emailengine-app 2.65.0 → 2.67.0

package/lib/routes-ui.js

@@ -69,6 +69,13 @@ const libmime = require('libmime');
 
 const adminEntitiesRoutes = require('./ui-routes/admin-entities-routes');
 const { Export } = require('./export');
+const passkeys = require('./passkeys');
+const {
+    generateRegistrationOptions,
+    verifyRegistrationResponse,
+    generateAuthenticationOptions,
+    verifyAuthenticationResponse
+} = require('@simplewebauthn/server');
 
 const {
     DEFAULT_MAX_LOG_LINES,
@@ -3524,18 +3531,21 @@ ${Buffer.from(data.content, 'base64url').toString('base64')}
                 return h.redirect(request.query.next || '/admin');
             }
 
+            let passkeysAvailable = await passkeys.hasPasskeys();
+
             return h.view(
                 'account/login',
                 {
                     pageTitle: 'Login',
                     menuLogin: true,
                     values: {
-                        username: 'admin',
+                        username: '',
                         next: request.query.next
                     },
                     providers: {
                         okta: USE_OKTA_AUTH && (await h.validateOktaConfig())
-                    }
+                    },
+                    passkeysAvailable
                 },
                 {
                     layout: 'login'
@@ -3566,7 +3576,11 @@ ${Buffer.from(data.content, 'base64url').toString('base64')}
                 },
 
                 query: Joi.object({
-                    next: Joi.string().empty('').uri({ relativeOnly: true }).label('NextUrl')
+                    next: Joi.string()
+                        .empty('')
+                        .uri({ relativeOnly: true })
+                        .pattern(/^\/(?!\/)/)
+                        .label('NextUrl')
                 })
             }
         }
@@ -3576,6 +3590,10 @@ ${Buffer.from(data.content, 'base64url').toString('base64')}
         method: 'GET',
         path: '/admin/logout',
         async handler(request, h) {
+            let user = request.auth && request.auth.credentials && request.auth.credentials.user;
+            if (user) {
+                request.logger.info({ msg: 'Admin logout', user, method: 'session', remoteAddress: request.app.ip });
+            }
             if (request.cookieAuth) {
                 request.cookieAuth.clear();
             }
@@ -3589,6 +3607,14 @@ ${Buffer.from(data.content, 'base64url').toString('base64')}
         path: '/admin/login',
         async handler(request, h) {
             try {
+                let ipRateLimit = await h.checkRateLimit(`login:ip:${request.app.ip}`, 1, 30, 60);
+                if (!ipRateLimit.success) {
+                    request.logger.error({ msg: 'Rate limited', ipRateLimit });
+                    let err = new Error('Rate limited, please wait and try again');
+                    err.responseText = err.message;
+                    throw err;
+                }
+
                 let rateLimit = await h.checkRateLimit(`login:${request.payload.username}`, 1, 10, 60);
                 if (!rateLimit.success) {
                     request.logger.error({ msg: 'Rate limited', rateLimit });
@@ -3614,7 +3640,7 @@ ${Buffer.from(data.content, 'base64url').toString('base64')}
                             throw new Error('Invalid password');
                         }
                     } catch (E) {
-                        request.logger.error({ msg: 'Failed to verify password hash', err: E, hash: authData.password });
+                        request.logger.error({ msg: 'Failed to verify password hash', err: E });
                         let err = new Error('Failed to authenticate');
                         err.details = { password: err.message };
                         throw err;
@@ -3633,6 +3659,8 @@ ${Buffer.from(data.content, 'base64url').toString('base64')}
                     }
                 }
 
+                request.logger.info({ msg: 'Admin login successful', user: authData.user, method: 'password', remoteAddress: request.app.ip });
+
                 if (totpEnabled) {
                     let url = new URL(`admin/totp`, 'http://localhost');
 
@@ -3651,8 +3679,8 @@ ${Buffer.from(data.content, 'base64url').toString('base64')}
                     return h.redirect('/admin');
                 }
             } catch (err) {
-                await request.flash({ type: 'danger', message: err.responseText || `Sign-in failed. Check your password and try again.` });
-                request.logger.error({ msg: 'Failed to authenticate', err });
+                await request.flash({ type: 'danger', message: err.responseText || `Could not sign in. Check your password and try again.` });
+                request.logger.error({ msg: 'Failed to authenticate', err, user: request.payload.username, method: 'password', remoteAddress: request.app.ip });
 
                 let errors = err.details;
 
@@ -3662,9 +3690,14 @@ ${Buffer.from(data.content, 'base64url').toString('base64')}
                         pageTitle: 'Login',
                         menuLogin: true,
                         errors,
+                        values: {
+                            username: request.payload.username,
+                            next: request.payload.next
+                        },
                         providers: {
                             okta: USE_OKTA_AUTH && (await h.validateOktaConfig())
-                        }
+                        },
+                        passkeysAvailable: await passkeys.hasPasskeys()
                     },
                     {
                         layout: 'login'
@@ -3691,8 +3724,8 @@ ${Buffer.from(data.content, 'base64url').toString('base64')}
                         });
                     }
 
-                    await request.flash({ type: 'danger', message: `Sign-in failed. Check your password and try again.` });
-                    request.logger.error({ msg: 'Failed to authenticate', err });
+                    await request.flash({ type: 'danger', message: `Could not sign in. Check your password and try again.` });
+                    request.logger.error({ msg: 'Failed to authenticate', err, method: 'password', remoteAddress: request.app.ip });
 
                     return h
                         .view(
@@ -3701,9 +3734,14 @@ ${Buffer.from(data.content, 'base64url').toString('base64')}
                                 pageTitle: 'Login',
                                 menuLogin: true,
                                 errors,
+                                values: {
+                                    username: request.payload.username,
+                                    next: request.payload.next
+                                },
                                 providers: {
                                     okta: USE_OKTA_AUTH && (await h.validateOktaConfig())
-                                }
+                                },
+                                passkeysAvailable: await passkeys.hasPasskeys()
                             },
                             {
                                 layout: 'login'
@@ -3716,7 +3754,11 @@ ${Buffer.from(data.content, 'base64url').toString('base64')}
                     username: Joi.string().max(256).example('user').label('Username').description('Your account username'),
                     password: Joi.string().max(256).min(8).required().example('secret').label('Password').description('Your account password'),
                     remember: Joi.boolean().truthy('Y', 'true', '1', 'on').falsy('N', 'false', 0, '').default(false).description('Remember me'),
-                    next: Joi.string().empty('').uri({ relativeOnly: true }).label('NextUrl')
+                    next: Joi.string()
+                        .empty('')
+                        .uri({ relativeOnly: true })
+                        .pattern(/^\/(?!\/)/)
+                        .label('NextUrl')
                 })
             },
 
@@ -3765,7 +3807,11 @@ ${Buffer.from(data.content, 'base64url').toString('base64')}
                 },
 
                 query: Joi.object({
-                    next: Joi.string().empty('').uri({ relativeOnly: true }).label('NextUrl')
+                    next: Joi.string()
+                        .empty('')
+                        .uri({ relativeOnly: true })
+                        .pattern(/^\/(?!\/)/)
+                        .label('NextUrl')
                 })
             }
         }
@@ -3832,6 +3878,13 @@ ${Buffer.from(data.content, 'base64url').toString('base64')}
                     request.cookieAuth.ttl(LOGIN_PERIOD_TTL);
                 }
 
+                request.logger.info({
+                    msg: 'TOTP verification successful',
+                    user: request.auth.credentials.user,
+                    method: 'totp',
+                    remoteAddress: request.app.ip
+                });
+
                 if (request.payload.next) {
                     return h.redirect(request.payload.next);
                 } else {
@@ -3840,10 +3893,16 @@ ${Buffer.from(data.content, 'base64url').toString('base64')}
             } catch (err) {
                 if (!err.details || !err.details.code) {
                     // skip error message if code is invalid
-                    await request.flash({ type: 'danger', message: err.responseText || `Verification failed. Check your code and try again.` });
+                    await request.flash({ type: 'danger', message: err.responseText || `Could not verify. Check your code and try again.` });
                 }
 
-                request.logger.error({ msg: 'Failed to verify login', err });
+                request.logger.error({
+                    msg: 'Failed to verify TOTP',
+                    err,
+                    user: request.auth && request.auth.credentials && request.auth.credentials.user,
+                    method: 'totp',
+                    remoteAddress: request.app.ip
+                });
 
                 let errors = err.details;
 
@@ -3879,7 +3938,7 @@ ${Buffer.from(data.content, 'base64url').toString('base64')}
                         });
                     }
 
-                    await request.flash({ type: 'danger', message: `Verification failed. Check your code and try again.` });
+                    await request.flash({ type: 'danger', message: `Could not verify. Check your code and try again.` });
                     request.logger.error({ msg: 'Failed to verify login', err });
 
                     return h
@@ -3900,7 +3959,11 @@ ${Buffer.from(data.content, 'base64url').toString('base64')}
                 payload: Joi.object({
                     type: Joi.string().valid('totp').description('The type of the two-factor authentication method').required(),
                     code: Joi.string().min(6).max(6).description('6-digit TOTP code').required(),
-                    next: Joi.string().empty('').uri({ relativeOnly: true }).label('NextUrl')
+                    next: Joi.string()
+                        .empty('')
+                        .uri({ relativeOnly: true })
+                        .pattern(/^\/(?!\/)/)
+                        .label('NextUrl')
                 })
             },
 
@@ -3959,6 +4022,21 @@ ${Buffer.from(data.content, 'base64url').toString('base64')}
                 }
             }
 
+            let registeredPasskeys = await passkeys.listCredentials(username);
+            for (let pk of registeredPasskeys) {
+                try {
+                    pk.createdAtFormatted = new Date(pk.createdAt).toLocaleDateString('en-US', {
+                        year: 'numeric',
+                        month: 'short',
+                        day: 'numeric'
+                    });
+                } catch (err) {
+                    pk.createdAtFormatted = pk.createdAt;
+                }
+            }
+
+            let serviceUrl = await settings.get('serviceUrl');
+
             return h.view(
                 'account/security',
                 {
@@ -3970,10 +4048,11 @@ ${Buffer.from(data.content, 'base64url').toString('base64')}
                     username,
 
                     totp,
+                    passkeys: registeredPasskeys,
+                    serviceUrl,
                     providers: {
                         okta: USE_OKTA_AUTH && (await h.validateOktaConfig())
                     },
-                    serviceUrl: await settings.get('serviceUrl'),
                     okta: {
                         OKTA_OAUTH2_ISSUER,
                         OKTA_OAUTH2_CLIENT_ID,
@@ -4119,7 +4198,7 @@ ${Buffer.from(data.content, 'base64url').toString('base64')}
                 await request.flash({ type: 'info', message: `User logged out` });
                 return h.redirect('/');
             } catch (err) {
-                await request.flash({ type: 'danger', message: `Couldn't log out sessions. Try again.` });
+                await request.flash({ type: 'danger', message: `Could not sign out sessions. Try again.` });
                 request.logger.error({ msg: 'Failed to log out user sessions', err, remoteAddress: request.app.ip });
                 return h.redirect(`/admin/account/security`);
             }
@@ -4133,7 +4212,7 @@ ${Buffer.from(data.content, 'base64url').toString('base64')}
                 },
 
                 async failAction(request, h, err) {
-                    await request.flash({ type: 'danger', message: `Couldn't log out sessions. Try again.` });
+                    await request.flash({ type: 'danger', message: `Could not sign out sessions. Try again.` });
                     request.logger.error({ msg: 'Failed to log out user sessions', err });
 
                     return h.redirect('/admin').takeover();
@@ -4142,6 +4221,421 @@ ${Buffer.from(data.content, 'base64url').toString('base64')}
         }
     });
 
+    // --- Passkey (WebAuthn) routes ---
+
+    const passkeyCredentialSchema = Joi.object({
+        id: Joi.string()
+            .max(512)
+            .pattern(/^[A-Za-z0-9_-]+$/)
+            .required(),
+        rawId: Joi.string()
+            .max(512)
+            .pattern(/^[A-Za-z0-9_-]+$/)
+            .required(),
+        response: Joi.object({
+            clientDataJSON: Joi.string().max(16384).required(),
+            attestationObject: Joi.string().max(65536),
+            authenticatorData: Joi.string().max(8192),
+            signature: Joi.string().max(2048),
+            userHandle: Joi.string().max(512).allow(''),
+            publicKey: Joi.string().max(4096),
+            publicKeyAlgorithm: Joi.number().integer()
+        }).required(),
+        type: Joi.string().valid('public-key').required(),
+        authenticatorAttachment: Joi.string().optional(),
+        clientExtensionResults: Joi.object().optional()
+    }).required();
+
+    // Registration: generate options (authenticated)
+    server.route({
+        method: 'POST',
+        path: '/admin/account/passkeys/register/options',
+        async handler(request, h) {
+            try {
+                let rateLimit = await h.checkRateLimit(`passkey:register:${request.app.ip}`, 1, 10, 60);
+                if (!rateLimit.success) {
+                    return h.response({ error: 'Rate limited, please wait and try again' }).code(429);
+                }
+
+                let authData = await settings.get('authData');
+                if (!authData || !authData.password) {
+                    return h.response({ error: 'Account password must be configured before registering passkeys' }).code(403);
+                }
+
+                if (!request.payload.password) {
+                    return h.response({ error: 'Current password is required' }).code(403);
+                }
+                let valid;
+                try {
+                    valid = await pbkdf2.verify(authData.password, request.payload.password);
+                } catch (err) {
+                    request.logger.error({ msg: 'Failed to verify password for passkey registration', err });
+                    valid = false;
+                }
+                if (!valid) {
+                    return h.response({ error: 'Invalid password' }).code(403);
+                }
+
+                let { rpId, origin } = await passkeys.getRpConfig();
+                if (!rpId || !origin) {
+                    return h.response({ error: 'Service URL must be configured before registering passkeys' }).code(400);
+                }
+
+                let user = (request.auth && request.auth.credentials && request.auth.credentials.user) || 'admin';
+
+                let existingCredentials = await passkeys.listCredentials(user);
+                if (existingCredentials.length >= consts.MAX_PASSKEYS_PER_USER) {
+                    return h.response({ error: 'Maximum number of passkeys reached' }).code(400);
+                }
+
+                let options = await generateRegistrationOptions({
+                    rpName: 'EmailEngine',
+                    rpID: rpId,
+                    userName: user,
+                    userID: Buffer.from(crypto.createHash('sha256').update(user).digest()),
+                    attestationType: 'none',
+                    excludeCredentials: existingCredentials.map(c => ({
+                        id: c.id,
+                        transports: c.transports
+                    })),
+                    authenticatorSelection: {
+                        residentKey: 'preferred',
+                        userVerification: 'required'
+                    }
+                });
+
+                let challengeId = await passkeys.storeChallenge(options.challenge);
+
+                return h.response({ challengeId, options }).code(200);
+            } catch (err) {
+                request.logger.error({ msg: 'Failed to generate passkey registration options', err });
+                return h.response({ error: 'Failed to generate registration options' }).code(500);
+            }
+        },
+        options: {
+            validate: {
+                options: {
+                    stripUnknown: true,
+                    abortEarly: false,
+                    convert: true
+                },
+                payload: Joi.object({
+                    password: Joi.string().max(256).allow('', null).optional().label('Current password')
+                })
+            }
+        }
+    });
+
+    // Registration: verify response (authenticated)
+    server.route({
+        method: 'POST',
+        path: '/admin/account/passkeys/register/verify',
+        async handler(request, h) {
+            try {
+                let rateLimit = await h.checkRateLimit(`passkey:register:${request.app.ip}`, 1, 10, 60);
+                if (!rateLimit.success) {
+                    return h.response({ error: 'Rate limited, please wait and try again' }).code(429);
+                }
+
+                let { rpId, origin } = await passkeys.getRpConfig();
+                if (!rpId || !origin) {
+                    return h.response({ error: 'Service URL must be configured' }).code(400);
+                }
+
+                let challenge = await passkeys.consumeChallenge(request.payload.challengeId);
+                if (!challenge) {
+                    return h.response({ error: 'Challenge expired or invalid. Please try again.' }).code(400);
+                }
+
+                let verification = await verifyRegistrationResponse({
+                    response: request.payload.credential,
+                    expectedChallenge: challenge,
+                    expectedOrigin: origin,
+                    expectedRPID: rpId
+                });
+
+                if (!verification.verified || !verification.registrationInfo) {
+                    return h.response({ error: 'Registration verification failed' }).code(400);
+                }
+
+                let { credential } = verification.registrationInfo;
+                let user = (request.auth && request.auth.credentials && request.auth.credentials.user) || 'admin';
+
+                let authData = await settings.get('authData');
+                if (!authData || !authData.password) {
+                    return h.response({ error: 'Account password must be configured before registering passkeys' }).code(403);
+                }
+
+                let saved = await passkeys.saveCredentialIfUnderLimit(
+                    {
+                        id: credential.id,
+                        publicKey: Buffer.from(credential.publicKey).toString('base64url'),
+                        counter: credential.counter,
+                        transports: credential.transports || [],
+                        name: request.payload.name,
+                        user
+                    },
+                    consts.MAX_PASSKEYS_PER_USER
+                );
+
+                if (!saved) {
+                    return h.response({ error: 'Maximum number of passkeys reached' }).code(400);
+                }
+
+                request.logger.info({
+                    msg: 'Passkey registered',
+                    user,
+                    name: request.payload.name,
+                    method: 'passkey',
+                    remoteAddress: request.app.ip
+                });
+
+                return h.response({ success: true }).code(200);
+            } catch (err) {
+                request.logger.error({ msg: 'Failed to verify passkey registration', err });
+                return h.response({ error: 'Registration failed' }).code(500);
+            }
+        },
+        options: {
+            validate: {
+                options: {
+                    stripUnknown: true,
+                    abortEarly: false,
+                    convert: true
+                },
+                payload: Joi.object({
+                    challengeId: Joi.string().hex().length(64).required(),
+                    name: Joi.string().max(100).empty('').default('Unnamed passkey'),
+                    credential: passkeyCredentialSchema
+                })
+            }
+        }
+    });
+
+    // Delete passkey (authenticated)
+    server.route({
+        method: 'POST',
+        path: '/admin/account/passkeys/delete',
+        async handler(request, h) {
+            if (request.auth.artifacts && request.auth.artifacts.provider) {
+                return h.redirect('/admin');
+            }
+
+            try {
+                let user = (request.auth && request.auth.credentials && request.auth.credentials.user) || 'admin';
+                let deleted = await passkeys.deleteCredential(request.payload.credentialId, user);
+                if (deleted) {
+                    request.logger.info({
+                        msg: 'Passkey deleted',
+                        user,
+                        credentialId: request.payload.credentialId,
+                        method: 'passkey',
+                        remoteAddress: request.app.ip
+                    });
+                    await request.flash({ type: 'info', message: 'Passkey removed' });
+                } else {
+                    await request.flash({ type: 'danger', message: 'Passkey not found' });
+                }
+            } catch (err) {
+                await request.flash({ type: 'danger', message: 'Failed to remove passkey' });
+                request.logger.error({ msg: 'Failed to delete passkey', err });
+            }
+            return h.redirect('/admin/account/security');
+        },
+        options: {
+            validate: {
+                options: {
+                    stripUnknown: true,
+                    abortEarly: false,
+                    convert: true
+                },
+
+                async failAction(request, h, err) {
+                    await request.flash({ type: 'danger', message: 'Failed to remove passkey' });
+                    request.logger.error({ msg: 'Failed to delete passkey', err });
+                    return h.redirect('/admin/account/security').takeover();
+                },
+
+                payload: Joi.object({
+                    credentialId: Joi.string()
+                        .max(512)
+                        .pattern(/^[A-Za-z0-9_-]+$/)
+                        .required()
+                        .description('Credential ID to delete')
+                })
+            }
+        }
+    });
+
+    // Authentication: generate options (unauthenticated)
+    server.route({
+        method: 'POST',
+        path: '/admin/passkey/auth/options',
+        async handler(request, h) {
+            try {
+                let rateLimit = await h.checkRateLimit(`passkey:auth:options:${request.app.ip}`, 1, 10, 60);
+                if (!rateLimit.success) {
+                    return h.response({ error: 'Rate limited, please wait and try again' }).code(429);
+                }
+
+                let { rpId } = await passkeys.getRpConfig();
+                if (!rpId) {
+                    return h.response({ error: 'no_passkeys' }).code(400);
+                }
+
+                let allCredentials = await passkeys.getAllCredentials();
+                if (!allCredentials.length) {
+                    return h.response({ error: 'no_passkeys' }).code(400);
+                }
+
+                let options = await generateAuthenticationOptions({
+                    rpID: rpId,
+                    allowCredentials: allCredentials.map(c => ({
+                        id: c.id,
+                        transports: c.transports
+                    })),
+                    userVerification: 'required'
+                });
+
+                let challengeId = await passkeys.storeChallenge(options.challenge);
+
+                return h.response({ challengeId, options }).code(200);
+            } catch (err) {
+                request.logger.error({ msg: 'Failed to generate passkey auth options', err });
+                return h.response({ error: 'Failed to generate authentication options' }).code(500);
+            }
+        },
+        options: {
+            auth: {
+                strategy: 'session',
+                mode: 'try'
+            },
+            plugins: {
+                cookie: {
+                    redirectTo: false
+                }
+            },
+            validate: {
+                options: {
+                    stripUnknown: true,
+                    abortEarly: false,
+                    convert: true
+                },
+                payload: Joi.object({})
+            }
+        }
+    });
+
+    // Authentication: verify response (unauthenticated)
+    server.route({
+        method: 'POST',
+        path: '/admin/passkey/auth/verify',
+        async handler(request, h) {
+            try {
+                let rateLimit = await h.checkRateLimit(`passkey:auth:verify:${request.app.ip}`, 1, 10, 60);
+                if (!rateLimit.success) {
+                    return h.response({ error: 'Rate limited, please wait and try again' }).code(429);
+                }
+
+                let { rpId, origin } = await passkeys.getRpConfig();
+                if (!rpId || !origin) {
+                    request.logger.warn({ msg: 'Passkey auth failed: missing RP config', method: 'passkey', remoteAddress: request.app.ip });
+                    return h.response({ success: false, error: 'Authentication failed' }).code(400);
+                }
+
+                let challenge = await passkeys.consumeChallenge(request.payload.challengeId);
+                if (!challenge) {
+                    request.logger.warn({ msg: 'Passkey auth failed: challenge expired or invalid', method: 'passkey', remoteAddress: request.app.ip });
+                    return h.response({ success: false, error: 'Challenge expired or invalid. Please try again.' }).code(400);
+                }
+
+                let credentialId = request.payload.credential && request.payload.credential.id;
+                let storedCredential = await passkeys.getCredential(credentialId);
+                if (!storedCredential) {
+                    request.logger.warn({ msg: 'Passkey auth failed: unknown credential', method: 'passkey', remoteAddress: request.app.ip });
+                    return h.response({ success: false, error: 'Authentication failed' }).code(400);
+                }
+
+                let verification = await verifyAuthenticationResponse({
+                    response: request.payload.credential,
+                    expectedChallenge: challenge,
+                    expectedOrigin: origin,
+                    expectedRPID: rpId,
+                    credential: {
+                        id: storedCredential.id,
+                        publicKey: Buffer.from(storedCredential.publicKey, 'base64url'),
+                        counter: storedCredential.counter,
+                        transports: storedCredential.transports
+                    }
+                });
+
+                if (!verification.verified) {
+                    request.logger.warn({ msg: 'Passkey auth failed: verification failed', method: 'passkey', remoteAddress: request.app.ip });
+                    return h.response({ success: false, error: 'Authentication failed' }).code(400);
+                }
+
+                let user = storedCredential.user;
+                let authData = await settings.get('authData');
+
+                if (!authData || !authData.user || authData.user !== user) {
+                    request.logger.warn({ msg: 'Passkey auth failed: user mismatch', method: 'passkey', remoteAddress: request.app.ip });
+                    return h.response({ success: false, error: 'Authentication failed' }).code(400);
+                }
+
+                await passkeys.updateCounter(storedCredential.id, verification.authenticationInfo.newCounter);
+
+                request.cookieAuth.set({
+                    user,
+                    requireTotp: false,
+                    passwordVersion: (authData && authData.passwordVersion) || 0,
+                    remember: request.payload.remember || false,
+                    sid: crypto.randomBytes(32).toString('hex')
+                });
+
+                if (request.payload.remember) {
+                    request.cookieAuth.ttl(LOGIN_PERIOD_TTL);
+                }
+
+                request.logger.info({ msg: 'Passkey authentication successful', user, method: 'passkey', remoteAddress: request.app.ip });
+
+                return h.response({ success: true, redirect: request.payload.next || '/admin' }).code(200);
+            } catch (err) {
+                request.logger.error({ msg: 'Failed to verify passkey authentication', err, method: 'passkey', remoteAddress: request.app.ip });
+                return h.response({ success: false, error: 'Authentication failed' }).code(400);
+            }
+        },
+        options: {
+            auth: {
+                strategy: 'session',
+                mode: 'try'
+            },
+            plugins: {
+                cookie: {
+                    redirectTo: false
+                }
+            },
+            validate: {
+                options: {
+                    stripUnknown: true,
+                    abortEarly: false,
+                    convert: true
+                },
+                payload: Joi.object({
+                    challengeId: Joi.string().hex().length(64).required(),
+                    credential: passkeyCredentialSchema,
+                    next: Joi.string()
+                        .empty('')
+                        .uri({ relativeOnly: true })
+                        .pattern(/^\/(?!\/)/)
+                        .label('NextUrl'),
+                    remember: Joi.boolean().truthy('Y', 'true', '1', 'on').falsy('N', 'false', 0, '').default(false)
+                })
+            }
+        }
+    });
+
+    // --- End of Passkey routes ---
+
     server.route({
         method: 'GET',
         path: '/admin/account/password',
@@ -4187,7 +4681,7 @@ ${Buffer.from(data.content, 'base64url').toString('base64')}
                             throw new Error('Invalid current password');
                         }
                     } catch (E) {
-                        request.logger.error({ msg: 'Failed to verify password hash', err: E, hash: authData.password });
+                        request.logger.error({ msg: 'Failed to verify password hash', err: E });
                         let err = new Error('Failed to verify current password');
                         err.details = { password0: err.message };
                         throw err;
@@ -4207,6 +4701,13 @@ ${Buffer.from(data.content, 'base64url').toString('base64')}
 
                 await settings.set('authData', authData);
 
+                try {
+                    await passkeys.deleteAllCredentials(authData.user || 'admin');
+                    request.logger.info({ msg: 'All passkeys cleared after password change', user: authData.user || 'admin' });
+                } catch (passkeyErr) {
+                    request.logger.error({ msg: 'Failed to clear passkeys after password change', err: passkeyErr });
+                }
+
                 if (!server.auth.settings.default) {
                     server.auth.default('session');
                     request.cookieAuth.set({
@@ -5638,7 +6139,7 @@ ${Buffer.from(data.content, 'base64url').toString('base64')}
                 if (request.cookieAuth) {
                     request.cookieAuth.clear();
                 }
-                await request.flash({ type: 'info', message: `Sign in again to continue` });
+                await request.flash({ type: 'info', message: `Sign in again to continue.` });
                 return h.redirect('/admin/login?next=' + encodeURIComponent('/admin/accounts/{account}/browse'));
             }