decryptSecret(key, stored) {
-  const [version, iv, encrypted, tag, ...rest] = stored.split(".");
-  if (version !== ENCRYPTION_VERSION || !iv || !encrypted || !tag || rest.length) return null;
-  const ivBytes = Buffer.from(iv, "base64url");
-  const tagBytes = Buffer.from(tag, "base64url");
-  if (ivBytes.length !== IV_BYTES || tagBytes.length !== TAG_BYTES) return null;
-  try {
-    const decipher = createDecipheriv("aes-256-gcm", key, ivBytes);
-    decipher.setAuthTag(tagBytes);
-    return Buffer.concat([decipher.update(Buffer.from(encrypted, "base64url")), decipher.final()]);
-  } catch {
-    return null;
-  }
+  return deriveKey(signingKeyD, "madauth totp secret");
 }
 function generateRecoveryCodes() {
   const codes = /* @__PURE__ */ new Set();
@@ -636,25 +1126,11 @@ function hashRecoveryCode(codeKey, code) {
 }
 
 // src/routes/totp.ts
-var CHALLENGE_COOKIE = "madauth_challenge";
-var CHALLENGE_TYP = "madauth-challenge+jwt";
-var CHALLENGE_TTL = 10 * 60;
-var SETUP_COOKIE = "madauth_totp_setup";
-var SETUP_TYP = "madauth-totp-setup+jwt";
-var SETUP_TTL = 10 * 60;
-var COOKIE_PATH = "/auth/totp";
-var cookieOptions = (secure) => ({ path: COOKIE_PATH, httpOnly: true, secure, sameSite: "Strict" });
-async function setChallenge(c, ctx, challenge) {
-  const token = await signToken(await ctx.keys, ctx.config.issuer, CHALLENGE_TYP, { ...challenge }, CHALLENGE_TTL);
-  setCookie2(c, CHALLENGE_COOKIE, token, { ...cookieOptions(ctx.secure), maxAge: CHALLENGE_TTL });
-}
-function clearChallenge(c, secure) {
-  deleteCookie2(c, CHALLENGE_COOKIE, cookieOptions(secure));
-}
-async function readChallenge(c, ctx, next) {
-  const claims = await readToken(await ctx.keys, ctx.config.issuer, CHALLENGE_TYP, getCookie2(c, CHALLENGE_COOKIE));
-  return claims && claims.next === next && typeof claims.sub === "string" && Array.isArray(claims.amr) ? claims : null;
-}
+var SETUP_COOKIE2 = "madauth_totp_setup";
+var SETUP_TYP2 = "madauth-totp-setup+jwt";
+var SETUP_TTL2 = 10 * 60;
+var COOKIE_PATH4 = "/auth/totp";
+var cookieOptions2 = (secure) => ({ path: COOKIE_PATH4, httpOnly: true, secure, sameSite: "Strict" });
 async function checkCode(c, ctx, keys, user, account, data, wrong = () => error(c, 401, "code_invalid", "The code is wrong or was already used.")) {
   const { users } = ctx;
   const refused = await countSignInAttempt(c, users, account);
@@ -664,11 +1140,11 @@ async function checkCode(c, ctx, keys, user, account, data, wrong = () => error(
     if (!code || !await users.consumeRecoveryCode(account, hashRecoveryCode(keys.codeKey, code))) return wrong();
     await users.updateAccount(account.id, { failedAttempts: 0, lockedUntil: 0 });
     const remaining = await users.countRecoveryCodes(account);
-    await ctx.emit("totp.recovery_code_used", { user: toMadauthUser(user), remaining });
+    await ctx.emit("user.recovery_code_used", { user: toMadauthUser(user), remaining });
     return "recovery_code";
   }
   if (typeof data.code !== "string" || !account.secret) return wrong();
-  const secret = decryptSecret(keys.totpKey, account.secret);
+  const secret = decrypt(keys.totpKey, account.secret);
   if (!secret) {
     console.error(`[madauth] The authenticator secret of user ${user.id} can't be read: was MADAUTH_SIGNING_KEY changed?`);
     return wrong();
@@ -680,9 +1156,9 @@ async function checkCode(c, ctx, keys, user, account, data, wrong = () => error(
 function totpRoutes(app, ctx, keys) {
   const { config, secure, users } = ctx;
   const { issuer } = config;
-  const cookie = cookieOptions(secure);
+  const cookie = cookieOptions2(secure);
   const methodsNow = (c) => ctx.methods(c);
-  app.use(`${COOKIE_PATH}/*`, async (c, next) => {
+  app.use(`${COOKIE_PATH4}/*`, async (c, next) => {
     if (!authenticatorOn(ctx.configured, await methodsNow(c))) {
       return error(c, 403, "method_disabled", "The authenticator app is switched off.");
     }
@@ -690,42 +1166,25 @@ function totpRoutes(app, ctx, keys) {
   });
   const standalone = async (c) => isOn("totp", ctx.configured, await methodsNow(c));
   const notStandalone = (c) => error(c, 403, "method_disabled", "Signing in with the authenticator app alone is switched off.");
-  const methodStillOn = async (c, challenge) => isOn(challenge.method, ctx.configured, await methodsNow(c));
-  const methodOff = (c) => error(c, 403, "method_disabled", "This way of signing in is switched off.");
   const signedIn = async (c) => {
     const user = await ctx.currentUser(c);
     return user ? users.findById(user.id) : null;
   };
-  const whoSetsUp = async (c) => {
-    const challenge = await readChallenge(c, ctx, "totp-setup");
-    const waiting = challenge ? await users.findById(challenge.sub) : null;
-    if (challenge && waiting && waiting.sessionVersion === challenge.sv) return { user: waiting, challenge };
-    const user = await signedIn(c);
-    return user ? { user, challenge: null } : null;
-  };
+  const whoSetsUp = (c) => pendingOrSignedIn(c, ctx);
   const newRecoveryCodes = () => {
     const recoveryCodes = generateRecoveryCodes();
     return { recoveryCodes, hashes: recoveryCodes.map((code) => hashRecoveryCode(keys.codeKey, normalizeRecoveryCode(code))) };
   };
-  const issuerLabel = (c) => {
-    if (config.totpIssuer) return config.totpIssuer;
-    const origin = c.req.header("origin");
-    return URL.canParse(origin ?? "") ? new URL(origin).hostname : new URL(issuer).hostname;
-  };
-  const finishSignIn = async (c, user, challenge, via) => {
-    const result = await ctx.startSession(c, toMadauthUser(user, challenge.profile), [...challenge.amr, "otp"], { sv: user.sessionVersion });
-    await ctx.emit("user.signed_in", { user: result, method: challenge.method, ...challenge.amr.length ? { secondFactor: via } : {} });
-    return result;
-  };
-  app.post(`${COOKIE_PATH}/setup`, async (c) => {
+  const issuerLabel = (c) => config.totpIssuer || originHost(ctx, c);
+  app.post(`${COOKIE_PATH4}/setup`, async (c) => {
     const who = await whoSetsUp(c);
     if (!who) return noSession(c);
-    if (who.challenge && !await methodStillOn(c, who.challenge)) return methodOff(c);
+    if (who.challenge && !await methodStillOn(c, ctx, who.challenge)) return methodOff(c);
     const existing = await users.totpAccount(who.user.id);
     let approved;
     if (existing) {
-      const previous = await readToken(await ctx.keys, issuer, SETUP_TYP, getCookie2(c, SETUP_COOKIE));
-      const holds = previous?.sub === who.user.id && typeof previous.approved === "number" && Date.now() - previous.approved < SETUP_TTL * 1e3;
+      const previous = await readToken(await ctx.keys, issuer, SETUP_TYP2, getCookie5(c, SETUP_COOKIE2));
+      const holds = previous?.sub === who.user.id && typeof previous.approved === "number" && Date.now() - previous.approved < SETUP_TTL2 * 1e3;
       if (holds) {
         approved = previous.approved;
       } else {
@@ -742,89 +1201,102 @@ function totpRoutes(app, ctx, keys) {
     const claims = {
       sub: who.user.id,
       setup: newId("tsu"),
-      secret: encryptSecret(keys.totpKey, secret),
+      secret: encrypt(keys.totpKey, secret),
       ...existing ? { replaces: existing.setupId } : {},
       ...approved ? { approved } : {}
     };
-    const token = await signToken(await ctx.keys, issuer, SETUP_TYP, claims, SETUP_TTL);
-    setCookie2(c, SETUP_COOKIE, token, { ...cookie, maxAge: SETUP_TTL });
+    const token = await signToken(await ctx.keys, issuer, SETUP_TYP2, claims, SETUP_TTL2);
+    setCookie5(c, SETUP_COOKIE2, token, { ...cookie, maxAge: SETUP_TTL2 });
     return c.json({ secret: base32Encode(secret), uri: otpauthUri({ issuer: issuerLabel(c), account: who.user.email, secret }) });
   });
-  app.post(`${COOKIE_PATH}/confirm`, async (c) => {
+  app.post(`${COOKIE_PATH4}/confirm`, async (c) => {
     const who = await whoSetsUp(c);
     if (!who) return noSession(c);
-    const { user, challenge } = who;
-    if (challenge && !await methodStillOn(c, challenge)) return methodOff(c);
+    const { challenge } = who;
+    let { user } = who;
+    if (challenge && !await methodStillOn(c, ctx, challenge)) return methodOff(c);
     const data = await body(c);
-    const setup = await readToken(await ctx.keys, issuer, SETUP_TYP, getCookie2(c, SETUP_COOKIE));
-    const secret = setup && setup.sub === user.id && typeof setup.secret === "string" && typeof setup.setup === "string" ? decryptSecret(keys.totpKey, setup.secret) : null;
+    const setup = await readToken(await ctx.keys, issuer, SETUP_TYP2, getCookie5(c, SETUP_COOKIE2));
+    const secret = setup && setup.sub === user.id && typeof setup.secret === "string" && typeof setup.setup === "string" ? decrypt(keys.totpKey, setup.secret) : null;
     if (!setup || !secret) return error(c, 400, "setup_expired", "The setup has expired or was started in another browser. Please start again.");
     const step = typeof data.code === "string" ? verifyTotp(secret, data.code, Date.now(), TOTP_WINDOW) : null;
     if (step === null) return error(c, 400, "code_invalid", "The code is wrong. Enter the current code from the app.");
+    const signUp = challenge?.method === "totp";
+    const fresh = signUp && !user.emailVerified ? await users.findById(user.id) : null;
+    if (fresh && !fresh.emailVerified) {
+      await users.verifyByProvider(fresh);
+      user = { ...user, emailVerified: true, wrongCodes: 0 };
+    }
     const { recoveryCodes, hashes } = newRecoveryCodes();
     await users.addRecoveryCodes(user.id, setup.setup, hashes);
     const patch = { secret: setup.secret, setupId: setup.setup, failedAttempts: 0, lockedUntil: 0, lastUsedStep: step };
-    const current = setup.replaces === void 0 ? null : await users.totpAccount(user.id);
-    const written = setup.replaces === void 0 ? !!await users.linkAccount(user.id, { key: totpAccountKey(user.id), ...patch }) : !!current && await users.confirmTotpSetup(current.id, setup.replaces, patch);
+    const replaced = setup.replaces === void 0 ? null : await users.totpApp(user.id);
+    const current = replaced?.account ?? null;
+    const written = setup.replaces === void 0 ? !!await users.linkAccount(user.id, { key: totpAccountKey(user.id), primary: signUp, ...patch }) : !!current && await users.confirmTotpSetup(current.id, setup.replaces, patch);
     if (!written) {
       await users.clearRecoveryCodes(user.id, { only: setup.setup });
-      deleteCookie2(c, SETUP_COOKIE, cookie);
+      deleteCookie5(c, SETUP_COOKIE2, cookie);
       return error(c, 400, "setup_expired", "Your authenticator app was set up or removed elsewhere meanwhile. Please start again.");
     }
     await users.clearRecoveryCodes(user.id, { except: setup.setup });
-    deleteCookie2(c, SETUP_COOKIE, cookie);
-    await ctx.emit("totp.enabled", { user: toMadauthUser(user) });
+    deleteCookie5(c, SETUP_COOKIE2, cookie);
+    const secondFactor = replaced ? !replaced.signsIn : !signUp;
+    if (secondFactor) await ctx.emit("user.second_factor_enabled", { user: toMadauthUser(user), method: "totp" });
     if (!challenge) return c.json({ recoveryCodes });
-    const result = await finishSignIn(c, user, challenge, "totp");
+    const result = await finishSignIn(c, ctx, user, challenge, "otp", "totp");
     return c.json({ user: result, recoveryCodes });
   });
-  app.post(`${COOKIE_PATH}/verify`, async (c) => {
+  app.post(`${COOKIE_PATH4}/verify`, async (c) => {
     const expired = () => error(c, 401, "challenge_expired", "The sign-in has expired. Please sign in again.");
     const challenge = await readChallenge(c, ctx, "totp");
     if (!challenge) return expired();
-    if (!await methodStillOn(c, challenge)) return methodOff(c);
+    if (!await methodStillOn(c, ctx, challenge)) return methodOff(c);
     const user = await users.findById(challenge.sub);
     const account = user && user.sessionVersion === challenge.sv ? await users.totpAccount(user.id) : null;
     if (!user || !account) return expired();
     const via = await checkCode(c, ctx, keys, user, account, await body(c));
     if (via instanceof Response) return via;
-    return c.json({ user: await finishSignIn(c, user, challenge, via) });
+    return c.json({ user: await finishSignIn(c, ctx, user, challenge, "otp", via) });
   });
-  app.post(`${COOKIE_PATH}/signin`, async (c) => {
+  app.post(`${COOKIE_PATH4}/signin`, async (c) => {
     if (!await standalone(c)) return notStandalone(c);
     const data = await body(c);
     const wrong = () => error(c, 401, "invalid_credentials", "E-mail or code is wrong.");
     if (!isValidEmail(data.email)) return wrong();
     const user = await users.findByEmail(normalizeEmail(data.email));
-    const account = user ? await users.totpAccount(user.id) : null;
-    if (!user || !user.emailVerified || !account?.secret) return wrong();
+    const app2 = user ? await users.totpApp(user.id) : null;
+    const account = app2?.account;
+    if (!user || !user.emailVerified || !app2?.signsIn || !account?.secret) return wrong();
     const via = await checkCode(c, ctx, keys, user, account, data, wrong);
     if (via instanceof Response) return via;
-    const result = await ctx.startSession(c, toMadauthUser(user), ["otp"], { sv: user.sessionVersion });
+    const result = await ctx.startSession(c, toMadauthUser(user), ["otp"], { method: "totp", signedUpAt: user.signedUpAt }, { sv: user.sessionVersion });
     await ctx.emit("user.signed_in", { user: result, method: "totp" });
     return c.json({ user: result });
   });
-  app.post(`${COOKIE_PATH}/remove`, async (c) => {
+  app.post(`${COOKIE_PATH4}/remove`, async (c) => {
     const user = await signedIn(c);
     if (!user) return noSession(c);
     const methods = await methodsNow(c);
     const required = METHODS_WITH_SECOND_FACTOR.filter((method) => isOn(method, ctx.configured, methods) && policyOf(method, methods) === "required");
-    if (required.length) {
-      const names = required.map((method) => method === "google" ? "Google" : "e-mail & password");
-      return error(c, 403, "required_by_policy", `Signing in with ${names.join(" and ")} requires the authenticator app, so it can't be removed.`);
+    const smsOn = isOn("sms", ctx.configured, methods);
+    if (required.length && !(smsOn && await users.smsAccount(user.id))) {
+      const names = required.map((method) => ({ google: "Google", github: "GitHub", password: "e-mail & password", "email-link": "the e-mail link" })[method]);
+      const alternative = smsOn ? " Add a phone number for SMS codes first, or" : " To stop using it,";
+      return error(c, 403, "required_by_policy", `Signing in with ${names.join(" and ")} requires a second factor, so the authenticator app can't be removed.${alternative} delete your account.`);
     }
-    const account = await users.totpAccount(user.id);
-    if (!account) return c.json({});
-    if (!(await users.signInMethods(user.id, methods)).some((method) => method !== "totp" && isOn(method, ctx.configured, methods))) {
+    const app2 = await users.totpApp(user.id);
+    if (!app2) return c.json({});
+    const { account } = app2;
+    if (app2.signsIn) {
       return error(c, 403, "only_method", "The authenticator app is the only way you sign in, so it can't be removed. Delete your account instead.");
     }
     const via = await checkCode(c, ctx, keys, user, account, await body(c));
     if (via instanceof Response) return via;
     await users.removeTotp(user.id);
-    await ctx.emit("totp.disabled", { user: toMadauthUser(user) });
+    await ctx.emit("user.second_factor_disabled", { user: toMadauthUser(user), method: "totp" });
     return c.json({});
   });
-  app.post(`${COOKIE_PATH}/recovery-codes`, async (c) => {
+  app.post(`${COOKIE_PATH4}/recovery-codes`, async (c) => {
     const user = await signedIn(c);
     if (!user) return noSession(c);
     const account = await users.totpAccount(user.id);
@@ -835,7 +1307,7 @@ function totpRoutes(app, ctx, keys) {
     await users.replaceRecoveryCodes(account, hashes);
     return c.json({ recoveryCodes });
   });
-  app.get(`${COOKIE_PATH}/status`, async (c) => {
+  app.get(`${COOKIE_PATH4}/status`, async (c) => {
     const user = await signedIn(c);
     if (!user) return noSession(c);
     const account = await users.totpAccount(user.id);
@@ -843,7 +1315,7 @@ function totpRoutes(app, ctx, keys) {
   });
   if (ctx.webhook && ctx.emailVerification) {
     const emails = createEmails(ctx, users, ctx.webhook);
-    app.post(`${COOKIE_PATH}/signup`, async (c) => {
+    app.post(`${COOKIE_PATH4}/signup`, async (c) => {
       if (!await standalone(c)) return notStandalone(c);
       const data = await body(c);
       const target = redirectTarget(ctx, c, data.redirectTo);
@@ -855,18 +1327,18 @@ function totpRoutes(app, ctx, keys) {
       const check = await ctx.checkSignup({ email, name: name ?? void 0, locale, method: "totp" });
       if (!check.ok) return check.reason === "rejected" ? error(c, 403, "signup_rejected", check.message) : unavailable(c);
       const existing = await users.findByEmail(normalizeEmail(email));
-      if (existing?.emailVerified && await users.hasAccounts(existing.id)) {
-        return await emails.sendAccountEmail(existing, "email.already_registered", target, locale) ? accepted(c) : unavailable(c);
+      if (existing?.emailVerified && await users.hasSignInMethod(existing.id)) {
+        return await emails.sendAccountEmail(existing, "email.send_already_registered", target, locale) ? accepted(c) : unavailable(c);
       }
       if (existing) {
         if (Date.now() - existing.lastMailAt < MAIL_INTERVAL_MS) return accepted(c);
-        if (!existing.emailVerified) await users.unlinkAccount(passwordAccountKey(existing.id));
+        if (!existing.emailVerified) await users.dropUnprovenAccounts(existing.id);
+        await users.reopenSignUp(existing);
         await users.updateUser(existing.id, { name });
         return await emails.sendLinkEmail({ ...existing, name }, "verify", target, locale) ? accepted(c) : unavailable(c);
       }
       const user = await users.createUser({ email, emailNormalized: normalizeEmail(email), name, emailVerified: false });
       if (!user) return accepted(c);
-      await ctx.emit("user.created", { user: toMadauthUser(user), method: "totp" });
       return await emails.sendLinkEmail(user, "verify", target, locale) ? accepted(c) : unavailable(c);
     });
   }
@@ -887,13 +1359,14 @@ function createApp(config) {
   const signsUp = (method) => canSignUp(methods, method);
   const emailVerification = sendsVerificationEmails(config);
   const totpKeys = { totpKey: deriveTotpKey(config.signingKey.d), codeKey };
+  const tokenKey = deriveTokenKey(config.signingKey.d);
   const issueSession = async (c, user, amr, extra) => {
     const signingKeys = await keys;
     const [sessionToken, renewalToken] = await Promise.all([
       signSession(signingKeys, issuer, sessionTtlSeconds, user, amr, extra),
       signRenewal(signingKeys, issuer, renewalTtlSeconds, user, amr, extra)
     ]);
-    setCookie3(c, SESSION_COOKIE, sessionToken, {
+    setCookie6(c, SESSION_COOKIE, sessionToken, {
       path: "/",
       domain: cookieDomain,
       httpOnly: true,
@@ -901,14 +1374,14 @@ function createApp(config) {
       sameSite: "Lax",
       maxAge: sessionTtlSeconds
     });
-    setCookie3(c, RENEWAL_COOKIE, renewalToken, {
+    setCookie6(c, RENEWAL_COOKIE, renewalToken, {
       path: "/auth",
       httpOnly: true,
       secure,
       sameSite: "Lax",
       maxAge: renewalTtlSeconds
     });
-    setCookie3(c, EXPIRY_COOKIE, String(Math.floor(Date.now() / 1e3) + sessionTtlSeconds), {
+    setCookie6(c, EXPIRY_COOKIE, String(Math.floor(Date.now() / 1e3) + sessionTtlSeconds), {
       path: "/",
       domain: cookieDomain,
       secure,
@@ -917,11 +1390,11 @@ function createApp(config) {
     });
   };
   const clearSession = (c) => {
-    deleteCookie3(c, SESSION_COOKIE, { path: "/", domain: cookieDomain, secure });
-    deleteCookie3(c, RENEWAL_COOKIE, { path: "/auth", secure });
-    deleteCookie3(c, EXPIRY_COOKIE, { path: "/", domain: cookieDomain, secure });
+    deleteCookie6(c, SESSION_COOKIE, { path: "/", domain: cookieDomain, secure });
+    deleteCookie6(c, RENEWAL_COOKIE, { path: "/auth", secure });
+    deleteCookie6(c, EXPIRY_COOKIE, { path: "/", domain: cookieDomain, secure });
   };
-  const tokenClaims = async (c, cookie, typ) => readToken(await keys, issuer, typ, getCookie3(c, cookie));
+  const tokenClaims = async (c, cookie, typ) => readToken(await keys, issuer, typ, getCookie6(c, cookie));
   const checked = async (claims) => {
     const stored = await users.findById(claims.sub);
     if (!stored || stored.sessionVersion !== claims.sv) return null;
@@ -960,24 +1433,35 @@ function createApp(config) {
       url.hash = "";
       return url;
     },
-    async startSession(c, user, amr, extra) {
+    async startSession(c, user, amr, { method, signedUpAt }, extra) {
+      const firstSession = signedUpAt === 0 && await users.markSignedUp(user.id);
       clearChallenge(c, secure);
       await issueSession(c, user, amr, extra);
-      return { ...user, amr };
+      const result = { ...user, amr };
+      if (firstSession) await this.emit("user.signed_up", { user: result, method });
+      return result;
     },
     async secondStep(c, user, amr, method, profile) {
       const methods2 = await this.methods(c);
       if (!isOn(method, configured, methods2)) return { disabled: true };
-      const enrolled = await users.totpAccount(user.id);
       const policy = method === "totp" ? "required" : policyOf(method, methods2);
-      const next = policy === "none" ? null : enrolled ? "totp" : policy === "required" ? "totp-setup" : null;
+      let next = null;
+      let factors = [];
+      if (policy !== "none") {
+        const [app2, phone] = await Promise.all([
+          users.totpAccount(user.id),
+          method !== "totp" && isOn("sms", configured, methods2) ? users.smsAccount(user.id) : null
+        ]);
+        factors = [...app2 ? ["totp"] : [], ...phone ? ["sms"] : []];
+        next = app2 ? "totp" : phone ? "sms" : policy === "required" ? "totp-setup" : null;
+      }
       if (next) {
         clearSession(c);
         const known = { ...profile?.name ? { name: profile.name } : {}, ...profile?.picture ? { picture: profile.picture } : {} };
-        await setChallenge(c, this, { sub: user.id, sv: user.sessionVersion, amr, method, next, ...Object.keys(known).length ? { profile: known } : {} });
-        return { next, method };
+        await setChallenge(c, this, { sub: user.id, sv: user.sessionVersion, amr, method, next, factors, ...Object.keys(known).length ? { profile: known } : {} });
+        return { next, method, factors };
       }
-      const result = await this.startSession(c, toMadauthUser(user, profile), amr, { sv: user.sessionVersion });
+      const result = await this.startSession(c, toMadauthUser(user, profile), amr, { method, signedUpAt: user.signedUpAt }, { sv: user.sessionVersion });
       await this.emit("user.signed_in", { user: result, method });
       return { user: result };
     },
@@ -999,10 +1483,10 @@ function createApp(config) {
       return isOn(method, configured, await this.methods(c));
     },
     async checkSignup(data) {
-      if (!this.webhook?.wants("signup.before")) return { ok: true };
-      const check = await this.webhook.call("signup.before", data, WEBHOOK_TIMEOUT_MS);
+      if (!this.webhook?.wants("user.signing_up")) return { ok: true };
+      const check = await this.webhook.call("user.signing_up", data, WEBHOOK_TIMEOUT_MS);
       if (!check.ok) {
-        console.error(`[madauth] Webhook "signup.before" failed: ${check.reason}`);
+        console.error(`[madauth] Webhook "user.signing_up" failed: ${check.reason}`);
         return { ok: false, reason: "unavailable" };
       }
       const answer = check.body;
@@ -1046,17 +1530,25 @@ function createApp(config) {
   app.get("/auth/config", async (c) => {
     const current = await ctx.methods(c);
     const on = (method) => isOn(method, configured, current);
+    const rules = on("password") ? await settings.passwordRules() : null;
     return c.json({
       google: on("google") ? { clientId: config.google.clientId, codeFlow: !!config.google.clientSecret, secondFactor: policyOf("google", current) } : null,
-      password: on("password") ? { minLength: config.password.minLength, secondFactor: policyOf("password", current) } : null,
+      github: on("github") ? { secondFactor: policyOf("github", current) } : null,
+      password: rules ? { ...rules, secondFactor: policyOf("password", current) } : null,
       // The app can be set up when it is in use at all; `signIn` says whether it signs in on its own.
       totp: authenticatorOn(configured, current) ? { signIn: on("totp"), signUp: on("totp") && emailVerification } : null,
-      email: { verification: emailVerification }
+      email: { verification: emailVerification },
+      emailLink: on("email-link") ? { secondFactor: policyOf("email-link", current) } : null,
+      // SMS codes as a second factor: a signed-in user can add a phone, and the dialog offers it in the second step.
+      sms: on("sms")
     });
   });
   if (emailVerification && ctx.webhook) emailRoutes(app, ctx, users, ctx.webhook);
+  if (configured("email-link") && ctx.webhook) emailLinkRoutes(app, ctx, users, ctx.webhook);
+  if (configured("sms") && ctx.webhook) smsRoutes(app, ctx, users, ctx.webhook);
   if (config.google) googleRoutes(app, ctx, config.google);
-  if (config.password && ctx.webhook) passwordRoutes(app, ctx, config.password, users, ctx.webhook);
+  if (config.github) githubRoutes(app, ctx, config.github, tokenKey);
+  if (config.password && ctx.webhook) passwordRoutes(app, ctx, users, ctx.webhook);
   totpRoutes(app, ctx, totpKeys);
   app.get("/auth/session", async (c) => {
     const user = await currentSession(c);
@@ -1085,10 +1577,13 @@ function createApp(config) {
       const via = await checkCode(c, ctx, totpKeys, stored, authenticator, data);
       if (via instanceof Response) return via;
     }
-    await users.deleteById(user.id);
+    const googleSub = await users.googleSub(user.id);
+    const githubAccount = config.github ? await users.githubAccount(user.id) : null;
+    const deleted = await users.deleteById(user.id);
+    if (deleted && config.github) await revokeGrant(config.github, tokenKey, githubAccount);
     clearSession(c);
     await ctx.emit("user.deleted", { user });
-    return c.body(null, 204);
+    return googleSub ? c.json({ googleSub }) : c.body(null, 204);
   });
   const admin = async (c) => {
     const user = await currentSession(c);
@@ -1128,19 +1623,21 @@ function createApp(config) {
     }
     const user = await users.findByEmail(normalizeEmail(data.email));
     if (!user) return noUser(c);
-    await users.updateUser(user.id, { claims: Object.keys(claims).length ? JSON.stringify(claims) : null });
+    const stored = Object.keys(claims).length ? JSON.stringify(claims) : null;
+    await users.updateUser(user.id, { claims: stored });
     const email = user.emailNormalized;
-    await ctx.emit("user.claims_changed", { userId: user.id, email, claims, by: caller.email });
+    await ctx.emit("user.claims_changed", { user: toMadauthUser({ ...user, claims: stored }), claims, by: caller.email });
     return c.json({ email, userId: user.id, claims });
   });
-  const settingsAnswer = (methods2) => ({
+  const settingsAnswer = (methods2, password) => ({
+    password,
     methods: Object.fromEntries(
-      SIGN_IN_METHODS.map((method) => [
+      METHODS.map((method) => [
         method,
         {
           configured: configured(method),
           enabled: isOn(method, configured, methods2),
-          ...method === "totp" ? {} : { secondFactor: policyOf(method, methods2) }
+          ...hasSecondFactor(method) ? { secondFactor: policyOf(method, methods2) } : {}
         }
       ])
     )
@@ -1148,22 +1645,43 @@ function createApp(config) {
   app.post("/auth/admin/settings/get", async (c) => {
     const caller = await admin(c);
     if ("answer" in caller) return caller.answer;
-    return c.json(settingsAnswer(await settings.methods()));
+    const [methods2, password] = await Promise.all([settings.methods(), settings.passwordRules()]);
+    return c.json(settingsAnswer(methods2, password));
   });
   app.post("/auth/admin/settings/set", async (c) => {
     const caller = await admin(c);
     if ("answer" in caller) return caller.answer;
     const data = await body(c);
     const invalid = (message) => c.json({ error: "invalid_settings", message }, 400);
-    const next = parseMethodSettings(data.methods, { booleans: true });
-    if (!next) {
+    if (data.methods === void 0 && data.password === void 0) return invalid("Pass methods, password or both.");
+    const next = data.methods === void 0 ? void 0 : parseMethodSettings(data.methods, { booleans: true });
+    if (next === null) {
       return invalid(
-        `methods must list the sign-in methods that are on (${SIGN_IN_METHODS.join(", ")}), each as true, {} or { "secondFactor": "none" | "optional" | "required" } (google and password), e.g. { "google": {}, "password": { "secondFactor": "optional" } }. A method that is not listed is off.`
+        `methods must list the sign-in methods that are on (${SIGN_IN_METHODS.join(", ")}; sms for SMS codes as a second factor), each as true, {} or { "secondFactor": "none" | "optional" | "required" } (google, github, password and email-link), e.g. { "google": {}, "password": { "secondFactor": "optional" }, "sms": {} }. A method that is not listed is off.`
       );
     }
-    const methods2 = await settings.changeMethods(() => anyOn(signsUp, next) ? next : null, caller.email);
-    if (!methods2) return invalid("At least one sign-in method that creates users must stay on: Google, e-mail & password, or the authenticator app with sign-up by e-mail.");
-    return c.json(settingsAnswer(methods2));
+    const rules = data.password === void 0 ? void 0 : parsePasswordRules(data.password);
+    if (rules === null) {
+      return invalid(
+        `password must be { "minLength": 1 to ${MAX_MIN_LENGTH}, "minScore": 0 to 4 }, both optional, e.g. { "minLength": 10, "minScore": 3 }. What is left out takes its default (${DEFAULT_PASSWORD_RULES.minLength}, ${DEFAULT_PASSWORD_RULES.minScore}).`
+      );
+    }
+    if (next && !anyOn(signsUp, next)) {
+      return invalid("At least one sign-in method that creates users must stay on: Google, GitHub, e-mail & password, the e-mail link, or the authenticator app with sign-up by e-mail.");
+    }
+    const previousRules = rules && next ? await settings.passwordRules() : void 0;
+    const password = rules ? await settings.setPasswordRules(rules, caller.email) : await settings.passwordRules();
+    if (next) {
+      try {
+        await settings.changeMethods(() => next, caller.email);
+      } catch (e) {
+        if (previousRules) await settings.setPasswordRules(previousRules, caller.email).catch(() => {
+        });
+        throw e;
+      }
+    }
+    const methods2 = next ?? await settings.methods();
+    return c.json(settingsAnswer(methods2, password));
   });
   app.post("/auth/admin/totp/remove", async (c) => {
     const caller = await admin(c);
@@ -1172,8 +1690,21 @@ function createApp(config) {
     if (!isValidEmail(data.email)) return invalidEmail(c);
     const user = await users.findByEmail(normalizeEmail(data.email));
     if (!user) return noUser(c);
+    const app2 = await users.totpApp(user.id);
+    const secondFactor = !!app2 && !app2.signsIn;
     const removed = await users.removeTotp(user.id);
-    if (removed) await ctx.emit("totp.disabled", { user: toMadauthUser(user), by: caller.email });
+    if (removed && secondFactor) await ctx.emit("user.second_factor_disabled", { user: toMadauthUser(user), method: "totp", by: caller.email });
+    return c.json({ email: user.emailNormalized, userId: user.id, enabled: false });
+  });
+  app.post("/auth/admin/sms/remove", async (c) => {
+    const caller = await admin(c);
+    if ("answer" in caller) return caller.answer;
+    const data = await body(c);
+    if (!isValidEmail(data.email)) return invalidEmail(c);
+    const user = await users.findByEmail(normalizeEmail(data.email));
+    if (!user) return noUser(c);
+    const removed = await users.removeSms(user.id);
+    if (removed) await ctx.emit("user.second_factor_disabled", { user: toMadauthUser(user), method: "sms", by: caller.email });
     return c.json({ email: user.emailNormalized, userId: user.id, enabled: false });
   });
   return app;