From 767f4333e7be2c78dcd014f71aeccd892c9ce020 Mon Sep 17 00:00:00 2001
From: palmoni5 <d8401948@gmail.com>
Date: Sun, 30 Aug 2026 21:15:04 +0000
Subject: [PATCH] fix: register DELETE /2factor/authn so disabling WebAuthn
 works

The 'Disable' button on the account 2factor page calls
DELETE /api/v3/plugins/2factor/authn, but no such route was
registered, so the request 404'd and users could not remove WebAuthn
wholesale. Add the route, backed by a removeAllDevices helper that
disassociate() now reuses.
---
 library.js | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/library.js b/library.js
index faaab4e..c2aafa0 100644
--- a/library.js
+++ b/library.js
@@ -153,6 +153,11 @@ plugin.addRoutes = async ({ router, middleware, helpers }) => {
 		helpers.formatApiResponse(200, res);
 	});
 
+	routeHelpers.setupApiRoute(router, 'delete', '/2factor/authn', middlewares, async (req, res) => {
+		await plugin.removeAllDevices(req.uid);
+		helpers.formatApiResponse(200, res);
+	});
+
 	routeHelpers.setupApiRoute(router, 'post', '/2factor/authn/register', middlewares, async (req, res) => {
 		const attestationExpectations = {
 			challenge: req.session.registrationRequest.challenge,
@@ -392,6 +397,10 @@ plugin.disassociate = async (uid) => {
 	]);
 
 	// Clear U2F keys
+	await plugin.removeAllDevices(uid);
+};
+
+plugin.removeAllDevices = async (uid) => {
 	const keyIds = await db.getObjectKeys(`2factor:webauthn:${uid}`);
 	await db.sortedSetRemove('2factor:webauthn:counters', keyIds);
 	await db.delete(`2factor:webauthn:${uid}`);