@technomoron/api-server-base 2.0.0-beta.10 → 2.0.0-beta.12

package/dist/cjs/api-server-base.cjs

@@ -619,6 +619,7 @@ class ApiServer {
         const path = `${this.apiBasePath}/v1/ping`;
         this.app.get(path, (_req, res) => {
             const payload = {
+                success: true,
                 status: 'ok',
                 apiVersion: this.config.apiVersion ?? '',
                 minClientVersion: this.config.minClientVersion ?? '',
@@ -626,7 +627,7 @@ class ApiServer {
                 startedAt: this.startedAt,
                 timestamp: new Date().toISOString()
             };
-            res.status(200).json({ code: 200, message: 'Success', data: payload });
+            res.status(200).json({ success: true, code: 200, message: 'Success', data: payload, errors: {} });
         });
     }
     normalizeApiBasePath(path) {
@@ -649,6 +650,7 @@ class ApiServer {
         }
         this.apiNotFoundHandler = (req, res) => {
             const payload = {
+                success: false,
                 code: 404,
                 message: this.describeMissingEndpoint(req),
                 data: null,
@@ -1068,6 +1070,7 @@ class ApiServer {
                     ? apiError.errors
                     : {};
                 const errorPayload = {
+                    success: false,
                     code: apiError.code,
                     message: apiError.message,
                     data: apiError.data ?? null,
@@ -1077,6 +1080,7 @@ class ApiServer {
                 return;
             }
             const errorPayload = {
+                success: false,
                 code: 500,
                 message: this.guessExceptionText(error),
                 data: null,
@@ -1111,7 +1115,7 @@ class ApiServer {
                     throw new ApiError({ code: 500, message: 'Handler result must start with a numeric status code' });
                 }
                 const message = typeof rawMessage === 'string' ? rawMessage : 'Success';
-                const responsePayload = { code, message, data };
+                const responsePayload = { success: true, code, message, data, errors: {} };
                 if (this.config.debug) {
                     this.dumpResponse(apiReq, responsePayload, code);
                 }
@@ -1124,6 +1128,7 @@ class ApiServer {
                         ? apiError.errors
                         : {};
                     const errorPayload = {
+                        success: false,
                         code: apiError.code,
                         message: apiError.message,
                         data: apiError.data ?? null,
@@ -1136,6 +1141,7 @@ class ApiServer {
                 }
                 else {
                     const errorPayload = {
+                        success: false,
                         code: 500,
                         message: this.guessExceptionText(error),
                         data: null,

package/dist/cjs/auth-api/auth-module.js

@@ -565,7 +565,28 @@ class AuthModule extends module_js_1.BaseAuthModule {
                 : cookiePrefs.refreshTtlSeconds;
             this.setJwtCookies(apiReq, { accessToken: access.token, refreshToken }, { sessionCookie: cookiePrefs.sessionCookie ?? false, refreshTtlSeconds: refreshTtlForCookie });
         }
-        return [200, this.storage.filterUser(user)];
+        const tokenClaims = verify.data;
+        const effectiveUserId = this.storage.getUserId(user);
+        const effectiveId = String(effectiveUserId);
+        const rawRealId = stored.ruid ?? tokenClaims.ruid;
+        const normalizedRealId = rawRealId === undefined || rawRealId === null ? null : String(rawRealId).trim() || null;
+        const isImpersonating = normalizedRealId !== null && normalizedRealId !== effectiveId;
+        let realUser;
+        let realUserId;
+        if (isImpersonating && normalizedRealId !== null) {
+            const realUserEntity = await this.getUserOrThrow(normalizedRealId, 'Real user not found');
+            realUser = this.storage.filterUser(realUserEntity);
+            realUserId = this.storage.getUserId(realUserEntity);
+        }
+        return [
+            200,
+            {
+                user: this.storage.filterUser(user),
+                isImpersonating,
+                realUser,
+                realUserId
+            }
+        ];
     }
     async postPasskeyChallenge(apiReq) {
         if (typeof this.storage.createPasskeyChallenge !== 'function') {
@@ -579,15 +600,7 @@ class AuthModule extends module_js_1.BaseAuthModule {
         const params = {
             action,
             login: toStringOrNull(body.login) ?? undefined,
-            userId: isAuthIdentifier(body.userId) ? body.userId : undefined,
-            userAgent: toStringOrNull(body.userAgent) ?? undefined,
-            domain: toStringOrNull(body.domain) ?? undefined,
-            fingerprint: toStringOrNull(body.fingerprint) ?? undefined,
-            label: toStringOrNull(body.label) ?? undefined,
-            browser: toStringOrNull(body.browser) ?? undefined,
-            device: toStringOrNull(body.device) ?? undefined,
-            ip: toStringOrNull(body.ip) ?? undefined,
-            os: toStringOrNull(body.os) ?? undefined
+            userId: isAuthIdentifier(body.userId) ? body.userId : undefined
         };
         const challenge = await this.storage.createPasskeyChallenge(params);
         return [200, challenge];
@@ -603,18 +616,25 @@ class AuthModule extends module_js_1.BaseAuthModule {
         if (!expectedChallenge || typeof response !== 'object' || response === null) {
             throw new api_server_base_js_1.ApiError({ code: 400, message: 'Malformed passkey verification payload' });
         }
-        const params = {
-            expectedChallenge,
-            response: response,
-            login: toStringOrNull(body.login) ?? undefined,
-            userId: isAuthIdentifier(body.userId) ? body.userId : undefined,
+        const rawMetadata = {
             domain: toStringOrNull(body.domain) ?? undefined,
             fingerprint: toStringOrNull(body.fingerprint) ?? undefined,
             label: toStringOrNull(body.label) ?? undefined,
             browser: toStringOrNull(body.browser) ?? undefined,
             device: toStringOrNull(body.device) ?? undefined,
             ip: toStringOrNull(body.ip) ?? undefined,
-            os: toStringOrNull(body.os) ?? undefined,
+            os: toStringOrNull(body.os) ?? undefined
+        };
+        const clientInfo = apiReq.getClientInfo();
+        const userAgent = toStringOrNull(body.userAgent) ?? (clientInfo.ua ? clientInfo.ua : null);
+        const requestMetadata = this.enrichTokenMetadata(apiReq, rawMetadata);
+        const params = {
+            expectedChallenge,
+            response: response,
+            login: toStringOrNull(body.login) ?? undefined,
+            userId: isAuthIdentifier(body.userId) ? body.userId : undefined,
+            userAgent: userAgent ?? undefined,
+            ...requestMetadata,
             ...sessionPrefs
         };
         const result = await this.storage.verifyPasskeyResponse(params);

package/dist/cjs/passkey/memory.js

@@ -62,9 +62,11 @@ class MemoryPasskeyStore extends base_js_1.PasskeyStore {
     }
     async saveChallenge(record) {
         this.challenges.set(record.challenge, {
-            ...record,
+            challenge: record.challenge,
+            action: record.action,
             userId: record.userId !== undefined ? normalizeUserId(record.userId) : undefined,
-            metadata: record.metadata ? { ...record.metadata } : {}
+            login: record.login ?? undefined,
+            expiresAt: record.expiresAt
         });
     }
     async consumeChallenge(challenge) {
@@ -73,7 +75,7 @@ class MemoryPasskeyStore extends base_js_1.PasskeyStore {
             return null;
         }
         this.challenges.delete(challenge);
-        return { ...record, metadata: record.metadata ? { ...record.metadata } : {} };
+        return { ...record };
     }
     async cleanupChallenges(now) {
         for (const [challenge, record] of this.challenges.entries()) {

package/dist/cjs/passkey/models.d.ts

@@ -1,5 +1,4 @@
 import { Model, type InferAttributes, type InferCreationAttributes, type ModelStatic, type Sequelize } from 'sequelize';
-import type { PasskeyChallengeMetadata } from './service.js';
 export declare class PasskeyCredentialModel extends Model<InferAttributes<PasskeyCredentialModel>, InferCreationAttributes<PasskeyCredentialModel>> {
     credentialId: Buffer;
     userId: number;
@@ -8,6 +7,13 @@ export declare class PasskeyCredentialModel extends Model<InferAttributes<Passke
     transports: string[] | null;
     backedUp: boolean;
     deviceType: string;
+    label: string | null;
+    createdDomain: string | null;
+    createdUserAgent: string | null;
+    createdBrowser: string | null;
+    createdOs: string | null;
+    createdDevice: string | null;
+    createdIp: string | null;
     createdAt?: Date;
     updatedAt?: Date;
 }
@@ -16,7 +22,6 @@ export declare class PasskeyChallengeModel extends Model<InferAttributes<Passkey
     action: 'register' | 'authenticate';
     userId: number | null;
     login: string | null;
-    metadata: PasskeyChallengeMetadata | null;
     expiresAt: Date;
     createdAt?: Date;
     updatedAt?: Date;

package/dist/cjs/passkey/models.js

@@ -67,6 +67,40 @@ function initPasskeyCredentialModel(sequelize) {
             type: sequelize_1.DataTypes.STRING(32),
             allowNull: false,
             defaultValue: 'multiDevice'
+        },
+        label: {
+            type: sequelize_1.DataTypes.STRING(120),
+            allowNull: true
+        },
+        createdDomain: {
+            field: 'created_domain',
+            type: sequelize_1.DataTypes.STRING(255),
+            allowNull: true
+        },
+        createdUserAgent: {
+            field: 'created_user_agent',
+            type: sequelize_1.DataTypes.TEXT,
+            allowNull: true
+        },
+        createdBrowser: {
+            field: 'created_browser',
+            type: sequelize_1.DataTypes.STRING(120),
+            allowNull: true
+        },
+        createdOs: {
+            field: 'created_os',
+            type: sequelize_1.DataTypes.STRING(120),
+            allowNull: true
+        },
+        createdDevice: {
+            field: 'created_device',
+            type: sequelize_1.DataTypes.STRING(120),
+            allowNull: true
+        },
+        createdIp: {
+            field: 'created_ip',
+            type: sequelize_1.DataTypes.STRING(45),
+            allowNull: true
         }
     }, {
         sequelize,
@@ -96,10 +130,6 @@ function initPasskeyChallengeModel(sequelize) {
             type: sequelize_1.DataTypes.STRING(128),
             allowNull: true
         },
-        metadata: {
-            type: sequelize_1.DataTypes.JSON,
-            allowNull: true
-        },
         expiresAt: {
             field: 'expires_at',
             type: sequelize_1.DataTypes.DATE,

package/dist/cjs/passkey/sequelize.d.ts

@@ -10,6 +10,13 @@ declare class PasskeyCredentialModel extends Model<InferAttributes<PasskeyCreden
     transports: string[] | null;
     backedUp: boolean;
     deviceType: string;
+    label: string | null;
+    createdDomain: string | null;
+    createdUserAgent: string | null;
+    createdBrowser: string | null;
+    createdOs: string | null;
+    createdDevice: string | null;
+    createdIp: string | null;
     createdAt?: Date;
     updatedAt?: Date;
 }
@@ -18,7 +25,6 @@ declare class PasskeyChallengeModel extends Model<InferAttributes<PasskeyChallen
     action: 'register' | 'authenticate';
     userId: number | null;
     login: string | null;
-    metadata: Record<string, unknown> | null;
     expiresAt: Date;
     createdAt?: Date;
     updatedAt?: Date;

package/dist/cjs/passkey/sequelize.js

@@ -76,6 +76,40 @@ function initPasskeyCredentialModel(sequelize) {
             type: sequelize_1.DataTypes.STRING(32),
             allowNull: false,
             defaultValue: 'multiDevice'
+        },
+        label: {
+            type: sequelize_1.DataTypes.STRING(120),
+            allowNull: true
+        },
+        createdDomain: {
+            field: 'created_domain',
+            type: sequelize_1.DataTypes.STRING(255),
+            allowNull: true
+        },
+        createdUserAgent: {
+            field: 'created_user_agent',
+            type: sequelize_1.DataTypes.TEXT,
+            allowNull: true
+        },
+        createdBrowser: {
+            field: 'created_browser',
+            type: sequelize_1.DataTypes.STRING(120),
+            allowNull: true
+        },
+        createdOs: {
+            field: 'created_os',
+            type: sequelize_1.DataTypes.STRING(120),
+            allowNull: true
+        },
+        createdDevice: {
+            field: 'created_device',
+            type: sequelize_1.DataTypes.STRING(120),
+            allowNull: true
+        },
+        createdIp: {
+            field: 'created_ip',
+            type: sequelize_1.DataTypes.STRING(45),
+            allowNull: true
         }
     }, {
         sequelize,
@@ -105,10 +139,6 @@ function initPasskeyChallengeModel(sequelize) {
             type: sequelize_1.DataTypes.STRING(128),
             allowNull: true
         },
-        metadata: {
-            type: sequelize_1.DataTypes.JSON,
-            allowNull: true
-        },
         expiresAt: {
             field: 'expires_at',
             type: sequelize_1.DataTypes.DATE,
@@ -148,6 +178,13 @@ class SequelizePasskeyStore extends base_js_1.PasskeyStore {
             transports: (model.transports ?? undefined),
             backedUp: model.backedUp,
             deviceType: model.deviceType,
+            label: model.label ?? undefined,
+            createdDomain: model.createdDomain ?? undefined,
+            createdUserAgent: model.createdUserAgent ?? undefined,
+            createdBrowser: model.createdBrowser ?? undefined,
+            createdOs: model.createdOs ?? undefined,
+            createdDevice: model.createdDevice ?? undefined,
+            createdIp: model.createdIp ?? undefined,
             createdAt: model.createdAt ?? undefined,
             updatedAt: model.updatedAt ?? undefined
         }));
@@ -170,6 +207,13 @@ class SequelizePasskeyStore extends base_js_1.PasskeyStore {
             transports: (model.transports ?? undefined),
             backedUp: model.backedUp,
             deviceType: model.deviceType,
+            label: model.label ?? undefined,
+            createdDomain: model.createdDomain ?? undefined,
+            createdUserAgent: model.createdUserAgent ?? undefined,
+            createdBrowser: model.createdBrowser ?? undefined,
+            createdOs: model.createdOs ?? undefined,
+            createdDevice: model.createdDevice ?? undefined,
+            createdIp: model.createdIp ?? undefined,
             createdAt: model.createdAt ?? undefined,
             updatedAt: model.updatedAt ?? undefined
         };
@@ -182,7 +226,14 @@ class SequelizePasskeyStore extends base_js_1.PasskeyStore {
             counter: record.counter,
             transports: record.transports ?? null,
             backedUp: record.backedUp,
-            deviceType: record.deviceType
+            deviceType: record.deviceType,
+            label: record.label ?? null,
+            createdDomain: record.createdDomain ?? null,
+            createdUserAgent: record.createdUserAgent ?? null,
+            createdBrowser: record.createdBrowser ?? null,
+            createdOs: record.createdOs ?? null,
+            createdDevice: record.createdDevice ?? null,
+            createdIp: record.createdIp ?? null
         });
     }
     async updateCredentialCounter(credentialId, counter) {
@@ -194,7 +245,6 @@ class SequelizePasskeyStore extends base_js_1.PasskeyStore {
             action: record.action,
             userId: record.userId !== undefined ? normalizeUserId(record.userId) : null,
             login: record.login ?? null,
-            metadata: (record.metadata ?? {}),
             expiresAt: record.expiresAt
         });
     }
@@ -209,8 +259,7 @@ class SequelizePasskeyStore extends base_js_1.PasskeyStore {
             action: model.action,
             userId: model.userId ?? undefined,
             login: model.login ?? undefined,
-            expiresAt: model.expiresAt,
-            metadata: model.metadata ?? {}
+            expiresAt: model.expiresAt
         };
     }
     async cleanupChallenges(now) {

package/dist/cjs/passkey/service.d.ts

@@ -1,6 +1,6 @@
 import type { PasskeyChallenge, PasskeyChallengeParams, PasskeyStorageAdapter, PasskeyVerificationParams, PasskeyVerificationResult, PasskeyServiceConfig, StoredPasskeyCredential } from './types.js';
 import type { AuthIdentifier } from '../auth-api/types.js';
-export type { CredentialDeviceType, PasskeyChallenge, PasskeyChallengeParams, PasskeyChallengeRecord, PasskeyChallengeMetadata, PasskeyUserDescriptor, PasskeyVerificationParams, PasskeyVerificationResult, PasskeyServiceConfig, PasskeyStorageAdapter, StoredPasskeyCredential } from './types.js';
+export type { CredentialDeviceType, PasskeyChallenge, PasskeyChallengeParams, PasskeyChallengeRecord, PasskeyUserDescriptor, PasskeyVerificationParams, PasskeyVerificationResult, PasskeyServiceConfig, PasskeyStorageAdapter, StoredPasskeyCredential } from './types.js';
 type Logger = Pick<typeof console, 'error' | 'warn'>;
 export declare class PasskeyService {
     private readonly config;

package/dist/cjs/passkey/service.js

@@ -54,6 +54,13 @@ function sanitizeTransports(input) {
         .filter((value) => ALLOWED_TRANSPORTS.includes(value));
     return filtered.length > 0 ? filtered : undefined;
 }
+function toOptionalString(value) {
+    if (typeof value !== 'string') {
+        return undefined;
+    }
+    const trimmed = value.trim();
+    return trimmed.length > 0 ? trimmed : undefined;
+}
 function toBase64Url(buffer) {
     return helpers_1.isoBase64URL.fromBuffer(new Uint8Array(buffer));
 }
@@ -127,17 +134,11 @@ class PasskeyService {
     }
     async createChallenge(params) {
         await this.adapter.cleanupChallenges?.(new Date());
-        const metadata = {
-            domain: typeof params.domain === 'string' ? params.domain : undefined,
-            fingerprint: typeof params.fingerprint === 'string' ? params.fingerprint : undefined,
-            label: typeof params.label === 'string' ? params.label : undefined,
-            userAgent: typeof params.userAgent === 'string' ? params.userAgent : undefined
-        };
         if (params.action === 'register') {
-            return this.createRegistrationChallenge(params, metadata);
+            return this.createRegistrationChallenge(params);
         }
         if (params.action === 'authenticate') {
-            return this.createAuthenticationChallenge(params, metadata);
+            return this.createAuthenticationChallenge(params);
         }
         throw new Error(`Unsupported passkey action: ${String(params.action)}`);
     }
@@ -163,7 +164,7 @@ class PasskeyService {
         }
         return { verified: false };
     }
-    async createRegistrationChallenge(params, metadata) {
+    async createRegistrationChallenge(params) {
         const user = await this.requireUser({ userId: params.userId, login: params.login });
         const existing = await this.adapter.listUserCredentials(user.id);
         const excludeCredentials = existing.map((credential) => {
@@ -186,8 +187,7 @@ class PasskeyService {
             action: 'register',
             userId: user.id,
             login: user.login,
-            expiresAt,
-            metadata
+            expiresAt
         });
         return {
             challenge: options.challenge,
@@ -196,7 +196,7 @@ class PasskeyService {
             publicKey: options
         };
     }
-    async createAuthenticationChallenge(params, metadata) {
+    async createAuthenticationChallenge(params) {
         const user = await this.requireUser({ userId: params.userId, login: params.login });
         const credentials = await this.adapter.listUserCredentials(user.id);
         const allowCredentials = credentials.map((credential) => {
@@ -216,8 +216,7 @@ class PasskeyService {
             action: 'authenticate',
             userId: user.id,
             login: user.login,
-            expiresAt,
-            metadata
+            expiresAt
         });
         return {
             challenge: options.challenge,
@@ -295,7 +294,14 @@ class PasskeyService {
             counter: registrationInfo.counter ?? 0,
             transports: sanitizeTransports(params.response.transports),
             backedUp: registrationInfo.credentialDeviceType === 'multiDevice',
-            deviceType: registrationInfo.credentialDeviceType
+            deviceType: registrationInfo.credentialDeviceType,
+            label: toOptionalString(params.label),
+            createdDomain: toOptionalString(params.domain),
+            createdUserAgent: toOptionalString(params.userAgent),
+            createdBrowser: toOptionalString(params.browser),
+            createdOs: toOptionalString(params.os),
+            createdDevice: toOptionalString(params.device),
+            createdIp: toOptionalString(params.ip)
         });
         return { verified: true, userId: user.id, login: user.login };
     }

package/dist/cjs/passkey/types.d.ts

@@ -9,19 +9,12 @@ export interface PasskeyServiceConfig {
     timeoutMs: number;
     userVerification?: 'preferred' | 'required' | 'discouraged';
 }
-export interface PasskeyChallengeMetadata {
-    domain?: string;
-    fingerprint?: string;
-    label?: string;
-    userAgent?: string;
-}
 export interface PasskeyChallengeRecord {
     challenge: string;
     action: 'register' | 'authenticate';
     userId?: AuthIdentifier;
     login?: string;
     expiresAt: Date;
-    metadata: PasskeyChallengeMetadata;
 }
 export interface PasskeyUserDescriptor {
     id: AuthIdentifier;
@@ -36,6 +29,13 @@ export interface StoredPasskeyCredential {
     transports?: AuthenticatorTransportFuture[];
     backedUp: boolean;
     deviceType: CredentialDeviceType;
+    label?: string;
+    createdDomain?: string;
+    createdUserAgent?: string;
+    createdBrowser?: string;
+    createdOs?: string;
+    createdDevice?: string;
+    createdIp?: string;
     createdAt?: Date;
     updatedAt?: Date;
 }
@@ -53,10 +53,9 @@ export interface PasskeyStorageAdapter {
     consumeChallenge(challenge: string): Promise<PasskeyChallengeRecord | null>;
     cleanupChallenges?(now: Date): Promise<void>;
 }
-export interface PasskeyChallengeParams extends Partial<Omit<Token, 'userId'>> {
+export interface PasskeyChallengeParams {
     action: 'register' | 'authenticate';
     login?: string;
-    userAgent?: string;
     userId?: AuthIdentifier;
 }
 export interface PasskeyChallenge extends Record<string, unknown> {
@@ -69,6 +68,7 @@ export interface PasskeyVerificationParams extends Partial<Omit<Token, 'userId'>
     login?: string;
     response: Record<string, unknown>;
     userId?: AuthIdentifier;
+    userAgent?: string;
 }
 export interface PasskeyVerificationResult extends Record<string, unknown> {
     login?: string;

package/dist/esm/api-server-base.js

@@ -611,6 +611,7 @@ export class ApiServer {
         const path = `${this.apiBasePath}/v1/ping`;
         this.app.get(path, (_req, res) => {
             const payload = {
+                success: true,
                 status: 'ok',
                 apiVersion: this.config.apiVersion ?? '',
                 minClientVersion: this.config.minClientVersion ?? '',
@@ -618,7 +619,7 @@ export class ApiServer {
                 startedAt: this.startedAt,
                 timestamp: new Date().toISOString()
             };
-            res.status(200).json({ code: 200, message: 'Success', data: payload });
+            res.status(200).json({ success: true, code: 200, message: 'Success', data: payload, errors: {} });
         });
     }
     normalizeApiBasePath(path) {
@@ -641,6 +642,7 @@ export class ApiServer {
         }
         this.apiNotFoundHandler = (req, res) => {
             const payload = {
+                success: false,
                 code: 404,
                 message: this.describeMissingEndpoint(req),
                 data: null,
@@ -1060,6 +1062,7 @@ export class ApiServer {
                     ? apiError.errors
                     : {};
                 const errorPayload = {
+                    success: false,
                     code: apiError.code,
                     message: apiError.message,
                     data: apiError.data ?? null,
@@ -1069,6 +1072,7 @@ export class ApiServer {
                 return;
             }
             const errorPayload = {
+                success: false,
                 code: 500,
                 message: this.guessExceptionText(error),
                 data: null,
@@ -1103,7 +1107,7 @@ export class ApiServer {
                     throw new ApiError({ code: 500, message: 'Handler result must start with a numeric status code' });
                 }
                 const message = typeof rawMessage === 'string' ? rawMessage : 'Success';
-                const responsePayload = { code, message, data };
+                const responsePayload = { success: true, code, message, data, errors: {} };
                 if (this.config.debug) {
                     this.dumpResponse(apiReq, responsePayload, code);
                 }
@@ -1116,6 +1120,7 @@ export class ApiServer {
                         ? apiError.errors
                         : {};
                     const errorPayload = {
+                        success: false,
                         code: apiError.code,
                         message: apiError.message,
                         data: apiError.data ?? null,
@@ -1128,6 +1133,7 @@ export class ApiServer {
                 }
                 else {
                     const errorPayload = {
+                        success: false,
                         code: 500,
                         message: this.guessExceptionText(error),
                         data: null,

package/dist/esm/auth-api/auth-module.js

@@ -563,7 +563,28 @@ class AuthModule extends BaseAuthModule {
                 : cookiePrefs.refreshTtlSeconds;
             this.setJwtCookies(apiReq, { accessToken: access.token, refreshToken }, { sessionCookie: cookiePrefs.sessionCookie ?? false, refreshTtlSeconds: refreshTtlForCookie });
         }
-        return [200, this.storage.filterUser(user)];
+        const tokenClaims = verify.data;
+        const effectiveUserId = this.storage.getUserId(user);
+        const effectiveId = String(effectiveUserId);
+        const rawRealId = stored.ruid ?? tokenClaims.ruid;
+        const normalizedRealId = rawRealId === undefined || rawRealId === null ? null : String(rawRealId).trim() || null;
+        const isImpersonating = normalizedRealId !== null && normalizedRealId !== effectiveId;
+        let realUser;
+        let realUserId;
+        if (isImpersonating && normalizedRealId !== null) {
+            const realUserEntity = await this.getUserOrThrow(normalizedRealId, 'Real user not found');
+            realUser = this.storage.filterUser(realUserEntity);
+            realUserId = this.storage.getUserId(realUserEntity);
+        }
+        return [
+            200,
+            {
+                user: this.storage.filterUser(user),
+                isImpersonating,
+                realUser,
+                realUserId
+            }
+        ];
     }
     async postPasskeyChallenge(apiReq) {
         if (typeof this.storage.createPasskeyChallenge !== 'function') {
@@ -577,15 +598,7 @@ class AuthModule extends BaseAuthModule {
         const params = {
             action,
             login: toStringOrNull(body.login) ?? undefined,
-            userId: isAuthIdentifier(body.userId) ? body.userId : undefined,
-            userAgent: toStringOrNull(body.userAgent) ?? undefined,
-            domain: toStringOrNull(body.domain) ?? undefined,
-            fingerprint: toStringOrNull(body.fingerprint) ?? undefined,
-            label: toStringOrNull(body.label) ?? undefined,
-            browser: toStringOrNull(body.browser) ?? undefined,
-            device: toStringOrNull(body.device) ?? undefined,
-            ip: toStringOrNull(body.ip) ?? undefined,
-            os: toStringOrNull(body.os) ?? undefined
+            userId: isAuthIdentifier(body.userId) ? body.userId : undefined
         };
         const challenge = await this.storage.createPasskeyChallenge(params);
         return [200, challenge];
@@ -601,18 +614,25 @@ class AuthModule extends BaseAuthModule {
         if (!expectedChallenge || typeof response !== 'object' || response === null) {
             throw new ApiError({ code: 400, message: 'Malformed passkey verification payload' });
         }
-        const params = {
-            expectedChallenge,
-            response: response,
-            login: toStringOrNull(body.login) ?? undefined,
-            userId: isAuthIdentifier(body.userId) ? body.userId : undefined,
+        const rawMetadata = {
             domain: toStringOrNull(body.domain) ?? undefined,
             fingerprint: toStringOrNull(body.fingerprint) ?? undefined,
             label: toStringOrNull(body.label) ?? undefined,
             browser: toStringOrNull(body.browser) ?? undefined,
             device: toStringOrNull(body.device) ?? undefined,
             ip: toStringOrNull(body.ip) ?? undefined,
-            os: toStringOrNull(body.os) ?? undefined,
+            os: toStringOrNull(body.os) ?? undefined
+        };
+        const clientInfo = apiReq.getClientInfo();
+        const userAgent = toStringOrNull(body.userAgent) ?? (clientInfo.ua ? clientInfo.ua : null);
+        const requestMetadata = this.enrichTokenMetadata(apiReq, rawMetadata);
+        const params = {
+            expectedChallenge,
+            response: response,
+            login: toStringOrNull(body.login) ?? undefined,
+            userId: isAuthIdentifier(body.userId) ? body.userId : undefined,
+            userAgent: userAgent ?? undefined,
+            ...requestMetadata,
             ...sessionPrefs
         };
         const result = await this.storage.verifyPasskeyResponse(params);

package/dist/esm/passkey/memory.js

@@ -59,9 +59,11 @@ export class MemoryPasskeyStore extends PasskeyStore {
     }
     async saveChallenge(record) {
         this.challenges.set(record.challenge, {
-            ...record,
+            challenge: record.challenge,
+            action: record.action,
             userId: record.userId !== undefined ? normalizeUserId(record.userId) : undefined,
-            metadata: record.metadata ? { ...record.metadata } : {}
+            login: record.login ?? undefined,
+            expiresAt: record.expiresAt
         });
     }
     async consumeChallenge(challenge) {
@@ -70,7 +72,7 @@ export class MemoryPasskeyStore extends PasskeyStore {
             return null;
         }
         this.challenges.delete(challenge);
-        return { ...record, metadata: record.metadata ? { ...record.metadata } : {} };
+        return { ...record };
     }
     async cleanupChallenges(now) {
         for (const [challenge, record] of this.challenges.entries()) {

package/dist/esm/passkey/models.d.ts

@@ -1,5 +1,4 @@
 import { Model, type InferAttributes, type InferCreationAttributes, type ModelStatic, type Sequelize } from 'sequelize';
-import type { PasskeyChallengeMetadata } from './service.js';
 export declare class PasskeyCredentialModel extends Model<InferAttributes<PasskeyCredentialModel>, InferCreationAttributes<PasskeyCredentialModel>> {
     credentialId: Buffer;
     userId: number;
@@ -8,6 +7,13 @@ export declare class PasskeyCredentialModel extends Model<InferAttributes<Passke
     transports: string[] | null;
     backedUp: boolean;
     deviceType: string;
+    label: string | null;
+    createdDomain: string | null;
+    createdUserAgent: string | null;
+    createdBrowser: string | null;
+    createdOs: string | null;
+    createdDevice: string | null;
+    createdIp: string | null;
     createdAt?: Date;
     updatedAt?: Date;
 }
@@ -16,7 +22,6 @@ export declare class PasskeyChallengeModel extends Model<InferAttributes<Passkey
     action: 'register' | 'authenticate';
     userId: number | null;
     login: string | null;
-    metadata: PasskeyChallengeMetadata | null;
     expiresAt: Date;
     createdAt?: Date;
     updatedAt?: Date;

package/dist/esm/passkey/models.js

@@ -60,6 +60,40 @@ export function initPasskeyCredentialModel(sequelize) {
             type: DataTypes.STRING(32),
             allowNull: false,
             defaultValue: 'multiDevice'
+        },
+        label: {
+            type: DataTypes.STRING(120),
+            allowNull: true
+        },
+        createdDomain: {
+            field: 'created_domain',
+            type: DataTypes.STRING(255),
+            allowNull: true
+        },
+        createdUserAgent: {
+            field: 'created_user_agent',
+            type: DataTypes.TEXT,
+            allowNull: true
+        },
+        createdBrowser: {
+            field: 'created_browser',
+            type: DataTypes.STRING(120),
+            allowNull: true
+        },
+        createdOs: {
+            field: 'created_os',
+            type: DataTypes.STRING(120),
+            allowNull: true
+        },
+        createdDevice: {
+            field: 'created_device',
+            type: DataTypes.STRING(120),
+            allowNull: true
+        },
+        createdIp: {
+            field: 'created_ip',
+            type: DataTypes.STRING(45),
+            allowNull: true
         }
     }, {
         sequelize,
@@ -89,10 +123,6 @@ export function initPasskeyChallengeModel(sequelize) {
             type: DataTypes.STRING(128),
             allowNull: true
         },
-        metadata: {
-            type: DataTypes.JSON,
-            allowNull: true
-        },
         expiresAt: {
             field: 'expires_at',
             type: DataTypes.DATE,

package/dist/esm/passkey/sequelize.d.ts

@@ -10,6 +10,13 @@ declare class PasskeyCredentialModel extends Model<InferAttributes<PasskeyCreden
     transports: string[] | null;
     backedUp: boolean;
     deviceType: string;
+    label: string | null;
+    createdDomain: string | null;
+    createdUserAgent: string | null;
+    createdBrowser: string | null;
+    createdOs: string | null;
+    createdDevice: string | null;
+    createdIp: string | null;
     createdAt?: Date;
     updatedAt?: Date;
 }
@@ -18,7 +25,6 @@ declare class PasskeyChallengeModel extends Model<InferAttributes<PasskeyChallen
     action: 'register' | 'authenticate';
     userId: number | null;
     login: string | null;
-    metadata: Record<string, unknown> | null;
     expiresAt: Date;
     createdAt?: Date;
     updatedAt?: Date;

package/dist/esm/passkey/sequelize.js

@@ -73,6 +73,40 @@ function initPasskeyCredentialModel(sequelize) {
             type: DataTypes.STRING(32),
             allowNull: false,
             defaultValue: 'multiDevice'
+        },
+        label: {
+            type: DataTypes.STRING(120),
+            allowNull: true
+        },
+        createdDomain: {
+            field: 'created_domain',
+            type: DataTypes.STRING(255),
+            allowNull: true
+        },
+        createdUserAgent: {
+            field: 'created_user_agent',
+            type: DataTypes.TEXT,
+            allowNull: true
+        },
+        createdBrowser: {
+            field: 'created_browser',
+            type: DataTypes.STRING(120),
+            allowNull: true
+        },
+        createdOs: {
+            field: 'created_os',
+            type: DataTypes.STRING(120),
+            allowNull: true
+        },
+        createdDevice: {
+            field: 'created_device',
+            type: DataTypes.STRING(120),
+            allowNull: true
+        },
+        createdIp: {
+            field: 'created_ip',
+            type: DataTypes.STRING(45),
+            allowNull: true
         }
     }, {
         sequelize,
@@ -102,10 +136,6 @@ function initPasskeyChallengeModel(sequelize) {
             type: DataTypes.STRING(128),
             allowNull: true
         },
-        metadata: {
-            type: DataTypes.JSON,
-            allowNull: true
-        },
         expiresAt: {
             field: 'expires_at',
             type: DataTypes.DATE,
@@ -145,6 +175,13 @@ export class SequelizePasskeyStore extends PasskeyStore {
             transports: (model.transports ?? undefined),
             backedUp: model.backedUp,
             deviceType: model.deviceType,
+            label: model.label ?? undefined,
+            createdDomain: model.createdDomain ?? undefined,
+            createdUserAgent: model.createdUserAgent ?? undefined,
+            createdBrowser: model.createdBrowser ?? undefined,
+            createdOs: model.createdOs ?? undefined,
+            createdDevice: model.createdDevice ?? undefined,
+            createdIp: model.createdIp ?? undefined,
             createdAt: model.createdAt ?? undefined,
             updatedAt: model.updatedAt ?? undefined
         }));
@@ -167,6 +204,13 @@ export class SequelizePasskeyStore extends PasskeyStore {
             transports: (model.transports ?? undefined),
             backedUp: model.backedUp,
             deviceType: model.deviceType,
+            label: model.label ?? undefined,
+            createdDomain: model.createdDomain ?? undefined,
+            createdUserAgent: model.createdUserAgent ?? undefined,
+            createdBrowser: model.createdBrowser ?? undefined,
+            createdOs: model.createdOs ?? undefined,
+            createdDevice: model.createdDevice ?? undefined,
+            createdIp: model.createdIp ?? undefined,
             createdAt: model.createdAt ?? undefined,
             updatedAt: model.updatedAt ?? undefined
         };
@@ -179,7 +223,14 @@ export class SequelizePasskeyStore extends PasskeyStore {
             counter: record.counter,
             transports: record.transports ?? null,
             backedUp: record.backedUp,
-            deviceType: record.deviceType
+            deviceType: record.deviceType,
+            label: record.label ?? null,
+            createdDomain: record.createdDomain ?? null,
+            createdUserAgent: record.createdUserAgent ?? null,
+            createdBrowser: record.createdBrowser ?? null,
+            createdOs: record.createdOs ?? null,
+            createdDevice: record.createdDevice ?? null,
+            createdIp: record.createdIp ?? null
         });
     }
     async updateCredentialCounter(credentialId, counter) {
@@ -191,7 +242,6 @@ export class SequelizePasskeyStore extends PasskeyStore {
             action: record.action,
             userId: record.userId !== undefined ? normalizeUserId(record.userId) : null,
             login: record.login ?? null,
-            metadata: (record.metadata ?? {}),
             expiresAt: record.expiresAt
         });
     }
@@ -206,8 +256,7 @@ export class SequelizePasskeyStore extends PasskeyStore {
             action: model.action,
             userId: model.userId ?? undefined,
             login: model.login ?? undefined,
-            expiresAt: model.expiresAt,
-            metadata: model.metadata ?? {}
+            expiresAt: model.expiresAt
         };
     }
     async cleanupChallenges(now) {

package/dist/esm/passkey/service.d.ts

@@ -1,6 +1,6 @@
 import type { PasskeyChallenge, PasskeyChallengeParams, PasskeyStorageAdapter, PasskeyVerificationParams, PasskeyVerificationResult, PasskeyServiceConfig, StoredPasskeyCredential } from './types.js';
 import type { AuthIdentifier } from '../auth-api/types.js';
-export type { CredentialDeviceType, PasskeyChallenge, PasskeyChallengeParams, PasskeyChallengeRecord, PasskeyChallengeMetadata, PasskeyUserDescriptor, PasskeyVerificationParams, PasskeyVerificationResult, PasskeyServiceConfig, PasskeyStorageAdapter, StoredPasskeyCredential } from './types.js';
+export type { CredentialDeviceType, PasskeyChallenge, PasskeyChallengeParams, PasskeyChallengeRecord, PasskeyUserDescriptor, PasskeyVerificationParams, PasskeyVerificationResult, PasskeyServiceConfig, PasskeyStorageAdapter, StoredPasskeyCredential } from './types.js';
 type Logger = Pick<typeof console, 'error' | 'warn'>;
 export declare class PasskeyService {
     private readonly config;

package/dist/esm/passkey/service.js

@@ -18,6 +18,13 @@ function sanitizeTransports(input) {
         .filter((value) => ALLOWED_TRANSPORTS.includes(value));
     return filtered.length > 0 ? filtered : undefined;
 }
+function toOptionalString(value) {
+    if (typeof value !== 'string') {
+        return undefined;
+    }
+    const trimmed = value.trim();
+    return trimmed.length > 0 ? trimmed : undefined;
+}
 function toBase64Url(buffer) {
     return isoBase64URL.fromBuffer(new Uint8Array(buffer));
 }
@@ -91,17 +98,11 @@ export class PasskeyService {
     }
     async createChallenge(params) {
         await this.adapter.cleanupChallenges?.(new Date());
-        const metadata = {
-            domain: typeof params.domain === 'string' ? params.domain : undefined,
-            fingerprint: typeof params.fingerprint === 'string' ? params.fingerprint : undefined,
-            label: typeof params.label === 'string' ? params.label : undefined,
-            userAgent: typeof params.userAgent === 'string' ? params.userAgent : undefined
-        };
         if (params.action === 'register') {
-            return this.createRegistrationChallenge(params, metadata);
+            return this.createRegistrationChallenge(params);
         }
         if (params.action === 'authenticate') {
-            return this.createAuthenticationChallenge(params, metadata);
+            return this.createAuthenticationChallenge(params);
         }
         throw new Error(`Unsupported passkey action: ${String(params.action)}`);
     }
@@ -127,7 +128,7 @@ export class PasskeyService {
         }
         return { verified: false };
     }
-    async createRegistrationChallenge(params, metadata) {
+    async createRegistrationChallenge(params) {
         const user = await this.requireUser({ userId: params.userId, login: params.login });
         const existing = await this.adapter.listUserCredentials(user.id);
         const excludeCredentials = existing.map((credential) => {
@@ -150,8 +151,7 @@ export class PasskeyService {
             action: 'register',
             userId: user.id,
             login: user.login,
-            expiresAt,
-            metadata
+            expiresAt
         });
         return {
             challenge: options.challenge,
@@ -160,7 +160,7 @@ export class PasskeyService {
             publicKey: options
         };
     }
-    async createAuthenticationChallenge(params, metadata) {
+    async createAuthenticationChallenge(params) {
         const user = await this.requireUser({ userId: params.userId, login: params.login });
         const credentials = await this.adapter.listUserCredentials(user.id);
         const allowCredentials = credentials.map((credential) => {
@@ -180,8 +180,7 @@ export class PasskeyService {
             action: 'authenticate',
             userId: user.id,
             login: user.login,
-            expiresAt,
-            metadata
+            expiresAt
         });
         return {
             challenge: options.challenge,
@@ -259,7 +258,14 @@ export class PasskeyService {
             counter: registrationInfo.counter ?? 0,
             transports: sanitizeTransports(params.response.transports),
             backedUp: registrationInfo.credentialDeviceType === 'multiDevice',
-            deviceType: registrationInfo.credentialDeviceType
+            deviceType: registrationInfo.credentialDeviceType,
+            label: toOptionalString(params.label),
+            createdDomain: toOptionalString(params.domain),
+            createdUserAgent: toOptionalString(params.userAgent),
+            createdBrowser: toOptionalString(params.browser),
+            createdOs: toOptionalString(params.os),
+            createdDevice: toOptionalString(params.device),
+            createdIp: toOptionalString(params.ip)
         });
         return { verified: true, userId: user.id, login: user.login };
     }

package/dist/esm/passkey/types.d.ts

@@ -9,19 +9,12 @@ export interface PasskeyServiceConfig {
     timeoutMs: number;
     userVerification?: 'preferred' | 'required' | 'discouraged';
 }
-export interface PasskeyChallengeMetadata {
-    domain?: string;
-    fingerprint?: string;
-    label?: string;
-    userAgent?: string;
-}
 export interface PasskeyChallengeRecord {
     challenge: string;
     action: 'register' | 'authenticate';
     userId?: AuthIdentifier;
     login?: string;
     expiresAt: Date;
-    metadata: PasskeyChallengeMetadata;
 }
 export interface PasskeyUserDescriptor {
     id: AuthIdentifier;
@@ -36,6 +29,13 @@ export interface StoredPasskeyCredential {
     transports?: AuthenticatorTransportFuture[];
     backedUp: boolean;
     deviceType: CredentialDeviceType;
+    label?: string;
+    createdDomain?: string;
+    createdUserAgent?: string;
+    createdBrowser?: string;
+    createdOs?: string;
+    createdDevice?: string;
+    createdIp?: string;
     createdAt?: Date;
     updatedAt?: Date;
 }
@@ -53,10 +53,9 @@ export interface PasskeyStorageAdapter {
     consumeChallenge(challenge: string): Promise<PasskeyChallengeRecord | null>;
     cleanupChallenges?(now: Date): Promise<void>;
 }
-export interface PasskeyChallengeParams extends Partial<Omit<Token, 'userId'>> {
+export interface PasskeyChallengeParams {
     action: 'register' | 'authenticate';
     login?: string;
-    userAgent?: string;
     userId?: AuthIdentifier;
 }
 export interface PasskeyChallenge extends Record<string, unknown> {
@@ -69,6 +68,7 @@ export interface PasskeyVerificationParams extends Partial<Omit<Token, 'userId'>
     login?: string;
     response: Record<string, unknown>;
     userId?: AuthIdentifier;
+    userAgent?: string;
 }
 export interface PasskeyVerificationResult extends Record<string, unknown> {
     login?: string;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@technomoron/api-server-base",
-	"version": "2.0.0-beta.10",
+	"version": "2.0.0-beta.12",
 	"description": "Api Server Skeleton / Base Class",
 	"type": "module",
 	"main": "./dist/cjs/index.cjs",
@@ -42,18 +42,18 @@
 	},
 	"dependencies": {
 		"@simplewebauthn/server": "^13.2.2",
-		"@types/cookie-parser": "^1.4.9",
+		"@types/cookie-parser": "^1.4.10",
 		"@types/cors": "^2.8.19",
-		"@types/express": "^4.17.23",
+		"@types/express": "^4.17.25",
 		"@types/jsonwebtoken": "^9.0.10",
 		"@types/multer": "^1.4.13",
 		"bcryptjs": "^2.4.3",
 		"cookie-parser": "^1.4.7",
 		"cors": "^2.8.5",
-		"express": "^4.21.2",
-		"jsonwebtoken": "^9.0.2",
+		"express": "^4.22.1",
+		"jsonwebtoken": "^9.0.3",
 		"multer": "^2.0.2",
-		"mysql2": "^3.15.3",
+		"mysql2": "^3.16.0",
 		"pg": "^8.16.3",
 		"sequelize": "^6.37.7",
 		"sqlite3": "^5.1.7"
@@ -62,14 +62,14 @@
 		"@types/bcryptjs": "^2.4.6",
 		"@types/express-serve-static-core": "^5.1.0",
 		"@types/supertest": "^6.0.3",
-		"@typescript-eslint/eslint-plugin": "^8.46.1",
-		"@typescript-eslint/parser": "^8.46.1",
+		"@typescript-eslint/eslint-plugin": "^8.50.0",
+		"@typescript-eslint/parser": "^8.50.0",
 		"@vue/eslint-config-prettier": "10.2.0",
 		"@vue/eslint-config-typescript": "14.5.0",
-		"eslint": "^9.37.0",
+		"eslint": "^9.39.2",
 		"eslint-plugin-import": "^2.32.0",
-		"eslint-plugin-vue": "^10.5.1",
-		"prettier": "^3.6.2",
+		"eslint-plugin-vue": "^10.6.2",
+		"prettier": "^3.7.4",
 		"supertest": "^7.1.4",
 		"typescript": "^5.9.3",
 		"vitest": "^3.2.4"