@opengis/fastify-table 2.0.89 → 2.0.90

package/dist/server/plugins/auth/index.js

@@ -78,7 +78,7 @@ export async function onRequest(req, reply) {
     // if 2factor is enabled globally + for user and secondFactorPassed not true => redirect to 2factor login page
     if (req.user?.uid &&
         req.user?.twofa &&
-        config.auth?.["2factor"] &&
+        // config.auth?.["2factor"] &&
         !isPublic &&
         (routeOptions?.method || "GET") === "GET" &&
         !req.session?.secondFactorPassed &&

package/dist/server/plugins/policy/funcs/checkPolicy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"checkPolicy.d.ts","sourceRoot":"","sources":["../../../../../server/plugins/policy/funcs/checkPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE5C,OAAO,KAAK,EAEV,eAAe,EAEhB,MAAM,wBAAwB,CAAC;AAKhC,MAAM,CAAC,OAAO,UAAU,WAAW,CAAC,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,YAAY,oSAiL5E"}
+{"version":3,"file":"checkPolicy.d.ts","sourceRoot":"","sources":["../../../../../server/plugins/policy/funcs/checkPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE5C,OAAO,KAAK,EAEV,eAAe,EAEhB,MAAM,wBAAwB,CAAC;AAKhC,MAAM,CAAC,OAAO,UAAU,WAAW,CAAC,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,YAAY,oSA+K5E"}

package/dist/server/plugins/policy/funcs/checkPolicy.js

@@ -10,7 +10,7 @@ export default function checkPolicy(req, reply) {
         return null;
     }
     // ! skip non-API Requests
-    const isApi = ["/files/", "/api/", "/api-user/", "/logger", "/file/"].filter((el) => path.includes(el)).length;
+    const isApi = routeOptions.method && routeOptions.url && routeOptions.handler;
     if (!isApi) {
         return null;
     }

package/dist/server/routes/auth/controllers/2factor/providers/totp.d.ts

@@ -1,7 +1,6 @@
 import { ExtendedPG } from "../../../../../types/core.js";
 interface ISecret {
     uid: string;
-    TYPE?: string;
     pg: ExtendedPG;
 }
 interface ICode {
@@ -10,9 +9,9 @@ interface ICode {
     pg: ExtendedPG;
     enable?: boolean;
 }
-declare const enableSecret: ({ uid, TYPE, pg }: ISecret) => Promise<void>;
-declare const deleteSecret: ({ uid, TYPE, pg }: ISecret) => Promise<void>;
-declare const getSecret: ({ uid, TYPE, pg }: ISecret) => Promise<{
+declare const enableSecret: ({ uid, pg }: ISecret) => Promise<void>;
+declare const deleteSecret: ({ uid, pg }: ISecret) => Promise<void>;
+declare const getSecret: ({ uid, pg }: ISecret) => Promise<{
     secret: any;
     enabled: any;
     recoveryCodes: any;

package/dist/server/routes/auth/controllers/2factor/providers/totp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"totp.d.ts","sourceRoot":"","sources":["../../../../../../../server/routes/auth/controllers/2factor/providers/totp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAQ1D,UAAU,OAAO;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,UAAU,CAAC;CAChB;AAED,UAAU,KAAK;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,UAAU,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAaD,QAAA,MAAM,YAAY,GAAU,mBAAmB,OAAO,kBAKrD,CAAC;AAEF,QAAA,MAAM,YAAY,GAAU,mBAAmB,OAAO,kBAKrD,CAAC;AAEF,QAAA,MAAM,SAAS,GAAU,mBAAmB,OAAO;;;;EAclD,CAAC;AAqCF,QAAA,MAAM,QAAQ,GAAU,aAAa,OAAO;;;;;;;;;;;;EA4C3C,CAAC;AAEF,QAAA,MAAM,MAAM,GAAU,0BAA0B,KAAK;;;EAiBpD,CAAC;AAKF,QAAA,MAAM,MAAM,GAAU,2BAA2B,KAAK,iBAuBrD,CAAC;AAEF,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC;;AAE3E,wBAAoB"}
+{"version":3,"file":"totp.d.ts","sourceRoot":"","sources":["../../../../../../../server/routes/auth/controllers/2factor/providers/totp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAQ1D,UAAU,OAAO;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,EAAE,EAAE,UAAU,CAAC;CAChB;AAED,UAAU,KAAK;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,UAAU,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAYD,QAAA,MAAM,YAAY,GAAU,aAAa,OAAO,kBAK/C,CAAC;AAEF,QAAA,MAAM,YAAY,GAAU,aAAa,OAAO,kBAK/C,CAAC;AAEF,QAAA,MAAM,SAAS,GAAU,aAAa,OAAO;;;;EAc5C,CAAC;AAuBF,QAAA,MAAM,QAAQ,GAAU,aAAa,OAAO;;;;;;;;;;;;EA0C3C,CAAC;AAEF,QAAA,MAAM,MAAM,GAAU,0BAA0B,KAAK;;;EAiBpD,CAAC;AAKF,QAAA,MAAM,MAAM,GAAU,2BAA2B,KAAK,iBAqBrD,CAAC;AAEF,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC;;AAE3E,wBAAoB"}

package/dist/server/routes/auth/controllers/2factor/providers/totp.js

@@ -2,13 +2,13 @@ import crypto from "node:crypto";
 import qrcode from "qrcode";
 import { authenticator } from "otplib";
 const TYPE = "TOTP";
-const enableSecret = async ({ uid, TYPE, pg }) => {
+const enableSecret = async ({ uid, pg }) => {
     await pg.query("update admin.users_social_auth set enabled=true where uid = $1 and social_auth_type = $2", [uid, TYPE]);
 };
-const deleteSecret = async ({ uid, TYPE, pg }) => {
+const deleteSecret = async ({ uid, pg }) => {
     await pg.query("delete from admin.users_social_auth where uid=$1 and social_auth_type = $2", [uid, TYPE]);
 };
-const getSecret = async ({ uid, TYPE, pg }) => {
+const getSecret = async ({ uid, pg }) => {
     const { social_auth_code: secret, enabled, recoveryCodes, } = await pg
         .query(`select social_auth_code, enabled, social_auth_obj->'codesArray' as "recoveryCodes"
     from admin.users_social_auth 
@@ -16,11 +16,11 @@ const getSecret = async ({ uid, TYPE, pg }) => {
         .then((el) => el.rows?.[0] || {});
     return { secret, enabled, recoveryCodes };
 };
-const addSecret = async ({ uid, secret, TYPE, pg, recoveryCodes, otp, }) => {
+const addSecret = async ({ uid, secret, pg, recoveryCodes, otp }) => {
     await pg.query(`insert into admin.users_social_auth(uid, social_auth_code, social_auth_type, social_auth_obj, social_auth_url, enabled)
     values($1, $2, $3, $4::json, $5, false)`, [uid, secret, TYPE, { codesArray: recoveryCodes }, otp]);
 };
-const updateSecret = async ({ uid, TYPE, pg, secret, recoveryCodes, otp, }) => {
+const updateSecret = async ({ uid, pg, secret, recoveryCodes, otp }) => {
     const result = await pg
         .query(`update admin.users_social_auth
     set social_auth_code=$3, social_auth_obj=$4::json, social_auth_url=$5
@@ -30,7 +30,7 @@ const updateSecret = async ({ uid, TYPE, pg, secret, recoveryCodes, otp, }) => {
 };
 // return a new secret until it's enabled
 const generate = async ({ uid, pg }) => {
-    const { enabled } = await getSecret({ uid, TYPE, pg });
+    const { enabled } = await getSecret({ uid, pg });
     if (enabled)
         return { enabled };
     const secret = authenticator.generateSecret();
@@ -48,7 +48,6 @@ const generate = async ({ uid, pg }) => {
         await addSecret({
             uid,
             secret,
-            TYPE,
             pg,
             recoveryCodes,
             otp,
@@ -58,7 +57,6 @@ const generate = async ({ uid, pg }) => {
         await updateSecret({
             uid,
             secret,
-            TYPE,
             pg,
             recoveryCodes,
             otp,
@@ -72,7 +70,7 @@ const generate = async ({ uid, pg }) => {
     };
 };
 const verify = async ({ uid, code: token, pg }) => {
-    const { secret, enabled, recoveryCodes } = await getSecret({ uid, TYPE, pg });
+    const { secret, enabled, recoveryCodes } = await getSecret({ uid, pg });
     // console.debug('secret', secret, 'enabled', enabled, 'verification', 'token', authenticator.generate(secret), authenticator.verify({ token: authenticator.generate(secret), secret }));
     if (!secret) {
         throw new Error("Включіть двофакторну аутентифікацію");
@@ -99,14 +97,12 @@ const toggle = async ({ uid, code, pg, enable }) => {
     if (enable) {
         await enableSecret({
             uid,
-            TYPE,
             pg,
         });
         return recoveryCodes;
     }
     await deleteSecret({
         uid,
-        TYPE,
         pg,
     });
     return "Відключено";

package/dist/server/routes/auth/controllers/2factor/qrcode.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"qrcode.d.ts","sourceRoot":"","sources":["../../../../../../server/routes/auth/controllers/2factor/qrcode.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAa5D,wBAA8B,MAAM,CAClC,GAAG,EAAE,eAAe,EACpB,KAAK,EAAE,YAAY,kBAsDpB"}
+{"version":3,"file":"qrcode.d.ts","sourceRoot":"","sources":["../../../../../../server/routes/auth/controllers/2factor/qrcode.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAa5D,wBAA8B,MAAM,CAClC,GAAG,EAAE,eAAe,EACpB,KAAK,EAAE,YAAY,kBAoDpB"}

package/dist/server/routes/auth/controllers/2factor/qrcode.js

@@ -7,7 +7,7 @@ const headers = {
 };
 export default async function qrCode(req, reply) {
     const { pg = pgClients.client } = req;
-    const { uid } = req.session?.passport?.user || {};
+    const { uid } = req.user || {};
     if (!uid) {
         return reply.status(401).send({ error: "unauthorized", code: 401 });
     }
@@ -20,12 +20,10 @@ export default async function qrCode(req, reply) {
     const userExists = await pg
         .query(`select uid from admin.users where uid=$1`, [uid])
         .then((el) => el.rows?.[0]?.uid);
-    if (!userExists && config.pg) {
+    if (!userExists) {
         return reply.status(404).send({ error: "invalid user", code: 404 });
     }
-    const { enabled, secret } = pg
-        ? await getSecret({ pg, TYPE: "TOTP", uid })
-        : {};
+    const { enabled, secret } = await getSecret({ pg, uid });
     const otp = secret
         ? await pg
             .query(`select social_auth_url

package/dist/server/routes/auth/controllers/2factor/recovery.d.ts

@@ -16,5 +16,5 @@ import { FastifyReply } from "fastify";
  * @returns {String|Object} message Повідомлення про успішне виконання або об'єкт з параметрами
  * @returns {String} redirect Шлях до переадресації
  */
-export default function recoveryFunction(req: any, reply: FastifyReply): Promise<never>;
+export default function recovery(req: any, reply: FastifyReply): Promise<never>;
 //# sourceMappingURL=recovery.d.ts.map

package/dist/server/routes/auth/controllers/2factor/recovery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"recovery.d.ts","sourceRoot":"","sources":["../../../../../../server/routes/auth/controllers/2factor/recovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAiBvC;;;;;;;;;;;;;;;;GAgBG;AAEH,wBAA8B,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,kBAsE3E"}
+{"version":3,"file":"recovery.d.ts","sourceRoot":"","sources":["../../../../../../server/routes/auth/controllers/2factor/recovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAiBvC;;;;;;;;;;;;;;;;GAgBG;AAEH,wBAA8B,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,kBAqFnE"}

package/dist/server/routes/auth/controllers/2factor/recovery.js

@@ -26,19 +26,24 @@ const dirname = path.dirname(fileURLToPath(import.meta.url));
  * @returns {String|Object} message Повідомлення про успішне виконання або об'єкт з параметрами
  * @returns {String} redirect Шлях до переадресації
  */
-export default async function recoveryFunction(req, reply) {
-    const { pg = pgClients.client, session = {}, body = {} } = req;
-    if (!config?.auth?.["2factor"]) {
-        return reply.status(400).send("2fa not enabled");
+export default async function recovery(req, reply) {
+    const { pg = pgClients.client, user, body = {}, method } = req;
+    if (!user?.uid) {
+        return reply.status(401).send({ error: "unauthorized", code: 401 });
+    }
+    if (!user.twofa) {
+        return reply.status(400).send({ error: "2fa not enabled", code: 400 });
     }
     if (!config.pg) {
-        return reply.status(400).send("empty pg");
+        return reply.status(400).send({ error: "empty pg", code: 400 });
     }
     const { code } = body;
-    const { uid, email } = session.passport?.user || {};
+    const { uid, email } = user || {};
     if (!code) {
         if (!email) {
-            return reply.status(404).send("user recovery email not set");
+            return reply
+                .status(404)
+                .send({ error: "user recovery email not set", code: 404 });
         }
         // return reply.status(400).send('not enough params');
         const customPt = await getTemplate("pt", template);
@@ -49,8 +54,9 @@ export default async function recoveryFunction(req, reply) {
       where uid = $1 and social_auth_type = $2`, [uid, "TOTP"])
             .then((el) => el.rows?.[0]?.recoveryCodes || []);
         if (!recoveryCodes?.length) {
-            return reply.status(404).send("user recovery code not found");
-            // return { message: 'user recovery code not found', status: 404 };
+            return reply
+                .status(404)
+                .send({ error: "user recovery code not found", code: 404 });
         }
         const html = await handlebars.compile(pt)({
             recoveryCodes: [recoveryCodes[0]],
@@ -61,23 +67,25 @@ export default async function recoveryFunction(req, reply) {
             to: email,
             template: html,
             title: `Recovery code for ${req.hostname} 2-factor authentication`,
-            nocache: config.local || config.debug,
+            nocache: config.local || config.debug || user?.user_type?.includes?.("admin"),
         });
+        if (method === "POST") {
+            return reply.status(200).send({ redirectUrl: "/2factor?recovery=1" });
+        }
         return reply.redirect("/2factor?recovery=1");
-        // return reply.status(200).send('recovery code sent to user email');
     }
     try {
         // validate recovery code
         await verify({ uid, code, pg });
         // delete old secret
-        await deleteSecret({
-            pg,
-            TYPE: "TOTP",
-            uid,
-        });
-        return reply.redirect("/2factor");
+        await deleteSecret({ pg, uid });
+        const redirectUrl = config.auth?.link?.["2fa"]?.login || "/2factor";
+        if (method === "POST") {
+            return reply.status(200).send({ redirectUrl });
+        }
+        return reply.redirect(redirectUrl);
     }
     catch (err) {
-        return reply.status(500).send(err.toString());
+        return reply.status(500).send({ error: err.toString(), code: 500 });
     }
 }

package/dist/server/routes/auth/controllers/2factor/reset.d.ts

@@ -0,0 +1,3 @@
+import { FastifyReply } from "fastify";
+export default function reset(req: any, reply: FastifyReply): Promise<never>;
+//# sourceMappingURL=reset.d.ts.map

package/dist/server/routes/auth/controllers/2factor/reset.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reset.d.ts","sourceRoot":"","sources":["../../../../../../server/routes/auth/controllers/2factor/reset.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAOvC,wBAA8B,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,kBAiBhE"}

package/dist/server/routes/auth/controllers/2factor/reset.js

@@ -0,0 +1,17 @@
+import config from "../../../../../config.js";
+import pgClients from "../../../../plugins/pg/pgClients.js";
+import { deleteSecret } from "./providers/totp.js";
+export default async function reset(req, reply) {
+    const { pg = pgClients.client, query } = req;
+    if (!query?.uid) {
+        return reply.status(400).send({
+            error: "not enough query params: uid",
+            code: 400,
+        });
+    }
+    if (!config.pg) {
+        return reply.status(400).send({ error: "empty pg", code: 400 });
+    }
+    await deleteSecret({ pg, uid: query.uid });
+    return reply.status(200).send({ ok: true });
+}

package/dist/server/routes/auth/controllers/2factor/verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../../../../server/routes/auth/controllers/2factor/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AA0BvC;;;;;;;;;;;;;;;;GAgBG;AAEH,wBAA8B,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,kBAmEzE"}
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../../../../server/routes/auth/controllers/2factor/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AA0BvC;;;;;;;;;;;;;;;;GAgBG;AAEH,wBAA8B,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,kBAwEzE"}

package/dist/server/routes/auth/controllers/2factor/verify.js

@@ -30,26 +30,23 @@ const defaultPt = existsSync(path.join(dirname, `../../../../templates/pt/${temp
  * @returns {String} redirect Шлях до переадресації
  */
 export default async function verifyFunction(req, reply) {
-    const { pg = pgClients.client, session = {}, body = {} } = req;
-    const { uid, twofa, email } = session?.passport?.user || {};
-    // const { nocache = config.local } = query;
+    const { pg = pgClients.client, user = {}, body = {} } = req;
+    const { uid, twofa, email } = user || {};
     const { code } = body;
     if (!twofa) {
-        return reply.status(400).send("2fa not enabled");
+        return reply.status(400).send({ error: "2fa not enabled", code: 400 });
     }
     if (!config.pg) {
-        return reply.status(400).send("empty pg");
+        return reply.status(400).send({ error: "empty pg", code: 400 });
     }
     if (!code) {
-        return reply.status(400).send("not enough params");
+        return reply
+            .status(400)
+            .send({ error: "not enough body params: code", code: 400 });
     }
     try {
         const { enabled } = await verify({ uid, code, pg });
-        await enableSecret({
-            pg,
-            TYPE: "TOTP",
-            uid,
-        });
+        await enableSecret({ pg, uid });
         req.session.secondFactorPassed = true;
         if (!enabled && email) {
             const { recoveryCodes } = await pg
@@ -68,7 +65,7 @@ export default async function verifyFunction(req, reply) {
                 to: email,
                 template: html,
                 title: `Recovery codes for ${req.hostname} 2-factor authentication`,
-                nocache: config.local || config.debug,
+                nocache: config.local || config.debug || user?.user_type?.includes?.("admin"),
             });
         }
         const redirectUrl = req.headers?.referer?.match?.(/[?&]redirect=([^&]+)/)?.[1] || "/";
@@ -78,8 +75,12 @@ export default async function verifyFunction(req, reply) {
             .send({ redirectUrl: redirectUrl.startsWith("/") ? redirectUrl : "/" });
     }
     catch (err) {
-        if (err.message === "Невірний код") {
-            return reply.status(401).send({ error: err.message, code: 401 });
+        if ([
+            "Невірний код",
+            "Вже знаходиться у даному стані",
+            "Включіть двофакторну аутентифікацію",
+        ].includes(err.message)) {
+            return reply.status(400).send({ error: err.message, code: 400 });
         }
         return reply.status(500).send(err.toString());
     }

package/dist/server/routes/auth/controllers/page/login2faTemplate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login2faTemplate.d.ts","sourceRoot":"","sources":["../../../../../../server/routes/auth/controllers/page/login2faTemplate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAwB5D,wBAA8B,aAAa,CACzC,GAAG,EAAE,eAAe,EACpB,KAAK,EAAE,YAAY,kBA0EpB"}
+{"version":3,"file":"login2faTemplate.d.ts","sourceRoot":"","sources":["../../../../../../server/routes/auth/controllers/page/login2faTemplate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAiC5D,wBAA8B,aAAa,CACzC,GAAG,EAAE,eAAe,EACpB,KAAK,EAAE,YAAY,kBAgEpB"}

package/dist/server/routes/auth/controllers/page/login2faTemplate.js

@@ -10,6 +10,8 @@ import { getSecret, generate } from "../2factor/providers/totp.js";
 // relative default template filepath
 const filename = fileURLToPath(import.meta.url);
 const dirname = path.dirname(filename);
+const twoFactorPagePath = path.join(dirname, "../../../../../server/templates/page/2factor.html");
+const defaultPagePath = path.join(dirname, "../../../../../server/templates/page/2factor-recovery.html");
 const headers = {
     "Content-Type": "text/html; charset=UTF-8",
     "Cache-Control": "no-cache",
@@ -17,9 +19,9 @@ const headers = {
 };
 export default async function loginTemplate(req, reply) {
     const { pg = pgClients.client } = req;
-    const { uid } = req.session?.passport?.user || {};
+    const { uid } = req.user || {};
     if (!uid) {
-        return reply.redirect("/login");
+        return reply.status(401).send({ error: "unauthorized", code: 401 });
     }
     const userExists = pg?.pk?.["admin.users"]
         ? await pg
@@ -27,14 +29,11 @@ export default async function loginTemplate(req, reply) {
             .then((el) => el.rows?.[0]?.uid)
         : false;
     if (!userExists && config.pg) {
-        return reply.status(400).send("user not found in db");
+        return reply.status(404).send({ error: "user not found in db", code: 400 });
     }
-    const twoFactorPagePath = path.join(dirname, "../../../../../server/templates/page/2factor.html");
     const customBody = await getTemplate("page", "2factor");
     const body = customBody || (await readFile(twoFactorPagePath, "utf8"));
-    const { enabled, secret } = config.pg
-        ? await getSecret({ pg, TYPE: "TOTP", uid })
-        : {};
+    const { enabled, secret } = config.pg ? await getSecret({ pg, uid }) : {};
     const { otp, recoveryCodes, key } = secret && pg?.pk?.["admin.users_social_auth"]
         ? await pg
             .query(`select social_auth_obj->'codesArray' as "recoveryCodes", enabled, social_auth_url as otp 
@@ -44,7 +43,6 @@ export default async function loginTemplate(req, reply) {
     /* -- access recovery start */
     // user already authorized via euSign / social / login
     if (uid && !req.session?.secondFactorPassed && req.query?.recovery) {
-        const defaultPagePath = path.join(dirname, "../../../../../server/templates/page/2factor-recovery.html");
         const customBodyRecovery = await getTemplate("page", "2factor-recovery");
         const bodyRecovery = customBodyRecovery || (await readFile(defaultPagePath, "utf8"));
         const html = await handlebars.compile(bodyRecovery)({

package/dist/server/routes/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../server/routes/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAkC1C,iBAAS,MAAM,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,GAAE,GAAQ,QA8ElD;AAED,eAAe,MAAM,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../server/routes/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAmC1C,iBAAS,MAAM,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,GAAE,GAAQ,QAiFlD;AAED,eAAe,MAAM,CAAC"}

package/dist/server/routes/auth/index.js

@@ -12,6 +12,7 @@ import updateUserInfo from "./controllers/core/updateUserInfo.js";
 // 2factor / totp
 import verify from "./controllers/2factor/verify.js";
 import recovery from "./controllers/2factor/recovery.js";
+import reset from "./controllers/2factor/reset.js";
 // pages
 import loginTemplate from "./controllers/page/loginTemplate.js";
 import login2faTemplate from "./controllers/page/login2faTemplate.js";
@@ -49,6 +50,9 @@ function plugin(app, opt = {}) {
     if (!app.hasRoute({ method: "GET", url: "/2factor/recovery" })) {
         app.get("/2factor/recovery", params, recovery);
     }
+    if (!app.hasRoute({ method: "GET", url: "/2factor/reset" })) {
+        app.get("/2factor/reset", { config: { role: "admin" } }, reset);
+    }
     // get/edit user info
     if (!app.hasRoute({ method: "GET", url: "/user" })) {
         app.get("/user", params, getUserInfo);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengis/fastify-table",
-  "version": "2.0.89",
+  "version": "2.0.90",
   "type": "module",
   "description": "core-plugins",
   "keywords": [