neoagent 2.4.1-beta.45 → 2.4.1-beta.47

package/server/public/flutter_bootstrap.js

@@ -37,6 +37,6 @@ _flutter.buildConfig = {"engineRevision":"c416acfeb8126e097f758c664aaa3da929e27d
 
 _flutter.loader.load({
   serviceWorkerSettings: {
-    serviceWorkerVersion: "2397226113" /* Flutter's service worker is deprecated and will be removed in a future Flutter release. */
+    serviceWorkerVersion: "111346624" /* Flutter's service worker is deprecated and will be removed in a future Flutter release. */
   }
 });

package/server/public/main.dart.js

@@ -133824,7 +133824,7 @@ r===$&&A.b()
 o.push(A.j4(p,A.j8(!1,new A.a3(B.up,A.dl(new A.cv(B.hr,new A.a7p(r,p),p),p,p),p),!1,B.I,!0),p,p,0,0,0,p))}r=!1
 if(!s.ay)if(!s.ch){r=s.e
 r===$&&A.b()
-r=B.b.t("mq6g3m8k-1096615").length!==0&&r.b}if(r){r=s.d
+r=B.b.t("mq73wuaf-558fe68").length!==0&&r.b}if(r){r=s.d
 r===$&&A.b()
 r=r.au&&!r.aQ?84:0
 q=s.e
@@ -139266,7 +139266,7 @@ $S:0}
 A.ZM.prototype={}
 A.Sw.prototype={
 n9(a){var s=this
-if(B.b.t("mq6g3m8k-1096615").length===0||s.a!=null)return
+if(B.b.t("mq73wuaf-558fe68").length===0||s.a!=null)return
 s.AN()
 s.a=A.qh(B.Rb,new A.bas(s))},
 AN(){var s=0,r=A.l(t.H),q,p=2,o=[],n=this,m,l,k,j,i,h,g,f
@@ -139284,7 +139284,7 @@ if(!t.f.b(k)){s=1
 break}i=J.a_(k,"buildId")
 h=i==null?null:B.b.t(J.p(i))
 j=h==null?"":h
-if(J.bf(j)===0||J.d(j,"mq6g3m8k-1096615")){s=1
+if(J.bf(j)===0||J.d(j,"mq73wuaf-558fe68")){s=1
 break}n.b=!0
 n.E()
 p=2
@@ -139301,7 +139301,7 @@ case 2:return A.i(o.at(-1),r)}})
 return A.k($async$AN,r)},
 vw(){var s=0,r=A.l(t.H),q,p=2,o=[],n=this,m,l,k,j,i,h,g,f,e,d,c,b,a,a0,a1
 var $async$vw=A.h(function(a2,a3){if(a2===1){o.push(a3)
-s=p}for(;;)switch(s){case 0:if(B.b.t("mq6g3m8k-1096615").length===0||n.c){s=1
+s=p}for(;;)switch(s){case 0:if(B.b.t("mq73wuaf-558fe68").length===0||n.c){s=1
 break}n.c=!0
 n.E()
 p=4

package/server/routes/admin.js

@@ -22,6 +22,21 @@ const rateLimit = require('express-rate-limit');
 const router = express.Router();
 const ADMIN_DIR = path.join(__dirname, '..', 'admin');
 
+const fs   = require('fs');
+
+// Admin sessions last 30 days and roll on every request.
+const ADMIN_SESSION_TTL = 30 * 24 * 60 * 60 * 1000;
+
+// Rolling refresh: touch the session on every authenticated admin request
+// so the 30-day window slides forward from the last activity.
+router.use((req, res, next) => {
+  if (req.session?.isAdmin) {
+    req.session.cookie.maxAge = ADMIN_SESSION_TTL;
+    req.session.touch();
+  }
+  next();
+});
+
 const loginLimiter = rateLimit({
   windowMs: 15 * 60 * 1000,
   max: 20,
@@ -46,21 +61,55 @@ router.get('/login', (req, res) => {
   res.sendFile(path.join(ADMIN_DIR, 'login.html'));
 });
 
-router.post('/api/login', loginLimiter, express.json(), (req, res) => {
+router.post('/api/login', loginLimiter, express.json(), async (req, res) => {
   const { username, password } = req.body || {};
   const expectedUsername = process.env.ADMIN_USERNAME || 'admin';
   const expectedPassword = process.env.ADMIN_PASSWORD || '';
   if (!expectedPassword) {
     return res.status(503).json({ error: 'Admin credentials not configured. Run `neoagent setup`.' });
   }
-  if (username === expectedUsername && password === expectedPassword) {
+  if (username !== expectedUsername || password !== expectedPassword) {
+    return res.status(401).json({ error: 'Invalid credentials' });
+  }
+  // Check whether 2FA is enabled
+  const adminTwoFactor = require('../services/account/admin_two_factor');
+  const tfStatus = adminTwoFactor.getStatus();
+  if (tfStatus.enabled) {
+    // Park the session in a "password OK, waiting for TOTP" state
+    req.session.adminPendingTwoFactor = true;
+    delete req.session.isAdmin;
+    return req.session.save((err) => {
+      if (err) return res.status(500).json({ error: 'Session error' });
+      res.json({ ok: false, requiresTwoFactor: true });
+    });
+  }
+  req.session.isAdmin = true;
+  req.session.cookie.maxAge = ADMIN_SESSION_TTL;
+  req.session.save((err) => {
+    if (err) return res.status(500).json({ error: 'Session error' });
+    res.json({ ok: true });
+  });
+});
+
+// Second-factor verification (called after a successful password login when 2FA is on)
+router.post('/api/2fa/verify', loginLimiter, express.json(), async (req, res) => {
+  if (!req.session?.adminPendingTwoFactor) {
+    return res.status(400).json({ error: 'No pending 2FA verification' });
+  }
+  const { code } = req.body || {};
+  try {
+    const adminTwoFactor = require('../services/account/admin_two_factor');
+    const valid = await adminTwoFactor.verifyCode(code);
+    if (!valid) return res.status(401).json({ error: 'Invalid code — try again' });
+    req.session.adminPendingTwoFactor = false;
     req.session.isAdmin = true;
+    req.session.cookie.maxAge = ADMIN_SESSION_TTL;
     req.session.save((err) => {
       if (err) return res.status(500).json({ error: 'Session error' });
       res.json({ ok: true });
     });
-  } else {
-    res.status(401).json({ error: 'Invalid credentials' });
+  } catch (err) {
+    res.status(500).json({ error: err.message });
   }
 });
 
@@ -262,6 +311,268 @@ router.put('/api/update/channel', requireAdminAuth, (req, res) => {
   });
 });
 
+const settingsLimiter = rateLimit({
+  windowMs: 15 * 60 * 1000,
+  max: 20,
+  standardHeaders: true,
+  legacyHeaders: false,
+  message: { error: 'Too many settings changes, slow down' },
+});
+
+const sqlLimiter = rateLimit({
+  windowMs: 15 * 60 * 1000,
+  max: 60,
+  standardHeaders: true,
+  legacyHeaders: false,
+  message: { error: 'Too many SQL queries, slow down' },
+});
+
+// --- Access settings (signup toggle + API key) ---
+
+router.get('/api/settings', requireAdminAuth, (req, res) => {
+  const apiKey = process.env.ADMIN_API_KEY || '';
+  const hint = apiKey.length > 8
+    ? `${apiKey.slice(0, 4)}${'•'.repeat(4)}${apiKey.slice(-4)}`
+    : apiKey ? '•'.repeat(apiKey.length) : '';
+  const adminTwoFactor = require('../services/account/admin_two_factor');
+  const tfStatus = adminTwoFactor.getStatus();
+  res.json({
+    signupEnabled: process.env.NEOAGENT_ALLOW_SIGNUP !== 'false',
+    apiKeyConfigured: Boolean(apiKey),
+    apiKeyHint: hint,
+    twoFactor: tfStatus,
+  });
+});
+
+// --- 2FA management ---
+
+router.get('/api/settings/2fa', requireAdminAuth, (req, res) => {
+  const adminTwoFactor = require('../services/account/admin_two_factor');
+  res.json(adminTwoFactor.getStatus());
+});
+
+router.post('/api/settings/2fa/setup', requireAdminAuth, settingsLimiter, async (req, res) => {
+  try {
+    const adminTwoFactor = require('../services/account/admin_two_factor');
+    const { otpauthUrl, manualKey } = adminTwoFactor.beginSetup();
+    const qrcode = require('qrcode');
+    const qrDataUrl = await qrcode.toDataURL(otpauthUrl, { width: 200, margin: 2 });
+    res.json({ qrDataUrl, manualKey });
+  } catch (err) {
+    res.status(err.statusCode || 500).json({ error: err.message });
+  }
+});
+
+router.post('/api/settings/2fa/enable', requireAdminAuth, settingsLimiter, express.json(), async (req, res) => {
+  try {
+    const adminTwoFactor = require('../services/account/admin_two_factor');
+    const { recoveryCodes } = await adminTwoFactor.enable(req.body?.code);
+    res.json({ ok: true, recoveryCodes });
+  } catch (err) {
+    res.status(err.statusCode || 500).json({ error: err.message });
+  }
+});
+
+router.delete('/api/settings/2fa', requireAdminAuth, settingsLimiter, express.json(), async (req, res) => {
+  try {
+    const adminTwoFactor = require('../services/account/admin_two_factor');
+    await adminTwoFactor.disable(req.body?.code);
+    res.json({ ok: true });
+  } catch (err) {
+    res.status(err.statusCode || 500).json({ error: err.message });
+  }
+});
+
+router.post('/api/settings/2fa/recovery-codes', requireAdminAuth, settingsLimiter, express.json(), async (req, res) => {
+  try {
+    const adminTwoFactor = require('../services/account/admin_two_factor');
+    const { recoveryCodes } = await adminTwoFactor.regenerateCodes(req.body?.code);
+    res.json({ ok: true, recoveryCodes });
+  } catch (err) {
+    res.status(err.statusCode || 500).json({ error: err.message });
+  }
+});
+
+router.put('/api/settings/signup', requireAdminAuth, settingsLimiter, express.json(), (req, res) => {
+  const enabled = req.body?.enabled !== false; // default true
+  const value   = enabled ? 'true' : 'false';
+  upsertEnvValue(ENV_FILE, 'NEOAGENT_ALLOW_SIGNUP', value);
+  process.env.NEOAGENT_ALLOW_SIGNUP = value;
+  res.json({ ok: true, signupEnabled: enabled });
+});
+
+router.post('/api/settings/apikey/rotate', requireAdminAuth, settingsLimiter, (req, res) => {
+  const newKey = require('crypto').randomBytes(32).toString('hex');
+  upsertEnvValue(ENV_FILE, 'ADMIN_API_KEY', newKey);
+  process.env.ADMIN_API_KEY = newKey;
+  // Return the key once — it will not be shown again
+  res.json({ ok: true, apiKey: newKey });
+});
+
+router.delete('/api/settings/apikey', requireAdminAuth, settingsLimiter, (req, res) => {
+  upsertEnvValue(ENV_FILE, 'ADMIN_API_KEY', '');
+  delete process.env.ADMIN_API_KEY;
+  res.json({ ok: true });
+});
+
+// --- Analytics ---
+
+router.get('/api/analytics', requireAdminAuth, (req, res) => {
+  const db = require('../db/database');
+  const now = new Date().toISOString();
+  const dayAgo  = new Date(Date.now() - 86_400_000).toISOString();
+  const weekAgo = new Date(Date.now() - 7 * 86_400_000).toISOString();
+  try {
+    const stats = {
+      totalUsers:    db.prepare('SELECT COUNT(*) AS n FROM users').get().n,
+      activeToday:   db.prepare('SELECT COUNT(*) AS n FROM users WHERE last_login > ?').get(dayAgo).n,
+      newThisWeek:   db.prepare('SELECT COUNT(*) AS n FROM users WHERE created_at > ?').get(weekAgo).n,
+      totalRuns:     db.prepare('SELECT COUNT(*) AS n FROM agent_runs').get().n,
+      runsToday:     db.prepare('SELECT COUNT(*) AS n FROM agent_runs WHERE created_at > ?').get(dayAgo).n,
+      totalTokens:   db.prepare('SELECT COALESCE(SUM(total_tokens),0) AS n FROM agent_runs').get().n,
+      activeSessions:db.prepare('SELECT COUNT(*) AS n FROM user_sessions WHERE revoked_at IS NULL AND expires_at > ?').get(now).n,
+      totalStorage:  db.prepare('SELECT COALESCE(SUM(byte_size),0) AS n FROM artifacts').get().n,
+    };
+    const topUsers = db.prepare(`
+      SELECT u.id, u.username, u.display_name,
+             COALESCE(r.runs,    0) AS runs,
+             COALESCE(r.tokens,  0) AS tokens,
+             COALESCE(a.storage, 0) AS storage
+      FROM users u
+      LEFT JOIN (
+        SELECT user_id,
+               COUNT(*)                   AS runs,
+               COALESCE(SUM(total_tokens),0) AS tokens
+        FROM agent_runs GROUP BY user_id
+      ) r ON r.user_id = u.id
+      LEFT JOIN (
+        SELECT user_id, COALESCE(SUM(byte_size),0) AS storage
+        FROM artifacts GROUP BY user_id
+      ) a ON a.user_id = u.id
+      ORDER BY runs DESC LIMIT 8
+    `).all();
+    const recentRuns = db.prepare(`
+      SELECT r.id, u.username, r.title, r.status, r.total_tokens,
+             r.created_at, r.completed_at
+      FROM agent_runs r
+      JOIN users u ON u.id = r.user_id
+      ORDER BY r.created_at DESC LIMIT 20
+    `).all();
+    res.json({ stats, topUsers, recentRuns });
+  } catch (err) {
+    res.status(500).json({ error: String(err.message || err) });
+  }
+});
+
+// --- User management ---
+
+router.get('/api/users', requireAdminAuth, (req, res) => {
+  const db = require('../db/database');
+  const q  = req.query.q ? `%${req.query.q}%` : null;
+  try {
+    const sql = `
+      SELECT u.id, u.username, u.display_name, u.email, u.email_verified_at,
+             u.created_at, u.last_login,
+             COALESCE(r.run_count,    0) AS run_count,
+             COALESCE(a.storage_bytes,0) AS storage_bytes
+      FROM users u
+      LEFT JOIN (
+        SELECT user_id, COUNT(*) AS run_count
+        FROM agent_runs GROUP BY user_id
+      ) r ON r.user_id = u.id
+      LEFT JOIN (
+        SELECT user_id, COALESCE(SUM(byte_size),0) AS storage_bytes
+        FROM artifacts GROUP BY user_id
+      ) a ON a.user_id = u.id
+      ${q ? 'WHERE u.username LIKE ? OR u.email LIKE ?' : ''}
+      ORDER BY u.created_at DESC LIMIT 200`;
+    const users = q ? db.prepare(sql).all(q, q) : db.prepare(sql).all();
+    res.json({ users });
+  } catch (err) {
+    res.status(500).json({ error: String(err.message || err) });
+  }
+});
+
+router.delete('/api/users/:id', requireAdminAuth, (req, res) => {
+  const db = require('../db/database');
+  const { DATA_DIR } = require('../../runtime/paths');
+  const { id } = req.params;
+  if (!id) return res.status(400).json({ error: 'Missing user id' });
+  try {
+    // Collect artifact paths before deletion
+    const artifacts = db.prepare('SELECT storage_path FROM artifacts WHERE user_id = ?').all(id);
+
+    const erase = db.transaction((uid) => {
+      db.prepare('DELETE FROM conversation_messages WHERE conversation_id IN (SELECT id FROM conversations WHERE user_id = ?)').run(uid);
+      db.prepare('DELETE FROM conversations WHERE user_id = ?').run(uid);
+      db.prepare('DELETE FROM agent_steps WHERE run_id IN (SELECT id FROM agent_runs WHERE user_id = ?)').run(uid);
+      db.prepare('DELETE FROM agent_runs WHERE user_id = ?').run(uid);
+      db.prepare('DELETE FROM messages WHERE user_id = ?').run(uid);
+      db.prepare('DELETE FROM memories WHERE user_id = ?').run(uid);
+      db.prepare('DELETE FROM integration_connections WHERE user_id = ?').run(uid);
+      db.prepare('DELETE FROM platform_connections WHERE user_id = ?').run(uid);
+      db.prepare('DELETE FROM mcp_servers WHERE user_id = ?').run(uid);
+      db.prepare('DELETE FROM user_settings WHERE user_id = ?').run(uid);
+      db.prepare('DELETE FROM user_sessions WHERE user_id = ?').run(uid);
+      db.prepare('DELETE FROM desktop_companion_devices WHERE user_id = ?').run(uid);
+      db.prepare('DELETE FROM scheduled_tasks WHERE user_id = ?').run(uid);
+      db.prepare('DELETE FROM recording_sessions WHERE user_id = ?').run(uid);
+      db.prepare('DELETE FROM screen_history WHERE user_id = ?').run(uid);
+      db.prepare('DELETE FROM agents WHERE user_id = ?').run(uid);
+      db.prepare('DELETE FROM artifacts WHERE user_id = ?').run(uid);
+      db.prepare('DELETE FROM users WHERE id = ?').run(uid);
+    });
+    erase(id);
+
+    // Clean up artifact files on disk
+    for (const artifact of artifacts) {
+      try {
+        const abs = path.isAbsolute(artifact.storage_path)
+          ? artifact.storage_path
+          : path.join(DATA_DIR, artifact.storage_path);
+        fs.rmSync(abs, { force: true });
+      } catch {}
+    }
+    try { fs.rmSync(path.join(DATA_DIR, 'artifacts', id), { recursive: true, force: true }); } catch {}
+
+    res.json({ ok: true });
+  } catch (err) {
+    res.status(500).json({ error: String(err.message || err) });
+  }
+});
+
+router.delete('/api/users/:id/sessions', requireAdminAuth, (req, res) => {
+  const db = require('../db/database');
+  const { id } = req.params;
+  try {
+    db.prepare('UPDATE user_sessions SET revoked_at = ? WHERE user_id = ?').run(new Date().toISOString(), id);
+    res.json({ ok: true });
+  } catch (err) {
+    res.status(500).json({ error: String(err.message || err) });
+  }
+});
+
+// --- SQL editor (read-only SELECT only) ---
+
+const SQL_BLOCKED = /\b(INSERT|UPDATE|DELETE|DROP|CREATE|ALTER|ATTACH|DETACH|TRUNCATE|VACUUM|REINDEX|REPLACE|UPSERT|PRAGMA)\b/i;
+
+router.post('/api/sql', requireAdminAuth, sqlLimiter, express.json(), (req, res) => {
+  const { query } = req.body || {};
+  if (!query || typeof query !== 'string') return res.status(400).json({ error: 'No query provided' });
+  const trimmed = query.trim();
+  if (!/^(SELECT|WITH)\b/i.test(trimmed)) return res.status(400).json({ error: 'Only SELECT (or WITH …) queries are allowed' });
+  if (SQL_BLOCKED.test(trimmed))           return res.status(400).json({ error: 'Query contains a blocked SQL keyword' });
+  try {
+    const db = require('../db/database');
+    const rows = db.prepare(trimmed).all();
+    const limited = rows.slice(0, 500);
+    const columns = limited.length ? Object.keys(limited[0]) : [];
+    res.json({ rows: limited, columns, truncated: rows.length > 500, total: rows.length });
+  } catch (err) {
+    res.status(400).json({ error: String(err.message || err) });
+  }
+});
+
 // --- Providers ---
 
 const PROVIDERS = [
@@ -300,7 +611,7 @@ router.put('/api/providers', requireAdminAuth, express.json(), (req, res) => {
   if (!ALLOWED_PROVIDER_KEYS.has(key)) {
     return res.status(400).json({ error: 'Unknown provider key' });
   }
-  const trimmed = String(value || '').trim();
+  const trimmed = String(value || '').trim().replace(/[\r\n]/g, '');
   upsertEnvValue(ENV_FILE, key, trimmed);
   if (trimmed) {
     process.env[key] = trimmed;

package/server/services/account/admin_two_factor.js

@@ -0,0 +1,132 @@
+'use strict';
+
+const bcrypt  = require('bcrypt');
+const crypto  = require('crypto');
+const { generateSecret, generateURI, verifySync } = require('otplib');
+const db      = require('../../db/database');
+const { encryptValue, decryptValue } = require('../integrations/secrets');
+
+const TOTP_OPTS = { strategy: 'totp', digits: 6, period: 30, epochTolerance: 30 };
+const RECOVERY_ALPHA = 'ABCDEFGHJKLMNPQRSTUVWXYZ23456789';
+
+// ── Helpers ────────────────────────────────────────────────────────────────
+
+function getRow() {
+  return db.prepare('SELECT * FROM admin_two_factor WHERE id = 1').get() || null;
+}
+
+function normalizeCode(v) {
+  return String(v || '').trim().replace(/\s+/g, '').toUpperCase();
+}
+
+function verifyTotpCode(secret, code) {
+  const token = String(code || '').trim().replace(/\s+/g, '');
+  if (!/^\d{6}$/.test(token)) return false;
+  return verifySync({ ...TOTP_OPTS, secret, token })?.valid === true;
+}
+
+function makeRecoveryCode() {
+  let raw = '';
+  while (raw.length < 10) raw += RECOVERY_ALPHA[crypto.randomInt(RECOVERY_ALPHA.length)];
+  return `${raw.slice(0, 5)}-${raw.slice(5)}`;
+}
+
+// ── Public API ─────────────────────────────────────────────────────────────
+
+function getStatus() {
+  const row = getRow();
+  const codesLeft = db.prepare('SELECT COUNT(*) AS n FROM admin_recovery_codes WHERE used_at IS NULL').get().n;
+  return {
+    enabled:                row?.enabled === 1,
+    pending:                Boolean(row?.pending_secret),
+    enabledAt:              row?.enabled_at || null,
+    recoveryCodesRemaining: codesLeft,
+  };
+}
+
+function beginSetup() {
+  if (!String(process.env.SESSION_SECRET || '').trim()) {
+    throw Object.assign(new Error('SESSION_SECRET must be configured before enabling 2FA'), { statusCode: 500 });
+  }
+  const secret      = generateSecret();
+  const otpauthUrl  = generateURI({ ...TOTP_OPTS, issuer: 'NeoAgent Admin', label: 'admin', secret });
+  db.prepare(`
+    INSERT INTO admin_two_factor (id, pending_secret, enabled, created_at, updated_at)
+    VALUES (1, ?, COALESCE((SELECT enabled FROM admin_two_factor WHERE id = 1), 0), datetime('now'), datetime('now'))
+    ON CONFLICT(id) DO UPDATE SET pending_secret = excluded.pending_secret, updated_at = datetime('now')
+  `).run(encryptValue(secret));
+  return { otpauthUrl, manualKey: secret };
+}
+
+async function enable(code) {
+  const row = getRow();
+  if (!row?.pending_secret) throw Object.assign(new Error('No 2FA setup pending'), { statusCode: 400 });
+  const secret = decryptValue(row.pending_secret);
+  if (!verifyTotpCode(secret, code)) throw Object.assign(new Error('Invalid code — try again'), { statusCode: 401 });
+
+  const codes  = Array.from({ length: 10 }, makeRecoveryCode);
+  const hashes = await Promise.all(codes.map((c) => bcrypt.hash(normalizeCode(c).replace(/-/g, ''), 12)));
+
+  db.transaction(() => {
+    db.prepare('DELETE FROM admin_recovery_codes').run();
+    const ins = db.prepare("INSERT INTO admin_recovery_codes (code_hash, created_at) VALUES (?, datetime('now'))");
+    for (const h of hashes) ins.run(h);
+    db.prepare(`
+      UPDATE admin_two_factor
+      SET secret = pending_secret, pending_secret = NULL, enabled = 1,
+          enabled_at = datetime('now'), updated_at = datetime('now')
+      WHERE id = 1
+    `).run();
+  })();
+
+  return { recoveryCodes: codes };
+}
+
+/**
+ * Verifies a TOTP code or recovery code.
+ * Returns true if valid (or if 2FA is not enabled).
+ */
+async function verifyCode(code) {
+  const row = getRow();
+  if (!row?.enabled || !row.secret) return true; // 2FA not configured
+
+  const secret = decryptValue(row.secret);
+  if (verifyTotpCode(secret, code)) return true;
+
+  // Try recovery code
+  const normalized = normalizeCode(String(code || '')).replace(/-/g, '');
+  if (normalized.length < 6) return false;
+  const rows = db.prepare('SELECT id, code_hash FROM admin_recovery_codes WHERE used_at IS NULL ORDER BY id').all();
+  for (const r of rows) {
+    if (await bcrypt.compare(normalized, r.code_hash)) {
+      db.prepare("UPDATE admin_recovery_codes SET used_at = datetime('now') WHERE id = ?").run(r.id);
+      return true;
+    }
+  }
+  return false;
+}
+
+async function disable(code) {
+  const row = getRow();
+  if (!row?.enabled) return;
+  if (!await verifyCode(code)) throw Object.assign(new Error('Invalid 2FA code'), { statusCode: 401 });
+  db.transaction(() => {
+    db.prepare(`UPDATE admin_two_factor SET enabled = 0, secret = NULL, pending_secret = NULL,
+      enabled_at = NULL, updated_at = datetime('now') WHERE id = 1`).run();
+    db.prepare('DELETE FROM admin_recovery_codes').run();
+  })();
+}
+
+async function regenerateCodes(code) {
+  if (!await verifyCode(code)) throw Object.assign(new Error('Invalid 2FA code'), { statusCode: 401 });
+  const codes  = Array.from({ length: 10 }, makeRecoveryCode);
+  const hashes = await Promise.all(codes.map((c) => bcrypt.hash(normalizeCode(c).replace(/-/g, ''), 12)));
+  db.transaction(() => {
+    db.prepare('DELETE FROM admin_recovery_codes').run();
+    const ins = db.prepare("INSERT INTO admin_recovery_codes (code_hash, created_at) VALUES (?, datetime('now'))");
+    for (const h of hashes) ins.run(h);
+  })();
+  return { recoveryCodes: codes };
+}
+
+module.exports = { getStatus, beginSetup, enable, verifyCode, disable, regenerateCodes };