Update migration guide

Update dependencies
Explain commercial support in README
2025-08-06 08:07:27 +02:00 · 2025-06-04 19:48:25 +02:00 · 2025-05-28 17:47:58 +02:00 · 2025-05-28 17:42:57 +02:00 · 2025-05-27 11:28:12 +02:00 · 2025-05-27 10:49:13 +02:00
44 changed files with 3248 additions and 398 deletions
--- a/Database/MySQL.sql
+++ b/Database/MySQL.sql
@@ -7,62 +7,101 @@
 /*!40101 SET @OLD_COLLATION_CONNECTION=@@COLLATION_CONNECTION */;
 /*!40101 SET NAMES utf8mb4 */;

-CREATE TABLE IF NOT EXISTS `users` (
-  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
+CREATE TABLE `users` (
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
  `email` varchar(249) COLLATE utf8mb4_unicode_ci NOT NULL,
  `password` varchar(255) CHARACTER SET latin1 COLLATE latin1_general_cs NOT NULL,
  `username` varchar(100) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
-  `status` tinyint(2) unsigned NOT NULL DEFAULT '0',
-  `verified` tinyint(1) unsigned NOT NULL DEFAULT '0',
-  `resettable` tinyint(1) unsigned NOT NULL DEFAULT '1',
-  `roles_mask` int(10) unsigned NOT NULL DEFAULT '0',
-  `registered` int(10) unsigned NOT NULL,
-  `last_login` int(10) unsigned DEFAULT NULL,
-  `force_logout` mediumint(7) unsigned NOT NULL DEFAULT '0',
+  `status` tinyint unsigned NOT NULL DEFAULT '0',
+  `verified` tinyint unsigned NOT NULL DEFAULT '0',
+  `resettable` tinyint unsigned NOT NULL DEFAULT '1',
+  `roles_mask` int unsigned NOT NULL DEFAULT '0',
+  `registered` int unsigned NOT NULL,
+  `last_login` int unsigned DEFAULT NULL,
+  `force_logout` mediumint unsigned NOT NULL DEFAULT '0',
  PRIMARY KEY (`id`),
  UNIQUE KEY `email` (`email`)
 ) ENGINE=MyISAM DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

-CREATE TABLE IF NOT EXISTS `users_confirmations` (
-  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
-  `user_id` int(10) unsigned NOT NULL,
+CREATE TABLE `users_2fa` (
+  `id` bigint unsigned NOT NULL AUTO_INCREMENT,
+  `user_id` int unsigned NOT NULL,
+  `mechanism` tinyint unsigned NOT NULL,
+  `seed` varchar(255) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
+  `created_at` int unsigned NOT NULL,
+  `expires_at` int unsigned DEFAULT NULL,
+  PRIMARY KEY (`id`),
+  UNIQUE KEY `user_id_mechanism` (`user_id`,`mechanism`)
+) ENGINE=MyISAM DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE `users_audit_log` (
+  `id` bigint unsigned NOT NULL AUTO_INCREMENT,
+  `user_id` int unsigned DEFAULT NULL,
+  `event_at` int unsigned NOT NULL,
+  `event_type` varchar(128) CHARACTER SET ascii COLLATE ascii_general_ci NOT NULL,
+  `admin_id` int unsigned DEFAULT NULL,
+  `ip_address` varchar(49) CHARACTER SET ascii COLLATE ascii_general_ci DEFAULT NULL,
+  `user_agent` text COLLATE utf8mb4_unicode_ci DEFAULT NULL,
+  `details_json` text COLLATE utf8mb4_unicode_ci DEFAULT NULL,
+  PRIMARY KEY (`id`),
+  KEY `event_at` (`event_at`),
+  KEY `user_id_event_at` (`user_id`,`event_at`),
+  KEY `user_id_event_type_event_at` (`user_id`,`event_type`,`event_at`)
+) ENGINE=MyISAM DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE `users_confirmations` (
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
+  `user_id` int unsigned NOT NULL,
  `email` varchar(249) COLLATE utf8mb4_unicode_ci NOT NULL,
  `selector` varchar(16) CHARACTER SET latin1 COLLATE latin1_general_cs NOT NULL,
  `token` varchar(255) CHARACTER SET latin1 COLLATE latin1_general_cs NOT NULL,
-  `expires` int(10) unsigned NOT NULL,
+  `expires` int unsigned NOT NULL,
  PRIMARY KEY (`id`),
  UNIQUE KEY `selector` (`selector`),
  KEY `email_expires` (`email`,`expires`),
  KEY `user_id` (`user_id`)
 ) ENGINE=MyISAM DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

-CREATE TABLE IF NOT EXISTS `users_remembered` (
-  `id` bigint(20) unsigned NOT NULL AUTO_INCREMENT,
-  `user` int(10) unsigned NOT NULL,
+CREATE TABLE `users_otps` (
+  `id` bigint unsigned NOT NULL AUTO_INCREMENT,
+  `user_id` int unsigned NOT NULL,
+  `mechanism` tinyint unsigned NOT NULL,
+  `single_factor` tinyint unsigned NOT NULL DEFAULT '0',
  `selector` varchar(24) CHARACTER SET latin1 COLLATE latin1_general_cs NOT NULL,
  `token` varchar(255) CHARACTER SET latin1 COLLATE latin1_general_cs NOT NULL,
-  `expires` int(10) unsigned NOT NULL,
+  `expires_at` int unsigned DEFAULT NULL,
+  PRIMARY KEY (`id`),
+  KEY `user_id_mechanism` (`user_id`,`mechanism`),
+  KEY `selector_user_id` (`selector`,`user_id`)
+) ENGINE=MyISAM DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE `users_remembered` (
+  `id` bigint unsigned NOT NULL AUTO_INCREMENT,
+  `user` int unsigned NOT NULL,
+  `selector` varchar(24) CHARACTER SET latin1 COLLATE latin1_general_cs NOT NULL,
+  `token` varchar(255) CHARACTER SET latin1 COLLATE latin1_general_cs NOT NULL,
+  `expires` int unsigned NOT NULL,
  PRIMARY KEY (`id`),
  UNIQUE KEY `selector` (`selector`),
  KEY `user` (`user`)
 ) ENGINE=MyISAM DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

-CREATE TABLE IF NOT EXISTS `users_resets` (
-  `id` bigint(20) unsigned NOT NULL AUTO_INCREMENT,
-  `user` int(10) unsigned NOT NULL,
+CREATE TABLE `users_resets` (
+  `id` bigint unsigned NOT NULL AUTO_INCREMENT,
+  `user` int unsigned NOT NULL,
  `selector` varchar(20) CHARACTER SET latin1 COLLATE latin1_general_cs NOT NULL,
  `token` varchar(255) CHARACTER SET latin1 COLLATE latin1_general_cs NOT NULL,
-  `expires` int(10) unsigned NOT NULL,
+  `expires` int unsigned NOT NULL,
  PRIMARY KEY (`id`),
  UNIQUE KEY `selector` (`selector`),
  KEY `user_expires` (`user`,`expires`)
 ) ENGINE=MyISAM DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

-CREATE TABLE IF NOT EXISTS `users_throttling` (
+CREATE TABLE `users_throttling` (
  `bucket` varchar(44) CHARACTER SET latin1 COLLATE latin1_general_cs NOT NULL,
-  `tokens` float unsigned NOT NULL,
-  `replenished_at` int(10) unsigned NOT NULL,
-  `expires_at` int(10) unsigned NOT NULL,
+  `tokens` float NOT NULL,
+  `replenished_at` int unsigned NOT NULL,
+  `expires_at` int unsigned NOT NULL,
  PRIMARY KEY (`bucket`),
  KEY `expires_at` (`expires_at`)
 ) ENGINE=MyISAM DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
--- a/Database/PostgreSQL.sql
+++ b/Database/PostgreSQL.sql
@@ -4,55 +4,91 @@

 BEGIN;

-CREATE TABLE IF NOT EXISTS "users" (
-	"id" SERIAL PRIMARY KEY CHECK ("id" >= 0),
+CREATE TABLE "users" (
+	"id" SERIAL PRIMARY KEY,
 	"email" VARCHAR(249) UNIQUE NOT NULL,
-	"password" VARCHAR(255) NOT NULL,
+	"password" VARCHAR(255) NOT NULL COLLATE "C",
 	"username" VARCHAR(100) DEFAULT NULL,
-	"status" SMALLINT NOT NULL DEFAULT '0' CHECK ("status" >= 0),
-	"verified" SMALLINT NOT NULL DEFAULT '0' CHECK ("verified" >= 0),
-	"resettable" SMALLINT NOT NULL DEFAULT '1' CHECK ("resettable" >= 0),
-	"roles_mask" INTEGER NOT NULL DEFAULT '0' CHECK ("roles_mask" >= 0),
+	"status" SMALLINT NOT NULL DEFAULT 0 CHECK ("status" >= 0),
+	"verified" SMALLINT NOT NULL DEFAULT 0 CHECK ("verified" >= 0 AND "verified" <= 1),
+	"resettable" SMALLINT NOT NULL DEFAULT 1 CHECK ("resettable" >= 0 AND "resettable" <= 1),
+	"roles_mask" INTEGER NOT NULL DEFAULT 0 CHECK ("roles_mask" >= 0),
 	"registered" INTEGER NOT NULL CHECK ("registered" >= 0),
 	"last_login" INTEGER DEFAULT NULL CHECK ("last_login" >= 0),
-	"force_logout" INTEGER NOT NULL DEFAULT '0' CHECK ("force_logout" >= 0)
+	"force_logout" INTEGER NOT NULL DEFAULT 0 CHECK ("force_logout" >= 0)
 );

-CREATE TABLE IF NOT EXISTS "users_confirmations" (
-	"id" SERIAL PRIMARY KEY CHECK ("id" >= 0),
+CREATE TABLE "users_2fa" (
+	"id" BIGSERIAL PRIMARY KEY,
+	"user_id" INTEGER NOT NULL CHECK ("user_id" >= 0),
+	"mechanism" SMALLINT NOT NULL CHECK ("mechanism" >= 0),
+	"seed" VARCHAR(255) DEFAULT NULL COLLATE "C",
+	"created_at" INTEGER NOT NULL CHECK ("created_at" >= 0),
+	"expires_at" INTEGER DEFAULT NULL CHECK ("expires_at" >= 0)
+);
+CREATE UNIQUE INDEX "users_2fa_user_id_mechanism_uq" ON "users_2fa" ("user_id", "mechanism");
+
+CREATE TABLE "users_audit_log" (
+	"id" BIGSERIAL PRIMARY KEY,
+	"user_id" INTEGER DEFAULT NULL CHECK ("user_id" >= 0),
+	"event_at" INTEGER NOT NULL CHECK ("event_at" >= 0),
+	"event_type" VARCHAR(128) NOT NULL COLLATE "C",
+	"admin_id" INTEGER DEFAULT NULL CHECK ("admin_id" >= 0),
+	"ip_address" INET DEFAULT NULL,
+	"user_agent" TEXT DEFAULT NULL,
+	"details_json" JSONB DEFAULT NULL
+);
+CREATE INDEX "users_audit_log_event_at_ix" ON "users_audit_log" ("event_at");
+CREATE INDEX "users_audit_log_user_id_event_at_ix" ON "users_audit_log" ("user_id", "event_at");
+CREATE INDEX "users_audit_log_user_id_event_type_event_at_ix" ON "users_audit_log" ("user_id", "event_type", "event_at");
+
+CREATE TABLE "users_confirmations" (
+	"id" SERIAL PRIMARY KEY,
 	"user_id" INTEGER NOT NULL CHECK ("user_id" >= 0),
 	"email" VARCHAR(249) NOT NULL,
-	"selector" VARCHAR(16) UNIQUE NOT NULL,
-	"token" VARCHAR(255) NOT NULL,
+	"selector" VARCHAR(16) UNIQUE NOT NULL COLLATE "C",
+	"token" VARCHAR(255) NOT NULL COLLATE "C",
 	"expires" INTEGER NOT NULL CHECK ("expires" >= 0)
 );
-CREATE INDEX IF NOT EXISTS "email_expires" ON "users_confirmations" ("email", "expires");
-CREATE INDEX IF NOT EXISTS "user_id" ON "users_confirmations" ("user_id");
+CREATE INDEX "users_confirmations_email_expires_ix" ON "users_confirmations" ("email", "expires");
+CREATE INDEX "users_confirmations_user_id_ix" ON "users_confirmations" ("user_id");

-CREATE TABLE IF NOT EXISTS "users_remembered" (
-	"id" BIGSERIAL PRIMARY KEY CHECK ("id" >= 0),
+CREATE TABLE "users_otps" (
+	"id" BIGSERIAL PRIMARY KEY,
+	"user_id" INTEGER NOT NULL CHECK ("user_id" >= 0),
+	"mechanism" SMALLINT NOT NULL CHECK ("mechanism" >= 0),
+	"single_factor" SMALLINT NOT NULL DEFAULT 0 CHECK ("single_factor" >= 0 AND "single_factor" <= 1),
+	"selector" VARCHAR(24) NOT NULL COLLATE "C",
+	"token" VARCHAR(255) NOT NULL COLLATE "C",
+	"expires_at" INTEGER DEFAULT NULL CHECK ("expires_at" >= 0)
+);
+CREATE INDEX "users_otps_user_id_mechanism_ix" ON "users_otps" ("user_id", "mechanism");
+CREATE INDEX "users_otps_selector_user_id_ix" ON "users_otps" ("selector", "user_id");
+
+CREATE TABLE "users_remembered" (
+	"id" BIGSERIAL PRIMARY KEY,
 	"user" INTEGER NOT NULL CHECK ("user" >= 0),
-	"selector" VARCHAR(24) UNIQUE NOT NULL,
-	"token" VARCHAR(255) NOT NULL,
+	"selector" VARCHAR(24) UNIQUE NOT NULL COLLATE "C",
+	"token" VARCHAR(255) NOT NULL COLLATE "C",
 	"expires" INTEGER NOT NULL CHECK ("expires" >= 0)
 );
-CREATE INDEX IF NOT EXISTS "user" ON "users_remembered" ("user");
+CREATE INDEX "users_remembered_user_ix" ON "users_remembered" ("user");

-CREATE TABLE IF NOT EXISTS "users_resets" (
-	"id" BIGSERIAL PRIMARY KEY CHECK ("id" >= 0),
+CREATE TABLE "users_resets" (
+	"id" BIGSERIAL PRIMARY KEY,
 	"user" INTEGER NOT NULL CHECK ("user" >= 0),
-	"selector" VARCHAR(20) UNIQUE NOT NULL,
-	"token" VARCHAR(255) NOT NULL,
+	"selector" VARCHAR(20) UNIQUE NOT NULL COLLATE "C",
+	"token" VARCHAR(255) NOT NULL COLLATE "C",
 	"expires" INTEGER NOT NULL CHECK ("expires" >= 0)
 );
-CREATE INDEX IF NOT EXISTS "user_expires" ON "users_resets" ("user", "expires");
+CREATE INDEX "users_resets_user_expires_ix" ON "users_resets" ("user", "expires");

-CREATE TABLE IF NOT EXISTS "users_throttling" (
-	"bucket" VARCHAR(44) PRIMARY KEY,
+CREATE TABLE "users_throttling" (
+	"bucket" VARCHAR(44) PRIMARY KEY COLLATE "C",
 	"tokens" REAL NOT NULL CHECK ("tokens" >= 0),
 	"replenished_at" INTEGER NOT NULL CHECK ("replenished_at" >= 0),
 	"expires_at" INTEGER NOT NULL CHECK ("expires_at" >= 0)
 );
-CREATE INDEX IF NOT EXISTS "expires_at" ON "users_throttling" ("expires_at");
+CREATE INDEX "users_throttling_expires_at_ix" ON "users_throttling" ("expires_at");

 COMMIT;
--- a/Database/SQLite.sql
+++ b/Database/SQLite.sql
@@ -5,56 +5,92 @@
 PRAGMA foreign_keys = OFF;

 CREATE TABLE "users" (
-	"id" INTEGER PRIMARY KEY AUTOINCREMENT NOT NULL CHECK ("id" >= 0),
-	"email" VARCHAR(249) NOT NULL,
-	"password" VARCHAR(255) NOT NULL,
-	"username" VARCHAR(100) DEFAULT NULL,
-	"status" INTEGER NOT NULL CHECK ("status" >= 0) DEFAULT "0",
-	"verified" INTEGER NOT NULL CHECK ("verified" >= 0) DEFAULT "0",
-	"resettable" INTEGER NOT NULL CHECK ("resettable" >= 0) DEFAULT "1",
-	"roles_mask" INTEGER NOT NULL CHECK ("roles_mask" >= 0) DEFAULT "0",
+	"id" INTEGER PRIMARY KEY AUTOINCREMENT NOT NULL,
+	"email" TEXT NOT NULL COLLATE NOCASE CHECK (LENGTH("email") <= 249),
+	"password" TEXT NOT NULL COLLATE BINARY CHECK (LENGTH("password") <= 255),
+	"username" TEXT DEFAULT NULL COLLATE NOCASE CHECK (LENGTH("username") <= 100),
+	"status" INTEGER NOT NULL CHECK ("status" >= 0) DEFAULT 0,
+	"verified" INTEGER NOT NULL CHECK ("verified" >= 0 AND "verified" <= 1) DEFAULT 0,
+	"resettable" INTEGER NOT NULL CHECK ("resettable" >= 0 AND "resettable" <= 1) DEFAULT 1,
+	"roles_mask" INTEGER NOT NULL CHECK ("roles_mask" >= 0) DEFAULT 0,
 	"registered" INTEGER NOT NULL CHECK ("registered" >= 0),
 	"last_login" INTEGER CHECK ("last_login" >= 0) DEFAULT NULL,
-	"force_logout" INTEGER NOT NULL CHECK ("force_logout" >= 0) DEFAULT "0",
-	CONSTRAINT "email" UNIQUE ("email")
+	"force_logout" INTEGER NOT NULL CHECK ("force_logout" >= 0) DEFAULT 0,
+	CONSTRAINT "users_email_uq" UNIQUE ("email")
 );

+CREATE TABLE "users_2fa" (
+	"id" INTEGER PRIMARY KEY AUTOINCREMENT NOT NULL,
+	"user_id" INTEGER NOT NULL CHECK ("user_id" >= 0),
+	"mechanism" INTEGER NOT NULL CHECK ("mechanism" >= 0),
+	"seed" TEXT DEFAULT NULL COLLATE BINARY CHECK (LENGTH("seed") <= 255),
+	"created_at" INTEGER NOT NULL CHECK ("created_at" >= 0),
+	"expires_at" INTEGER CHECK ("expires_at" >= 0) DEFAULT NULL,
+	CONSTRAINT "users_2fa_user_id_mechanism_uq" UNIQUE ("user_id", "mechanism")
+);
+
+CREATE TABLE "users_audit_log" (
+	"id" INTEGER PRIMARY KEY AUTOINCREMENT NOT NULL,
+	"user_id" INTEGER DEFAULT NULL CHECK ("user_id" >= 0),
+	"event_at" INTEGER NOT NULL CHECK ("event_at" >= 0),
+	"event_type" TEXT NOT NULL COLLATE NOCASE CHECK (LENGTH("event_type") <= 128),
+	"admin_id" INTEGER DEFAULT NULL CHECK ("admin_id" >= 0),
+	"ip_address" TEXT DEFAULT NULL COLLATE NOCASE CHECK (LENGTH("ip_address") <= 49),
+	"user_agent" TEXT DEFAULT NULL,
+	"details_json" TEXT DEFAULT NULL
+);
+CREATE INDEX "users_audit_log_event_at_ix" ON "users_audit_log" ("event_at");
+CREATE INDEX "users_audit_log_user_id_event_at_ix" ON "users_audit_log" ("user_id", "event_at");
+CREATE INDEX "users_audit_log_user_id_event_type_event_at_ix" ON "users_audit_log" ("user_id", "event_type", "event_at");
+
 CREATE TABLE "users_confirmations" (
-	"id" INTEGER PRIMARY KEY AUTOINCREMENT NOT NULL CHECK ("id" >= 0),
+	"id" INTEGER PRIMARY KEY AUTOINCREMENT NOT NULL,
 	"user_id" INTEGER NOT NULL CHECK ("user_id" >= 0),
-	"email" VARCHAR(249) NOT NULL,
-	"selector" VARCHAR(16) NOT NULL,
-	"token" VARCHAR(255) NOT NULL,
+	"email" TEXT NOT NULL COLLATE NOCASE CHECK (LENGTH("email") <= 249),
+	"selector" TEXT NOT NULL COLLATE BINARY CHECK (LENGTH("selector") <= 16),
+	"token" TEXT NOT NULL COLLATE BINARY CHECK (LENGTH("token") <= 255),
 	"expires" INTEGER NOT NULL CHECK ("expires" >= 0),
-	CONSTRAINT "selector" UNIQUE ("selector")
+	CONSTRAINT "users_confirmations_selector_uq" UNIQUE ("selector")
 );
-CREATE INDEX "users_confirmations.email_expires" ON "users_confirmations" ("email", "expires");
-CREATE INDEX "users_confirmations.user_id" ON "users_confirmations" ("user_id");
+CREATE INDEX "users_confirmations_email_expires_ix" ON "users_confirmations" ("email", "expires");
+CREATE INDEX "users_confirmations_user_id_ix" ON "users_confirmations" ("user_id");
+
+CREATE TABLE "users_otps" (
+	"id" INTEGER PRIMARY KEY AUTOINCREMENT NOT NULL,
+	"user_id" INTEGER NOT NULL CHECK ("user_id" >= 0),
+	"mechanism" INTEGER NOT NULL CHECK ("mechanism" >= 0),
+	"single_factor" INTEGER NOT NULL CHECK ("single_factor" >= 0 AND "single_factor" <= 1) DEFAULT 0,
+	"selector" TEXT NOT NULL COLLATE BINARY CHECK (LENGTH("selector") <= 24),
+	"token" TEXT NOT NULL COLLATE BINARY CHECK (LENGTH("token") <= 255),
+	"expires_at" INTEGER CHECK ("expires_at" >= 0) DEFAULT NULL
+);
+CREATE INDEX "users_otps_user_id_mechanism_ix" ON "users_otps" ("user_id", "mechanism");
+CREATE INDEX "users_otps_selector_user_id_ix" ON "users_otps" ("selector", "user_id");

 CREATE TABLE "users_remembered" (
-	"id" INTEGER PRIMARY KEY AUTOINCREMENT NOT NULL CHECK ("id" >= 0),
+	"id" INTEGER PRIMARY KEY AUTOINCREMENT NOT NULL,
 	"user" INTEGER NOT NULL CHECK ("user" >= 0),
-	"selector" VARCHAR(24) NOT NULL,
-	"token" VARCHAR(255) NOT NULL,
+	"selector" TEXT NOT NULL COLLATE BINARY CHECK (LENGTH("selector") <= 24),
+	"token" TEXT NOT NULL COLLATE BINARY CHECK (LENGTH("token") <= 255),
 	"expires" INTEGER NOT NULL CHECK ("expires" >= 0),
-	CONSTRAINT "selector" UNIQUE ("selector")
+	CONSTRAINT "users_remembered_selector_uq" UNIQUE ("selector")
 );
-CREATE INDEX "users_remembered.user" ON "users_remembered" ("user");
+CREATE INDEX "users_remembered_user_ix" ON "users_remembered" ("user");

 CREATE TABLE "users_resets" (
-	"id" INTEGER PRIMARY KEY AUTOINCREMENT NOT NULL CHECK ("id" >= 0),
+	"id" INTEGER PRIMARY KEY AUTOINCREMENT NOT NULL,
 	"user" INTEGER NOT NULL CHECK ("user" >= 0),
-	"selector" VARCHAR(20) NOT NULL,
-	"token" VARCHAR(255) NOT NULL,
+	"selector" TEXT NOT NULL COLLATE BINARY CHECK (LENGTH("selector") <= 20),
+	"token" TEXT NOT NULL COLLATE BINARY CHECK (LENGTH("token") <= 255),
 	"expires" INTEGER NOT NULL CHECK ("expires" >= 0),
-	CONSTRAINT "selector" UNIQUE ("selector")
+	CONSTRAINT "users_resets_selector_uq" UNIQUE ("selector")
 );
-CREATE INDEX "users_resets.user_expires" ON "users_resets" ("user", "expires");
+CREATE INDEX "users_resets_user_expires_ix" ON "users_resets" ("user", "expires");

 CREATE TABLE "users_throttling" (
-	"bucket" VARCHAR(44) PRIMARY KEY NOT NULL,
+	"bucket" TEXT PRIMARY KEY NOT NULL COLLATE BINARY CHECK (LENGTH("bucket") <= 44),
 	"tokens" REAL NOT NULL CHECK ("tokens" >= 0),
 	"replenished_at" INTEGER NOT NULL CHECK ("replenished_at" >= 0),
 	"expires_at" INTEGER NOT NULL CHECK ("expires_at" >= 0)
 );
-CREATE INDEX "users_throttling.expires_at" ON "users_throttling" ("expires_at");
+CREATE INDEX "users_throttling_expires_at_ix" ON "users_throttling" ("expires_at");
--- a/Migration.md
+++ b/Migration.md
@@ -1,6 +1,7 @@
 # Migration

 * [General](#general)
+ * [From `v8.x.x` to `v9.x.x`](#from-v8xx-to-v9xx)
 * [From `v7.x.x` to `v8.x.x`](#from-v7xx-to-v8xx)
 * [From `v6.x.x` to `v7.x.x`](#from-v6xx-to-v7xx)
 * [From `v5.x.x` to `v6.x.x`](#from-v5xx-to-v6xx)
@@ -13,6 +14,10 @@

 Update your version of this library using Composer and its `composer update` or `composer require` commands [[?]](https://github.com/delight-im/Knowledge/blob/master/Composer%20(PHP).md#how-do-i-update-libraries-or-modules-within-my-application).

+## From `v8.x.x` to `v9.x.x`
+
+ * The database schema has changed. Create the three new tables `users_2fa`, `users_otps` and `users_audit_log` in your [MySQL](Database/MySQL.sql), [PostgreSQL](Database/PostgreSQL.sql) or [SQLite](Database/SQLite.sql) schema to update your database.
+
 ## From `v7.x.x` to `v8.x.x`

 * The database schema has changed.
--- a/README.md
+++ b/README.md
--- a/composer.json
+++ b/composer.json
@@ -6,7 +6,8 @@
 		"ext-openssl": "*",
 		"delight-im/base64": "^1.0",
 		"delight-im/cookie": "^3.1",
-		"delight-im/db": "^1.2"
+		"delight-im/db": "^1.5",
+		"delight-im/otp": "^1.0"
 	},
 	"type": "library",
 	"keywords": [ "auth", "authentication", "login", "security" ],
--- a/composer.lock
+++ b/composer.lock
@@ -1,10 +1,10 @@
 {
    "_readme": [
        "This file locks the dependencies of your project to a known state",
-        "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#composer-lock-the-lock-file",
+        "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
        "This file is @generated automatically"
    ],
-    "content-hash": "54d541ae3c5ba25b0cc06688d2b65467",
+    "content-hash": "2467e7d9c74e16240dd81cd23d33a880",
    "packages": [
        {
            "name": "delight-im/base64",
@@ -49,16 +49,16 @@
        },
        {
            "name": "delight-im/cookie",
-            "version": "v3.1.0",
+            "version": "v3.4.0",
            "source": {
                "type": "git",
                "url": "https://github.com/delight-im/PHP-Cookie.git",
-                "reference": "76ef2a21817cf7a034f85fc3f4d4bfc60f873947"
+                "reference": "67065d34272377d63bab0bd58f984f9b228c803f"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/delight-im/PHP-Cookie/zipball/76ef2a21817cf7a034f85fc3f4d4bfc60f873947",
-                "reference": "76ef2a21817cf7a034f85fc3f4d4bfc60f873947",
+                "url": "https://api.github.com/repos/delight-im/PHP-Cookie/zipball/67065d34272377d63bab0bd58f984f9b228c803f",
+                "reference": "67065d34272377d63bab0bd58f984f9b228c803f",
                "shasum": ""
            },
            "require": {
@@ -86,20 +86,24 @@
                "samesite",
                "xss"
            ],
-            "time": "2017-10-18T19:48:59+00:00"
+            "support": {
+                "issues": "https://github.com/delight-im/PHP-Cookie/issues",
+                "source": "https://github.com/delight-im/PHP-Cookie/tree/v3.4.0"
+            },
+            "time": "2020-04-16T11:01:26+00:00"
        },
        {
            "name": "delight-im/db",
-            "version": "v1.2.0",
+            "version": "v1.5.0",
            "source": {
                "type": "git",
                "url": "https://github.com/delight-im/PHP-DB.git",
-                "reference": "df99ef7c2e86c7ce206647ffe8ba74447c075b57"
+                "reference": "c613571382fa76359abc6de71d19738d7b7f1d13"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/delight-im/PHP-DB/zipball/df99ef7c2e86c7ce206647ffe8ba74447c075b57",
-                "reference": "df99ef7c2e86c7ce206647ffe8ba74447c075b57",
+                "url": "https://api.github.com/repos/delight-im/PHP-DB/zipball/c613571382fa76359abc6de71d19738d7b7f1d13",
+                "reference": "c613571382fa76359abc6de71d19738d7b7f1d13",
                "shasum": ""
            },
            "require": {
@@ -127,20 +131,24 @@
                "sql",
                "sqlite"
            ],
-            "time": "2017-03-18T20:51:59+00:00"
+            "support": {
+                "issues": "https://github.com/delight-im/PHP-DB/issues",
+                "source": "https://github.com/delight-im/PHP-DB/tree/v1.5.0"
+            },
+            "time": "2025-05-26T16:39:50+00:00"
        },
        {
            "name": "delight-im/http",
-            "version": "v2.0.0",
+            "version": "v2.1.0",
            "source": {
                "type": "git",
                "url": "https://github.com/delight-im/PHP-HTTP.git",
-                "reference": "0a19a72a7eac8b1301aa972fb20cff494ac43e09"
+                "reference": "a5c2c4eae1dd3207f797984e8f64f2d71ed889dd"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/delight-im/PHP-HTTP/zipball/0a19a72a7eac8b1301aa972fb20cff494ac43e09",
-                "reference": "0a19a72a7eac8b1301aa972fb20cff494ac43e09",
+                "url": "https://api.github.com/repos/delight-im/PHP-HTTP/zipball/a5c2c4eae1dd3207f797984e8f64f2d71ed889dd",
+                "reference": "a5c2c4eae1dd3207f797984e8f64f2d71ed889dd",
                "shasum": ""
            },
            "require": {
@@ -163,7 +171,129 @@
                "http",
                "https"
            ],
-            "time": "2016-07-21T15:05:01+00:00"
+            "support": {
+                "issues": "https://github.com/delight-im/PHP-HTTP/issues",
+                "source": "https://github.com/delight-im/PHP-HTTP/tree/v2.1.0"
+            },
+            "time": "2021-10-12T18:52:29+00:00"
+        },
+        {
+            "name": "delight-im/otp",
+            "version": "v1.0.1",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/delight-im/PHP-OTP.git",
+                "reference": "d012342f5ee3430394b568b46a00c412c24f4f4a"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/delight-im/PHP-OTP/zipball/d012342f5ee3430394b568b46a00c412c24f4f4a",
+                "reference": "d012342f5ee3430394b568b46a00c412c24f4f4a",
+                "shasum": ""
+            },
+            "require": {
+                "ext-openssl": "*",
+                "paragonie/constant_time_encoding": "~1.1.0",
+                "php": ">=5.6.0"
+            },
+            "type": "library",
+            "autoload": {
+                "psr-4": {
+                    "Delight\\Otp\\": "src/"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "description": "One-time password (OTP) implementation for two-factor authentication with TOTP in accordance with RFC 6238 and RFC 4226",
+            "homepage": "https://github.com/delight-im/PHP-OTP",
+            "keywords": [
+                "2fa",
+                "google-authenticator",
+                "hotp",
+                "otp",
+                "rfc-4226",
+                "rfc-6238",
+                "rfc4226",
+                "rfc6238",
+                "tfa",
+                "totp",
+                "two-factor",
+                "two-factor-authentication"
+            ],
+            "support": {
+                "issues": "https://github.com/delight-im/PHP-OTP/issues",
+                "source": "https://github.com/delight-im/PHP-OTP/tree/v1.0.1"
+            },
+            "time": "2023-07-03T08:13:03+00:00"
+        },
+        {
+            "name": "paragonie/constant_time_encoding",
+            "version": "v1.1.0",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/paragonie/constant_time_encoding.git",
+                "reference": "317718fb438e60151f72b20404f040cb5ae1d494"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/paragonie/constant_time_encoding/zipball/317718fb438e60151f72b20404f040cb5ae1d494",
+                "reference": "317718fb438e60151f72b20404f040cb5ae1d494",
+                "shasum": ""
+            },
+            "require": {
+                "php": "^5.3|^7|^8"
+            },
+            "require-dev": {
+                "paragonie/random_compat": "^1.4|^2",
+                "phpunit/phpunit": ">= 4"
+            },
+            "type": "library",
+            "autoload": {
+                "psr-4": {
+                    "ParagonIE\\ConstantTime\\": "src/"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Paragon Initiative Enterprises",
+                    "email": "security@paragonie.com",
+                    "homepage": "https://paragonie.com",
+                    "role": "Maintainer"
+                },
+                {
+                    "name": "Steve 'Sc00bz' Thomas",
+                    "email": "steve@tobtu.com",
+                    "homepage": "https://www.tobtu.com",
+                    "role": "Original Developer"
+                }
+            ],
+            "description": "Constant-time Implementations of RFC 4648 Encoding (Base-64, Base-32, Base-16)",
+            "keywords": [
+                "base16",
+                "base32",
+                "base32_decode",
+                "base32_encode",
+                "base64",
+                "base64_decode",
+                "base64_encode",
+                "bin2hex",
+                "encoding",
+                "hex",
+                "hex2bin",
+                "rfc4648"
+            ],
+            "support": {
+                "email": "info@paragonie.com",
+                "issues": "https://github.com/paragonie/constant_time_encoding/issues",
+                "source": "https://github.com/paragonie/constant_time_encoding"
+            },
+            "time": "2022-01-17T05:23:46+00:00"
        }
    ],
    "packages-dev": [],
@@ -176,5 +306,6 @@
        "php": ">=5.6.0",
        "ext-openssl": "*"
    },
-    "platform-dev": []
+    "platform-dev": [],
+    "plugin-api-version": "2.1.0"
 }
--- a/src/Administration.php
+++ b/src/Administration.php
@@ -12,17 +12,16 @@ use Delight\Db\PdoDatabase;
 use Delight\Db\PdoDsn;
 use Delight\Db\Throwable\Error;

-require_once __DIR__ . '/Exceptions.php';
-
 /** Component that can be used for administrative tasks by privileged and authorized users */
 final class Administration extends UserManager {

 	/**
 	 * @param PdoDatabase|PdoDsn|\PDO $databaseConnection the database connection to operate on
 	 * @param string|null $dbTablePrefix (optional) the prefix for the names of all database tables used by this component
+	 * @param string|null $dbSchema (optional) the schema name for all database tables used by this component
 	 */
-	public function __construct($databaseConnection, $dbTablePrefix = null) {
-		parent::__construct($databaseConnection, $dbTablePrefix);
+	public function __construct($databaseConnection, $dbTablePrefix = null, $dbSchema = null) {
+		parent::__construct($databaseConnection, $dbTablePrefix, $dbSchema);
 	}

 	/**
@@ -277,7 +276,7 @@ final class Administration extends UserManager {
 		$userId = (int) $userId;

 		$rolesBitmask = $this->db->selectValue(
-			'SELECT roles_mask FROM ' . $this->dbTablePrefix . 'users WHERE id = ?',
+			'SELECT roles_mask FROM ' . $this->makeTableName('users') . ' WHERE id = ?',
 			[ $userId ]
 		);

@@ -303,7 +302,7 @@ final class Administration extends UserManager {
 		$userId = (int) $userId;

 		$rolesBitmask = $this->db->selectValue(
-			'SELECT roles_mask FROM ' . $this->dbTablePrefix . 'users WHERE id = ?',
+			'SELECT roles_mask FROM ' . $this->makeTableName('users') . ' WHERE id = ?',
 			[ $userId ]
 		);

@@ -385,7 +384,7 @@ final class Administration extends UserManager {
 	 */
 	public function changePasswordForUserById($userId, $newPassword) {
 		$userId = (int) $userId;
-		$newPassword = self::validatePassword($newPassword);
+		$newPassword = self::validatePassword($newPassword, true);

 		$this->updatePasswordInternal(
 			$userId,
@@ -430,7 +429,7 @@ final class Administration extends UserManager {
 	private function deleteUsersByColumnValue($columnName, $columnValue) {
 		try {
 			return $this->db->delete(
-				$this->dbTablePrefix . 'users',
+				$this->makeTableNameComponents('users'),
 				[
 					$columnName => $columnValue
 				]
@@ -457,7 +456,7 @@ final class Administration extends UserManager {
 	private function modifyRolesForUserByColumnValue($columnName, $columnValue, callable $modification) {
 		try {
 			$userData = $this->db->selectRow(
-				'SELECT id, roles_mask FROM ' . $this->dbTablePrefix . 'users WHERE ' . $columnName . ' = ?',
+				'SELECT id, roles_mask FROM ' . $this->makeTableName('users') . ' WHERE ' . $columnName . ' = ?',
 				[ $columnValue ]
 			);
 		}
@@ -473,7 +472,7 @@ final class Administration extends UserManager {

 		try {
 			$this->db->exec(
-				'UPDATE ' . $this->dbTablePrefix . 'users SET roles_mask = ? WHERE id = ?',
+				'UPDATE ' . $this->makeTableName('users') . ' SET roles_mask = ? WHERE id = ?',
 				[
 					$newRolesBitmask,
 					(int) $userData['id']
@@ -549,7 +548,7 @@ final class Administration extends UserManager {
 	private function logInAsUserByColumnValue($columnName, $columnValue) {
 		try {
 			$users = $this->db->select(
-				'SELECT verified, id, email, username, status, roles_mask FROM ' . $this->dbTablePrefix . 'users WHERE ' . $columnName . ' = ? LIMIT 2 OFFSET 0',
+				'SELECT verified, id, email, username, status, roles_mask FROM ' . $this->makeTableName('users') . ' WHERE ' . $columnName . ' = ? LIMIT 2 OFFSET 0',
 				[ $columnValue ]
 			);
 		}
--- a/src/AmbiguousUsernameException.php
+++ b/src/AmbiguousUsernameException.php
@@ -0,0 +1,11 @@
+<?php
+
+/*
+ * PHP-Auth (https://github.com/delight-im/PHP-Auth)
+ * Copyright (c) delight.im (https://www.delight.im/)
+ * Licensed under the MIT License (https://opensource.org/licenses/MIT)
+ */
+
+namespace Delight\Auth;
+
+class AmbiguousUsernameException extends AuthException {}
--- a/src/AttemptCancelledException.php
+++ b/src/AttemptCancelledException.php
@@ -0,0 +1,12 @@
+<?php
+
+/*
+ * PHP-Auth (https://github.com/delight-im/PHP-Auth)
+ * Copyright (c) delight.im (https://www.delight.im/)
+ * Licensed under the MIT License (https://opensource.org/licenses/MIT)
+ */
+
+namespace Delight\Auth;
+
+/** @deprecated */
+class AttemptCancelledException extends AuthException {}
--- a/src/Auth.php
+++ b/src/Auth.php
--- a/src/AuthError.php
+++ b/src/AuthError.php
@@ -0,0 +1,12 @@
+<?php
+
+/*
+ * PHP-Auth (https://github.com/delight-im/PHP-Auth)
+ * Copyright (c) delight.im (https://www.delight.im/)
+ * Licensed under the MIT License (https://opensource.org/licenses/MIT)
+ */
+
+namespace Delight\Auth;
+
+/** Base class for all (unchecked) errors */
+class AuthError extends \Exception {}
--- a/src/AuthException.php
+++ b/src/AuthException.php
@@ -0,0 +1,12 @@
+<?php
+
+/*
+ * PHP-Auth (https://github.com/delight-im/PHP-Auth)
+ * Copyright (c) delight.im (https://www.delight.im/)
+ * Licensed under the MIT License (https://opensource.org/licenses/MIT)
+ */
+
+namespace Delight\Auth;
+
+/** Base class for all (checked) exceptions */
+class AuthException extends \Exception {}
--- a/src/ConfirmationRequestNotFound.php
+++ b/src/ConfirmationRequestNotFound.php
@@ -0,0 +1,11 @@
+<?php
+
+/*
+ * PHP-Auth (https://github.com/delight-im/PHP-Auth)
+ * Copyright (c) delight.im (https://www.delight.im/)
+ * Licensed under the MIT License (https://opensource.org/licenses/MIT)
+ */
+
+namespace Delight\Auth;
+
+class ConfirmationRequestNotFound extends AuthException {}
--- a/src/DatabaseError.php
+++ b/src/DatabaseError.php
@@ -0,0 +1,11 @@
+<?php
+
+/*
+ * PHP-Auth (https://github.com/delight-im/PHP-Auth)
+ * Copyright (c) delight.im (https://www.delight.im/)
+ * Licensed under the MIT License (https://opensource.org/licenses/MIT)
+ */
+
+namespace Delight\Auth;
+
+class DatabaseError extends AuthError {}
--- a/src/DuplicateUsernameException.php
+++ b/src/DuplicateUsernameException.php
@@ -0,0 +1,11 @@
+<?php
+
+/*
+ * PHP-Auth (https://github.com/delight-im/PHP-Auth)
+ * Copyright (c) delight.im (https://www.delight.im/)
+ * Licensed under the MIT License (https://opensource.org/licenses/MIT)
+ */
+
+namespace Delight\Auth;
+
+class DuplicateUsernameException extends AuthException {}
--- a/src/EmailAddress.php
+++ b/src/EmailAddress.php
@@ -0,0 +1,59 @@
+<?php
+
+/*
+ * PHP-Auth (https://github.com/delight-im/PHP-Auth)
+ * Copyright (c) delight.im (https://www.delight.im/)
+ * Licensed under the MIT License (https://opensource.org/licenses/MIT)
+ */
+
+namespace Delight\Auth;
+
+final class EmailAddress {
+
+	/**
+	 * Returns a masked version of the given email address that can be used for privacy reasons and data safety reasons
+	 *
+	 * @param string $emailAddress
+	 * @return string
+	 */
+	public static function mask($emailAddress) {
+		if (empty($emailAddress)) {
+			return $emailAddress;
+		}
+
+		// split the email address into local part and domain part and then split the domain part into individual segments
+		$emailAddress = \trim((string) $emailAddress);
+		$partsSeparatedByAtSymbol = \explode('@', $emailAddress);
+		$domainPart = \array_pop($partsSeparatedByAtSymbol);
+		$localPart = \implode('@', $partsSeparatedByAtSymbol);
+		$localPart = \str_replace('"', '', $localPart);
+		$localPart = \str_replace("'", "", $localPart);
+		$parts = \explode('.', $domainPart);
+		\array_unshift($parts, $localPart);
+
+		// mask the individual parts of the address one by one
+		for ($i = 0; $i < \count($parts); $i++) {
+			$parts[$i] = \trim($parts[$i]);
+
+			if (\mb_strlen($parts[$i]) >= 5) {
+				$parts[$i] = \mb_substr($parts[$i], 0, 1) . '***' . \mb_substr($parts[$i], -1);
+			}
+			elseif (\mb_strlen($parts[$i]) === 4) {
+				$parts[$i] = \mb_substr($parts[$i], 0, 1) . '**' . \mb_substr($parts[$i], -1);
+			}
+			elseif (\mb_strlen($parts[$i]) === 3 && $i <= 1) {
+				$parts[$i] = \mb_substr($parts[$i], 0, 1) . '*' . \mb_substr($parts[$i], -1);
+			}
+			elseif (\mb_strlen($parts[$i]) === 2 && $i <= 1) {
+				$parts[$i] = \mb_substr($parts[$i], 0, 1) . '*';
+			}
+			elseif (\mb_strlen($parts[$i]) === 1 && $i <= 1) {
+				$parts[$i] = '*';
+			}
+		}
+
+		// join the individual parts back together
+		return \array_shift($parts) . '@' . \implode('.', $parts);
+	}
+
+}
--- a/src/EmailNotVerifiedException.php
+++ b/src/EmailNotVerifiedException.php
@@ -0,0 +1,11 @@
+<?php
+
+/*
+ * PHP-Auth (https://github.com/delight-im/PHP-Auth)
+ * Copyright (c) delight.im (https://www.delight.im/)
+ * Licensed under the MIT License (https://opensource.org/licenses/MIT)
+ */
+
+namespace Delight\Auth;
+
+class EmailNotVerifiedException extends AuthException {}
--- a/src/EmailOrUsernameRequiredError.php
+++ b/src/EmailOrUsernameRequiredError.php
@@ -0,0 +1,11 @@
+<?php
+
+/*
+ * PHP-Auth (https://github.com/delight-im/PHP-Auth)
+ * Copyright (c) delight.im (https://www.delight.im/)
+ * Licensed under the MIT License (https://opensource.org/licenses/MIT)
+ */
+
+namespace Delight\Auth;
+
+class EmailOrUsernameRequiredError extends AuthError {}
--- a/src/Exceptions.php
+++ b/src/Exceptions.php
@@ -1,53 +0,0 @@
-<?php
-
-/*
- * PHP-Auth (https://github.com/delight-im/PHP-Auth)
- * Copyright (c) delight.im (https://www.delight.im/)
- * Licensed under the MIT License (https://opensource.org/licenses/MIT)
- */
-
-namespace Delight\Auth;
-
-class AuthException extends \Exception {}
-
-class UnknownIdException extends AuthException {}
-
-class InvalidEmailException extends AuthException {}
-
-class UnknownUsernameException extends AuthException {}
-
-class InvalidPasswordException extends AuthException {}
-
-class EmailNotVerifiedException extends AuthException {}
-
-class UserAlreadyExistsException extends AuthException {}
-
-class NotLoggedInException extends AuthException {}
-
-class InvalidSelectorTokenPairException extends AuthException {}
-
-class TokenExpiredException extends AuthException {}
-
-class TooManyRequestsException extends AuthException {}
-
-class DuplicateUsernameException extends AuthException {}
-
-class AmbiguousUsernameException extends AuthException {}
-
-class AttemptCancelledException extends AuthException {}
-
-class ResetDisabledException extends AuthException {}
-
-class ConfirmationRequestNotFound extends AuthException {}
-
-class AuthError extends \Exception {}
-
-class DatabaseError extends AuthError {}
-
-class DatabaseDriverError extends DatabaseError {}
-
-class MissingCallbackError extends AuthError {}
-
-class HeadersAlreadySentError extends AuthError {}
-
-class EmailOrUsernameRequiredError extends AuthError {}
--- a/src/HeadersAlreadySentError.php
+++ b/src/HeadersAlreadySentError.php
@@ -0,0 +1,11 @@
+<?php
+
+/*
+ * PHP-Auth (https://github.com/delight-im/PHP-Auth)
+ * Copyright (c) delight.im (https://www.delight.im/)
+ * Licensed under the MIT License (https://opensource.org/licenses/MIT)
+ */
+
+namespace Delight\Auth;
+
+class HeadersAlreadySentError extends AuthError {}
--- a/src/InvalidEmailException.php
+++ b/src/InvalidEmailException.php
@@ -0,0 +1,11 @@
+<?php
+
+/*
+ * PHP-Auth (https://github.com/delight-im/PHP-Auth)
+ * Copyright (c) delight.im (https://www.delight.im/)
+ * Licensed under the MIT License (https://opensource.org/licenses/MIT)
+ */
+
+namespace Delight\Auth;
+
+class InvalidEmailException extends AuthException {}
--- a/src/InvalidOneTimePasswordException.php
+++ b/src/InvalidOneTimePasswordException.php
@@ -0,0 +1,12 @@
+<?php
+
+/*
+ * PHP-Auth (https://github.com/delight-im/PHP-Auth)
+ * Copyright (c) delight.im (https://www.delight.im/)
+ * Licensed under the MIT License (https://opensource.org/licenses/MIT)
+ */
+
+namespace Delight\Auth;
+
+/** Exception that is thrown when a one-time password (OTP) provided by the user is not valid */
+class InvalidOneTimePasswordException extends AuthException {}
--- a/src/InvalidPasswordException.php
+++ b/src/InvalidPasswordException.php
@@ -0,0 +1,11 @@
+<?php
+
+/*
+ * PHP-Auth (https://github.com/delight-im/PHP-Auth)
+ * Copyright (c) delight.im (https://www.delight.im/)
+ * Licensed under the MIT License (https://opensource.org/licenses/MIT)
+ */
+
+namespace Delight\Auth;
+
+class InvalidPasswordException extends AuthException {}
--- a/src/InvalidPhoneNumberException.php
+++ b/src/InvalidPhoneNumberException.php
@@ -0,0 +1,11 @@
+<?php
+
+/*
+ * PHP-Auth (https://github.com/delight-im/PHP-Auth)
+ * Copyright (c) delight.im (https://www.delight.im/)
+ * Licensed under the MIT License (https://opensource.org/licenses/MIT)
+ */
+
+namespace Delight\Auth;
+
+class InvalidPhoneNumberException extends AuthException {}
--- a/src/InvalidSelectorTokenPairException.php
+++ b/src/InvalidSelectorTokenPairException.php
@@ -0,0 +1,11 @@
+<?php
+
+/*
+ * PHP-Auth (https://github.com/delight-im/PHP-Auth)
+ * Copyright (c) delight.im (https://www.delight.im/)
+ * Licensed under the MIT License (https://opensource.org/licenses/MIT)
+ */
+
+namespace Delight\Auth;
+
+class InvalidSelectorTokenPairException extends AuthException {}
--- a/src/InvalidStateError.php
+++ b/src/InvalidStateError.php
@@ -0,0 +1,11 @@
+<?php
+
+/*
+ * PHP-Auth (https://github.com/delight-im/PHP-Auth)
+ * Copyright (c) delight.im (https://www.delight.im/)
+ * Licensed under the MIT License (https://opensource.org/licenses/MIT)
+ */
+
+namespace Delight\Auth;
+
+class InvalidStateError extends AuthError {}
--- a/src/IpAddress.php
+++ b/src/IpAddress.php
@@ -0,0 +1,111 @@
+<?php
+
+/*
+ * PHP-Auth (https://github.com/delight-im/PHP-Auth)
+ * Copyright (c) delight.im (https://www.delight.im/)
+ * Licensed under the MIT License (https://opensource.org/licenses/MIT)
+ */
+
+namespace Delight\Auth;
+
+final class IpAddress {
+
+	const IPV4_LENGTH_BITS = 32;
+	const IPV4_LENGTH_BYTES = 4;
+	const IPV6_LENGTH_BITS = 128;
+	const IPV6_LENGTH_BYTES = 16;
+
+	/**
+	 * Returns a masked version of the given IP address (IPv4 or IPv6) that can be used for privacy reasons and data safety reasons
+	 *
+	 * For IPv4-mapped IPv6 addresses, only the embedded IPv4 portion is masked (like an IPv4 address) and returned as IPv6 again
+	 *
+	 * @param string $ip the IP address (IPv4 or IPv6), e.g. '192.0.2.128' or '2001:db8:be4d:fbe0:c0af:b298:1242:33e4'
+	 * @param int|null $maskBitsIpv4 (optional) the number of bits to zero out from the right in IPv4 addresses
+	 * @param int|null $maskBitsIpv6 (optional) the number of bits to zero out from the right in IPv6 addresses
+	 * @param bool|null $includePrefixLength (optional) whether to include the prefix length (e.g. '/24' at the end) or not
+	 * @return string|null
+	 */
+	public static function mask($ip, $maskBitsIpv4 = null, $maskBitsIpv6 = null, $includePrefixLength = null) {
+		$maskBitsIpv4 = isset($maskBitsIpv4) ? \max(0, \min(self::IPV4_LENGTH_BITS, (int) $maskBitsIpv4)) : 8;
+		$maskBitsIpv6 = isset($maskBitsIpv6) ? \max(0, \min(self::IPV6_LENGTH_BITS, (int) $maskBitsIpv6)) : 80;
+		$packedIp = @\inet_pton($ip);
+
+		if ($packedIp === false) {
+			return null;
+		}
+
+		$ipLengthInBytes = \strlen($packedIp);
+
+		// for IPv4 addresses
+		if ($ipLengthInBytes === self::IPV4_LENGTH_BYTES) {
+			if ($maskBitsIpv4 === 0) {
+				return $ip;
+			}
+			elseif ($maskBitsIpv4 === self::IPV4_LENGTH_BITS) {
+				return '0.0.0.0';
+			}
+
+			// unpack to a 32-bit unsigned integer in network byte order
+			$ipInt32 = unpack('N', $packedIp)[1];
+
+			// create a bitmask (like 0xFFFFFF00 to mask 8 bits or 0xFFFF0000 to mask 16 bits) using a bitwise right shift and then left shift
+			$mask = (0xFFFFFFFF >> $maskBitsIpv4) << $maskBitsIpv4;
+
+			$packedIp = \pack('N', $ipInt32 & $mask);
+
+			$prefixLength = self::IPV4_LENGTH_BITS - $maskBitsIpv4;
+		}
+		// for IPv6 addresses
+		elseif ($ipLengthInBytes === self::IPV6_LENGTH_BYTES) {
+			// if the IP address is an IPv4-mapped IPv6 address
+			if (\substr($packedIp, 0, 12) === "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff") {
+				// the last 4 bytes are the IPv4 address, so mask bits as per IPv4 option
+				$maskBitsIpv6 = $maskBitsIpv4;
+			}
+
+			if ($maskBitsIpv6 === 0) {
+				return $ip;
+			}
+			elseif ($maskBitsIpv6 === self::IPV6_LENGTH_BITS) {
+				return '::';
+			}
+
+			$maskBytesIpv6 = (int) \ceil($maskBitsIpv6 / 8);
+			$maskBitsInFirstByteIpv6 = $maskBitsIpv6 % 8;
+
+			// work byte by byte for IPv6 due to lack of 128-bit integers
+
+			for ($i = 0; $i < $maskBytesIpv6; $i++) {
+				// start from the rightmost byte
+				$byteIndex = $ipLengthInBytes - $i - 1;
+
+				// if we are at the first byte and it should only be masked partially (i.e. masking 1-7 bits there)
+				if ($i === ($maskBytesIpv6 - 1) && $maskBitsInFirstByteIpv6 !== 0) {
+					$firstByteMask = (0xFF >> $maskBitsInFirstByteIpv6) << $maskBitsInFirstByteIpv6;
+					$packedIp[$byteIndex] = \chr(\ord($packedIp[$byteIndex]) & $firstByteMask);
+				}
+				// when masking a full first byte or any byte after the first byte
+				else {
+					 $packedIp[$byteIndex] = "\x00";
+				}
+			}
+
+			$prefixLength = self::IPV6_LENGTH_BITS - $maskBitsIpv6;
+		}
+		// for addresses with invalid lengths in bytes
+		else {
+			return null;
+		}
+
+		$ip = \inet_ntop($packedIp);
+
+		if ($includePrefixLength) {
+			return $ip . '/' . $prefixLength;
+		}
+		else {
+			return $ip;
+		}
+	}
+
+}
--- a/src/MissingCallbackError.php
+++ b/src/MissingCallbackError.php
@@ -0,0 +1,11 @@
+<?php
+
+/*
+ * PHP-Auth (https://github.com/delight-im/PHP-Auth)
+ * Copyright (c) delight.im (https://www.delight.im/)
+ * Licensed under the MIT License (https://opensource.org/licenses/MIT)
+ */
+
+namespace Delight\Auth;
+
+class MissingCallbackError extends AuthError {}
--- a/src/NotLoggedInException.php
+++ b/src/NotLoggedInException.php
@@ -0,0 +1,11 @@
+<?php
+
+/*
+ * PHP-Auth (https://github.com/delight-im/PHP-Auth)
+ * Copyright (c) delight.im (https://www.delight.im/)
+ * Licensed under the MIT License (https://opensource.org/licenses/MIT)
+ */
+
+namespace Delight\Auth;
+
+class NotLoggedInException extends AuthException {}
--- a/src/PasswordHash.php
+++ b/src/PasswordHash.php
@@ -0,0 +1,96 @@
+<?php
+
+/*
+ * PHP-Auth (https://github.com/delight-im/PHP-Auth)
+ * Copyright (c) delight.im (https://www.delight.im/)
+ * Licensed under the MIT License (https://opensource.org/licenses/MIT)
+ */
+
+namespace Delight\Auth;
+
+final class PasswordHash {
+
+	const HASH_ALGORITHM_IDENTIFIER = \PASSWORD_DEFAULT;
+	const PEPPER_HMAC_SHA_512_PREHASH = 'bec95beffb3afd078df7cbfd4c4617ba214ac4641a157c1ca64106e7544c9fb4cef6e99b0a8f0b63e96328c09943ce96b9b8899ff54fa7ea57b622675442dbbf';
+	const PREFIX_BCRYPT_WITH_HMAC_SHA_512_PREHASH = '$pa01';
+	const PREFIX_LENGTH = 5;
+
+	/**
+	 * Creates a computationally expensive hash from a password
+	 *
+	 * @param string $passwordText
+	 * @return string|bool
+	 */
+	public static function from($passwordText) {
+		// if the bcrypt algorithm will be used for computationally expensive hashing
+		if (self::HASH_ALGORITHM_IDENTIFIER === \PASSWORD_BCRYPT || self::HASH_ALGORITHM_IDENTIFIER === null) {
+			// pre-hash the password to support passwords with more than 72 bytes (i.e. more than 18-72 characters) and passwords containing null bytes
+			$passwordText = self::prehash($passwordText);
+			// use 72 out of the ~88 bytes from the prehash in bcrypt later and denote this in a custom hash prefix
+			$outputPrefix = self::PREFIX_BCRYPT_WITH_HMAC_SHA_512_PREHASH;
+		}
+		else {
+			$outputPrefix = '';
+		}
+
+		return $outputPrefix . \password_hash($passwordText, self::HASH_ALGORITHM_IDENTIFIER);
+	}
+
+	/**
+	 * Verifies whether a password matches a computationally expensive hash
+	 *
+	 * @param string $passwordText
+	 * @param string $expectedHash
+	 * @return bool
+	 */
+	public static function verify($passwordText, $expectedHash) {
+		// if the expected hash has a custom prefix that indicates a prehash has been used
+		if (\substr($expectedHash, 0, self::PREFIX_LENGTH) === self::PREFIX_BCRYPT_WITH_HMAC_SHA_512_PREHASH) {
+			// pre-hash the password here as well to allow for a possible match
+			$passwordText = self::prehash($passwordText);
+			// and drop the custom prefix from the expected hash
+			$expectedHash = \substr($expectedHash, self::PREFIX_LENGTH);
+		}
+
+		return \password_verify($passwordText, $expectedHash);
+	}
+
+	/**
+	 * Checks whether a computationally expensive hash needs to be updated to match a desired algorithm and set of options
+	 *
+	 * @param string $existingHash
+	 * @return bool
+	 */
+	public static function needsRehash($existingHash) {
+		// if the existing hash has a custom prefix indicating that a prehash has been used
+		if (\substr($existingHash, 0, self::PREFIX_LENGTH) === self::PREFIX_BCRYPT_WITH_HMAC_SHA_512_PREHASH) {
+			// drop that custom prefix from the existing hash
+			$existingHash = \substr($existingHash, self::PREFIX_LENGTH);
+		}
+		/*// if the existing hash has no custom prefix denoting a prehash
+		else {
+			// if the existing hash used the bcrypt algorithm
+			if (\preg_match('/^\$2[abxy]?\$/', $existingHash) === 1) {
+				// the prehash needs to be applied
+				return true;
+			}
+		}*/
+
+		return \password_needs_rehash($existingHash, self::HASH_ALGORITHM_IDENTIFIER);
+	}
+
+	private static function prehash($passwordText) {
+		$pepperBinary = \hex2bin(self::PEPPER_HMAC_SHA_512_PREHASH);
+
+		// do not just use SHA-512 but apply an HMAC with a (semi-public) pepper to avoid breach correlation or "password shucking"
+		$hmacBinary = \hash_hmac('sha512', $passwordText, $pepperBinary, true);
+
+		if (empty($hmacBinary)) {
+			throw new AuthError('Could not generate HMAC');
+		}
+
+		// encode the prehash using Base64 to avoid passing null bytes to the main hash function later (which could truncate the input)
+		return \base64_encode($hmacBinary);
+	}
+
+}
--- a/src/PhoneNumber.php
+++ b/src/PhoneNumber.php
@@ -0,0 +1,67 @@
+<?php
+
+/*
+ * PHP-Auth (https://github.com/delight-im/PHP-Auth)
+ * Copyright (c) delight.im (https://www.delight.im/)
+ * Licensed under the MIT License (https://opensource.org/licenses/MIT)
+ */
+
+namespace Delight\Auth;
+
+final class PhoneNumber {
+
+	/**
+	 * Returns a masked version of the given phone number that can be used for privacy reasons and data safety reasons
+	 *
+	 * @param string $phoneNumber
+	 * @return string
+	 */
+	public static function mask($phoneNumber) {
+		if (empty($phoneNumber)) {
+			return '';
+		}
+
+		$phoneNumber = \preg_replace('/[^0-9A-Za-z+]+/', '', $phoneNumber);
+
+		if (empty($phoneNumber)) {
+			return '';
+		}
+
+		$hasLeadingPlus = \mb_substr($phoneNumber, 0, 1) === '+';
+
+		if ($hasLeadingPlus) {
+			$phoneNumber = \mb_substr($phoneNumber, 1);
+		}
+
+		$significantCharsLength = \mb_strlen($phoneNumber);
+
+		if ($significantCharsLength >= 7) {
+			$phoneNumber = \mb_substr($phoneNumber, 0, 2) . '***' . \mb_substr($phoneNumber, -2);
+		}
+		elseif ($significantCharsLength === 6) {
+			$phoneNumber = \mb_substr($phoneNumber, 0, 2) . '**' . \mb_substr($phoneNumber, -2);
+		}
+		elseif ($significantCharsLength === 5) {
+			$phoneNumber = \mb_substr($phoneNumber, 0, 1) . '**' . \mb_substr($phoneNumber, -2);
+		}
+		elseif ($significantCharsLength === 4) {
+			$phoneNumber = \mb_substr($phoneNumber, 0, 1) . '**' . \mb_substr($phoneNumber, -1);
+		}
+		elseif ($significantCharsLength === 3) {
+			$phoneNumber = '**' . \mb_substr($phoneNumber, -1);
+		}
+		elseif ($significantCharsLength === 2) {
+			$phoneNumber = '**';
+		}
+		else {
+			$phoneNumber = '*';
+		}
+
+		if ($hasLeadingPlus) {
+			$phoneNumber = '+' . $phoneNumber;
+		}
+
+		return $phoneNumber;
+	}
+
+}
--- a/src/ResetDisabledException.php
+++ b/src/ResetDisabledException.php
@@ -0,0 +1,11 @@
+<?php
+
+/*
+ * PHP-Auth (https://github.com/delight-im/PHP-Auth)
+ * Copyright (c) delight.im (https://www.delight.im/)
+ * Licensed under the MIT License (https://opensource.org/licenses/MIT)
+ */
+
+namespace Delight\Auth;
+
+class ResetDisabledException extends AuthException {}
--- a/src/SecondFactorRequiredException.php
+++ b/src/SecondFactorRequiredException.php
@@ -0,0 +1,74 @@
+<?php
+
+/*
+ * PHP-Auth (https://github.com/delight-im/PHP-Auth)
+ * Copyright (c) delight.im (https://www.delight.im/)
+ * Licensed under the MIT License (https://opensource.org/licenses/MIT)
+ */
+
+namespace Delight\Auth;
+
+/** Exception that is thrown when a first factor has been successfully provided for authentification but a second one is still required */
+class SecondFactorRequiredException extends AuthException {
+
+	protected $totp;
+	protected $smsRecipient;
+	protected $smsRecipientMasked;
+	protected $smsOtpValue;
+	protected $emailRecipient;
+	protected $emailRecipientMasked;
+	protected $emailOtpValue;
+
+	public function hasTotpOption() {
+		return !empty($this->totp);
+	}
+
+	public function hasSmsOption() {
+		return !empty($this->smsRecipient) && !empty($this->smsOtpValue);
+	}
+
+	public function getSmsRecipient() {
+		return $this->smsRecipient;
+	}
+
+	public function getSmsRecipientMasked() {
+		return $this->smsRecipientMasked;
+	}
+
+	public function getSmsOtpValue() {
+		return $this->smsOtpValue;
+	}
+
+	public function hasEmailOption() {
+		return !empty($this->emailRecipient) && !empty($this->emailOtpValue);
+	}
+
+	public function getEmailRecipient() {
+		return $this->emailRecipient;
+	}
+
+	public function getEmailRecipientMasked() {
+		return $this->emailRecipientMasked;
+	}
+
+	public function getEmailOtpValue() {
+		return $this->emailOtpValue;
+	}
+
+	public function addTotpOption() {
+		$this->totp = true;
+	}
+
+	public function addSmsOption($otpValue, $recipient, $recipientMasked = null) {
+		$this->smsOtpValue = !empty($otpValue) ? (string) $otpValue : null;
+		$this->smsRecipient = !empty($recipient) ? (string) $recipient : null;
+		$this->smsRecipientMasked = !empty($recipientMasked) ? (string) $recipientMasked : null;
+	}
+
+	public function addEmailOption($otpValue, $recipient, $recipientMasked = null) {
+		$this->emailOtpValue = !empty($otpValue) ? (string) $otpValue : null;
+		$this->emailRecipient = !empty($recipient) ? (string) $recipient : null;
+		$this->emailRecipientMasked = !empty($recipientMasked) ? (string) $recipientMasked : null;
+	}
+
+}
--- a/src/TokenExpiredException.php
+++ b/src/TokenExpiredException.php
@@ -0,0 +1,11 @@
+<?php
+
+/*
+ * PHP-Auth (https://github.com/delight-im/PHP-Auth)
+ * Copyright (c) delight.im (https://www.delight.im/)
+ * Licensed under the MIT License (https://opensource.org/licenses/MIT)
+ */
+
+namespace Delight\Auth;
+
+class TokenExpiredException extends AuthException {}
--- a/src/TokenHash.php
+++ b/src/TokenHash.php
@@ -0,0 +1,46 @@
+<?php
+
+/*
+ * PHP-Auth (https://github.com/delight-im/PHP-Auth)
+ * Copyright (c) delight.im (https://www.delight.im/)
+ * Licensed under the MIT License (https://opensource.org/licenses/MIT)
+ */
+
+namespace Delight\Auth;
+
+final class TokenHash {
+
+	const HASH_ALGORITHM_IDENTIFIER = \PASSWORD_DEFAULT;
+
+	/**
+	 * Creates a computationally expensive hash from a token
+	 *
+	 * @param string $tokenText
+	 * @return string|bool
+	 */
+	public static function from($tokenText) {
+		return \password_hash($tokenText, self::HASH_ALGORITHM_IDENTIFIER);
+	}
+
+	/**
+	 * Verifies whether a token matches a computationally expensive hash
+	 *
+	 * @param string $tokenText
+	 * @param string $expectedHash
+	 * @return bool
+	 */
+	public static function verify($tokenText, $expectedHash) {
+		return \password_verify($tokenText, $expectedHash);
+	}
+
+	/**
+	 * Checks whether a computationally expensive hash needs to be updated to match a desired algorithm and set of options
+	 *
+	 * @param string $existingHash
+	 * @return bool
+	 */
+	public static function needsRehash($existingHash) {
+		return \password_needs_rehash($existingHash, self::HASH_ALGORITHM_IDENTIFIER);
+	}
+
+}
--- a/src/TooManyRequestsException.php
+++ b/src/TooManyRequestsException.php
@@ -0,0 +1,11 @@
+<?php
+
+/*
+ * PHP-Auth (https://github.com/delight-im/PHP-Auth)
+ * Copyright (c) delight.im (https://www.delight.im/)
+ * Licensed under the MIT License (https://opensource.org/licenses/MIT)
+ */
+
+namespace Delight\Auth;
+
+class TooManyRequestsException extends AuthException {}
--- a/src/TwoFactorMechanismAlreadyEnabledException.php
+++ b/src/TwoFactorMechanismAlreadyEnabledException.php
@@ -0,0 +1,12 @@
+<?php
+
+/*
+ * PHP-Auth (https://github.com/delight-im/PHP-Auth)
+ * Copyright (c) delight.im (https://www.delight.im/)
+ * Licensed under the MIT License (https://opensource.org/licenses/MIT)
+ */
+
+namespace Delight\Auth;
+
+/** Exception that is thrown when a given mechanism for two-factor authentification has already been enabled */
+class TwoFactorMechanismAlreadyEnabledException extends AuthException {}
--- a/src/TwoFactorMechanismNotInitializedException.php
+++ b/src/TwoFactorMechanismNotInitializedException.php
@@ -0,0 +1,12 @@
+<?php
+
+/*
+ * PHP-Auth (https://github.com/delight-im/PHP-Auth)
+ * Copyright (c) delight.im (https://www.delight.im/)
+ * Licensed under the MIT License (https://opensource.org/licenses/MIT)
+ */
+
+namespace Delight\Auth;
+
+/** Exception that is thrown when a given mechanism for two-factor authentification has not been initialized yet or the prior initialization is not valid anymore */
+class TwoFactorMechanismNotInitializedException extends AuthException {}
--- a/src/UnknownIdException.php
+++ b/src/UnknownIdException.php
@@ -0,0 +1,11 @@
+<?php
+
+/*
+ * PHP-Auth (https://github.com/delight-im/PHP-Auth)
+ * Copyright (c) delight.im (https://www.delight.im/)
+ * Licensed under the MIT License (https://opensource.org/licenses/MIT)
+ */
+
+namespace Delight\Auth;
+
+class UnknownIdException extends AuthException {}
--- a/src/UnknownUsernameException.php
+++ b/src/UnknownUsernameException.php
@@ -0,0 +1,11 @@
+<?php
+
+/*
+ * PHP-Auth (https://github.com/delight-im/PHP-Auth)
+ * Copyright (c) delight.im (https://www.delight.im/)
+ * Licensed under the MIT License (https://opensource.org/licenses/MIT)
+ */
+
+namespace Delight\Auth;
+
+class UnknownUsernameException extends AuthException {}
--- a/src/UserAlreadyExistsException.php
+++ b/src/UserAlreadyExistsException.php
@@ -0,0 +1,11 @@
+<?php
+
+/*
+ * PHP-Auth (https://github.com/delight-im/PHP-Auth)
+ * Copyright (c) delight.im (https://www.delight.im/)
+ * Licensed under the MIT License (https://opensource.org/licenses/MIT)
+ */
+
+namespace Delight\Auth;
+
+class UserAlreadyExistsException extends AuthException {}
--- a/src/UserManager.php
+++ b/src/UserManager.php
@@ -15,8 +15,6 @@ use Delight\Db\PdoDsn;
 use Delight\Db\Throwable\Error;
 use Delight\Db\Throwable\IntegrityConstraintViolationException;

-require_once __DIR__ . '/Exceptions.php';
-
 /**
 * Abstract base class for components implementing user management
 *
@@ -42,9 +40,17 @@ abstract class UserManager {
 	const SESSION_FIELD_LAST_RESYNC = 'auth_last_resync';
 	/** @var string session field for the counter that keeps track of forced logouts that need to be performed in the current session */
 	const SESSION_FIELD_FORCE_LOGOUT = 'auth_force_logout';
+	/** @var string session field for the UNIX timestamp in seconds until which the first factor of authentication is considered to be completed and valid */
+	const SESSION_FIELD_AWAITING_2FA_UNTIL = 'auth_awaiting_2fa_until';
+	/** @var string session field for the ID of the user for whom the first factor of authentication has already been completed */
+	const SESSION_FIELD_AWAITING_2FA_USER_ID = 'auth_awaiting_2fa_user_id';
+	/** @var string session field for the desired "remember me" duration that the user originally requested when attempting to sign in */
+	const SESSION_FIELD_AWAITING_2FA_REMEMBER_DURATION = 'auth_awaiting_2fa_remember_duration';

 	/** @var PdoDatabase the database connection to operate on */
 	protected $db;
+	/** @var string|null the schema name for all database tables used by this component */
+	protected $dbSchema;
 	/** @var string the prefix for the names of all database tables used by this component */
 	protected $dbTablePrefix;

@@ -70,8 +76,9 @@ abstract class UserManager {
 	/**
 	 * @param PdoDatabase|PdoDsn|\PDO $databaseConnection the database connection to operate on
 	 * @param string|null $dbTablePrefix (optional) the prefix for the names of all database tables used by this component
+	 * @param string|null $dbSchema (optional) the schema name for all database tables used by this component
 	 */
-	protected function __construct($databaseConnection, $dbTablePrefix = null) {
+	protected function __construct($databaseConnection, $dbTablePrefix = null, $dbSchema = null) {
 		if ($databaseConnection instanceof PdoDatabase) {
 			$this->db = $databaseConnection;
 		}
@@ -87,6 +94,7 @@ abstract class UserManager {
 			throw new \InvalidArgumentException('The database connection must be an instance of either `PdoDatabase`, `PdoDsn` or `PDO`');
 		}

+		$this->dbSchema = $dbSchema !== null ? (string) $dbSchema : null;
 		$this->dbTablePrefix = (string) $dbTablePrefix;
 	}

@@ -124,7 +132,7 @@ abstract class UserManager {
 		\ignore_user_abort(true);

 		$email = self::validateEmailAddress($email);
-		$password = self::validatePassword($password);
+		$password = self::validatePassword($password, true);

 		$username = isset($username) ? \trim($username) : null;

@@ -140,7 +148,7 @@ abstract class UserManager {
 			if ($username !== null) {
 				// count the number of users who do already have that specified username
 				$occurrencesOfUsername = $this->db->selectValue(
-					'SELECT COUNT(*) FROM ' . $this->dbTablePrefix . 'users WHERE username = ?',
+					'SELECT COUNT(*) FROM ' . $this->makeTableName('users') . ' WHERE username = ?',
 					[ $username ]
 				);

@@ -152,12 +160,12 @@ abstract class UserManager {
 			}
 		}

-		$password = \password_hash($password, \PASSWORD_DEFAULT);
+		$password = PasswordHash::from($password);
 		$verified = \is_callable($callback) ? 0 : 1;

 		try {
 			$this->db->insert(
-				$this->dbTablePrefix . 'users',
+				$this->makeTableNameComponents('users'),
 				[
 					'email' => $email,
 					'password' => $password,
@@ -193,11 +201,11 @@ abstract class UserManager {
 	 * @throws AuthError if an internal problem occurred (do *not* catch)
 	 */
 	protected function updatePasswordInternal($userId, $newPassword) {
-		$newPassword = \password_hash($newPassword, \PASSWORD_DEFAULT);
+		$newPassword = PasswordHash::from($newPassword);

 		try {
 			$affected = $this->db->update(
-				$this->dbTablePrefix . 'users',
+				$this->makeTableNameComponents('users'),
 				[ 'password' => $newPassword ],
 				[ 'id' => $userId ]
 			);
@@ -239,6 +247,9 @@ abstract class UserManager {
 		$_SESSION[self::SESSION_FIELD_FORCE_LOGOUT] = (int) $forceLogout;
 		$_SESSION[self::SESSION_FIELD_REMEMBERED] = $remembered;
 		$_SESSION[self::SESSION_FIELD_LAST_RESYNC] = \time();
+		$_SESSION[self::SESSION_FIELD_AWAITING_2FA_UNTIL] = null;
+		$_SESSION[self::SESSION_FIELD_AWAITING_2FA_USER_ID] = null;
+		$_SESSION[self::SESSION_FIELD_AWAITING_2FA_REMEMBER_DURATION] = null;
 	}

 	/**
@@ -258,7 +269,7 @@ abstract class UserManager {
 			$projection = \implode(', ', $requestedColumns);

 			$users = $this->db->select(
-				'SELECT ' . $projection . ' FROM ' . $this->dbTablePrefix . 'users WHERE username = ? LIMIT 2 OFFSET 0',
+				'SELECT ' . $projection . ' FROM ' . $this->makeTableName('users') . ' WHERE username = ? LIMIT 2 OFFSET 0',
 				[ $username ]
 			);
 		}
@@ -304,20 +315,28 @@ abstract class UserManager {
 	 * Validates a password
 	 *
 	 * @param string $password the password to validate
+	 * @param bool|null $isNewPassword (optional) whether the password is a new password that the user wants to use
 	 * @return string the sanitized password
 	 * @throws InvalidPasswordException if the password has been invalid
 	 */
-	protected static function validatePassword($password) {
+	protected static function validatePassword($password, $isNewPassword = null) {
 		if (empty($password)) {
 			throw new InvalidPasswordException();
 		}

 		$password = \trim($password);
+		$isNewPassword = ($isNewPassword !== null) ? (bool) $isNewPassword : false;

 		if (\strlen($password) < 1) {
 			throw new InvalidPasswordException();
 		}

+		if ($isNewPassword) {
+			if (\strlen($password) > 2048) {
+				throw new InvalidPasswordException();
+			}
+		}
+
 		return $password;
 	}

@@ -340,12 +359,12 @@ abstract class UserManager {
 	protected function createConfirmationRequest($userId, $email, callable $callback) {
 		$selector = self::createRandomString(16);
 		$token = self::createRandomString(16);
-		$tokenHashed = \password_hash($token, \PASSWORD_DEFAULT);
+		$tokenHashed = TokenHash::from($token);
 		$expires = \time() + 60 * 60 * 24;

 		try {
 			$this->db->insert(
-				$this->dbTablePrefix . 'users_confirmations',
+				$this->makeTableNameComponents('users_confirmations'),
 				[
 					'user_id' => (int) $userId,
 					'email' => $email,
@@ -385,7 +404,7 @@ abstract class UserManager {

 		try {
 			$this->db->delete(
-				$this->dbTablePrefix . 'users_remembered',
+				$this->makeTableNameComponents('users_remembered'),
 				$whereMappings
 			);
 		}
@@ -403,9 +422,50 @@ abstract class UserManager {
 	protected function forceLogoutForUserById($userId) {
 		$this->deleteRememberDirectiveForUserById($userId);
 		$this->db->exec(
-			'UPDATE ' . $this->dbTablePrefix . 'users SET force_logout = force_logout + 1 WHERE id = ?',
+			'UPDATE ' . $this->makeTableName('users') . ' SET force_logout = force_logout + 1 WHERE id = ?',
 			[ $userId ]
 		);
 	}

+	/**
+	 * Builds a (qualified) full table name from an optional qualifier, an optional prefix, and the table name itself
+	 *
+	 * The optional qualifier may be a database name or a schema name, for example
+	 *
+	 * @param string $name the name of the table
+	 * @return string[] the components of the (qualified) full name of the table
+	 */
+	protected function makeTableNameComponents($name) {
+		$components = [];
+
+		if (!empty($this->dbSchema)) {
+			$components[] = $this->dbSchema;
+		}
+
+		if (!empty($name)) {
+			if (!empty($this->dbTablePrefix)) {
+				$components[] = $this->dbTablePrefix . $name;
+			}
+			else {
+				$components[] = $name;
+			}
+		}
+
+		return $components;
+	}
+
+	/**
+	 * Builds a (qualified) full table name from an optional qualifier, an optional prefix, and the table name itself
+	 *
+	 * The optional qualifier may be a database name or a schema name, for example
+	 *
+	 * @param string $name the name of the table
+	 * @return string the (qualified) full name of the table
+	 */
+	protected function makeTableName($name) {
+		$components = $this->makeTableNameComponents($name);
+
+		return \implode('.', $components);
+	}
+
 }
--- a/tests/index.php
+++ b/tests/index.php
@@ -35,6 +35,14 @@ $db = new \PDO('mysql:dbname=php_auth;host=127.0.0.1;charset=utf8mb4', 'root', '

 $auth = new \Delight\Auth\Auth($db);

+echo '<!DOCTYPE html>';
+echo '<html>';
+echo '<head>';
+echo '<meta charset="utf-8">';
+echo '<title></title>';
+echo '</head>';
+echo '<body>';
+
 $result = \processRequestData($auth);

 \showGeneralForm();
@@ -88,6 +96,37 @@ function processRequestData(\Delight\Auth\Auth $auth) {
 				catch (\Delight\Auth\EmailNotVerifiedException $e) {
 					return 'email address not verified';
 				}
+				catch (\Delight\Auth\SecondFactorRequiredException $e) {
+					$secondFactorOptions = [];
+
+					if ($e->hasTotpOption()) {
+						$secondFactorOptions[] = 'TOTP';
+					}
+					if ($e->hasSmsOption()) {
+						$secondFactorOptions[] = 'SMS (' . $e->getSmsRecipient() . ' / ' . $e->getSmsRecipientMasked() . ') with ' . $e->getSmsOtpValue();
+					}
+					if ($e->hasEmailOption()) {
+						$secondFactorOptions[] = 'email (' . $e->getEmailRecipient() . ' / ' . $e->getEmailRecipientMasked() . ') with ' . $e->getEmailOtpValue();
+					}
+
+					return 'second factor required: ' . \implode(' / ', $secondFactorOptions);
+				}
+				catch (\Delight\Auth\TooManyRequestsException $e) {
+					return 'too many requests';
+				}
+			}
+			else if ($_POST['action'] === 'provideOneTimePasswordAsSecondFactor') {
+				try {
+					$auth->provideOneTimePasswordAsSecondFactor($_POST['otpValue']);
+
+					return 'ok';
+				}
+				catch (\Delight\Auth\InvalidOneTimePasswordException $e) {
+					return 'invalid OTP';
+				}
+				catch (\Delight\Auth\NotLoggedInException $e) {
+					return 'first factor not completed';
+				}
 				catch (\Delight\Auth\TooManyRequestsException $e) {
 					return 'too many requests';
 				}
@@ -167,6 +206,21 @@ function processRequestData(\Delight\Auth\Auth $auth) {
 				catch (\Delight\Auth\UserAlreadyExistsException $e) {
 					return 'email address already exists';
 				}
+				catch (\Delight\Auth\SecondFactorRequiredException $e) {
+					$secondFactorOptions = [];
+
+					if ($e->hasTotpOption()) {
+						$secondFactorOptions[] = 'TOTP';
+					}
+					if ($e->hasSmsOption()) {
+						$secondFactorOptions[] = 'SMS (' . $e->getSmsRecipient() . ' / ' . $e->getSmsRecipientMasked() . ') with ' . $e->getSmsOtpValue();
+					}
+					if ($e->hasEmailOption()) {
+						$secondFactorOptions[] = 'email (' . $e->getEmailRecipient() . ' / ' . $e->getEmailRecipientMasked() . ') with ' . $e->getEmailOtpValue();
+					}
+
+					return 'second factor required: ' . \implode(' / ', $secondFactorOptions);
+				}
 				catch (\Delight\Auth\TooManyRequestsException $e) {
 					return 'too many requests';
 				}
@@ -254,9 +308,21 @@ function processRequestData(\Delight\Auth\Auth $auth) {
 			}
 			else if ($_POST['action'] === 'resetPassword') {
 				try {
-					$auth->resetPassword($_POST['selector'], $_POST['token'], $_POST['password']);
+					if (isset($_POST['login']) && $_POST['login'] > 0) {
+						if ($_POST['login'] == 2) {
+							// keep logged in for one year
+							$rememberDuration = (int) (60 * 60 * 24 * 365.25);
+						}
+						else {
+							// do not keep logged in after session ends
+							$rememberDuration = null;
+						}

-					return 'ok';
+						return $auth->resetPasswordAndSignIn($_POST['selector'], $_POST['token'], $_POST['password'], $rememberDuration);
+					}
+					else {
+						return $auth->resetPassword($_POST['selector'], $_POST['token'], $_POST['password']);
+					}
 				}
 				catch (\Delight\Auth\InvalidSelectorTokenPairException $e) {
 					return 'invalid token';
@@ -270,6 +336,21 @@ function processRequestData(\Delight\Auth\Auth $auth) {
 				catch (\Delight\Auth\InvalidPasswordException $e) {
 					return 'invalid password';
 				}
+				catch (\Delight\Auth\SecondFactorRequiredException $e) {
+					$secondFactorOptions = [];
+
+					if ($e->hasTotpOption()) {
+						$secondFactorOptions[] = 'TOTP';
+					}
+					if ($e->hasSmsOption()) {
+						$secondFactorOptions[] = 'SMS (' . $e->getSmsRecipient() . ' / ' . $e->getSmsRecipientMasked() . ') with ' . $e->getSmsOtpValue();
+					}
+					if ($e->hasEmailOption()) {
+						$secondFactorOptions[] = 'email (' . $e->getEmailRecipient() . ' / ' . $e->getEmailRecipientMasked() . ') with ' . $e->getEmailOtpValue();
+					}
+
+					return 'second factor required: ' . \implode(' / ', $secondFactorOptions);
+				}
 				catch (\Delight\Auth\TooManyRequestsException $e) {
 					return 'too many requests';
 				}
@@ -293,6 +374,175 @@ function processRequestData(\Delight\Auth\Auth $auth) {
 					return 'too many requests';
 				}
 			}
+			else if ($_POST['action'] === 'prepareTwoFactorViaTotp') {
+				try {
+					$keyUriAndSecret = $auth->prepareTwoFactorViaTotp($_POST['serviceName']);
+
+					return \implode(' | ', $keyUriAndSecret);
+				}
+				catch (\Delight\Auth\TwoFactorMechanismAlreadyEnabledException $e) {
+					return 'already enabled';
+				}
+				catch (\Delight\Auth\NotLoggedInException $e) {
+					return 'not logged in';
+				}
+				catch (\Delight\Auth\TooManyRequestsException $e) {
+					return 'too many requests';
+				}
+			}
+			else if ($_POST['action'] === 'prepareTwoFactorViaSms') {
+				try {
+					$phoneNumberAndOtpValue = $auth->prepareTwoFactorViaSms($_POST['phoneNumber']);
+
+					return $phoneNumberAndOtpValue[1] . ' -> ' . $phoneNumberAndOtpValue[0];
+				}
+				catch (\Delight\Auth\InvalidPhoneNumberException $e) {
+					return 'invalid phone number';
+				}
+				catch (\Delight\Auth\TwoFactorMechanismAlreadyEnabledException $e) {
+					return 'already enabled';
+				}
+				catch (\Delight\Auth\NotLoggedInException $e) {
+					return 'not logged in';
+				}
+				catch (\Delight\Auth\TooManyRequestsException $e) {
+					return 'too many requests';
+				}
+			}
+			else if ($_POST['action'] === 'prepareTwoFactorViaEmail') {
+				try {
+					$emailAddressAndOtpValue = $auth->prepareTwoFactorViaEmail();
+
+					return $emailAddressAndOtpValue[1] . ' -> ' . $emailAddressAndOtpValue[0];
+				}
+				catch (\Delight\Auth\TwoFactorMechanismAlreadyEnabledException $e) {
+					return 'already enabled';
+				}
+				catch (\Delight\Auth\NotLoggedInException $e) {
+					return 'not logged in';
+				}
+				catch (\Delight\Auth\TooManyRequestsException $e) {
+					return 'too many requests';
+				}
+			}
+			else if ($_POST['action'] === 'enableTwoFactorViaTotp') {
+				try {
+					$recoveryCodes = $auth->enableTwoFactorViaTotp($_POST['otpValue']);
+
+					return \implode(' | ', $recoveryCodes);
+				}
+				catch (\Delight\Auth\InvalidOneTimePasswordException $e) {
+					return 'invalid OTP';
+				}
+				catch (\Delight\Auth\TwoFactorMechanismNotInitializedException $e) {
+					return 'not initialized';
+				}
+				catch (\Delight\Auth\TwoFactorMechanismAlreadyEnabledException $e) {
+					return 'already enabled';
+				}
+				catch (\Delight\Auth\NotLoggedInException $e) {
+					return 'not logged in';
+				}
+				catch (\Delight\Auth\TooManyRequestsException $e) {
+					return 'too many requests';
+				}
+			}
+			else if ($_POST['action'] === 'enableTwoFactorViaSms') {
+				try {
+					$recoveryCodes = $auth->enableTwoFactorViaSms($_POST['otpValue']);
+
+					return \implode(' | ', $recoveryCodes);
+				}
+				catch (\Delight\Auth\InvalidOneTimePasswordException $e) {
+					return 'invalid OTP';
+				}
+				catch (\Delight\Auth\TwoFactorMechanismNotInitializedException $e) {
+					return 'not initialized';
+				}
+				catch (\Delight\Auth\TwoFactorMechanismAlreadyEnabledException $e) {
+					return 'already enabled';
+				}
+				catch (\Delight\Auth\NotLoggedInException $e) {
+					return 'not logged in';
+				}
+				catch (\Delight\Auth\TooManyRequestsException $e) {
+					return 'too many requests';
+				}
+			}
+			else if ($_POST['action'] === 'enableTwoFactorViaEmail') {
+				try {
+					$recoveryCodes = $auth->enableTwoFactorViaEmail($_POST['otpValue']);
+
+					return \implode(' | ', $recoveryCodes);
+				}
+				catch (\Delight\Auth\InvalidOneTimePasswordException $e) {
+					return 'invalid OTP';
+				}
+				catch (\Delight\Auth\TwoFactorMechanismNotInitializedException $e) {
+					return 'not initialized';
+				}
+				catch (\Delight\Auth\TwoFactorMechanismAlreadyEnabledException $e) {
+					return 'already enabled';
+				}
+				catch (\Delight\Auth\NotLoggedInException $e) {
+					return 'not logged in';
+				}
+				catch (\Delight\Auth\TooManyRequestsException $e) {
+					return 'too many requests';
+				}
+			}
+			else if ($_POST['action'] === 'disableTwoFactorViaTotp') {
+				try {
+					$auth->disableTwoFactorViaTotp();
+
+					return 'ok';
+				}
+				catch (\Delight\Auth\NotLoggedInException $e) {
+					return 'not logged in';
+				}
+				catch (\Delight\Auth\TooManyRequestsException $e) {
+					return 'too many requests';
+				}
+			}
+			else if ($_POST['action'] === 'disableTwoFactorViaSms') {
+				try {
+					$auth->disableTwoFactorViaSms();
+
+					return 'ok';
+				}
+				catch (\Delight\Auth\NotLoggedInException $e) {
+					return 'not logged in';
+				}
+				catch (\Delight\Auth\TooManyRequestsException $e) {
+					return 'too many requests';
+				}
+			}
+			else if ($_POST['action'] === 'disableTwoFactorViaEmail') {
+				try {
+					$auth->disableTwoFactorViaEmail();
+
+					return 'ok';
+				}
+				catch (\Delight\Auth\NotLoggedInException $e) {
+					return 'not logged in';
+				}
+				catch (\Delight\Auth\TooManyRequestsException $e) {
+					return 'too many requests';
+				}
+			}
+			else if ($_POST['action'] === 'disableTwoFactor') {
+				try {
+					$auth->disableTwoFactor();
+
+					return 'ok';
+				}
+				catch (\Delight\Auth\NotLoggedInException $e) {
+					return 'not logged in';
+				}
+				catch (\Delight\Auth\TooManyRequestsException $e) {
+					return 'too many requests';
+				}
+			}
 			else if ($_POST['action'] === 'reconfirmPassword') {
 				try {
 					return $auth->reconfirmPassword($_POST['password']) ? 'correct' : 'wrong';
@@ -367,6 +617,22 @@ function processRequestData(\Delight\Auth\Auth $auth) {
 					return 'too many requests';
 				}
 			}
+			else if ($_POST['action'] === 'changeUsername') {
+				try {
+					$auth->changeUsername($_POST['newUsername'], $_POST['requireUnique']);
+
+					return 'ok';
+				}
+				catch (\Delight\Auth\DuplicateUsernameException $e) {
+					return 'username already exists';
+				}
+				catch (\Delight\Auth\NotLoggedInException $e) {
+					return 'not logged in';
+				}
+				catch (\Delight\Auth\TooManyRequestsException $e) {
+					return 'too many requests';
+				}
+			}
 			else if ($_POST['action'] === 'setPasswordResetEnabled') {
 				try {
 					$auth->setPasswordResetEnabled($_POST['enabled'] == 1);
@@ -730,7 +996,22 @@ function showDebugData(\Delight\Auth\Auth $auth, $result) {
 	\var_dump($auth->isRemembered());
 	echo '$auth->getIpAddress()' . "\t\t\t";
 	\var_dump($auth->getIpAddress());
-	echo "\n";
+	echo '$auth->hasTwoFactor()' . "\t\t\t";
+	\var_dump($auth->hasTwoFactor());
+	echo '$auth->hasTwoFactorViaTotp()' . "\t\t";
+	\var_dump($auth->hasTwoFactorViaTotp());
+	echo '$auth->hasTwoFactorViaSms()' . "\t\t";
+	\var_dump($auth->hasTwoFactorViaSms());
+	echo '$auth->hasTwoFactorViaEmail()' . "\t\t";
+	\var_dump($auth->hasTwoFactorViaEmail());
+	echo 'Waiting for 2FA' . "\t\t\t\t";
+	if ($auth->isWaitingForSecondFactor()) {
+		echo 'User #' . ((int) $_SESSION[\Delight\Auth\Auth::SESSION_FIELD_AWAITING_2FA_USER_ID]) . ' (' . ($_SESSION[\Delight\Auth\Auth::SESSION_FIELD_AWAITING_2FA_UNTIL] - \time()) . ' seconds)';
+	}
+	else {
+		echo 'No';
+	}
+	echo "\n\n";

 	echo 'Session name' . "\t\t\t\t";
 	\var_dump(\session_name());
@@ -810,6 +1091,16 @@ function showAuthenticatedUserForm(\Delight\Auth\Auth $auth) {
 	echo '<button type="submit">Change email address</button>';
 	echo '</form>';

+	echo '<form action="" method="post" accept-charset="utf-8">';
+	echo '<input type="hidden" name="action" value="changeUsername" />';
+	echo '<input type="text" name="newUsername" placeholder="New username" /> ';
+	echo '<select name="requireUnique" size="1">';
+	echo '<option value="0">Any</option>';
+	echo '<option value="1">Unique</option>';
+	echo '</select> ';
+	echo '<button type="submit">Change username</button>';
+	echo '</form>';
+
 	\showConfirmEmailForm();

 	echo '<form action="" method="post" accept-charset="utf-8">';
@@ -821,6 +1112,61 @@ function showAuthenticatedUserForm(\Delight\Auth\Auth $auth) {
 	echo '<button type="submit">Control password resets</button>';
 	echo '</form>';

+	echo '<form action="" method="post" accept-charset="utf-8">';
+	echo '<input type="hidden" name="action" value="prepareTwoFactorViaTotp" />';
+	echo '<input type="text" name="serviceName" placeholder="Service name" value="' . \htmlspecialchars(!empty($_SERVER['SERVER_NAME']) ? (string) $_SERVER['SERVER_NAME'] : (!empty($_SERVER['SERVER_ADDR']) ? (string) $_SERVER['SERVER_ADDR'] : '')) . '" /> ';
+	echo '<button type="submit">Prepare 2FA via TOTP</button>';
+	echo '</form>';
+
+	echo '<form action="" method="post" accept-charset="utf-8">';
+	echo '<input type="hidden" name="action" value="prepareTwoFactorViaSms" />';
+	echo '<input type="text" name="phoneNumber" placeholder="Phone number" /> ';
+	echo '<button type="submit">Prepare 2FA via SMS</button>';
+	echo '</form>';
+
+	echo '<form action="" method="post" accept-charset="utf-8">';
+	echo '<input type="hidden" name="action" value="prepareTwoFactorViaEmail" />';
+	echo '<button type="submit">Prepare 2FA via email</button>';
+	echo '</form>';
+
+	echo '<form action="" method="post" accept-charset="utf-8">';
+	echo '<input type="hidden" name="action" value="enableTwoFactorViaTotp" />';
+	echo '<input type="text" name="otpValue" placeholder="OTP value" /> ';
+	echo '<button type="submit">Enable 2FA via TOTP</button>';
+	echo '</form>';
+
+	echo '<form action="" method="post" accept-charset="utf-8">';
+	echo '<input type="hidden" name="action" value="enableTwoFactorViaSms" />';
+	echo '<input type="text" name="otpValue" placeholder="OTP value" /> ';
+	echo '<button type="submit">Enable 2FA via SMS</button>';
+	echo '</form>';
+
+	echo '<form action="" method="post" accept-charset="utf-8">';
+	echo '<input type="hidden" name="action" value="enableTwoFactorViaEmail" />';
+	echo '<input type="text" name="otpValue" placeholder="OTP value" /> ';
+	echo '<button type="submit">Enable 2FA via email</button>';
+	echo '</form>';
+
+	echo '<form action="" method="post" accept-charset="utf-8">';
+	echo '<input type="hidden" name="action" value="disableTwoFactorViaTotp" />';
+	echo '<button type="submit">Disable 2FA via TOTP</button>';
+	echo '</form>';
+
+	echo '<form action="" method="post" accept-charset="utf-8">';
+	echo '<input type="hidden" name="action" value="disableTwoFactorViaSms" />';
+	echo '<button type="submit">Disable 2FA via SMS</button>';
+	echo '</form>';
+
+	echo '<form action="" method="post" accept-charset="utf-8">';
+	echo '<input type="hidden" name="action" value="disableTwoFactorViaEmail" />';
+	echo '<button type="submit">Disable 2FA via email</button>';
+	echo '</form>';
+
+	echo '<form action="" method="post" accept-charset="utf-8">';
+	echo '<input type="hidden" name="action" value="disableTwoFactor" />';
+	echo '<button type="submit">Disable 2FA</button>';
+	echo '</form>';
+
 	echo '<form action="" method="post" accept-charset="utf-8">';
 	echo '<input type="hidden" name="action" value="logOut" />';
 	echo '<button type="submit">Log out</button>';
@@ -864,6 +1210,12 @@ function showGuestUserForm() {
 	echo '<button type="submit">Log in with username</button>';
 	echo '</form>';

+	echo '<form action="" method="post" accept-charset="utf-8">';
+	echo '<input type="hidden" name="action" value="provideOneTimePasswordAsSecondFactor" />';
+	echo '<input type="text" name="otpValue" placeholder="OTP value" /> ';
+	echo '<button type="submit">Provide OTP</button>';
+	echo '</form>';
+
 	echo '<form action="" method="post" accept-charset="utf-8">';
 	echo '<input type="hidden" name="action" value="register" />';
 	echo '<input type="text" name="email" placeholder="Email address" /> ';
@@ -893,6 +1245,11 @@ function showGuestUserForm() {
 	echo '<input type="text" name="selector" placeholder="Selector" /> ';
 	echo '<input type="text" name="token" placeholder="Token" /> ';
 	echo '<input type="text" name="password" placeholder="New password" /> ';
+	echo '<select name="login" size="1">';
+	echo '<option value="0">Sign in automatically? — No</option>';
+	echo '<option value="1">Sign in automatically? — Yes</option>';
+	echo '<option value="2">Sign in automatically? — Yes (and remember)</option>';
+	echo '</select> ';
 	echo '<button type="submit">Reset password</button>';
 	echo '</form>';

@@ -1067,3 +1424,6 @@ function createRolesOptions() {

 	return $out;
 }
+
+echo '</body>';
+echo '</html>';
Author	SHA1	Message	Date
Marco	cc8c212acb	Update migration guide	2025-06-04 19:48:25 +02:00
Marco	ef996fd2ae	Update dependencies	2025-05-28 17:47:58 +02:00
Marco	245e10b390	Explain commercial support in README	2025-05-28 17:42:57 +02:00
Marco	288bc1d967	Save all relevant user actions on 'Auth' interface to audit log	2025-05-27 11:28:12 +02:00
Marco	ed7fb0b2eb	Implement method 'Auth#logForAudit' for saving records to audit log	2025-05-27 10:49:13 +02:00
Marco	68beb69984	Track which mechanism was used when successfully providing OTP for 2FA	2025-05-27 10:46:50 +02:00
Marco	10cf5a3855	Capture 2FA configuration in variable before returning it	2025-05-27 10:10:29 +02:00
Marco	cdcc82040f	Determine if configuration had actually been active when disabling 2FA	2025-05-27 09:59:15 +02:00
Marco	2d2ff46121	Improve code style	2025-05-27 09:32:59 +02:00
Marco	1fc2a87232	Add database structure for audit log for SQLite	2025-05-26 19:48:44 +02:00
Marco	f4514372f6	Add database structure for audit log for PostgreSQL	2025-05-26 19:44:12 +02:00
Marco	5249a75fcd	Add database structure for audit log for MySQL	2025-05-26 19:41:29 +02:00
Marco	0a4100b8c7	Create function 'IpAddress::mask'	2025-05-22 22:19:10 +02:00
Marco	db97bbaed7	Fix missing ToC entry in README	2025-05-22 21:14:31 +02:00
Marco	f1d2476fb9	Improve language	2025-05-22 21:08:37 +02:00
Marco	e6c827cd79	Improve documentation on excluding unwanted characters for usernames	2025-05-22 20:43:46 +02:00
Marco	5cc4745fc7	Document method 'Auth#changeUsername' in README	2025-05-22 09:06:11 +02:00
Marco	8875697eec	Add tests for method 'Auth#changeUsername'	2025-05-22 08:44:23 +02:00
Marco	7a20e96600	Implement method 'Auth#changeUsername'	2025-05-22 08:41:13 +02:00
Marco	15e9761b6b	Improve notes on passwords and hashing in README	2025-05-19 18:29:16 +02:00
Marco	293d57f243	Loosen length restriction for passwords from 72 bytes to 2048 bytes	2025-05-19 13:24:54 +02:00
Marco	e087c9af2f	Implement pre-hashing for passwords when using bcrypt This enables support for passwords with more than 72 bytes (or more than 18-72 characters) and for passwords containing null bytes	2025-05-19 12:55:28 +02:00
Marco	1cac1a5188	Extract usages of hashing for tokens to new class 'TokenHash'	2025-05-17 18:32:13 +02:00
Marco	3625622670	Extract usages of hashing for passwords to new class 'PasswordHash'	2025-05-17 18:19:07 +02:00
Marco	6b7ef7c93c	Improve documentation for two-factor authentication in README	2025-05-05 22:56:11 +02:00
Marco	d73a1bf919	Document two-factor authentication in README	2025-05-01 00:28:22 +02:00
Marco	ff4e52d111	Deprecate 'onBeforeSuccess' callback and 'AttemptCancelledException'	2025-04-30 14:35:07 +02:00
Marco	05854dad61	Restrict new passwords to 72 characters in length	2025-04-30 13:54:16 +02:00
Marco	233640502c	Add length constraints to SQLite text columns to match MySQL/Postgres	2025-04-24 09:04:10 +02:00
Marco	ea6cbf6089	Improve DDL for SQLite	2025-03-20 14:28:20 +01:00
Marco	e771398527	Drop 'UNSIGNED' for 'FLOAT' in DDL for MySQL	2025-03-17 09:20:37 +01:00
Marco	3defd87461	Drop integer display widths in DDL for MySQL	2025-03-16 16:13:36 +01:00
Marco	c0a289c352	Improve DDL for PostgreSQL	2025-03-15 16:05:33 +01:00
Marco	5609c80af0	Remove trailing commas (syntax errors) in PostgreSQL Thanks, @hauke-97 and @jgmamxmn !	2025-03-12 15:42:41 +01:00
Marco	efae015004	Do not use 'IF NOT EXISTS' with 'CREATE TABLE' for MySQL	2025-03-12 15:34:49 +01:00
Marco	fcdb946042	Add tests for four methods 'Auth#disableTwoFactor*'	2024-09-24 16:40:22 +02:00
Marco	61e4367c31	Create four methods 'Auth#disableTwoFactor*' to let users disable 2FA	2024-09-24 16:38:02 +02:00
Marco	60175e1889	Add tests for four methods 'Auth#hasTwoFactor*'	2024-08-29 13:51:43 +02:00
Marco	df31a85e4a	Create four methods 'Auth#hasTwoFactor*' to check if user has 2FA	2024-08-29 13:50:21 +02:00
Marco	663268c712	Use full and valid HTML page markup in tests	2024-08-16 09:15:50 +02:00
Marco	bf64593ebf	Emphasize that spaces or special chars are fine in supplied OTPs	2024-08-16 07:12:45 +02:00
Marco	960dc7ffdc	Display masked recipients for OTPs as well in tests	2024-08-16 07:10:55 +02:00
Marco	ff3038386c	Additionally pass masked recipients to 'SecondFactorRequiredException'	2024-08-16 07:08:14 +02:00
Marco	0e82d095cf	Accept masked SMS/email recipients in 'SecondFactorRequiredException'	2024-08-16 07:06:42 +02:00
Marco	ceac62c3f3	Swap order of arguments for 'addSmsOption' and 'addEmailOption'	2024-08-16 07:02:38 +02:00
Marco	e5ccc81988	Always cast integers from database to 'int' before strict comparisons	2024-08-16 06:55:59 +02:00
Marco	2a37898560	Create function 'PhoneNumber::mask'	2024-08-16 06:46:26 +02:00
Marco	a25b57cd7b	Create function 'EmailAddress::mask'	2024-08-16 06:44:17 +02:00
Marco	e5bc48eaa6	Prefer numerical OTPs for setup and usage of 2FA via SMS and email	2024-07-04 17:58:22 +02:00
Marco	d2602121ab	Delete OTPs from incomplete attempts to set up 2FA	2024-07-04 13:53:07 +02:00
Marco	eba7cd2657	Extract sanitization of OTP values into separate method	2024-07-04 13:35:27 +02:00
Marco	2ffe09c52e	Prevent text in README from being detected by tooling	2024-06-14 14:18:12 +02:00
Marco	75c372198d	Add tests for method 'Auth#enableTwoFactorViaEmail'	2024-06-14 13:34:28 +02:00
Marco	4dc67aaa30	Add tests for method 'Auth#enableTwoFactorViaSms'	2024-06-14 13:03:14 +02:00
Marco	87c4ad0b92	Improve language	2024-06-11 12:19:36 +02:00
Marco	aebaea128b	Implement 'enableTwoFactorViaEmail' using 'enableTwoFactor'	2024-06-11 11:40:37 +02:00
Marco	0f71c335e6	Implement 'enableTwoFactorViaSms' using 'enableTwoFactor'	2024-06-11 11:12:04 +02:00
Marco	1f231d0a94	Re-implement 'enableTwoFactorViaTotp' using 'enableTwoFactor'	2024-06-11 11:06:17 +02:00
Marco	e447e972af	Turn 'enableTwoFactorViaTotp' into generalized 'enableTwoFactor'	2024-06-11 09:49:26 +02:00
Marco	9464d754bd	Add tests for method 'Auth#prepareTwoFactorViaEmail'	2024-04-04 19:52:29 +02:00
Marco	804141f1d4	Add tests for method 'Auth#prepareTwoFactorViaSms'	2024-04-04 19:51:18 +02:00
Marco	8b870567e7	Update documentation for 'provideOneTimePasswordAsSecondFactor'	2024-04-04 19:46:57 +02:00
Marco	b0965525de	Implement 'prepareTwoFactorViaEmail' using 'prepareTwoFactor'	2024-04-04 19:42:23 +02:00
Marco	ea7b1208ad	Implement 'prepareTwoFactorViaSms' using 'prepareTwoFactor'	2024-04-04 19:39:54 +02:00
Marco	0ff92ce870	Re-implement 'prepareTwoFactorViaTotp' using 'prepareTwoFactor'	2024-04-04 19:34:24 +02:00
Marco	c249c3b060	Turn 'prepareTwoFactorViaTotp' into generalized 'prepareTwoFactor'	2024-04-04 19:25:11 +02:00
Marco	e266178f95	Extract code into separate 'generateAndStoreRandomOneTimePassword'	2024-04-04 19:09:40 +02:00
Marco	c21f59d4d5	Use method 'Auth#isWaitingForSecondFactor' in tests	2024-04-04 19:03:06 +02:00
Marco	68f5b23fc5	Implement method 'Auth#isWaitingForSecondFactor'	2024-04-04 19:01:43 +02:00
Marco	4d92ca24c2	Add SQLite schema for new tables 'users_2fa' and 'users_otps'	2024-04-04 18:48:51 +02:00
Marco	8f249d0080	Add PostgreSQL schema for new tables 'users_2fa' and 'users_otps'	2024-04-04 17:47:08 +02:00
Marco	96b72f0be9	Add MySQL schema for new tables 'users_2fa' and 'users_otps'	2024-04-02 18:57:57 +02:00
Marco	bc15776348	Require 'delight-im/otp' as dependency	2024-04-02 16:03:12 +02:00
Marco	9cab58ecb4	Add tests for 'Auth#provideOneTimePasswordAsSecondFactor'	2024-04-02 14:39:23 +02:00
Marco	561d6cd450	In tests show whether 2FA is currently pending for any user	2024-04-02 13:52:22 +02:00
Marco	e919eec2a9	Add tests for 'Auth#enableTwoFactorViaTotp'	2024-04-01 14:15:11 +02:00
Marco	8b0f5f3407	Add tests for 'Auth#prepareTwoFactorViaTotp'	2024-04-01 09:37:38 +02:00
Marco	3c7e17fca8	Handle 'SecondFactorRequiredException' in four relevant cases in tests	2024-03-26 09:15:45 +01:00
Marco	fc468397e2	Add method 'Auth#provideOneTimePasswordAsSecondFactor'	2024-03-25 11:32:03 +01:00
Marco	76c756118b	Replace calls on successful login with 'finishSingleFactorOrThrow'	2024-03-21 12:45:52 +01:00
Marco	dc04d52249	Implement method 'Auth#finishSingleFactorOrThrow'	2024-03-20 08:16:03 +01:00
Marco	29fbd7b480	Create method 'Auth#enableTwoFactorViaTotp'	2024-03-17 10:31:22 +01:00
Marco	b79246ff40	Create method 'Auth#prepareTwoFactorViaTotp'	2024-03-15 07:47:53 +01:00
Marco	8256fd11e8	Create method 'Auth::createSelectorForOneTimePassword'	2024-03-14 14:37:07 +01:00
Marco	e5310aa699	Document methods supposed to throw 'SecondFactorRequiredException'	2024-03-14 13:57:50 +01:00
Marco	bcfbc1d2f8	Add constants for designated mechanisms for OTP generation/delivery	2024-03-13 08:18:35 +01:00
Marco	3d19df85fc	Create session fields to track pending 2FA after login	2024-03-13 08:13:44 +01:00
Marco	db7480be38	Create class 'SecondFactorRequiredException'	2024-03-11 11:14:12 +01:00
Marco	67b4cba4d9	Create class 'InvalidOneTimePasswordException'	2024-03-05 09:42:15 +01:00
Marco	d58519d831	Create class 'InvalidStateError'	2024-03-05 09:39:31 +01:00
Marco	759a523a92	Create class 'TwoFactorMechanismAlreadyEnabledException'	2024-03-05 09:38:44 +01:00
Marco	88fcc61562	Create class 'TwoFactorMechanismNotInitializedException'	2024-03-05 09:37:16 +01:00
Marco	ada9553919	Improve code style	2023-03-20 09:25:29 +01:00
Marco	f9700fcae6	Move unaffected code outside of try/catch statement	2023-03-20 09:23:13 +01:00
Marco	892512f6e1	Move unaffected code outside of try/catch statement	2023-03-20 08:19:43 +01:00
Marco	79cc249318	Clarify parameter to 'Auth#register' to omit to disable verification	2022-01-12 14:55:18 +01:00
Marco	0d240e4322	Add guidance on using email or SMS for token delivery to README	2021-11-16 18:21:20 +01:00
Marco	7bce546def	Allow for 'Auth#throttle' to be used even when throttling is disabled	2021-04-21 16:39:10 +02:00
Marco	df16db9b2b	Refer to constructor docs for throttling parameter in related section	2021-04-16 21:26:51 +02:00
Sikander Iqbal	fa655c4908	Update links for examples of bad password policies in README	2021-03-12 19:24:41 +01:00
Marco	fd67044826	Improve links to 'php.net' by adding 'www' subdomain	2021-03-12 19:13:43 +01:00
Sikander Iqbal	6333d25cf2	Improve links to 'php.net' by using HTTPS and automatic language	2021-03-12 19:12:05 +01:00
Marco	f5060b5a1d	Adjust documentation to allow for direct usage of database component	2021-03-04 21:23:10 +01:00
Marco	729c76668f	Move all exceptions and errors to separate files for autoloading	2020-09-30 20:40:54 +02:00
Marco	cc6430a83e	Explain where usernames may be used to address unconfirmed recipients	2020-05-11 13:14:14 +02:00
Marco	6f933ac560	Explain how to impose restrictions on characters/length for usernames	2020-05-11 13:10:33 +02:00
Marco	157a7095b0	Use 'throttling' flag in 'Auth#forgotPassword' when limiting requests	2020-05-06 22:36:45 +02:00
Marco	0f976a260b	Fix doc comment for parameter 'ipAddress' on 'Auth' constructor	2020-05-06 22:35:20 +02:00
Marco	dcd893a12c	Document 'Auth#resetPasswordAndSignIn' in README	2020-04-20 21:36:08 +02:00
Marco	0086419175	Add tests for 'Auth#resetPasswordAndSignIn'	2020-04-20 21:35:04 +02:00
Marco	d49b35690c	Implement 'Auth#resetPasswordAndSignIn'	2020-04-20 21:34:00 +02:00
Marco	171519fdf3	Use 'see' tag to link 'Auth#id' to 'Auth#getUserId'	2020-04-20 21:32:43 +02:00
Marco	14ce7b1e8f	Add references between four methods for password reset via 'see' tags	2020-04-20 21:31:28 +02:00
Marco	49c70eff41	Document return value of 'Auth#resetPassword' in README	2020-04-20 21:02:57 +02:00
Marco	2f772b00c8	Adjust tests for 'Auth#resetPassword' now having a return value	2020-04-20 20:48:19 +02:00
Marco	5214da1f59	Make 'Auth#resetPassword' return both the user's ID and their email	2020-04-20 20:47:27 +02:00
Marco	d8847fb197	Document in README how to retrieve a list of all registered users	2020-03-19 18:52:24 +01:00
Emin Mühəmmədi	1757ad3fd1	Fix variable name in README	2019-07-28 17:44:37 +02:00
Marco	54f6c5320a	Refer to section 'Additional user information' from 'Registration'	2019-05-23 19:29:45 +02:00
Marco	4b3f2ab91c	Document option of custom expiry of requests for 'Auth#forgotPassword'	2019-02-25 19:52:32 +01:00
Marco	df990b5b75	Fix notes regarding session resync after adding or removing roles	2019-02-21 18:34:09 +01:00
Marco	7b2ac9b107	Fix missing entries in table of contents for 'Usage'	2019-01-29 13:33:07 +01:00
Marco	ad90c7d04a	Change responses with success messages from comments to 'echo'	2018-10-05 00:27:01 +02:00
Marco	c0baa517fa	Change responses with error messages from comments to 'die' statements	2018-10-04 23:55:55 +02:00
Marco	3120e3a6a5	Document return values of 'confirmEmail' and 'confirmEmailAndSignIn'	2018-10-04 23:12:41 +02:00
Marco	4cd6360fc7	Document optional database name, schema or other qualifier in README	2018-08-28 23:51:30 +02:00
Marco	382832457d	Make use of database name, schema or other qualifier in all statements	2018-08-28 23:44:50 +02:00
Marco	f70923679f	Implement methods 'makeTableName' and 'makeTableNameComponents'	2018-08-28 23:25:28 +02:00
Marco	521e73662d	Allow for specification of database name, schema or other qualifier	2018-08-28 22:03:40 +02:00
Marco	2b3bf611e2	Update dependencies	2018-08-28 21:47:16 +02:00
Marco	352260c759	Remove obsolete error class 'DatabaseDriverError'	2018-07-25 20:31:36 +02:00
Marco	cbf2b52f29	Fix wrong example of variable name for library's instance in README	2018-07-23 01:08:04 +02:00
Marco	c685f22937	Add note about scope of variables with regard to closures to README	2018-05-28 21:28:00 +02:00