zibri 2.3.0 → 2.4.0

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "zibri",
-    "version": "2.3.0",
+    "version": "2.4.0",
     "main": "./dist/cjs/index.js",
     "types": "./dist/cjs/index.d.ts",
     "module": "./dist/esm/index.mjs",
@@ -49,58 +49,60 @@
     "license": "MIT",
     "description": "TS Backend Framework",
     "peerDependencies": {
-        "axios": "^1.13.2",
-        "bcryptjs": "^3.0.2",
-        "bignumber.js": "^9.3.1",
-        "handlebars": "^4.7.8",
+        "axios": "^1.15.0",
+        "bcryptjs": "^3.0.3",
+        "bignumber.js": "^10.0.2",
+        "handlebars": "^4.7.9",
         "hi-base32": "^0.5.1",
-        "jsonwebtoken": "^9.0.2",
-        "otpauth": "^9.4.1",
+        "jsonwebtoken": "^9.0.3",
+        "otpauth": "^9.5.0",
         "pdfmake": "^0.2.2",
-        "preact": "^10.28.3",
-        "preact-render-to-string": "^6.6.5",
+        "preact": "^10.29.1",
+        "preact-render-to-string": "^6.6.7",
         "rxjs": "^7.8.2",
-        "socket.io": "^4.8.1",
+        "socket.io": "^4.8.3",
         "ts-node": "^10.9.2",
         "uuid": "^11.1.0",
-        "xmlbuilder2": "^4.0.3"
+        "xmlbuilder2": "^4.0.3",
+        "cookie-parser": "^1.4.7"
     },
     "dependencies": {
         "@fastify/busboy": "^3.2.0",
-        "cors": "^2.8.5",
-        "express": "^5.1.0",
+        "cors": "^2.8.6",
+        "express": "^5.2.1",
         "glob": "^13.0.6",
         "node-cron": "^4.2.1",
-        "nodemailer": "^8.0.4",
-        "pg": "^8.16.3",
+        "nodemailer": "^8.0.5",
+        "pg": "^8.20.0",
         "prom-client": "^15.1.3",
         "reflect-metadata": "^0.2.2",
         "swagger-ui-express": "^5.0.1",
         "swagger2openapi": "^7.0.8",
-        "systeminformation": "^5.27.10",
-        "typeorm": "^0.3.27"
+        "systeminformation": "^5.31.5",
+        "typeorm": "^0.3.28"
     },
     "devDependencies": {
         "@faker-js/faker": "^9.9.0",
-        "@jest/globals": "^30.2.0",
-        "@swc/core": "^1.13.5",
-        "@testcontainers/postgresql": "^11.6.0",
+        "@jest/globals": "^30.3.0",
+        "@swc/core": "^1.15.24",
+        "@testcontainers/postgresql": "^11.14.0",
+        "@types/cookie-parser": "^1.4.10",
         "@types/cors": "^2.8.19",
-        "@types/express": "^5.0.3",
+        "@types/express": "^5.0.6",
         "@types/jsonwebtoken": "^9.0.10",
-        "@types/node": "^24.10.13",
-        "@types/nodemailer": "^7.0.1",
+        "@types/node": "^25.6.0",
+        "@types/nodemailer": "^8.0.0",
         "@types/pdfmake": "^0.2.11",
         "@types/swagger-ui-express": "^4.1.8",
         "@types/swagger2openapi": "^7.0.4",
         "eslint": "^9.36.0",
         "eslint-config-service-soft": "^2.1.6",
-        "jest": "^30.2.0",
+        "jest": "^30.3.0",
         "npm-run-all": "^4.1.5",
         "openapi3-ts": "^4.5.0",
-        "testcontainers": "^11.6.0",
-        "ts-jest": "^29.4.6",
-        "typedoc": "^0.28.17",
-        "typescript": "^5.9.3"
+        "testcontainers": "^11.14.0",
+        "ts-jest": "^29.4.9",
+        "typedoc": "^0.28.19",
+        "typescript": "^5.9.2"
     }
 }

package/src/__testing__/constants.ts

@@ -2,8 +2,14 @@ import { FsUtilities, FsPath } from '../utilities/fs.utilities';
 
 export const testFileFolder: FsPath = FsUtilities.getPath(__dirname, 'file-output');
 
+export const testAssetsFolder: FsPath = FsUtilities.getPath(__dirname, 'mocks', 'assets');
+
 export const POSTGRES_TEST_IMAGE: string = 'postgres:17.6';
 
 export const noOp: () => void = () => {};
 
-export const noOpAsync: () => Promise<void> = async () => {};
+export const noOpAsync: () => Promise<void> = async () => {};
+
+export async function flushMicrotasks(): Promise<void> {
+    await Promise.resolve();
+}

package/src/__testing__/test-server/create-test-data-source.function.ts

@@ -1,4 +1,7 @@
 import { OtpCredentials } from '../../auth/2fa/methods/otp/otp-credentials.model';
+import { EncryptionKey } from '../../auth/encryption/encryption-key.model';
+import { EncryptionStrategyEntity } from '../../auth/encryption/strategies/encryption-strategy-entity.model';
+import { HashStrategyEntity } from '../../auth/hash/strategies/hash-strategy-entity.model';
 import { PasswordResetToken } from '../../auth/models/password-reset-token.model';
 import { JwtCredentials } from '../../auth/strategies/jwt/jwt-credentials.model';
 import { JwtRefreshToken } from '../../auth/strategies/jwt/jwt-refresh-token.model';
@@ -10,6 +13,8 @@ import { DataSource } from '../../data-source/decorators/data-source.decorator';
 import { MigrationEntity } from '../../data-source/migration/migration-entity.model';
 import { Email } from '../../email/models/email.model';
 import { BaseEntity } from '../../entity/base-entity.model';
+import { EventSubscriberRun } from '../../event/event-subscriber-run.model';
+import { Event } from '../../event/event.model';
 import { Log } from '../../logging/log.model';
 import { ThreadJobEntity } from '../../multithreading/models/thread-job-entity.model';
 import { Newable } from '../../types/newable.type';
@@ -40,7 +45,12 @@ export const defaultTestServerEntities: Newable<BaseEntity>[] = [
     JwtRefreshToken,
     JwtCredentials,
     OtpCredentials,
-    ThreadJobEntity
+    ThreadJobEntity,
+    Event,
+    EventSubscriberRun,
+    HashStrategyEntity,
+    EncryptionKey,
+    EncryptionStrategyEntity
 ];
 
 export function createTestDataSource({

package/src/__testing__/test-server/providers.ts

@@ -1,3 +1,6 @@
+import { randomBytes } from 'node:crypto';
+
+import { AesGcmEncryptionStrategy } from '../../auth/encryption/strategies/aes-gcm.encryption-strategy';
 import { PasswordResetEmailTemplate } from '../../auth/strategies/jwt/jwt-auth.controller';
 import { CronServiceInterface } from '../../cron/cron-service.interface';
 import { ZIBRI_DI_TOKENS } from '../../di/default/zibri-di-tokens.default';
@@ -15,11 +18,11 @@ export const defaultTestServerProviders: DiProvider<unknown>[] = [
         useFactory: () => 'test'
     }),
     defineProvider({
-        token: ZIBRI_DI_TOKENS.JWT_CONFIRM_PASSWORD_RESET_URL,
+        token: ZIBRI_DI_TOKENS.CONFIRM_PASSWORD_RESET_URL,
         useFactory: () => 'http://localhost:4200/confirm-password-reset'
     }),
     defineProvider({
-        token: ZIBRI_DI_TOKENS.JWT_PASSWORD_RESET_EMAIL_TEMPLATE,
+        token: ZIBRI_DI_TOKENS.PASSWORD_RESET_EMAIL_TEMPLATE,
         // eslint-disable-next-line typescript/no-explicit-any
         useValue: (() => 'string') as unknown as PasswordResetEmailTemplate<any, any>
     }),
@@ -38,6 +41,13 @@ export const defaultTestServerProviders: DiProvider<unknown>[] = [
             };
         }
     }),
+    defineProvider({
+        token: ZIBRI_DI_TOKENS.ENCRYPTION_MASTER_OPTIONS,
+        useValue: {
+            currentMasterStrategy: new AesGcmEncryptionStrategy(),
+            currentMasterKey: { id: 'mk1', value: randomBytes(32) }
+        }
+    }),
     defineProvider({
         token: ZIBRI_DI_TOKENS.CRON_SERVICE,
         useFactory: () => {

package/src/__testing__/test-server/start-test-server.function.ts

@@ -1,3 +1,5 @@
+import { AddressInfo } from 'node:net';
+
 import { jest } from '@jest/globals';
 import { PostgreSqlContainer, StartedPostgreSqlContainer } from '@testcontainers/postgresql';
 import H from 'handlebars/runtime';
@@ -15,10 +17,11 @@ import { DiContainer } from '../../di/di-container';
 import { inject } from '../../di/inject.function';
 import { LoggerInterface } from '../../logging/logger.interface';
 import { Newable } from '../../types/newable.type';
-import { noOp, POSTGRES_TEST_IMAGE } from '../constants';
+import { noOp, POSTGRES_TEST_IMAGE, testAssetsFolder } from '../constants';
 import { createTestDataSource } from './create-test-data-source.function';
+import { AssetServiceInterface } from '../../assets/asset-service.interface';
 
-type StartTestServerOptions = Partial<Pick<ZibriApplicationOptions, 'providers' | 'plugins'>> & {
+type StartTestServerOptions = Partial<Pick<ZibriApplicationOptions, 'providers' | 'plugins' | 'controllers'>> & {
     dataSources?: Newable<PostgresDataSource>[]
 };
 
@@ -29,6 +32,18 @@ export class StartedTestServer {
         private readonly exitSpy = jest.spyOn(process, 'exit').mockImplementation(() => undefined as never)
     ) {}
 
+    async start(): Promise<string> {
+        await this.app.start(0);
+        const address: string | AddressInfo | null = this.app.server.address();
+        if (address == undefined || typeof address === 'string') {
+            throw new Error('Failed to resolve test server port.');
+        }
+        const host: string = address.address === '::' || address.address === '0.0.0.0'
+            ? '127.0.0.1'
+            : address.address;
+        return `http://${host}:${address.port}`;
+    }
+
     async shutdown(): Promise<void> {
         await this.app.shutdown();
         this.exitSpy.mockRestore();
@@ -40,7 +55,8 @@ export async function startTestServer(
     {
         dataSources = [createTestDataSource()],
         providers = defaultTestServerProviders,
-        plugins = defaultTestServerPlugins
+        plugins = defaultTestServerPlugins,
+        controllers = []
     }: StartTestServerOptions = {}
 ): Promise<StartedTestServer> {
     // Reset singleton — every test file gets a clean container with no stale instances.
@@ -66,11 +82,14 @@ export async function startTestServer(
     const info: typeof logger.info = logger.info;
     logger.info = noOp;
 
+    const assetService: AssetServiceInterface = inject(ZIBRI_DI_TOKENS.ASSET_SERVICE);
+    (assetService.assetsPath as string) = testAssetsFolder;
+
     const app: ZibriApplication = new ZibriApplication({
         name: 'test',
         version: '0.0.1',
         baseUrl: 'http://localhost:3000',
-        controllers: [],
+        controllers,
         websocketControllers: [],
         dataSources,
         providers,

package/src/__testing__/test-server/user-repository.ts

@@ -21,7 +21,7 @@ export class DefaultTestServerUserRepository extends Repository<JwtUser>
         @InjectRepository(JwtUser)
         private readonly credentialsRepository: Repository<JwtCredentials>
     ) {
-        super(JwtUser, repo, logger);
+        super(JwtUser, repo, logger, repo.dataSource);
     }
 
     async findByEmail(email: string): Promise<JwtUser> {

package/src/application-options.model.ts

@@ -3,11 +3,46 @@ import { AuthStrategies } from './auth/strategies/auth-strategies.model';
 import { CronJob } from './cron/cron-job.model';
 import { DataSourceInterface } from './data-source/data-sources/data-source.interface';
 import { DiProvider } from './di/models/di-provider.model';
+import { KnownHeader } from './http/known-header.enum';
 import { BodyParserInterface } from './parsing/body-parser.interface';
 import { ZibriPlugin } from './plugin/plugin.model';
+import { DeepPartial } from './types/deep-partial.type';
 import { Newable } from './types/newable.type';
 import { Version } from './types/version.type';
 
+/**
+ * Configuration options for strict transport security / hsts.
+ */
+export type HstsOptions = {
+    /**
+     * The maximum age for which strict transport should be enabled. Defaults to 2 years.
+     */
+    maxAgeSeconds: number,
+    /**
+     * Whether or not subdomains should be included. Defaults to true.
+     */
+    includeSubDomains: boolean,
+    /**
+     * Whether or not this url should be put on a preload list. Defaults to false.
+     */
+    preload: boolean
+};
+
+/**
+ * The global security options for a Zibri application.
+ */
+export type ZibriApplicationSecurityOptions = {
+    /**
+     * Some headers to set.
+     */
+    headers: {
+        /**
+         * Configuration for the strict transport security / hsts header.
+         */
+        [KnownHeader.STRICT_TRANSPORT_SECURITY]: boolean | HstsOptions
+    }
+};
+
 /**
  * All options for a Zibri application.
  */
@@ -35,6 +70,10 @@ export type ZibriApplicationOptions = {
      * The websocket controllers to register in the app.
      */
     websocketControllers: Newable<unknown>[],
+    /**
+     * Globals security settings, like eg. Hsts.
+     */
+    security?: DeepPartial<ZibriApplicationSecurityOptions>,
     /**
      * The data sources to register in the app.
      */

package/src/application.ts

@@ -1,9 +1,11 @@
 import { createServer, Server } from 'node:http';
+import { AddressInfo } from 'node:net';
 
+import cookieParser from 'cookie-parser';
 import cors from 'cors';
 import express, { RequestHandler } from 'express';
 
-import { ZibriApplicationOptions } from './application-options.model';
+import { HstsOptions, ZibriApplicationOptions, ZibriApplicationSecurityOptions } from './application-options.model';
 import { OtpTwoFactorMethod } from './auth/2fa/methods/otp/otp.two-factor-method';
 import { isTwoFactorMethod } from './auth/2fa/methods/two-factor-method.interface';
 import { isAuthStrategy } from './auth/strategies/auth-strategy.interface';
@@ -27,24 +29,37 @@ import { implementsOnAppInit } from './global/on-app-init.interface';
 import { implementsOnAppShutdown, OnAppShutdown } from './global/on-app-shutdown.interface';
 import { implementsOnAppStart } from './global/on-app-start.interface';
 import { HandlebarUtilities } from './handlebars/handlebar.utilities';
+import { KnownHeader } from './http/known-header.enum';
 import { LoggerInterface } from './logging/logger.interface';
 import { FormDataBodyParser } from './parsing/form-data/form-data.body-parser';
 import { JsonBodyParser } from './parsing/json/json.body-parser';
 import { ZibriPlugin } from './plugin/plugin.model';
 import { Route } from './routing/controller-route-configuration.model';
+import { DeepPartial } from './types/deep-partial.type';
 import { OmitStrict } from './types/omit-strict.type';
 import { FsUtilities } from './utilities/fs.utilities';
 import { Ms } from './utilities/ms';
+import { NumberUtilities } from './utilities/number.utilities';
 import { PromiseUtilities } from './utilities/promise.utilities';
 
 // eslint-disable-next-line jsdoc/require-jsdoc
-type FullZibriApplicationOptions = Required<OmitStrict<ZibriApplicationOptions, 'plugins'>>;
+type FullZibriApplicationOptions = Required<OmitStrict<ZibriApplicationOptions, 'plugins' | 'security'>> & {
+    // eslint-disable-next-line jsdoc/require-jsdoc
+    security: ZibriApplicationSecurityOptions
+};
 
 // eslint-disable-next-line typescript/typedef
 const SHUTDOWN_SIGNALS = ['SIGTERM', 'SIGINT', 'SIGHUP'] as const;
 
 const DEFAULT_SHUTDOWN_TIMEOUT_IN_MS: number = Ms.SECOND * 30;
 
+const defaultHstsOptions: HstsOptions = {
+    maxAgeSeconds: NumberUtilities.multiply(Ms.YEAR, 2).dividedBy(1000)
+        .toNumber(),
+    includeSubDomains: true,
+    preload: false
+};
+
 /**
  * A os signal that triggers the shutdown of a Zibri application.
  */
@@ -80,6 +95,29 @@ export class ZibriApplication {
     constructor(private readonly providedOptions: ZibriApplicationOptions) {
         this.options = this.createFullOptions();
 
+        this.use((req, res, next) => {
+            res.setHeader(KnownHeader.X_CONTENT_TYPE_OPTIONS, 'nosniff');
+            res.setHeader(KnownHeader.REFERRER_POLICY, 'strict-origin-when-cross-origin');
+
+            const hsts: boolean | HstsOptions = this.options.security.headers[KnownHeader.STRICT_TRANSPORT_SECURITY];
+            const isSecure: boolean = req.secure || req.headers[KnownHeader.X_FORWARDED_PROTO] === 'https';
+            if (isSecure && hsts !== false) {
+                const options: HstsOptions = hsts === true
+                    ? defaultHstsOptions
+                    : hsts;
+                res.setHeader(
+                    KnownHeader.STRICT_TRANSPORT_SECURITY,
+                    [
+                        `max-age=${options.maxAgeSeconds}`,
+                        ...options.includeSubDomains ? ['includeSubDomains'] : [],
+                        ...options.preload ? ['preload'] : []
+                    ].join('; ')
+                );
+            }
+
+            next();
+        });
+
         for (const signal of SHUTDOWN_SIGNALS) {
             const handler: () => void = () => void this.shutdown(signal);
             this.signalHandlers.set(signal, handler);
@@ -130,6 +168,12 @@ export class ZibriApplication {
         this.validateInjectables(injectables);
 
         await this.onAppInit(injectables);
+
+        const secret: string | undefined = inject(ZIBRI_DI_TOKENS.COOKIE_SIGN_SECRET);
+        if (secret) {
+            this.use(cookieParser(secret));
+        }
+
         await this.afterAppInit(injectables);
 
         for (const controller of this.options.controllers) {
@@ -168,6 +212,12 @@ export class ZibriApplication {
         this.use((req, _, next) => next(new UnmatchedRouteError(req.originalUrl)));
         this.use(inject(ZIBRI_DI_TOKENS.GLOBAL_ERROR_HANDLER));
         this.server.listen(port);
+        if (port === 0) {
+            const address: string | AddressInfo | null = this.server.address();
+            if (address != undefined && typeof address !== 'string') {
+                port = address.port;
+            }
+        }
         GlobalRegistry.markAppAsStarted();
         await this.logger.info(`${this.options.name} is running on port ${port}`);
     }
@@ -247,7 +297,8 @@ export class ZibriApplication {
         await Promise.all(elements.map(async e => {
             try {
                 const timeoutInMs: number = e.shutdownTimeoutInMs ?? DEFAULT_SHUTDOWN_TIMEOUT_IN_MS;
-                await PromiseUtilities.withTimeout(e.afterAppShutdown(this, signal), timeoutInMs);
+                // no abort signal here because stopping the api does that.
+                await PromiseUtilities.withTimeout(() => e.afterAppShutdown(this, signal), timeoutInMs);
             }
             catch (error) {
                 await this.logger.error(
@@ -264,7 +315,8 @@ export class ZibriApplication {
         await Promise.all(elements.map(async e => {
             try {
                 const timeoutInMs: number = e.shutdownTimeoutInMs ?? DEFAULT_SHUTDOWN_TIMEOUT_IN_MS;
-                await PromiseUtilities.withTimeout(e.onAppShutdown(this, signal), timeoutInMs);
+                // no abort signal here because stopping the api does that.
+                await PromiseUtilities.withTimeout(() => e.onAppShutdown(this, signal), timeoutInMs);
             }
             catch (error) {
                 await this.logger.error(
@@ -281,7 +333,8 @@ export class ZibriApplication {
         await Promise.all(elements.map(async e => {
             try {
                 const timeoutInMs: number = e.shutdownTimeoutInMs ?? DEFAULT_SHUTDOWN_TIMEOUT_IN_MS;
-                await PromiseUtilities.withTimeout(e.beforeAppShutdown(this, signal), timeoutInMs);
+                // no abort signal here because stopping the api does that.
+                await PromiseUtilities.withTimeout(() => e.beforeAppShutdown(this, signal), timeoutInMs);
             }
             catch (error) {
                 await this.logger.error(
@@ -346,6 +399,9 @@ export class ZibriApplication {
     }
 
     private createFullOptions(): FullZibriApplicationOptions {
+        // eslint-disable-next-line stylistic/max-len
+        const hsts: DeepPartial<HstsOptions> | boolean | undefined = this.providedOptions.security?.headers?.[KnownHeader.STRICT_TRANSPORT_SECURITY];
+
         const res: FullZibriApplicationOptions = {
             dataSources: [],
             authStrategies: [],
@@ -353,7 +409,17 @@ export class ZibriApplication {
             bodyParsers: [],
             providers: [],
             cronJobs: [],
-            ...this.providedOptions
+            ...this.providedOptions,
+            security: {
+                headers: {
+                    [KnownHeader.STRICT_TRANSPORT_SECURITY]: typeof hsts === 'boolean'
+                        ? hsts
+                        : {
+                            ...defaultHstsOptions,
+                            ...hsts
+                        }
+                }
+            }
         };
         for (const plugin of this.providedOptions.plugins ?? []) {
             // TODO: handle order of plugin initialization so that everything is available for DI inside the plugin constructor.

package/src/assets/asset.service.ts

@@ -61,12 +61,6 @@ export class AssetService implements AssetServiceInterface, OnAppInit {
             handler: () => FileResponse.fromPath(FsUtilities.getPath(this.publicAssetsPath, 'favicon.png'))
         });
 
-        // await app.router.registerRoute({
-        //     httpMethod: HttpMethod.GET,
-        //     route: '/favicon.ico',
-        //     handler: () => FileResponse.fromPath(FsUtilities.getPath(this.publicAssetsPath, 'favicon.png'))
-        // });
-
     }
 
     // eslint-disable-next-line jsdoc/require-jsdoc

package/src/auth/2fa/methods/otp/otp.two-factor-method.ts

@@ -4,14 +4,14 @@ import { HiBase32Utilities } from './hi-base32.utilities';
 import { TwoFactorMethod } from '../two-factor-method.interface';
 import { OtpCredentials, OtpCredentialsCreateData } from './otp-credentials.model';
 import { OtpUtilities } from './otp.utilities';
+import { HttpRequestContext } from '../../../../context/request/http-request.context';
+import { WebsocketRequestContext } from '../../../../context/request/websocket-request.context';
 import { Repository } from '../../../../data-source/repository';
 import { InjectRepository } from '../../../../di/decorators/inject-repository.decorator';
 import { Inject } from '../../../../di/decorators/inject.decorator';
 import { ZIBRI_DI_TOKENS } from '../../../../di/default/zibri-di-tokens.default';
 import { UnauthorizedError } from '../../../../error-handling/errors/unauthorized.error';
-import { HttpRequest } from '../../../../http/http-request.model';
 import { KnownHeader } from '../../../../http/known-header.enum';
-import { WebsocketRequest } from '../../../../websocket/models/websocket-request.model';
 import { BaseUser } from '../../../models/base-user.model';
 
 /**
@@ -71,10 +71,10 @@ export class OtpTwoFactorMethod implements TwoFactorMethod<never, OtpConfirmRegi
     // eslint-disable-next-line jsdoc/require-jsdoc
     async validate<Role extends string, UserType extends BaseUser<Role>>(
         user: UserType,
-        request: HttpRequest | WebsocketRequest
+        context: HttpRequestContext | WebsocketRequestContext
     ): Promise<void> {
         const credentials: OtpCredentials[] = await this.otpCredentialsRepository.findAll({ where: { userId: user.id } });
-        const token: string = this.extractTokenFromRequest(request);
+        const token: string = this.extractTokenFromRequestContext(context);
         for (const c of credentials) {
             if (OtpUtilities.validate(c.secret, token)) {
                 return;
@@ -83,8 +83,8 @@ export class OtpTwoFactorMethod implements TwoFactorMethod<never, OtpConfirmRegi
         throw new UnauthorizedError('The provided two factor code is invalid.');
     }
 
-    private extractTokenFromRequest(request: HttpRequest | WebsocketRequest): string {
-        const code: string | undefined = request.headers[this.otpHeader];
+    private extractTokenFromRequestContext(context: HttpRequestContext | WebsocketRequestContext): string {
+        const code: string | undefined = context.request.headers[this.otpHeader];
         if (!code) {
             throw new UnauthorizedError(`"${this.otpHeader}" header not found`);
         }

package/src/auth/2fa/methods/two-factor-method.interface.ts

@@ -1,5 +1,5 @@
-import { HttpRequest } from '../../../http/http-request.model';
-import { WebsocketRequest } from '../../../websocket/models/websocket-request.model';
+import { HttpRequestContext } from '../../../context/request/http-request.context';
+import { WebsocketRequestContext } from '../../../context/request/websocket-request.context';
 import { BaseUser } from '../../models/base-user.model';
 
 /**
@@ -29,7 +29,7 @@ export interface TwoFactorMethod<TwoFactorRequestRegisterData, TwoFactorConfirmR
      */
     validate: <Role extends string, UserType extends BaseUser<Role>>(
         user: UserType,
-        request: HttpRequest | WebsocketRequest
+        context: HttpRequestContext | WebsocketRequestContext
     ) => void | Promise<void>
 }
 

package/src/auth/2fa/two-factor-service.interface.ts

@@ -1,7 +1,7 @@
 import { TwoFactorMethod } from './methods/two-factor-method.interface';
 import { TwoFactorMethods } from './two-factor-methods.model';
-import { HttpRequest } from '../../http/http-request.model';
-import { WebsocketRequest } from '../../websocket/models/websocket-request.model';
+import { HttpRequestContext } from '../../context/request/http-request.context';
+import { WebsocketRequestContext } from '../../context/request/websocket-request.context';
 import { BaseUser } from '../models/base-user.model';
 
 /**
@@ -52,7 +52,7 @@ export interface TwoFactorServiceInterface {
      */
     has2fa: (
         user: BaseUser<string>,
-        request: HttpRequest | WebsocketRequest,
+        context: HttpRequestContext | WebsocketRequestContext,
         allowedMethods?: TwoFactorMethods
     ) => Promise<boolean>
 }

package/src/auth/2fa/two-factor.service.ts

@@ -1,13 +1,14 @@
 import { ZibriApplication } from '../../application';
+import { HttpRequestContext } from '../../context/request/http-request.context';
+import { ZIBRI_REQUEST_CONTEXT_TOKENS } from '../../context/request/request-context-token.model';
+import { WebsocketRequestContext } from '../../context/request/websocket-request.context';
 import { Inject } from '../../di/decorators/inject.decorator';
 import { Injectable } from '../../di/decorators/injectable.decorator';
 import { ZIBRI_DI_TOKENS } from '../../di/default/zibri-di-tokens.default';
 import { inject } from '../../di/inject.function';
 import { register } from '../../di/register.function';
 import { OnAppInit } from '../../global/on-app-init.interface';
-import { HttpRequest } from '../../http/http-request.model';
 import { type LoggerInterface } from '../../logging/logger.interface';
-import { WebsocketRequest } from '../../websocket/models/websocket-request.model';
 import { BaseUser } from '../models/base-user.model';
 import { TwoFactorMethod } from './methods/two-factor-method.interface';
 import { TwoFactorMethods } from './two-factor-methods.model';
@@ -87,12 +88,15 @@ export class TwoFactorService implements TwoFactorServiceInterface, OnAppInit {
     // eslint-disable-next-line jsdoc/require-jsdoc
     async has2fa(
         user: BaseUser<string>,
-        request: HttpRequest | WebsocketRequest,
+        context: HttpRequestContext | WebsocketRequestContext,
         allowedMethods: TwoFactorMethods = this.twoFactorMethods
     ): Promise<boolean> {
+        if (context.has(ZIBRI_REQUEST_CONTEXT_TOKENS.HAS_2FA)) {
+            return context.get(ZIBRI_REQUEST_CONTEXT_TOKENS.HAS_2FA);
+        }
         try {
             await Promise.any(
-                allowedMethods.map(m => inject(m).validate(user, request))
+                allowedMethods.map(m => inject(m).validate(user, context))
             );
             return true;
         }