slauthjs 1.0.0 → 2.0.0

package/src/routes/oauth.js

@@ -0,0 +1,106 @@
+import { normalizeEmail } from '../users.js'
+import { json, redirect, safeRedirect, withParams } from '../util.js'
+
+/**
+ * "Sign in with GitHub/Google/…".
+ *
+ *   GET oauth/<provider>?redirect=/somewhere         start signing in
+ *   GET oauth/<provider>?link=1&redirect=/settings   link to the signed-in account
+ *   GET oauth/<provider>/callback                    where the provider sends people back
+ *
+ *   account:<provider>:<accountId>  { provider, accountId, userId, email, name, createdAt, tokens? }
+ *   accounts:<userId>               ["github:123", ...]
+ *
+ * Who is it? In order: someone who's linked this account before; the signed-in person,
+ * when linking; the user with the same email, when the provider says it's verified;
+ * otherwise a new user (if the allow list agrees).
+ *
+ * @param {object} app  the shared context from core.js
+ */
+export function oauthRoutes(app) {
+  const { store, users, oauth, providers } = app
+
+  return async function route({ route, method, request, url }) {
+    if (!route.startsWith('oauth/') || method !== 'GET') return
+    const [, id, step] = route.split('/')
+    const provider = providers.find((p) => p.id === id)
+    if (!provider || (step && step !== 'callback')) return json({ error: 'No such provider.', code: 'not-found' }, 404)
+    const callbackUrl = `${app.origin(url)}${app.prefix}/oauth/${provider.id}/callback`
+    const secure = app.secure(request)
+
+    if (!step) {
+      // Back to the page the button was on when something needs the person (an error, a 2FA code).
+      const referer = sameSitePath(request.headers.get('referer'), url)
+      const redirectTo = safeRedirect(url.searchParams.get('redirect') ?? referer ?? '/')
+      let linkUserId = null
+      if (url.searchParams.get('link')) {
+        const me = await app.current(request)
+        if (!me) return redirect(withParams(app.signInPage ?? referer ?? '/', { slauth_error: 'signed-out' }))
+        if (!app.fresh(me.session)) return redirect(withParams(referer ?? redirectTo, { slauth_error: 'reauth-required' }))
+        linkUserId = me.user.id
+      }
+      const started = await oauth.start(provider, { callbackUrl, redirect: redirectTo, returnTo: app.signInPage ?? referer ?? redirectTo, linkUserId, secure })
+      return redirect(started.location, [started.cookie])
+    }
+
+    const result = await oauth.finish(provider, request, { callbackUrl })
+    const back = result.state?.returnTo ?? app.signInPage ?? '/'
+    const clear = oauth.clearCookie(secure)
+    const fail = (code) => redirect(withParams(back, { slauth_error: code }), [clear])
+    if (!result.ok) return fail(result.code)
+    const { profile, tokens, state: saved } = result
+    const accountKey = `${provider.id}:${profile.id}`
+    const linked = await store.get(`account:${accountKey}`)
+    const email = profile.email ? normalizeEmail(profile.email) : null
+    const context = { method: 'oauth', provider: provider.id, profile }
+
+    let found = null
+    if (saved.linkUserId) {
+      if (linked && linked.userId !== saved.linkUserId) return fail('account-in-use')
+      found = await users.byId(saved.linkUserId)
+      if (!found) return fail('signed-out')
+    } else if (linked) {
+      found = await users.byId(linked.userId)
+      if (found && !(await users.allowed(found.email, context))) return fail('not-allowed')
+    } else {
+      if (!email || !profile.emailVerified) return fail('email-not-verified')
+      found = await users.signIn(email, context, { name: profile.name, image: profile.image })
+      if (!found) return fail('not-allowed')
+    }
+    if (!found) return fail('oauth-failed')
+
+    const account = {
+      provider: provider.id,
+      accountId: profile.id,
+      userId: found.id,
+      email,
+      name: profile.name ?? null,
+      createdAt: linked?.createdAt ?? Date.now(),
+      updatedAt: Date.now(),
+      ...(provider.keepTokens ? { tokens: { ...tokens, savedAt: Date.now() } } : {}),
+    }
+    await store.put(`account:${accountKey}`, account)
+    const keys = (await store.get(`accounts:${found.id}`)) ?? []
+    if (!keys.includes(accountKey)) {
+      // One account per provider per person: linking a second GitHub replaces the first.
+      for (const old of keys.filter((k) => k.split(':')[0] === provider.id)) await store.delete(`account:${old}`)
+      await store.put(`accounts:${found.id}`, [...keys.filter((k) => k.split(':')[0] !== provider.id), accountKey])
+    }
+
+    if (saved.linkUserId) return redirect(withParams(saved.redirect, { slauth_linked: provider.id }), [clear])
+
+    const done = await app.complete(found, request, { method: `oauth:${provider.id}` })
+    if (done.kind === 'refused') return fail(done.code)
+    if (done.kind === 'two-factor') return redirect(withParams(back, { slauth_step: 'two-factor', redirect: saved.redirect }), [clear, done.cookie])
+    return redirect(saved.redirect, [clear, done.cookie])
+  }
+}
+
+function sameSitePath(referer, url) {
+  try {
+    const from = new URL(referer)
+    return from.origin === url.origin ? from.pathname + from.search : null
+  } catch {
+    return null
+  }
+}

package/src/routes/orgs.js

@@ -0,0 +1,144 @@
+import { normalizeEmail, publicUser, validEmail } from '../users.js'
+import { json, withParams } from '../util.js'
+
+const ROLE = /^[a-z0-9_-]{1,40}$/i
+
+/**
+ * Organizations, when `organizations` is on. Everything here is for signed-in people.
+ *
+ *   GET  orgs                              → { orgs }   mine, each with my role
+ *   POST orgs                  { name }    → { org }    I'm its owner
+ *   GET  orgs/<id>                         → { org, role, members, invites? }
+ *   POST orgs/<id>             { name }    rename (owner, admin)
+ *   POST orgs/<id>/delete                  (owner)
+ *   POST orgs/<id>/invite      { email, role? }   (owner, admin)
+ *   POST orgs/<id>/invites/revoke   { id }        (owner, admin)
+ *   POST orgs/<id>/members/role     { userId, role }   (owner, admin; only owners make owners)
+ *   POST orgs/<id>/members/remove   { userId }   (owner, admin, or yourself to leave)
+ *   GET  invites                           → { invites }   addressed to my email
+ *   POST invites/accept        { id }
+ *   POST invites/decline       { id }
+ *
+ * @param {object} app  the shared context from core.js
+ */
+export function orgRoutes(app) {
+  const { orgs, users } = app
+  const forbidden = () => json({ error: "You don't have access to that.", code: 'forbidden' }, 403)
+  const notFound = () => json({ error: 'No such organization.', code: 'not-found' }, 404)
+
+  return async function route({ route, method, request, url, body }) {
+    if (!(route === 'orgs' || route.startsWith('orgs/') || route === 'invites' || route.startsWith('invites/'))) return
+    if (!orgs) return json({ error: 'Organizations are turned off.', code: 'not-found' }, 404)
+    const me = await app.signedIn(request)
+    if (me instanceof Response) return me
+    const { user } = me
+
+    if (route === 'orgs' && method === 'GET') return json({ orgs: await orgs.forUser(user.id) })
+
+    if (route === 'orgs' && method === 'POST') {
+      const allowCreate = app.orgOptions.allowCreate
+      if (allowCreate === false || (typeof allowCreate === 'function' && !(await allowCreate(publicUser(user))))) return forbidden()
+      const { name } = await body()
+      if (typeof name !== 'string' || !name.trim()) return json({ error: 'Give it a name.', code: 'bad-request' }, 400)
+      const org = await orgs.create({ name }, user.id)
+      return json({ org: { ...org, role: 'owner' } })
+    }
+
+    if (route === 'invites' && method === 'GET') {
+      const out = []
+      for (const invite of await orgs.invitesFor(user.email)) {
+        const org = await orgs.get(invite.orgId)
+        if (org) out.push({ id: invite.id, role: invite.role, org: { id: org.id, name: org.name }, expiresAt: invite.expiresAt })
+      }
+      return json({ invites: out })
+    }
+
+    if (route === 'invites/accept' && method === 'POST') {
+      const accepted = await orgs.accept((await body()).id, user)
+      if (!accepted) return json({ error: "That invitation has expired or isn't for you.", code: 'not-found' }, 404)
+      return json({ ok: true, org: { ...(await orgs.get(accepted.orgId)), role: accepted.role } })
+    }
+
+    if (route === 'invites/decline' && method === 'POST') {
+      const invite = await orgs.getInvite((await body()).id)
+      if (!invite || invite.email !== user.email) return json({ error: 'No such invitation.', code: 'not-found' }, 404)
+      await orgs.revokeInvite(invite.id)
+      return json({ ok: true })
+    }
+
+    const [, orgId, ...rest] = route.split('/')
+    const action = rest.join('/')
+    const org = await orgs.get(orgId)
+    const role = org && (await orgs.role(orgId, user.id))
+    if (!org || !role) return notFound()
+    const manager = orgs.canManage(role)
+
+    if (action === '' && method === 'GET') {
+      const members = []
+      for (const m of await orgs.members(orgId)) {
+        const u = await users.byId(m.userId)
+        if (u) members.push({ userId: m.userId, role: m.role, joinedAt: m.joinedAt, email: u.email, name: u.name, image: u.image })
+      }
+      const out = { org, role, members }
+      if (manager) out.invites = (await orgs.invitesOf(orgId)).map(({ id, email, role: r, createdAt, expiresAt }) => ({ id, email, role: r, createdAt, expiresAt }))
+      return json(out)
+    }
+
+    if (method !== 'POST') return
+    const input = await body()
+
+    if (action === '') {
+      if (!manager) return forbidden()
+      return json({ org: await orgs.update(orgId, { name: input.name }) })
+    }
+
+    if (action === 'delete') {
+      if (role !== 'owner') return forbidden()
+      await orgs.remove(orgId)
+      return json({ ok: true })
+    }
+
+    if (action === 'invite') {
+      if (!manager) return forbidden()
+      const email = normalizeEmail(input.email)
+      const inviteRole = input.role ?? 'member'
+      if (!validEmail(email)) return json({ error: "That doesn't look like an email address.", code: 'bad-email' }, 400)
+      if (!ROLE.test(inviteRole)) return json({ error: 'Roles are letters, digits, dashes and underscores.', code: 'bad-request' }, 400)
+      if (inviteRole === 'owner' && role !== 'owner') return forbidden()
+      const existing = await users.byEmail(email)
+      if (existing && (await orgs.role(orgId, existing.id))) return json({ error: "They're already a member.", code: 'already-member' }, 409)
+      const invite = await orgs.invite(orgId, email, inviteRole, user.id)
+      const link = `${app.origin(url)}${withParams(app.orgOptions.invitePage ?? app.signInPage ?? '/', { slauth_invite: invite.id })}`
+      await app.codes.send({ kind: 'invite', to: email, link, orgName: org.name, inviter: user.name ?? user.email })
+      return json({ ok: true, invite: { id: invite.id, email, role: inviteRole, expiresAt: invite.expiresAt } })
+    }
+
+    if (action === 'invites/revoke') {
+      if (!manager) return forbidden()
+      const invite = await orgs.getInvite(input.id)
+      if (!invite || invite.orgId !== orgId) return json({ error: 'No such invitation.', code: 'not-found' }, 404)
+      await orgs.revokeInvite(invite.id)
+      return json({ ok: true })
+    }
+
+    if (action === 'members/role') {
+      if (!manager) return forbidden()
+      if (typeof input.role !== 'string' || !ROLE.test(input.role)) return json({ error: 'Roles are letters, digits, dashes and underscores.', code: 'bad-request' }, 400)
+      const theirs = await orgs.role(orgId, input.userId)
+      if (!theirs) return json({ error: "They're not a member.", code: 'not-found' }, 404)
+      // Only owners can make owners, or change what an owner is.
+      if ((input.role === 'owner' || theirs === 'owner') && role !== 'owner') return forbidden()
+      await orgs.setRole(orgId, input.userId, input.role)
+      return json({ ok: true })
+    }
+
+    if (action === 'members/remove') {
+      const self = input.userId === user.id
+      const theirs = await orgs.role(orgId, input.userId)
+      if (!theirs) return json({ error: "They're not a member.", code: 'not-found' }, 404)
+      if (!self && (!manager || (theirs === 'owner' && role !== 'owner'))) return forbidden()
+      await orgs.removeMember(orgId, input.userId)
+      return json({ ok: true })
+    }
+  }
+}

package/src/routes/passkeys.js

@@ -0,0 +1,136 @@
+import { PasskeyError, readChallenge, verifyAuthentication, verifyRegistration } from '../passkey/webauthn.js'
+import { base64Url, json } from '../util.js'
+
+const CHALLENGE_SECONDS = 5 * 60
+
+/**
+ * Passkeys (WebAuthn).
+ *
+ *   challenge:<challenge>  { type, userId? }   (lives 5 minutes, single use)
+ *   passkey:<id>           { id, publicKey, alg, counter, userId, name, createdAt, lastUsedAt }
+ *   passkeys:<userId>      [id, ...]
+ *
+ * @param {object} app  the shared context from core.js
+ */
+export function passkeyRoutes(app) {
+  const { store, users, passkeys } = app
+
+  const expect = (url, challenge) => ({
+    rpId: passkeys.rpId ?? url.hostname,
+    origin: passkeys.origin ?? app.origins ?? url.origin,
+    challenge,
+    requireUserVerification: passkeys.userVerification === 'required',
+  })
+
+  async function takeChallenge(clientDataJSON, type) {
+    const challenge = readChallenge(clientDataJSON)
+    if (!challenge) throw new PasskeyError('The response has no challenge.')
+    const stored = await store.get(`challenge:${challenge}`)
+    // Single use, whatever happens next.
+    await store.delete(`challenge:${challenge}`)
+    if (!stored || stored.type !== type) throw new PasskeyError('That passkey request expired. Try again.')
+    return { challenge, stored }
+  }
+
+  async function newChallenge(value) {
+    const challenge = base64Url(crypto.getRandomValues(new Uint8Array(32)))
+    await store.put(`challenge:${challenge}`, value, { ttl: CHALLENGE_SECONDS })
+    return challenge
+  }
+
+  return async function route({ route, method, request, url, body }) {
+    if (!route.startsWith('passkey') && route !== 'passkeys') return
+    if (passkeys === false) return json({ error: 'Passkeys are turned off.', code: 'not-found' }, 404)
+
+    if (route === 'passkey/login/options' && method === 'POST') {
+      const challenge = await newChallenge({ type: 'login' })
+      return json({
+        challenge,
+        rpId: passkeys.rpId ?? url.hostname,
+        timeout: CHALLENGE_SECONDS * 1000,
+        userVerification: passkeys.userVerification ?? 'preferred',
+        allowCredentials: [],
+      })
+    }
+
+    if (route === 'passkey/login/verify' && method === 'POST') {
+      const { credential } = await body()
+      await takeChallenge(credential?.response?.clientDataJSON, 'login')
+      const stored = typeof credential?.id === 'string' ? await store.get(`passkey:${credential.id}`) : null
+      if (!stored) return json({ error: "This passkey isn't registered here.", code: 'passkey-unknown' }, 400)
+      if (credential.response.userHandle && credential.response.userHandle !== base64Url(new TextEncoder().encode(stored.userId))) {
+        throw new PasskeyError('This passkey belongs to someone else.')
+      }
+      const { counter } = await verifyAuthentication(credential, stored, expect(url, readChallenge(credential.response.clientDataJSON)))
+      await store.put(`passkey:${stored.id}`, { ...stored, counter, lastUsedAt: Date.now() })
+      const found = await users.byId(stored.userId)
+      if (!found || !(await users.allowed(found.email, { method: 'passkey' }))) return json({ error: "You're not on the list for this app.", code: 'not-allowed' }, 403)
+      return app.reply(await app.complete(found, request, { method: 'passkey' }), {}, request)
+    }
+
+    // Everything below is for someone already signed in.
+    const me = await app.signedIn(request)
+    if (me instanceof Response) return me
+    const found = me.user
+    const ids = (await store.get(`passkeys:${found.id}`)) ?? []
+
+    if (route === 'passkey/register/options' && method === 'POST') {
+      // A passkey is a way back in: only add one soon after signing in.
+      if (!app.fresh(me.session)) return app.reauth()
+      const challenge = await newChallenge({ type: 'register', userId: found.id })
+      return json({
+        challenge,
+        rp: { id: passkeys.rpId ?? url.hostname, name: passkeys.rpName ?? app.appName },
+        user: { id: base64Url(new TextEncoder().encode(found.id)), name: found.email, displayName: found.name ?? found.email },
+        pubKeyCredParams: [
+          { type: 'public-key', alg: -7 },
+          { type: 'public-key', alg: -257 },
+        ],
+        timeout: CHALLENGE_SECONDS * 1000,
+        attestation: 'none',
+        authenticatorSelection: { residentKey: 'required', requireResidentKey: true, userVerification: passkeys.userVerification ?? 'preferred' },
+        excludeCredentials: ids.map((id) => ({ type: 'public-key', id })),
+      })
+    }
+
+    if (route === 'passkey/register/verify' && method === 'POST') {
+      const { credential, name } = await body()
+      const { challenge, stored } = await takeChallenge(credential?.response?.clientDataJSON, 'register')
+      if (stored.userId !== found.id) throw new PasskeyError('That passkey request was for someone else.')
+      const verified = await verifyRegistration(credential, expect(url, challenge))
+      if (await store.get(`passkey:${verified.id}`)) return json({ error: 'That passkey is already registered.', code: 'passkey-exists' }, 409)
+      const label = typeof name === 'string' && name.trim() ? name.trim().slice(0, 60) : `Passkey added ${new Date().toISOString().slice(0, 10)}`
+      await store.put(`passkey:${verified.id}`, { ...verified, userId: found.id, name: label, createdAt: Date.now(), lastUsedAt: null })
+      await store.put(`passkeys:${found.id}`, [...ids, verified.id])
+      return json({ ok: true, passkey: { id: verified.id, name: label } })
+    }
+
+    if (route === 'passkeys' && method === 'GET') {
+      const list = []
+      for (const id of ids) {
+        const pk = await store.get(`passkey:${id}`)
+        if (pk) list.push({ id: pk.id, name: pk.name, createdAt: pk.createdAt, lastUsedAt: pk.lastUsedAt })
+      }
+      return json({ passkeys: list })
+    }
+
+    if (route === 'passkey/rename' && method === 'POST') {
+      const { id, name } = await body()
+      if (!ids.includes(id)) return json({ error: 'No such passkey.', code: 'passkey-unknown' }, 404)
+      if (typeof name !== 'string' || !name.trim()) return json({ error: 'Give it a name.', code: 'bad-request' }, 400)
+      const pk = await store.get(`passkey:${id}`)
+      await store.put(`passkey:${id}`, { ...pk, name: name.trim().slice(0, 60) })
+      return json({ ok: true })
+    }
+
+    if (route === 'passkey/delete' && method === 'POST') {
+      const { id } = await body()
+      if (!ids.includes(id)) return json({ error: 'No such passkey.', code: 'passkey-unknown' }, 404)
+      await store.delete(`passkey:${id}`)
+      await store.put(`passkeys:${found.id}`, ids.filter((x) => x !== id))
+      return json({ ok: true })
+    }
+
+    return json({ error: 'Not found.', code: 'not-found' }, 404)
+  }
+}

package/src/routes/password.js

@@ -0,0 +1,78 @@
+import { normalizeEmail, validEmail } from '../users.js'
+import { json } from '../util.js'
+
+/**
+ * Passwords, when `passwords` is on.
+ *
+ *   POST password/signin  { email, password }     sign in
+ *   POST password/signup  { email, password }     emails a code; the password is saved once it's used
+ *   POST password/set     { password, current? }  add or change (signed in)
+ *   POST password/remove  { }                     go back to codes and passkeys (signed in)
+ *
+ * @param {object} app  the shared context from core.js
+ */
+export function passwordRoutes(app) {
+  const { store, users, passwords, limits } = app
+
+  return async function route({ route, method, request, url, body }) {
+    if (!route.startsWith('password/')) return
+    if (!passwords) return json({ error: 'Passwords are turned off.', code: 'not-found' }, 404)
+    if (method !== 'POST') return
+
+    if (route === 'password/signin') {
+      const input = await body()
+      const email = normalizeEmail(input.email)
+      if (!validEmail(email)) return json({ error: "That doesn't look like an email address.", code: 'bad-email' }, 400)
+      const wait = await limits.check('password/signin', request)
+      if (wait) return json({ error: `Too many tries. Please wait ${wait}s.`, code: 'slow-down', retryAfter: wait }, 429)
+      const found = await users.byEmail(email)
+      const checked = await passwords.check(email, found?.id ?? null, input.password)
+      if (!checked.ok) {
+        if (checked.code === 'too-many-tries') return json({ error: 'Too many wrong passwords. Sign in with an email code, or wait 15 minutes.', code: 'too-many-tries' }, 429)
+        return json({ error: "That email and password don't match.", code: 'bad-password' }, 400)
+      }
+      if (!(await users.allowed(email, { method: 'password' }))) return json({ error: "That email isn't on the list for this app.", code: 'not-allowed' }, 403)
+      return app.reply(await app.complete(found, request, { method: 'password' }), {}, request)
+    }
+
+    if (route === 'password/signup') {
+      const input = await body()
+      const email = normalizeEmail(input.email)
+      if (!validEmail(email)) return json({ error: "That doesn't look like an email address.", code: 'bad-email' }, 400)
+      const problem = await passwords.problem(input.password)
+      if (problem) return json({ error: problem, code: 'weak-password' }, 400)
+      const wait = await limits.check('password/signup', request)
+      if (wait) return json({ error: `Please wait ${wait}s before trying again.`, code: 'slow-down', retryAfter: wait }, 429)
+      if (!(await users.allowed(email, { method: 'password' }))) return json({ error: "That email isn't on the list for this app.", code: 'not-allowed' }, 403)
+      // Same answer whether or not they have an account, so this can't be used to find out.
+      const sent = await app.sendSignInCode(email, url, input.redirect)
+      if (!sent.ok) return json({ error: `Please wait ${sent.retryAfter}s before asking for another code.`, code: 'slow-down', retryAfter: sent.retryAfter }, 429)
+      await store.put(`signup:${email}`, { hash: await passwords.hash(input.password) }, { ttl: 10 * 60 })
+      return json({ ok: true, verify: 'email' })
+    }
+
+    const me = await app.signedIn(request)
+    if (me instanceof Response) return me
+
+    if (route === 'password/set') {
+      const input = await body()
+      const has = await passwords.has(me.user.id)
+      // Changing a password takes the old one, or a recent sign-in.
+      if (has && input.current !== undefined) {
+        if (!(await passwords.verify(me.user.id, input.current))) return json({ error: "That's not your current password.", code: 'bad-password' }, 400)
+      } else if (!app.fresh(me.session)) return app.reauth()
+      const problem = await passwords.problem(input.password)
+      if (problem) return json({ error: problem, code: 'weak-password' }, 400)
+      await passwords.set(me.user.id, input.password)
+      // Anyone else signed in with the old password is signed out.
+      if (has) await app.sessions.revokeAll(me.user.id, me.session?.id)
+      return json({ ok: true })
+    }
+
+    if (route === 'password/remove') {
+      if (!app.fresh(me.session)) return app.reauth()
+      await passwords.remove(me.user.id)
+      return json({ ok: true })
+    }
+  }
+}

package/src/routes/two-factor.js

@@ -0,0 +1,89 @@
+import { publicUser } from '../users.js'
+import { json, serializeCookie } from '../util.js'
+
+const MAX_TRIES = 5
+
+/**
+ * Two-factor sign-in, when `twoFactor` is on. After the first step (a code, a link, a
+ * password or a provider) someone with an authenticator app set up gets
+ * `{ twoFactor: true }` instead of a session, and finishes here.
+ *
+ *   POST two-factor/verify    { code } or { recoveryCode }  (+ pendingToken for apps)
+ *   POST two-factor/setup     → { secret, uri }   (signed in, recently)
+ *   POST two-factor/enable    { code } → { recoveryCodes }
+ *   POST two-factor/disable   { code } or { recoveryCode }
+ *   POST two-factor/recovery-codes  { code } → { recoveryCodes }   (a fresh set)
+ *
+ *   2fa:<sha256 of token>  { userId, method, tries }   (lives 10 minutes)
+ *
+ * Passkeys skip this step: a passkey is already something you have and something you are.
+ *
+ * @param {object} app  the shared context from core.js
+ */
+export function twoFactorRoutes(app) {
+  const { store, users, twoFactor, limits } = app
+
+  return async function route({ route, method, request, body }) {
+    if (!route.startsWith('two-factor/')) return
+    if (!twoFactor) return json({ error: 'Two-factor sign-in is turned off.', code: 'not-found' }, 404)
+    if (method !== 'POST') return
+    const input = await body()
+    const clearPending = serializeCookie(app.pendingCookie, '', { maxAge: 0, secure: app.secure(request) })
+
+    if (route === 'two-factor/verify') {
+      const wait = await limits.check('two-factor/verify', request)
+      if (wait) return json({ error: `Too many tries. Please wait ${wait}s.`, code: 'slow-down', retryAfter: wait }, 429)
+      const pending = await app.pending(request, typeof input.pendingToken === 'string' ? input.pendingToken : undefined)
+      if (!pending) return json({ error: 'That sign-in has expired. Please start again.', code: 'expired' }, 410, { 'Set-Cookie': clearPending })
+      const ok = await twoFactor.check(pending.userId, { code: input.code, recoveryCode: input.recoveryCode })
+      if (!ok) {
+        const tries = pending.tries + 1
+        const { key, ...doc } = pending
+        if (tries >= MAX_TRIES) {
+          await store.delete(key)
+          return json({ error: 'Too many tries. Please start again.', code: 'too-many-tries' }, 410, { 'Set-Cookie': clearPending })
+        }
+        await store.put(key, { ...doc, tries }, { ttl: 10 * 60 })
+        return json({ error: 'That code is wrong.', code: 'bad-code', triesLeft: MAX_TRIES - tries }, 400)
+      }
+      await store.delete(pending.key)
+      const found = await users.byId(pending.userId)
+      if (!found || found.bannedAt) return json({ error: "This account can't sign in.", code: 'banned' }, 403, { 'Set-Cookie': clearPending })
+      const made = await app.sessions.create(found.id, request, { method: `${pending.method}+totp` })
+      await app.emit('signIn', { user: publicUser(found), method: pending.method, request })
+      const extra = input.recoveryCode ? { recoveryCodesLeft: await twoFactor.recoveryLeft(found.id) } : {}
+      if (request.headers.get('x-slauth-transport') === 'bearer') return json({ user: publicUser(found), token: made.token, ...extra })
+      const headers = new Headers({ 'Content-Type': 'application/json; charset=utf-8', 'Cache-Control': 'no-store' })
+      headers.append('Set-Cookie', made.cookie)
+      headers.append('Set-Cookie', clearPending)
+      return new Response(JSON.stringify({ user: publicUser(found), ...extra }), { headers })
+    }
+
+    const me = await app.signedIn(request)
+    if (me instanceof Response) return me
+    const userId = me.user.id
+
+    if (route === 'two-factor/setup') {
+      if (await twoFactor.enabled(userId)) return json({ error: 'Two-factor sign-in is already on.', code: 'two-factor-on' }, 409)
+      if (!app.fresh(me.session)) return app.reauth()
+      return json(await twoFactor.setup(me.user))
+    }
+
+    if (route === 'two-factor/enable') {
+      const recoveryCodes = await twoFactor.enable(userId, input.code)
+      if (!recoveryCodes) return json({ error: 'That code is wrong. Check the time on your phone, and try the newest code.', code: 'bad-code' }, 400)
+      return json({ ok: true, recoveryCodes })
+    }
+
+    if (route === 'two-factor/disable') {
+      if (!(await twoFactor.check(userId, input))) return json({ error: 'That code is wrong.', code: 'bad-code' }, 400)
+      await twoFactor.disable(userId)
+      return json({ ok: true })
+    }
+
+    if (route === 'two-factor/recovery-codes') {
+      if (!(await twoFactor.check(userId, { code: input.code }))) return json({ error: 'That code is wrong.', code: 'bad-code' }, 400)
+      return json({ ok: true, recoveryCodes: await twoFactor.regenerate(userId) })
+    }
+  }
+}