Large project reorder and consolidation

19 files changed, 0 insertions, 2580 deletions

diff --git a/VNLib.Plugins.Essentials.Accounts/AccountValidations.cs b/VNLib.Plugins.Essentials.Accounts/AccountValidations.cs
deleted file mode 100644
index 972bd36..0000000
--- a/VNLib.Plugins.Essentials.Accounts/AccountValidations.cs
+++ /dev/null
@@ -1,107 +0,0 @@
-/*
-* Copyright (c) 2022 Vaughn Nugent
-* 
-* Library: VNLib
-* Package: VNLib.Plugins.Essentials.Accounts
-* File: AccountValidations.cs 
-*
-* AccountValidations.cs is part of VNLib.Plugins.Essentials.Accounts which is part of the larger 
-* VNLib collection of libraries and utilities.
-*
-* VNLib.Plugins.Essentials.Accounts is free software: you can redistribute it and/or modify 
-* it under the terms of the GNU Affero General Public License as 
-* published by the Free Software Foundation, either version 3 of the
-* License, or (at your option) any later version.
-*
-* VNLib.Plugins.Essentials.Accounts is distributed in the hope that it will be useful,
-* but WITHOUT ANY WARRANTY; without even the implied warranty of
-* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-* GNU Affero General Public License for more details.
-*
-* You should have received a copy of the GNU Affero General Public License
-* along with this program.  If not, see https://www.gnu.org/licenses/.
-*/
-
-using FluentValidation;
-
-using VNLib.Plugins.Extensions.Validation;
-
-#nullable enable
-
-namespace VNLib.Plugins.Essentials.Accounts
-{
-    public static class AccountValidations
-    {
-        /// <summary>
-        /// Central password requirement validator
-        /// </summary>
-        public static IValidator<string> PasswordValidator { get; } = GetPassVal();
-
-        public static IValidator<AccountData> AccountDataValidator { get; } = GetAcVal();
-     
-
-        static IValidator<string> GetPassVal()
-        {
-            InlineValidator<string> passVal = new();
-
-            passVal.RuleFor(static password => password)
-                .NotEmpty()
-                .Length(min: 8, max: 100)
-                .Password()
-                .WithMessage(errorMessage: "Password does not meet minium requirements");
-            
-            return passVal;
-        }
-
-        static IValidator<AccountData> GetAcVal()
-        {
-            InlineValidator<AccountData> adv = new ();
-
-            //Validate city
-
-            adv.RuleFor(t => t.City)
-                .MaximumLength(35)
-                .AlphaOnly()
-                .When(t => t.City?.Length > 0);
-
-            adv.RuleFor(t => t.Company)
-                .MaximumLength(50)
-                .SpecialCharacters()
-                .When(t => t.Company?.Length > 0);
-
-            //Require a first and last names to be set together
-            adv.When(t => t.First?.Length > 0 || t.Last?.Length > 0, () =>
-            {
-                adv.RuleFor(t => t.First)
-                    .Length(1, 35)
-                    .AlphaOnly();
-                adv.RuleFor(t => t.Last)
-                    .Length(1, 35)
-                    .AlphaOnly();
-            });
-
-            adv.RuleFor(t => t.PhoneNumber)
-                .PhoneNumber()
-                .When(t => t.PhoneNumber?.Length > 0)
-                .OverridePropertyName("Phone");
-
-            //State must be 2 characters for us states if set
-            adv.RuleFor(t => t.State)
-                .Length(2)
-                .When(t => t.State?.Length > 0);
-
-            adv.RuleFor(t => t.Street)
-                .AlphaNumericOnly()
-                .MaximumLength(50)
-                .When(t => t.Street?.Length > 0);
-
-            //Allow empty zip codes, but if one is defined, is must be less than 7 characters
-            adv.RuleFor(t => t.Zip)
-                .NumericOnly()
-                .MaximumLength(7)
-                .When(t => t.Zip?.Length > 0);
-
-            return adv;
-        }
-    }
-}
diff --git a/VNLib.Plugins.Essentials.Accounts/AccountsEntryPoint.cs b/VNLib.Plugins.Essentials.Accounts/AccountsEntryPoint.cs
deleted file mode 100644
index ed79476..0000000
--- a/VNLib.Plugins.Essentials.Accounts/AccountsEntryPoint.cs
+++ /dev/null
@@ -1,204 +0,0 @@
-/*
-* Copyright (c) 2022 Vaughn Nugent
-* 
-* Library: VNLib
-* Package: VNLib.Plugins.Essentials.Accounts
-* File: AccountsEntryPoint.cs 
-*
-* AccountsEntryPoint.cs is part of VNLib.Plugins.Essentials.Accounts which is part of the larger 
-* VNLib collection of libraries and utilities.
-*
-* VNLib.Plugins.Essentials.Accounts is free software: you can redistribute it and/or modify 
-* it under the terms of the GNU Affero General Public License as 
-* published by the Free Software Foundation, either version 3 of the
-* License, or (at your option) any later version.
-*
-* VNLib.Plugins.Essentials.Accounts is distributed in the hope that it will be useful,
-* but WITHOUT ANY WARRANTY; without even the implied warranty of
-* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-* GNU Affero General Public License for more details.
-*
-* You should have received a copy of the GNU Affero General Public License
-* along with this program.  If not, see https://www.gnu.org/licenses/.
-*/
-
-using System;
-using System.Linq;
-using System.Collections.Generic;
-
-using VNLib.Utils.Memory;
-using VNLib.Utils.Logging;
-using VNLib.Plugins.Essentials.Users;
-using VNLib.Plugins.Essentials.Accounts.Endpoints;
-using VNLib.Plugins.Extensions.Loading;
-using VNLib.Plugins.Extensions.Loading.Users;
-using VNLib.Plugins.Extensions.Loading.Routing;
-
-namespace VNLib.Plugins.Essentials.Accounts
-{
-    public sealed class AccountsEntryPoint : PluginBase
-    {
-
-        public override string PluginName => "Essentials.Accounts";
-
-        protected override void OnLoad()
-        {
-            try
-            {
-                //Route endpoints
-                this.Route<LoginEndpoint>();
-
-                this.Route<LogoutEndpoint>();
-
-                this.Route<KeepAliveEndpoint>();
-
-                this.Route<ProfileEndpoint>();
-
-                this.Route<PasswordChangeEndpoint>();
-
-                this.Route<MFAEndpoint>();
-
-                //Write loaded to log
-                Log.Information("Plugin loaded");
-            }
-            catch (KeyNotFoundException knf)
-            {
-                Log.Error("Missing required account configuration variables {mess}", knf.Message);
-            }
-            catch (UriFormatException uri)
-            {
-                Log.Error("Invalid endpoint URI {message}", uri.Message);
-            }
-        }
-
-     
-
-        protected override void OnUnLoad()
-        {
-            //Write closing messsage and dispose the log
-            Log.Information("Plugin unloaded");
-        }
-      
-        protected override async void ProcessHostCommand(string cmd)
-        {
-            //Only process commands if the plugin is in debug mode
-            if (!this.IsDebug())
-            {
-                return;
-            }
-            try
-            {
-                IUserManager Users = this.GetUserManager();
-                PasswordHashing Passwords = this.GetPasswords();
-
-                //get args as a list
-                List<string> args = cmd.Split(' ').ToList();
-                if (args.Count < 3)
-                {
-                    Log.Warn("No command specified");
-                }
-                switch (args[2].ToLower())
-                {
-                    //Create new user
-                    case "create":
-                        {
-                            int uid = args.IndexOf("-u");
-                            int pwd = args.IndexOf("-p");
-                            if (uid < 0 || pwd < 0)
-                            {
-                                Log.Warn("You are missing required argument values. Format 'create -u <username> -p <password>'");
-                                return;
-                            }
-                            string username = args[uid + 1].Trim();
-                            string randomUserId = AccountManager.GetRandomUserId();
-                            //Password as privatestring DANGEROUS to refs
-                            using (PrivateString password = (PrivateString)args[pwd + 1].Trim()!)
-                            {
-                                //Hash the password
-                                using PrivateString passHash = Passwords.Hash(password);
-                                //Create the user
-                                using IUser user = await Users.CreateUserAsync(randomUserId, username, AccountManager.MINIMUM_LEVEL, passHash);                                
-                                //Set active flag
-                                user.Status = UserStatus.Active;
-                                //Set local account
-                                user.SetAccountOrigin(AccountManager.LOCAL_ACCOUNT_ORIGIN);
-
-                                await user.ReleaseAsync();
-                            }
-                            Log.Information("Successfully created user {id}", username);
-
-                        }
-                        break;
-                    case "reset":
-                        {
-                            int uid = args.IndexOf("-u");
-                            int pwd = args.IndexOf("-p");
-                            if (uid < 0 || pwd < 0)
-                            {
-                                Log.Warn("You are missing required argument values. Format 'reset -u <username> -p <password>'");
-                                return;
-                            }
-                            string username = args[uid + 1].Trim();
-                            //Password as privatestring DANGEROUS to refs
-                            using (PrivateString password = (PrivateString)args[pwd + 1].Trim()!)
-                            {
-                                //Hash the password
-                                using PrivateString passHash = Passwords.Hash(password);
-                                //Get the user
-                                using IUser? user = await Users.GetUserFromEmailAsync(username);
-
-                                if(user == null)
-                                {
-                                    Log.Warn("The specified user does not exist");
-                                    break;
-                                }
-                                
-                                //Set the password
-                                await Users.UpdatePassAsync(user, passHash);
-                            }
-                            Log.Information("Successfully reset password for {id}", username);
-                        }
-                        break;
-                    case "delete":
-                        {
-                            //get user-id
-                            string userId = args[3].Trim();
-                            //Get user
-                            using IUser? user = await Users.GetUserFromEmailAsync(userId);
-                            
-                            if (user == null)
-                            {
-                                Log.Warn("The specified user does not exist");
-                                break;
-                            }
-                            
-                            //delete user
-                            user.Delete();
-                            //Release user
-                            await user.ReleaseAsync();
-                        }
-                        break;
-                    default:
-                        Log.Warn("Uknown command");
-                        break;
-                }
-            }
-            catch (UserExistsException)
-            {
-                Log.Error("User already exists");
-            }
-            catch(UserCreationFailedException)
-            {
-                Log.Error("Failed to create the new user");
-            }
-            catch (ArgumentOutOfRangeException)
-            {
-                Log.Error("You are missing required command arguments");
-            }
-            catch(Exception ex)
-            {
-                Log.Error(ex);    
-            }
-        }
-    }
-}
\ No newline at end of file
diff --git a/VNLib.Plugins.Essentials.Accounts/Endpoints/KeepAliveEndpoint.cs b/VNLib.Plugins.Essentials.Accounts/Endpoints/KeepAliveEndpoint.cs
deleted file mode 100644
index fe5a65b..0000000
--- a/VNLib.Plugins.Essentials.Accounts/Endpoints/KeepAliveEndpoint.cs
+++ /dev/null
@@ -1,64 +0,0 @@
-/*
-* Copyright (c) 2022 Vaughn Nugent
-* 
-* Library: VNLib
-* Package: VNLib.Plugins.Essentials.Accounts
-* File: KeepAliveEndpoint.cs 
-*
-* KeepAliveEndpoint.cs is part of VNLib.Plugins.Essentials.Accounts which is part of the larger 
-* VNLib collection of libraries and utilities.
-*
-* VNLib.Plugins.Essentials.Accounts is free software: you can redistribute it and/or modify 
-* it under the terms of the GNU Affero General Public License as 
-* published by the Free Software Foundation, either version 3 of the
-* License, or (at your option) any later version.
-*
-* VNLib.Plugins.Essentials.Accounts is distributed in the hope that it will be useful,
-* but WITHOUT ANY WARRANTY; without even the implied warranty of
-* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-* GNU Affero General Public License for more details.
-*
-* You should have received a copy of the GNU Affero General Public License
-* along with this program.  If not, see https://www.gnu.org/licenses/.
-*/
-
-using System;
-using System.Net;
-using System.Text.Json;
-using System.Collections.Generic;
-
-using VNLib.Plugins.Essentials.Endpoints;
-using VNLib.Plugins.Extensions.Loading;
-
-namespace VNLib.Plugins.Essentials.Accounts.Endpoints
-{
-    [ConfigurationName("keepalive_endpoint")]
-    internal sealed class KeepAliveEndpoint : ProtectedWebEndpoint
-    {
-        /*
-         * Endpoint does not use a log, so IniPathAndLog is never called
-         * and path verification happens verbosly 
-         */
-        public KeepAliveEndpoint(PluginBase pbase, IReadOnlyDictionary<string, JsonElement> config)
-        {
-            string? path = config["path"].GetString();
-
-            InitPathAndLog(path, pbase.Log);
-        }
-
-        protected override VfReturnType Get(HttpEntity entity)
-        {
-            //Return okay
-            entity.CloseResponse(HttpStatusCode.OK);
-            return VfReturnType.VirtualSkip;
-        }
-
-        //Allow post to update user's credentials
-        protected override VfReturnType Post(HttpEntity entity)
-        {
-            //Return okay
-            entity.CloseResponse(HttpStatusCode.OK);
-            return VfReturnType.VirtualSkip;
-        }
-    }
-}
\ No newline at end of file
diff --git a/VNLib.Plugins.Essentials.Accounts/Endpoints/LoginEndpoint.cs b/VNLib.Plugins.Essentials.Accounts/Endpoints/LoginEndpoint.cs
deleted file mode 100644
index 4100620..0000000
--- a/VNLib.Plugins.Essentials.Accounts/Endpoints/LoginEndpoint.cs
+++ /dev/null
@@ -1,410 +0,0 @@
-/*
-* Copyright (c) 2022 Vaughn Nugent
-* 
-* Library: VNLib
-* Package: VNLib.Plugins.Essentials.Accounts
-* File: LoginEndpoint.cs 
-*
-* LoginEndpoint.cs is part of VNLib.Plugins.Essentials.Accounts which is part of the larger 
-* VNLib collection of libraries and utilities.
-*
-* VNLib.Plugins.Essentials.Accounts is free software: you can redistribute it and/or modify 
-* it under the terms of the GNU Affero General Public License as 
-* published by the Free Software Foundation, either version 3 of the
-* License, or (at your option) any later version.
-*
-* VNLib.Plugins.Essentials.Accounts is distributed in the hope that it will be useful,
-* but WITHOUT ANY WARRANTY; without even the implied warranty of
-* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-* GNU Affero General Public License for more details.
-*
-* You should have received a copy of the GNU Affero General Public License
-* along with this program.  If not, see https://www.gnu.org/licenses/.
-*/
-
-using System;
-using System.Net;
-using System.Text.Json;
-using System.Threading.Tasks;
-using System.Collections.Generic;
-using System.Security.Cryptography;
-using System.Text.Json.Serialization;
-
-using VNLib.Hashing;
-using VNLib.Utils;
-using VNLib.Utils.Memory;
-using VNLib.Utils.Logging;
-using VNLib.Utils.Extensions;
-using VNLib.Plugins.Essentials.Users;
-using VNLib.Plugins.Essentials.Endpoints;
-using VNLib.Plugins.Essentials.Extensions;
-using VNLib.Plugins.Extensions.Validation;
-using VNLib.Plugins.Essentials.Accounts.MFA;
-using VNLib.Plugins.Essentials.Accounts.Validators;
-using VNLib.Plugins.Extensions.Loading;
-using VNLib.Plugins.Extensions.Loading.Users;
-using static VNLib.Plugins.Essentials.Statics;
-using static VNLib.Plugins.Essentials.Accounts.AccountManager;
-
-
-namespace VNLib.Plugins.Essentials.Accounts.Endpoints
-{
-
-    /// <summary>
-    /// Provides an authentication endpoint for user-accounts
-    /// </summary>
-    [ConfigurationName("login_endpoint")]
-    internal sealed class LoginEndpoint : UnprotectedWebEndpoint
-    {
-        public const string INVALID_MESSAGE = "Please check your email or password.";
-        public const string LOCKED_ACCOUNT_MESSAGE = "You have been timed out, please try again later";
-        public const string MFA_ERROR_MESSAGE = "Invalid or expired request.";
-
-        private static readonly LoginMessageValidation LmValidator = new();
-       
-        private readonly PasswordHashing Passwords;
-        private readonly MFAConfig? MultiFactor;
-        private readonly IUserManager Users;
-        private readonly uint MaxFailedLogins;
-        private readonly TimeSpan FailedCountTimeout;
-
-        public LoginEndpoint(PluginBase pbase, IReadOnlyDictionary<string, JsonElement> config)
-        {
-            string? path = config["path"].GetString();
-            FailedCountTimeout = config["failed_count_timeout_sec"].GetTimeSpan(TimeParseType.Seconds);
-            MaxFailedLogins = config["failed_count_max"].GetUInt32();
-
-            InitPathAndLog(path, pbase.Log);
-
-            Passwords = pbase.GetPasswords();
-            Users = pbase.GetUserManager();
-            MultiFactor = pbase.GetMfaConfig();
-        }
-
-        private class MfaUpgradeWebm : ValErrWebMessage
-        {
-            [JsonPropertyName("pwtoken")]
-            public string? PasswordToken { get; set; }
-
-            [JsonPropertyName("mfa")]
-            public bool? MultiFactorUpgrade { get; set; } = null;
-        }
-
-
-        protected async override ValueTask<VfReturnType> PostAsync(HttpEntity entity)
-        {
-            //Conflict if user is logged in
-            if (entity.LoginCookieMatches() || entity.TokenMatches())
-            {
-                entity.CloseResponse(HttpStatusCode.Conflict);
-                return VfReturnType.VirtualSkip;
-            }
-            
-            //If mfa is enabled, allow processing via mfa
-            if (MultiFactor != null)
-            {
-                if (entity.QueryArgs.ContainsKey("mfa"))
-                {
-                    return await ProcessMfaAsync(entity);
-                }
-            }
-            return await ProccesLoginAsync(entity);
-        }
-
-
-        private async ValueTask<VfReturnType> ProccesLoginAsync(HttpEntity entity)
-        {
-            MfaUpgradeWebm webm = new();
-            try
-            {
-                //Make sure the id is regenerated (or upgraded if successful login)
-                entity.Session.RegenID();
-                
-                using LoginMessage? loginMessage = await entity.GetJsonFromFileAsync<LoginMessage>(SR_OPTIONS);
-                
-                if (webm.Assert(loginMessage != null, "Invalid request data"))
-                {
-                    entity.CloseResponseJson(HttpStatusCode.BadRequest, webm);
-                    return VfReturnType.VirtualSkip;
-                }
-                
-                //validate the message
-                if (!LmValidator.Validate(loginMessage, webm))
-                {
-                    entity.CloseResponseJson(HttpStatusCode.UnprocessableEntity, webm);
-                    return VfReturnType.VirtualSkip;
-                }
-                
-                //Time to get the user
-                using IUser? user = await Users.GetUserAndPassFromEmailAsync(loginMessage.UserName);
-                //Make sure account exists
-                if (webm.Assert(user != null, INVALID_MESSAGE))
-                {
-                    entity.CloseResponse(webm);
-                    return VfReturnType.VirtualSkip;
-                }
-                
-                //Make sure the account has not been locked out
-                if (webm.Assert(!UserLoginLocked(user), LOCKED_ACCOUNT_MESSAGE))
-                {
-                    goto Cleanup;
-                }
-                
-                //Only allow local accounts
-                if (user.IsLocalAccount() && !PrivateString.IsNullOrEmpty(user.PassHash))
-                {
-                    //If login return true, the response has been set and we should return
-                    if (LoginUser(entity, loginMessage, user, webm))
-                    {
-                        goto Cleanup;
-                    }
-                }
-
-                //Inc failed login count
-                user.FailedLoginIncrement();
-                webm.Result = INVALID_MESSAGE;
-
-            Cleanup:
-                await user.ReleaseAsync();
-                entity.CloseResponse(webm);
-                return VfReturnType.VirtualSkip;
-            }
-            catch (UserUpdateException uue)
-            {
-                Log.Warn(uue);
-                return VfReturnType.Error;
-            }
-        }
-        
-        private bool LoginUser(HttpEntity entity, LoginMessage loginMessage, IUser user, MfaUpgradeWebm webm)
-        {
-            //Verify password before we tell the user the status of their account for security reasons
-            if (!Passwords.Verify(user.PassHash, new PrivateString(loginMessage.Password, false)))
-            {
-                return false;
-            }
-            //Reset flc for account
-            user.FailedLoginCount(0);
-            try
-            {
-                switch (user.Status)
-                {
-                    case UserStatus.Active:
-                        {
-                            //Is the account restricted to a local network connection?
-                            if (user.LocalOnly && !entity.IsLocalConnection)
-                            {
-                                Log.Information("User {uid} attempted a login from a non-local network with the correct password. Access was denied", user.UserID);
-                                return false;
-                            }
-                            //Gen and store the pw secret
-                            byte[] pwSecret = entity.Session.GenPasswordChallenge(new(loginMessage.Password, false));
-                            //Encrypt and convert to base64
-                            string clientPwSecret = EncryptSecret(loginMessage.ClientPublicKey, pwSecret);
-                            //get the new upgrade jwt string
-                            Tuple<string,string>? message = user.MFAGetUpgradeIfEnabled(MultiFactor, loginMessage, clientPwSecret);
-                            //if message is null, mfa was not enabled or could not be prepared
-                            if (message != null)
-                            {
-                                //Store the base64 signature
-                                entity.Session.MfaUpgradeSignature(message.Item2);
-                                //send challenge message to client
-                                webm.Result = message.Item1;
-                                webm.Success = true;
-                                webm.MultiFactorUpgrade = true;
-                                break;
-                            }
-                            //Set password token
-                            webm.PasswordToken = clientPwSecret;
-                            //Elevate the login status of the session to reflect the user's status
-                            webm.Token = entity.GenerateAuthorization(loginMessage, user);
-                            //Send the Username (since they already have it)
-                            webm.Result = new AccountData()
-                            {
-                                EmailAddress = user.EmailAddress,
-                            };
-                            webm.Success = true;
-                            //Write to log
-                            Log.Verbose("Successful login for user {uid}...", user.UserID[..8]);
-                        }
-                        break;
-                    default:
-                        //This is an unhandled case, and should never happen, but just incase write a warning to the log
-                        Log.Warn("Account {uid} has invalid status key and a login was attempted from {ip}", user.UserID, entity.TrustedRemoteIp);
-                        return false;
-                }
-            }
-            /*
-             * Account auhorization may throw excetpions if the configuration does not 
-             * match the client, or the client sent invalid or malicous data and 
-             * it could not grant authorization
-             */
-            catch (OutOfMemoryException)
-            {
-                webm.Result = "Your browser sent malformatted security information";
-            }
-            catch (CryptographicException ce)
-            {
-                webm.Result = "Your browser sent malformatted security information";
-                Log.Debug(ce);
-            }
-            return true;
-        }
-       
-
-        private async ValueTask<VfReturnType> ProcessMfaAsync(HttpEntity entity)
-        {
-            MfaUpgradeWebm webm = new();
-            //Recover request message
-            using JsonDocument? request = await entity.GetJsonFromFileAsync();
-            if (webm.Assert(request != null, "Invalid request data"))
-            {
-                entity.CloseResponseJson(HttpStatusCode.BadRequest, webm);
-                return VfReturnType.VirtualSkip;
-            }
-            //Recover upgrade jwt
-            string? upgradeJwt = request.RootElement.GetPropString("upgrade");
-            if (webm.Assert(upgradeJwt != null, "Missing required upgrade data"))
-            {
-                entity.CloseResponseJson(HttpStatusCode.UnprocessableEntity, webm);
-                return VfReturnType.VirtualSkip;
-            }
-            
-            //Recover stored signature
-            string? storedSig = entity.Session.MfaUpgradeSignature();
-            if(webm.Assert(!string.IsNullOrWhiteSpace(storedSig), MFA_ERROR_MESSAGE))
-            {
-                entity.CloseResponse(webm);
-                return VfReturnType.VirtualSkip;
-            }
-            
-            //Recover upgrade data from upgrade message
-            if (!MultiFactor!.RecoverUpgrade(upgradeJwt, storedSig, out MFAUpgrade? upgrade))
-            {
-                webm.Result = MFA_ERROR_MESSAGE;
-                entity.CloseResponse(webm);
-                return VfReturnType.VirtualSkip;
-            }
-            
-            //recover user account 
-            using IUser? user = await Users.GetUserFromEmailAsync(upgrade.UserName!);
-
-            if (webm.Assert(user != null, MFA_ERROR_MESSAGE))
-            {
-                entity.CloseResponse(webm);
-                return VfReturnType.VirtualSkip;
-            }
-
-            bool locked = UserLoginLocked(user);
-
-            //Make sure the account has not been locked out
-            if (!webm.Assert(locked == false, LOCKED_ACCOUNT_MESSAGE))
-            {
-                //process mfa login
-                LoginMfa(entity, user, request, upgrade, webm);
-            }
-            else
-            {
-                //Locked, so clear stored signature
-                entity.Session.MfaUpgradeSignature(null);
-            }
-      
-            //Update user on clean process
-            await user.ReleaseAsync();
-            //Close rseponse
-            entity.CloseResponse(webm);
-            return VfReturnType.VirtualSkip;
-        }
-
-        private void LoginMfa(HttpEntity entity, IUser user, JsonDocument request, MFAUpgrade upgrade, MfaUpgradeWebm webm)
-        {         
-            //Recover the user's local time
-            DateTimeOffset localTime = request.RootElement.GetProperty("localtime").GetDateTimeOffset();
-
-            //Check mode
-            switch (upgrade.Type)
-            {
-                case MFAType.TOTP:
-                    {
-                        //get totp code from request
-                        uint code = request.RootElement.GetProperty("code").GetUInt32();
-                        //Verify totp code
-                        if (!MultiFactor!.VerifyTOTP(user, code))
-                        {
-                            webm.Result = "Please check your code.";
-                            //Increment flc and update the user in the store
-                            user.FailedLoginIncrement();                           
-                            return;
-                        }
-                        //Valid, complete                         
-                    }
-                    break;
-                case MFAType.PGP:
-                    { }
-                    break;
-                default:
-                    {
-                        webm.Result = MFA_ERROR_MESSAGE;
-                    }
-                    return;
-            }
-
-            //Wipe session signature
-            entity.Session.MfaUpgradeSignature(null);
-
-            //build login message from upgrade
-            LoginMessage loginMessage = new()
-            {
-                ClientID = upgrade.ClientID,
-                ClientPublicKey = upgrade.Base64PubKey,
-                LocalLanguage = upgrade.ClientLocalLanguage,
-                LocalTime = localTime,
-                UserName = upgrade.UserName
-            };
-            //Elevate the login status of the session to reflect the user's status
-            webm.Token = entity.GenerateAuthorization(loginMessage, user);
-            //Set the password token as the password field of the login message
-            webm.PasswordToken = upgrade.PwClientData;
-            //Send the Username (since they already have it)
-            webm.Result = new AccountData()
-            {
-                EmailAddress = user.EmailAddress,
-            };
-            webm.Success = true;
-            //Write to log
-            Log.Verbose("Successful login for user {uid}...", user.UserID[..8]);
-        }        
-
-        private static string EncryptSecret(string pubKey, byte[] secret)
-        {
-            //Alloc buffer for secret
-            using IMemoryHandle<byte> buffer = Memory.SafeAlloc<byte>(4096);
-            //Try to encrypt the data
-            ERRNO count = TryEncryptClientData(pubKey, secret, buffer.Span);
-            //Clear secret
-            RandomHash.GetRandomBytes(secret);
-            //Convert to base64 string
-            return Convert.ToBase64String(buffer.Span[..(int)count]);
-        }
-
-        public bool UserLoginLocked(IUser user)
-        {
-            //Recover last counter value
-            TimestampedCounter flc = user.FailedLoginCount();
-            if(flc.Count < MaxFailedLogins)
-            {
-                //Period exceeded
-                return false;
-            }
-            //See if the flc timeout period has expired
-            if (flc.LastModified.Add(FailedCountTimeout) < DateTimeOffset.UtcNow)
-            {
-                //clear flc flag
-                user.FailedLoginCount(0);
-                return false;
-            }
-            //Count has been exceeded, and has not timed out yet
-            return true;
-        }
-    }
-}
\ No newline at end of file
diff --git a/VNLib.Plugins.Essentials.Accounts/Endpoints/LogoutEndpoint.cs b/VNLib.Plugins.Essentials.Accounts/Endpoints/LogoutEndpoint.cs
deleted file mode 100644
index cc36609..0000000
--- a/VNLib.Plugins.Essentials.Accounts/Endpoints/LogoutEndpoint.cs
+++ /dev/null
@@ -1,53 +0,0 @@
-/*
-* Copyright (c) 2022 Vaughn Nugent
-* 
-* Library: VNLib
-* Package: VNLib.Plugins.Essentials.Accounts
-* File: LogoutEndpoint.cs 
-*
-* LogoutEndpoint.cs is part of VNLib.Plugins.Essentials.Accounts which is part of the larger 
-* VNLib collection of libraries and utilities.
-*
-* VNLib.Plugins.Essentials.Accounts is free software: you can redistribute it and/or modify 
-* it under the terms of the GNU Affero General Public License as 
-* published by the Free Software Foundation, either version 3 of the
-* License, or (at your option) any later version.
-*
-* VNLib.Plugins.Essentials.Accounts is distributed in the hope that it will be useful,
-* but WITHOUT ANY WARRANTY; without even the implied warranty of
-* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-* GNU Affero General Public License for more details.
-*
-* You should have received a copy of the GNU Affero General Public License
-* along with this program.  If not, see https://www.gnu.org/licenses/.
-*/
-
-using System;
-using System.Net;
-using System.Text.Json;
-using System.Collections.Generic;
-
-using VNLib.Plugins.Extensions.Loading;
-using VNLib.Plugins.Essentials.Endpoints;
-
-namespace VNLib.Plugins.Essentials.Accounts.Endpoints
-{
-    [ConfigurationName("logout_endpoint")]
-    internal class LogoutEndpoint : ProtectedWebEndpoint
-    {
-        
-        public LogoutEndpoint(PluginBase pbase, IReadOnlyDictionary<string, JsonElement> config)
-        {
-            string? path = config["path"].GetString();
-            InitPathAndLog(path, pbase.Log);
-        }
-
-        
-        protected override VfReturnType Post(HttpEntity entity)
-        {
-            entity.InvalidateLogin();
-            entity.CloseResponse(HttpStatusCode.OK);
-            return VfReturnType.VirtualSkip;
-        }
-    }
-}
diff --git a/VNLib.Plugins.Essentials.Accounts/Endpoints/MFAEndpoint.cs b/VNLib.Plugins.Essentials.Accounts/Endpoints/MFAEndpoint.cs
deleted file mode 100644
index 6ebb024..0000000
--- a/VNLib.Plugins.Essentials.Accounts/Endpoints/MFAEndpoint.cs
+++ /dev/null
@@ -1,282 +0,0 @@
-/*
-* Copyright (c) 2022 Vaughn Nugent
-* 
-* Library: VNLib
-* Package: VNLib.Plugins.Essentials.Accounts
-* File: MFAEndpoint.cs 
-*
-* MFAEndpoint.cs is part of VNLib.Plugins.Essentials.Accounts which is part of the larger 
-* VNLib collection of libraries and utilities.
-*
-* VNLib.Plugins.Essentials.Accounts is free software: you can redistribute it and/or modify 
-* it under the terms of the GNU Affero General Public License as 
-* published by the Free Software Foundation, either version 3 of the
-* License, or (at your option) any later version.
-*
-* VNLib.Plugins.Essentials.Accounts is distributed in the hope that it will be useful,
-* but WITHOUT ANY WARRANTY; without even the implied warranty of
-* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-* GNU Affero General Public License for more details.
-*
-* You should have received a copy of the GNU Affero General Public License
-* along with this program.  If not, see https://www.gnu.org/licenses/.
-*/
-
-using System;
-using System.Net;
-using System.Text.Json;
-using System.Threading.Tasks;
-using System.Collections.Generic;
-using System.Text.Json.Serialization;
-
-using VNLib.Hashing;
-using VNLib.Utils;
-using VNLib.Utils.Memory;
-using VNLib.Utils.Logging;
-using VNLib.Utils.Extensions;
-using VNLib.Plugins.Essentials.Users;
-using VNLib.Plugins.Essentials.Extensions;
-using VNLib.Plugins.Essentials.Accounts.MFA;
-using VNLib.Plugins.Extensions.Validation;
-using VNLib.Plugins.Essentials.Endpoints;
-using VNLib.Plugins.Extensions.Loading;
-using VNLib.Plugins.Extensions.Loading.Users;
-
-namespace VNLib.Plugins.Essentials.Accounts.Endpoints
-{
-    [ConfigurationName("mfa_endpoint")]
-    internal sealed class MFAEndpoint : ProtectedWebEndpoint
-    {
-        public const int TOTP_URL_MAX_CHARS = 1024;
-
-        private readonly IUserManager Users;
-        private readonly MFAConfig? MultiFactor;
-
-        public MFAEndpoint(PluginBase pbase, IReadOnlyDictionary<string, JsonElement> config)
-        {
-            string? path = config["path"].GetString();
-            InitPathAndLog(path, pbase.Log);
-
-            Users = pbase.GetUserManager();
-            MultiFactor = pbase.GetMfaConfig();
-        }
-
-        private class TOTPUpdateMessage
-        {
-            [JsonPropertyName("issuer")]
-            public string? Issuer { get; set; }
-            [JsonPropertyName("digits")]
-            public int Digits { get; set; }
-            [JsonPropertyName("period")]
-            public int Period { get; set; }
-            [JsonPropertyName("secret")]
-            public string? Base64EncSecret { get; set; }
-            [JsonPropertyName("algorithm")]
-            public string? Algorithm { get; set; }
-        }
-
-        protected override async ValueTask<VfReturnType> GetAsync(HttpEntity entity)
-        {
-            List<string> enabledModes = new(2);
-            //Load the MFA entry for the user
-            using IUser? user = await Users.GetUserFromIDAsync(entity.Session.UserID);
-            //Set the TOTP flag if set
-            if (!string.IsNullOrWhiteSpace(user?.MFAGetTOTPSecret()))
-            {
-                enabledModes.Add("totp");
-            }
-            //TODO Set fido flag if enabled
-            if (!string.IsNullOrWhiteSpace(""))
-            {
-                enabledModes.Add("fido");
-            }
-            //Return mfa modes as an array
-            entity.CloseResponseJson(HttpStatusCode.OK, enabledModes);
-            return VfReturnType.VirtualSkip;
-        }
-
-        protected override async ValueTask<VfReturnType> PutAsync(HttpEntity entity)
-        {
-            WebMessage webm = new();
-
-            //Get the request message
-            using JsonDocument? mfaRequest = await entity.GetJsonFromFileAsync();
-            if (webm.Assert(mfaRequest != null, "Invalid request"))
-            {
-                entity.CloseResponseJson(HttpStatusCode.BadRequest, webm);
-                return VfReturnType.VirtualSkip;
-            }
-            
-            //Get the type argument
-            string? mfaType = mfaRequest.RootElement.GetPropString("type");
-            if (string.IsNullOrWhiteSpace(mfaType))
-            {
-                webm.Result = "MFA type was not specified";
-                entity.CloseResponseJson(HttpStatusCode.UnprocessableEntity, webm);
-                return VfReturnType.VirtualSkip;
-            }
-            
-            //Make sure the user's account origin is a local account
-            if (webm.Assert(entity.Session.HasLocalAccount(), "Your account uses external authentication and MFA cannot be enabled"))
-            {
-                entity.CloseResponse(webm);
-                return VfReturnType.VirtualSkip;
-            }
-
-            //Make sure mfa is loaded
-            if (webm.Assert(MultiFactor != null, "MFA is not enabled on this server"))
-            {
-                entity.CloseResponse(webm);
-                return VfReturnType.VirtualSkip;
-            }
-
-            //get the user's password challenge
-            using (PrivateString? password = (PrivateString?)mfaRequest.RootElement.GetPropString("challenge"))
-            {
-                if (PrivateString.IsNullOrEmpty(password))
-                {
-                    webm.Result = "Please check your password";
-                    entity.CloseResponseJson(HttpStatusCode.Unauthorized, webm);
-                    return VfReturnType.VirtualSkip;
-                }
-                //Verify challenge
-                if (!entity.Session.VerifyChallenge(password))
-                {
-                    webm.Result = "Please check your password";
-                    entity.CloseResponseJson(HttpStatusCode.Unauthorized, webm);
-                    return VfReturnType.VirtualSkip;
-                }
-            }
-            //Get the user entry
-            using IUser? user = await Users.GetUserFromIDAsync(entity.Session.UserID);
-            if (webm.Assert(user != null, "Please log-out and try again."))
-            {
-                entity.CloseResponse(webm);
-                return VfReturnType.VirtualSkip;
-            }
-            switch (mfaType.ToLower())
-            {
-                //Process a Time based one time password(TOTP) creation/regeneration
-                case "totp":
-                    {
-                        //generate a new secret (passing the buffer which will get copied to an array because the pw bytes can be modified during encryption)
-                        byte[] secretBuffer = user.MFAGenreateTOTPSecret(MultiFactor);
-                        //Alloc output buffer
-                        UnsafeMemoryHandle<byte> outputBuffer = Memory.UnsafeAlloc<byte>(4096, true);
-                        try
-                        {
-                            //Encrypt the secret for the client
-                            ERRNO count = entity.Session.TryEncryptClientData(secretBuffer, outputBuffer.Span);
-                            if (!count)
-                            {
-                                webm.Result = "There was an error updating your credentials";
-                                //If this code is running, the client should have a valid public key stored, but log it anyway
-                                Log.Warn("TOTP secret encryption failed, for requested user {uid}", entity.Session.UserID);
-                                break;
-                            }
-                            webm.Result = new TOTPUpdateMessage()
-                            {
-                                Issuer = MultiFactor.IssuerName,
-                                Digits = MultiFactor.TOTPDigits,
-                                Period = (int)MultiFactor.TOTPPeriod.TotalSeconds,
-                                Algorithm = MultiFactor.TOTPAlg.ToString(),
-                                //Convert the secret to base64 string to send to client
-                                Base64EncSecret = Convert.ToBase64String(outputBuffer.Span[..(int)count])
-                            };
-                            //set success flag
-                            webm.Success = true;
-                        }
-                        finally
-                        {
-                            //dispose the output buffer
-                            outputBuffer.Dispose();
-                            RandomHash.GetRandomBytes(secretBuffer);
-                        }
-                        //Only write changes to the db of operation was successful
-                        await user.ReleaseAsync();
-                    }
-                    break;
-                default:
-                    webm.Result = "The server does not support the specified MFA type";
-                    break;
-            }
-            //Close response
-            entity.CloseResponse(webm);
-            return VfReturnType.VirtualSkip;
-        }
-
-        protected override async ValueTask<VfReturnType> PostAsync(HttpEntity entity)
-        {
-            WebMessage webm = new();
-            try
-            {
-                //Check account type
-                if (!entity.Session.HasLocalAccount())
-                {
-                    webm.Result = "You are using external authentication. Operation failed.";
-                    entity.CloseResponseJson(HttpStatusCode.BadRequest, webm);
-                    return VfReturnType.VirtualSkip;
-                }
-                
-                //get the request
-                using JsonDocument? request = await entity.GetJsonFromFileAsync();
-                if (webm.Assert(request != null, "Invalid request."))
-                {
-                    entity.CloseResponseJson(HttpStatusCode.BadRequest, webm);
-                    return VfReturnType.VirtualSkip;
-                }
-                /*
-                 * An MFA upgrade requires a challenge to be verified because
-                 * it can break the user's ability to access their account
-                 */
-                string? challenge = request.RootElement.GetProperty("challenge").GetString();
-                string? mfaType = request.RootElement.GetProperty("type").GetString();
-                if (!entity.Session.VerifyChallenge(challenge))
-                {
-                    webm.Result = "Please check your password";
-                    //return unauthorized
-                    entity.CloseResponseJson(HttpStatusCode.Unauthorized, webm);
-                    return VfReturnType.VirtualSkip;
-                }
-                //get the user
-                using IUser? user = await Users.GetUserFromIDAsync(entity.Session.UserID);
-                if (user == null)
-                {
-                    return VfReturnType.NotFound;
-                }
-                //Check for totp disable
-                if ("totp".Equals(mfaType, StringComparison.OrdinalIgnoreCase))
-                {
-                    //Clear the TOTP secret
-                    user.MFASetTOTPSecret(null);
-                    //write changes
-                    await user.ReleaseAsync();
-                    webm.Result = "Successfully disabled your TOTP authentication";
-                    webm.Success = true;
-                }
-                else if ("fido".Equals(mfaType, StringComparison.OrdinalIgnoreCase))
-                {
-                    //Clear webauthn changes
-
-                    //write changes
-                    await user.ReleaseAsync();
-                    webm.Result = "Successfully disabled your FIDO authentication";
-                    webm.Success = true;
-                }
-                else
-                {
-                    webm.Result = "Invalid MFA type";
-                }
-                //Must write response while password is in scope
-                entity.CloseResponse(webm);
-                return VfReturnType.VirtualSkip;
-            }
-            catch (KeyNotFoundException)
-            {
-                webm.Result = "The request was is missing required fields";
-                entity.CloseResponseJson(HttpStatusCode.UnprocessableEntity, webm);
-                return VfReturnType.BadRequest;
-            }
-        }
-    }
-}
\ No newline at end of file
diff --git a/VNLib.Plugins.Essentials.Accounts/Endpoints/PasswordResetEndpoint.cs b/VNLib.Plugins.Essentials.Accounts/Endpoints/PasswordResetEndpoint.cs
deleted file mode 100644
index 0a51eb5..0000000
--- a/VNLib.Plugins.Essentials.Accounts/Endpoints/PasswordResetEndpoint.cs
+++ /dev/null
@@ -1,140 +0,0 @@
-/*
-* Copyright (c) 2022 Vaughn Nugent
-* 
-* Library: VNLib
-* Package: VNLib.Plugins.Essentials.Accounts
-* File: PasswordResetEndpoint.cs 
-*
-* PasswordResetEndpoint.cs is part of VNLib.Plugins.Essentials.Accounts which is part of the larger 
-* VNLib collection of libraries and utilities.
-*
-* VNLib.Plugins.Essentials.Accounts is free software: you can redistribute it and/or modify 
-* it under the terms of the GNU Affero General Public License as 
-* published by the Free Software Foundation, either version 3 of the
-* License, or (at your option) any later version.
-*
-* VNLib.Plugins.Essentials.Accounts is distributed in the hope that it will be useful,
-* but WITHOUT ANY WARRANTY; without even the implied warranty of
-* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-* GNU Affero General Public License for more details.
-*
-* You should have received a copy of the GNU Affero General Public License
-* along with this program.  If not, see https://www.gnu.org/licenses/.
-*/
-
-using System;
-using System.Net;
-using System.Text.Json;
-using System.Threading.Tasks;
-using System.Collections.Generic;
-
-using FluentValidation;
-
-using VNLib.Utils.Memory;
-using VNLib.Utils.Extensions;
-using VNLib.Plugins.Essentials.Users;
-using VNLib.Plugins.Essentials.Extensions;
-using VNLib.Plugins.Extensions.Validation;
-using VNLib.Plugins.Extensions.Loading;
-using VNLib.Plugins.Extensions.Loading.Users;
-using VNLib.Plugins.Essentials.Endpoints;
-
-namespace VNLib.Plugins.Essentials.Accounts.Endpoints
-{
-
-    /// <summary>
-    /// Password reset for user's that are logged in and know 
-    /// their passwords to reset their MFA methods
-    /// </summary>
-    [ConfigurationName("password_endpoint")]
-    internal sealed class PasswordChangeEndpoint : ProtectedWebEndpoint
-    {
-        private readonly IUserManager Users;
-        private readonly PasswordHashing Passwords;
-
-        public PasswordChangeEndpoint(PluginBase pbase, IReadOnlyDictionary<string, JsonElement> config)
-        {
-            string? path = config["path"].GetString();
-            InitPathAndLog(path, pbase.Log);
-
-            Users = pbase.GetUserManager();
-            Passwords = pbase.GetPasswords();
-        }
-
-        protected override async ValueTask<VfReturnType> PostAsync(HttpEntity entity)
-        {
-            ValErrWebMessage webm = new();
-            //get the request body
-            using JsonDocument? request = await entity.GetJsonFromFileAsync();
-            if (request == null)
-            {
-                webm.Result = "No request specified";
-                entity.CloseResponseJson(HttpStatusCode.BadRequest, webm);
-                return VfReturnType.VirtualSkip;
-            }
-            //get the user's old password
-            using PrivateString? currentPass = (PrivateString?)request.RootElement.GetPropString("current");
-            //Get password as a private string
-            using PrivateString? newPass = (PrivateString?)request.RootElement.GetPropString("new_password");
-            if (PrivateString.IsNullOrEmpty(currentPass))
-            {
-                webm.Result = "You must specifiy your current password.";
-                entity.CloseResponseJson(HttpStatusCode.UnprocessableEntity, webm);
-                return VfReturnType.VirtualSkip;
-            }
-            if (PrivateString.IsNullOrEmpty(newPass))
-            {
-                webm.Result = "You must specifiy a new password.";
-                entity.CloseResponseJson(HttpStatusCode.UnprocessableEntity, webm);
-                return VfReturnType.VirtualSkip;
-            }
-            //Test the password against minimum
-            if (!AccountValidations.PasswordValidator.Validate((string)newPass, webm))
-            {
-                entity.CloseResponse(webm);
-                return VfReturnType.VirtualSkip;
-            }
-            if (webm.Assert(!currentPass.Equals(newPass), "Passwords cannot be the same."))
-            {
-                entity.CloseResponse(webm);
-                return VfReturnType.VirtualSkip;
-            }
-            //get the user's entry in the table
-            using IUser?  user = await Users.GetUserAndPassFromIDAsync(entity.Session.UserID);
-            if(webm.Assert(user != null, "An error has occured, please log-out and try again"))
-            {
-                entity.CloseResponse(webm);
-                return VfReturnType.VirtualSkip;
-            }
-            //Make sure the account's origin is a local profile
-            if (webm.Assert(user.IsLocalAccount(), "External accounts cannot be modified"))
-            {
-                entity.CloseResponse(webm);
-                return VfReturnType.VirtualSkip;
-            }
-            //Verify the user's old password
-            if (!Passwords.Verify(user.PassHash, currentPass))
-            {
-                webm.Result = "Please check your current password";
-                entity.CloseResponse(webm);
-                return VfReturnType.VirtualSkip;
-            }
-            //Hash the user's new password
-            using PrivateString newPassHash = Passwords.Hash(newPass);
-            //Update the user's password
-            if (!await Users.UpdatePassAsync(user, newPassHash))
-            {
-                //error
-                webm.Result = "Your password could not be updated";
-                entity.CloseResponse(webm);
-                return VfReturnType.VirtualSkip;
-            }
-            await user.ReleaseAsync();
-            //delete the user's MFA entry so they can re-enable it
-            webm.Result = "Your password has been updated";
-            webm.Success = true;
-            entity.CloseResponse(webm);
-            return VfReturnType.VirtualSkip;
-        }
-    }
-}
diff --git a/VNLib.Plugins.Essentials.Accounts/Endpoints/ProfileEndpoint.cs b/VNLib.Plugins.Essentials.Accounts/Endpoints/ProfileEndpoint.cs
deleted file mode 100644
index 45908e7..0000000
--- a/VNLib.Plugins.Essentials.Accounts/Endpoints/ProfileEndpoint.cs
+++ /dev/null
@@ -1,132 +0,0 @@
-/*
-* Copyright (c) 2022 Vaughn Nugent
-* 
-* Library: VNLib
-* Package: VNLib.Plugins.Essentials.Accounts
-* File: ProfileEndpoint.cs 
-*
-* ProfileEndpoint.cs is part of VNLib.Plugins.Essentials.Accounts which is part of the larger 
-* VNLib collection of libraries and utilities.
-*
-* VNLib.Plugins.Essentials.Accounts is free software: you can redistribute it and/or modify 
-* it under the terms of the GNU Affero General Public License as 
-* published by the Free Software Foundation, either version 3 of the
-* License, or (at your option) any later version.
-*
-* VNLib.Plugins.Essentials.Accounts is distributed in the hope that it will be useful,
-* but WITHOUT ANY WARRANTY; without even the implied warranty of
-* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-* GNU Affero General Public License for more details.
-*
-* You should have received a copy of the GNU Affero General Public License
-* along with this program.  If not, see https://www.gnu.org/licenses/.
-*/
-
-using System;
-using System.Net;
-using System.Text.Json;
-using System.Threading.Tasks;
-using System.Collections.Generic;
-
-using VNLib.Utils.Logging;
-using VNLib.Plugins.Essentials.Users;
-using VNLib.Plugins.Essentials.Endpoints;
-using VNLib.Plugins.Essentials.Extensions;
-using VNLib.Plugins.Extensions.Validation;
-using VNLib.Plugins.Extensions.Loading;
-using VNLib.Plugins.Extensions.Loading.Users;
-using static VNLib.Plugins.Essentials.Statics;
-
-
-namespace VNLib.Plugins.Essentials.Accounts.Endpoints
-{
-    /// <summary>
-    /// Provides an http endpoint for user account profile access
-    /// </summary>
-    [ConfigurationName("profile_endpoint")]
-    internal sealed class ProfileEndpoint : ProtectedWebEndpoint
-    {
-        private readonly IUserManager Users;
-        
-        public ProfileEndpoint(PluginBase pbase, IReadOnlyDictionary<string, JsonElement> config)
-        {
-            string? path = config["path"].GetString();
-            
-            InitPathAndLog(path, pbase.Log);
-            //Store user system
-            Users = pbase.GetUserManager();
-        }
-
-        protected override async ValueTask<VfReturnType> GetAsync(HttpEntity entity)
-        {
-            //get user data from database
-            using IUser? user = await Users.GetUserFromIDAsync(entity.Session.UserID);
-            //Make sure the account exists
-            if (user == null || user.Status != UserStatus.Active)
-            {
-                //Account was not found
-                entity.CloseResponse(HttpStatusCode.NotFound);
-                return VfReturnType.VirtualSkip;
-            }
-            //Get the stored profile
-            AccountData? profile = user.GetProfile();
-            //No profile found, so return an empty "profile"
-            profile ??= new()
-            {
-                //set email address
-                EmailAddress = user.EmailAddress,
-                //created time in rfc1123 gmt time
-                Created = user.Created.ToString("R")
-            };
-            //Serialize the profile and return to user
-            entity.CloseResponseJson(HttpStatusCode.OK, profile);
-            return VfReturnType.VirtualSkip;
-        }
-        protected override async ValueTask<VfReturnType> PostAsync(HttpEntity entity)
-        {
-            ValErrWebMessage webm = new();
-            try
-            {
-                //Recover the update message form the client
-                AccountData? updateMessage = await entity.GetJsonFromFileAsync<AccountData>(SR_OPTIONS);
-                if (webm.Assert(updateMessage != null, "Malformatted payload"))
-                {
-                    entity.CloseResponseJson(HttpStatusCode.BadRequest, webm);
-                    return VfReturnType.VirtualSkip;
-                }
-                //Validate the new account data
-                if (!AccountValidations.AccountDataValidator.Validate(updateMessage, webm))
-                {
-                    entity.CloseResponseJson(HttpStatusCode.UnprocessableEntity, webm);
-                    return VfReturnType.VirtualSkip;
-                }
-                //Get the user from database
-                using IUser? user = await Users.GetUserFromIDAsync(entity.Session.UserID);
-                //Make sure the user exists
-                if (webm.Assert(user != null, "Account does not exist"))
-                {
-                    //Should probably log the user out here
-                    entity.CloseResponseJson(HttpStatusCode.NotFound, webm);
-                    return VfReturnType.VirtualSkip;
-                }
-                //Overwite the current profile data (will also sanitize inputs)
-                user.SetProfile(updateMessage);
-                //Update the user only if successful
-                await user.ReleaseAsync();
-                webm.Result = "Successfully updated account";
-                webm.Success = true;
-                entity.CloseResponse(webm);
-                return VfReturnType.VirtualSkip;
-            }
-            //Catch an account update exception
-            catch (UserUpdateException uue)
-            {
-                Log.Error(uue, "An error occured while the user account is being updated");
-                //Return message to client
-                webm.Result = "An error occured while updating your account, try again later";
-                entity.CloseResponseJson(HttpStatusCode.InternalServerError, webm);
-                return VfReturnType.VirtualSkip;
-            }
-        }
-    }
-}
\ No newline at end of file
diff --git a/VNLib.Plugins.Essentials.Accounts/LICENSE.txt b/VNLib.Plugins.Essentials.Accounts/LICENSE.txt
deleted file mode 100644
index d159169..0000000
--- a/VNLib.Plugins.Essentials.Accounts/LICENSE.txt
+++ /dev/null
@@ -1,339 +0,0 @@
-                    GNU GENERAL PUBLIC LICENSE
-                       Version 2, June 1991
-
- Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
- 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
- Everyone is permitted to copy and distribute verbatim copies
- of this license document, but changing it is not allowed.
-
-                            Preamble
-
-  The licenses for most software are designed to take away your
-freedom to share and change it.  By contrast, the GNU General Public
-License is intended to guarantee your freedom to share and change free
-software--to make sure the software is free for all its users.  This
-General Public License applies to most of the Free Software
-Foundation's software and to any other program whose authors commit to
-using it.  (Some other Free Software Foundation software is covered by
-the GNU Lesser General Public License instead.)  You can apply it to
-your programs, too.
-
-  When we speak of free software, we are referring to freedom, not
-price.  Our General Public Licenses are designed to make sure that you
-have the freedom to distribute copies of free software (and charge for
-this service if you wish), that you receive source code or can get it
-if you want it, that you can change the software or use pieces of it
-in new free programs; and that you know you can do these things.
-
-  To protect your rights, we need to make restrictions that forbid
-anyone to deny you these rights or to ask you to surrender the rights.
-These restrictions translate to certain responsibilities for you if you
-distribute copies of the software, or if you modify it.
-
-  For example, if you distribute copies of such a program, whether
-gratis or for a fee, you must give the recipients all the rights that
-you have.  You must make sure that they, too, receive or can get the
-source code.  And you must show them these terms so they know their
-rights.
-
-  We protect your rights with two steps: (1) copyright the software, and
-(2) offer you this license which gives you legal permission to copy,
-distribute and/or modify the software.
-
-  Also, for each author's protection and ours, we want to make certain
-that everyone understands that there is no warranty for this free
-software.  If the software is modified by someone else and passed on, we
-want its recipients to know that what they have is not the original, so
-that any problems introduced by others will not reflect on the original
-authors' reputations.
-
-  Finally, any free program is threatened constantly by software
-patents.  We wish to avoid the danger that redistributors of a free
-program will individually obtain patent licenses, in effect making the
-program proprietary.  To prevent this, we have made it clear that any
-patent must be licensed for everyone's free use or not licensed at all.
-
-  The precise terms and conditions for copying, distribution and
-modification follow.
-
-                    GNU GENERAL PUBLIC LICENSE
-   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
-
-  0. This License applies to any program or other work which contains
-a notice placed by the copyright holder saying it may be distributed
-under the terms of this General Public License.  The "Program", below,
-refers to any such program or work, and a "work based on the Program"
-means either the Program or any derivative work under copyright law:
-that is to say, a work containing the Program or a portion of it,
-either verbatim or with modifications and/or translated into another
-language.  (Hereinafter, translation is included without limitation in
-the term "modification".)  Each licensee is addressed as "you".
-
-Activities other than copying, distribution and modification are not
-covered by this License; they are outside its scope.  The act of
-running the Program is not restricted, and the output from the Program
-is covered only if its contents constitute a work based on the
-Program (independent of having been made by running the Program).
-Whether that is true depends on what the Program does.
-
-  1. You may copy and distribute verbatim copies of the Program's
-source code as you receive it, in any medium, provided that you
-conspicuously and appropriately publish on each copy an appropriate
-copyright notice and disclaimer of warranty; keep intact all the
-notices that refer to this License and to the absence of any warranty;
-and give any other recipients of the Program a copy of this License
-along with the Program.
-
-You may charge a fee for the physical act of transferring a copy, and
-you may at your option offer warranty protection in exchange for a fee.
-
-  2. You may modify your copy or copies of the Program or any portion
-of it, thus forming a work based on the Program, and copy and
-distribute such modifications or work under the terms of Section 1
-above, provided that you also meet all of these conditions:
-
-    a) You must cause the modified files to carry prominent notices
-    stating that you changed the files and the date of any change.
-
-    b) You must cause any work that you distribute or publish, that in
-    whole or in part contains or is derived from the Program or any
-    part thereof, to be licensed as a whole at no charge to all third
-    parties under the terms of this License.
-
-    c) If the modified program normally reads commands interactively
-    when run, you must cause it, when started running for such
-    interactive use in the most ordinary way, to print or display an
-    announcement including an appropriate copyright notice and a
-    notice that there is no warranty (or else, saying that you provide
-    a warranty) and that users may redistribute the program under
-    these conditions, and telling the user how to view a copy of this
-    License.  (Exception: if the Program itself is interactive but
-    does not normally print such an announcement, your work based on
-    the Program is not required to print an announcement.)
-
-These requirements apply to the modified work as a whole.  If
-identifiable sections of that work are not derived from the Program,
-and can be reasonably considered independent and separate works in
-themselves, then this License, and its terms, do not apply to those
-sections when you distribute them as separate works.  But when you
-distribute the same sections as part of a whole which is a work based
-on the Program, the distribution of the whole must be on the terms of
-this License, whose permissions for other licensees extend to the
-entire whole, and thus to each and every part regardless of who wrote it.
-
-Thus, it is not the intent of this section to claim rights or contest
-your rights to work written entirely by you; rather, the intent is to
-exercise the right to control the distribution of derivative or
-collective works based on the Program.
-
-In addition, mere aggregation of another work not based on the Program
-with the Program (or with a work based on the Program) on a volume of
-a storage or distribution medium does not bring the other work under
-the scope of this License.
-
-  3. You may copy and distribute the Program (or a work based on it,
-under Section 2) in object code or executable form under the terms of
-Sections 1 and 2 above provided that you also do one of the following:
-
-    a) Accompany it with the complete corresponding machine-readable
-    source code, which must be distributed under the terms of Sections
-    1 and 2 above on a medium customarily used for software interchange; or,
-
-    b) Accompany it with a written offer, valid for at least three
-    years, to give any third party, for a charge no more than your
-    cost of physically performing source distribution, a complete
-    machine-readable copy of the corresponding source code, to be
-    distributed under the terms of Sections 1 and 2 above on a medium
-    customarily used for software interchange; or,
-
-    c) Accompany it with the information you received as to the offer
-    to distribute corresponding source code.  (This alternative is
-    allowed only for noncommercial distribution and only if you
-    received the program in object code or executable form with such
-    an offer, in accord with Subsection b above.)
-
-The source code for a work means the preferred form of the work for
-making modifications to it.  For an executable work, complete source
-code means all the source code for all modules it contains, plus any
-associated interface definition files, plus the scripts used to
-control compilation and installation of the executable.  However, as a
-special exception, the source code distributed need not include
-anything that is normally distributed (in either source or binary
-form) with the major components (compiler, kernel, and so on) of the
-operating system on which the executable runs, unless that component
-itself accompanies the executable.
-
-If distribution of executable or object code is made by offering
-access to copy from a designated place, then offering equivalent
-access to copy the source code from the same place counts as
-distribution of the source code, even though third parties are not
-compelled to copy the source along with the object code.
-
-  4. You may not copy, modify, sublicense, or distribute the Program
-except as expressly provided under this License.  Any attempt
-otherwise to copy, modify, sublicense or distribute the Program is
-void, and will automatically terminate your rights under this License.
-However, parties who have received copies, or rights, from you under
-this License will not have their licenses terminated so long as such
-parties remain in full compliance.
-
-  5. You are not required to accept this License, since you have not
-signed it.  However, nothing else grants you permission to modify or
-distribute the Program or its derivative works.  These actions are
-prohibited by law if you do not accept this License.  Therefore, by
-modifying or distributing the Program (or any work based on the
-Program), you indicate your acceptance of this License to do so, and
-all its terms and conditions for copying, distributing or modifying
-the Program or works based on it.
-
-  6. Each time you redistribute the Program (or any work based on the
-Program), the recipient automatically receives a license from the
-original licensor to copy, distribute or modify the Program subject to
-these terms and conditions.  You may not impose any further
-restrictions on the recipients' exercise of the rights granted herein.
-You are not responsible for enforcing compliance by third parties to
-this License.
-
-  7. If, as a consequence of a court judgment or allegation of patent
-infringement or for any other reason (not limited to patent issues),
-conditions are imposed on you (whether by court order, agreement or
-otherwise) that contradict the conditions of this License, they do not
-excuse you from the conditions of this License.  If you cannot
-distribute so as to satisfy simultaneously your obligations under this
-License and any other pertinent obligations, then as a consequence you
-may not distribute the Program at all.  For example, if a patent
-license would not permit royalty-free redistribution of the Program by
-all those who receive copies directly or indirectly through you, then
-the only way you could satisfy both it and this License would be to
-refrain entirely from distribution of the Program.
-
-If any portion of this section is held invalid or unenforceable under
-any particular circumstance, the balance of the section is intended to
-apply and the section as a whole is intended to apply in other
-circumstances.
-
-It is not the purpose of this section to induce you to infringe any
-patents or other property right claims or to contest validity of any
-such claims; this section has the sole purpose of protecting the
-integrity of the free software distribution system, which is
-implemented by public license practices.  Many people have made
-generous contributions to the wide range of software distributed
-through that system in reliance on consistent application of that
-system; it is up to the author/donor to decide if he or she is willing
-to distribute software through any other system and a licensee cannot
-impose that choice.
-
-This section is intended to make thoroughly clear what is believed to
-be a consequence of the rest of this License.
-
-  8. If the distribution and/or use of the Program is restricted in
-certain countries either by patents or by copyrighted interfaces, the
-original copyright holder who places the Program under this License
-may add an explicit geographical distribution limitation excluding
-those countries, so that distribution is permitted only in or among
-countries not thus excluded.  In such case, this License incorporates
-the limitation as if written in the body of this License.
-
-  9. The Free Software Foundation may publish revised and/or new versions
-of the General Public License from time to time.  Such new versions will
-be similar in spirit to the present version, but may differ in detail to
-address new problems or concerns.
-
-Each version is given a distinguishing version number.  If the Program
-specifies a version number of this License which applies to it and "any
-later version", you have the option of following the terms and conditions
-either of that version or of any later version published by the Free
-Software Foundation.  If the Program does not specify a version number of
-this License, you may choose any version ever published by the Free Software
-Foundation.
-
-  10. If you wish to incorporate parts of the Program into other free
-programs whose distribution conditions are different, write to the author
-to ask for permission.  For software which is copyrighted by the Free
-Software Foundation, write to the Free Software Foundation; we sometimes
-make exceptions for this.  Our decision will be guided by the two goals
-of preserving the free status of all derivatives of our free software and
-of promoting the sharing and reuse of software generally.
-
-                            NO WARRANTY
-
-  11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
-FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
-OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
-PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
-OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
-MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
-TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
-PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
-REPAIR OR CORRECTION.
-
-  12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
-WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
-REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
-INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
-OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
-TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
-YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
-PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
-POSSIBILITY OF SUCH DAMAGES.
-
-                     END OF TERMS AND CONDITIONS
-
-            How to Apply These Terms to Your New Programs
-
-  If you develop a new program, and you want it to be of the greatest
-possible use to the public, the best way to achieve this is to make it
-free software which everyone can redistribute and change under these terms.
-
-  To do so, attach the following notices to the program.  It is safest
-to attach them to the start of each source file to most effectively
-convey the exclusion of warranty; and each file should have at least
-the "copyright" line and a pointer to where the full notice is found.
-
-    <one line to give the program's name and a brief idea of what it does.>
-    Copyright (C) <year>  <name of author>
-
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation; either version 2 of the License, or
-    (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License along
-    with this program; if not, write to the Free Software Foundation, Inc.,
-    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-
-Also add information on how to contact you by electronic and paper mail.
-
-If the program is interactive, make it output a short notice like this
-when it starts in an interactive mode:
-
-    Gnomovision version 69, Copyright (C) year name of author
-    Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
-    This is free software, and you are welcome to redistribute it
-    under certain conditions; type `show c' for details.
-
-The hypothetical commands `show w' and `show c' should show the appropriate
-parts of the General Public License.  Of course, the commands you use may
-be called something other than `show w' and `show c'; they could even be
-mouse-clicks or menu items--whatever suits your program.
-
-You should also get your employer (if you work as a programmer) or your
-school, if any, to sign a "copyright disclaimer" for the program, if
-necessary.  Here is a sample; alter the names:
-
-  Yoyodyne, Inc., hereby disclaims all copyright interest in the program
-  `Gnomovision' (which makes passes at compilers) written by James Hacker.
-
-  <signature of Ty Coon>, 1 April 1989
-  Ty Coon, President of Vice
-
-This General Public License does not permit incorporating your program into
-proprietary programs.  If your program is a subroutine library, you may
-consider it more useful to permit linking proprietary applications with the
-library.  If this is what you want to do, use the GNU Lesser General
-Public License instead of this License.
diff --git a/VNLib.Plugins.Essentials.Accounts/MFA/FidoAuthenticatorSelection.cs b/VNLib.Plugins.Essentials.Accounts/MFA/FidoAuthenticatorSelection.cs
deleted file mode 100644
index 0ea6dad..0000000
--- a/VNLib.Plugins.Essentials.Accounts/MFA/FidoAuthenticatorSelection.cs
+++ /dev/null
@@ -1,40 +0,0 @@
-/*
-* Copyright (c) 2022 Vaughn Nugent
-* 
-* Library: VNLib
-* Package: VNLib.Plugins.Essentials.Accounts
-* File: FidoAuthenticatorSelection.cs 
-*
-* FidoAuthenticatorSelection.cs is part of VNLib.Plugins.Essentials.Accounts which is part of the larger 
-* VNLib collection of libraries and utilities.
-*
-* VNLib.Plugins.Essentials.Accounts is free software: you can redistribute it and/or modify 
-* it under the terms of the GNU Affero General Public License as 
-* published by the Free Software Foundation, either version 3 of the
-* License, or (at your option) any later version.
-*
-* VNLib.Plugins.Essentials.Accounts is distributed in the hope that it will be useful,
-* but WITHOUT ANY WARRANTY; without even the implied warranty of
-* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-* GNU Affero General Public License for more details.
-*
-* You should have received a copy of the GNU Affero General Public License
-* along with this program.  If not, see https://www.gnu.org/licenses/.
-*/
-
-using System.Text.Json.Serialization;
-
-#nullable enable
-
-namespace VNLib.Plugins.Essentials.Accounts.MFA
-{
-    class FidoAuthenticatorSelection
-    {
-        [JsonPropertyName("requireResidentKey")]
-        public bool RequireResidentKey { get; set; } = false;
-        [JsonPropertyName("authenticatorAttachment")]
-        public string? AuthenticatorAttachment { get; set; } = "cross-platform";
-        [JsonPropertyName("userVerification")]
-        public string? UserVerification { get; set; } = "required";
-    }
-}
diff --git a/VNLib.Plugins.Essentials.Accounts/MFA/FidoRegClientData.cs b/VNLib.Plugins.Essentials.Accounts/MFA/FidoRegClientData.cs
deleted file mode 100644
index 1ef7d59..0000000
--- a/VNLib.Plugins.Essentials.Accounts/MFA/FidoRegClientData.cs
+++ /dev/null
@@ -1,40 +0,0 @@
-/*
-* Copyright (c) 2022 Vaughn Nugent
-* 
-* Library: VNLib
-* Package: VNLib.Plugins.Essentials.Accounts
-* File: FidoRegClientData.cs 
-*
-* FidoRegClientData.cs is part of VNLib.Plugins.Essentials.Accounts which is part of the larger 
-* VNLib collection of libraries and utilities.
-*
-* VNLib.Plugins.Essentials.Accounts is free software: you can redistribute it and/or modify 
-* it under the terms of the GNU Affero General Public License as 
-* published by the Free Software Foundation, either version 3 of the
-* License, or (at your option) any later version.
-*
-* VNLib.Plugins.Essentials.Accounts is distributed in the hope that it will be useful,
-* but WITHOUT ANY WARRANTY; without even the implied warranty of
-* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-* GNU Affero General Public License for more details.
-*
-* You should have received a copy of the GNU Affero General Public License
-* along with this program.  If not, see https://www.gnu.org/licenses/.
-*/
-
-using System.Text.Json.Serialization;
-
-#nullable enable
-
-namespace VNLib.Plugins.Essentials.Accounts.MFA
-{
-    internal class FidoRegClientData
-    {
-        [JsonPropertyName("challenge")]
-        public string? Challenge { get; set; }
-        [JsonPropertyName("origin")]
-        public string? Origin { get; set; }
-        [JsonPropertyName("type")]
-        public string? Type { get; set; }
-    }
-}
diff --git a/VNLib.Plugins.Essentials.Accounts/MFA/FidoRegistrationMessage.cs b/VNLib.Plugins.Essentials.Accounts/MFA/FidoRegistrationMessage.cs
deleted file mode 100644
index e8fbcc4..0000000
--- a/VNLib.Plugins.Essentials.Accounts/MFA/FidoRegistrationMessage.cs
+++ /dev/null
@@ -1,52 +0,0 @@
-/*
-* Copyright (c) 2022 Vaughn Nugent
-* 
-* Library: VNLib
-* Package: VNLib.Plugins.Essentials.Accounts
-* File: FidoRegistrationMessage.cs 
-*
-* FidoRegistrationMessage.cs is part of VNLib.Plugins.Essentials.Accounts which is part of the larger 
-* VNLib collection of libraries and utilities.
-*
-* VNLib.Plugins.Essentials.Accounts is free software: you can redistribute it and/or modify 
-* it under the terms of the GNU Affero General Public License as 
-* published by the Free Software Foundation, either version 3 of the
-* License, or (at your option) any later version.
-*
-* VNLib.Plugins.Essentials.Accounts is distributed in the hope that it will be useful,
-* but WITHOUT ANY WARRANTY; without even the implied warranty of
-* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-* GNU Affero General Public License for more details.
-*
-* You should have received a copy of the GNU Affero General Public License
-* along with this program.  If not, see https://www.gnu.org/licenses/.
-*/
-
-using System.Text.Json.Serialization;
-
-#nullable enable
-
-namespace VNLib.Plugins.Essentials.Accounts.MFA
-{
-    /// <summary>
-    /// Represents a fido device registration message to be sent
-    /// to a currently signed in user
-    /// </summary>
-    class FidoRegistrationMessage
-    {
-        [JsonPropertyName("id")]
-        public string? GuidUserId { get; set; }
-        [JsonPropertyName("challenge")]
-        public string? Base64Challenge { get; set; } = null;
-        [JsonPropertyName("timeout")]
-        public int Timeout { get; set; } = 60000;
-        [JsonPropertyName("cose_alg")]
-        public int CoseAlgNumber { get; set; }
-        [JsonPropertyName("rp_name")]
-        public string? SiteName { get; set; }
-        [JsonPropertyName("attestation")]
-        public string? AttestationType { get; set; } = "none";
-        [JsonPropertyName("authenticatorSelection")]
-        public FidoAuthenticatorSelection? AuthSelection { get; set; } = new();
-    }
-}
diff --git a/VNLib.Plugins.Essentials.Accounts/MFA/MFAConfig.cs b/VNLib.Plugins.Essentials.Accounts/MFA/MFAConfig.cs
deleted file mode 100644
index 03d5a20..0000000
--- a/VNLib.Plugins.Essentials.Accounts/MFA/MFAConfig.cs
+++ /dev/null
@@ -1,103 +0,0 @@
-/*
-* Copyright (c) 2022 Vaughn Nugent
-* 
-* Library: VNLib
-* Package: VNLib.Plugins.Essentials.Accounts
-* File: MFAConfig.cs 
-*
-* MFAConfig.cs is part of VNLib.Plugins.Essentials.Accounts which is part of the larger 
-* VNLib collection of libraries and utilities.
-*
-* VNLib.Plugins.Essentials.Accounts is free software: you can redistribute it and/or modify 
-* it under the terms of the GNU Affero General Public License as 
-* published by the Free Software Foundation, either version 3 of the
-* License, or (at your option) any later version.
-*
-* VNLib.Plugins.Essentials.Accounts is distributed in the hope that it will be useful,
-* but WITHOUT ANY WARRANTY; without even the implied warranty of
-* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-* GNU Affero General Public License for more details.
-*
-* You should have received a copy of the GNU Affero General Public License
-* along with this program.  If not, see https://www.gnu.org/licenses/.
-*/
-
-using System;
-using System.Linq;
-using System.Text.Json;
-using System.Collections.Generic;
-
-using VNLib.Hashing;
-using VNLib.Utils.Extensions;
-using VNLib.Hashing.IdentityUtility;
-
-namespace VNLib.Plugins.Essentials.Accounts.MFA
-{
-    internal class MFAConfig
-    {
-        public ReadOnlyJsonWebKey? MFASecret { get; set; }
-
-        public bool TOTPEnabled { get; }
-        public string? IssuerName { get; }
-        public TimeSpan TOTPPeriod { get; }
-        public HashAlg TOTPAlg { get; }
-        public int TOTPDigits { get; }
-        public int TOTPSecretBytes { get; }
-        public int TOTPTimeWindowSteps { get; }
-
-
-        public bool FIDOEnabled { get; }
-        public int FIDOChallangeSize { get; }
-        public int FIDOTimeout { get; }
-        public string? FIDOSiteName { get; }
-        public string? FIDOAttestationType { get; }
-        public FidoAuthenticatorSelection? FIDOAuthSelection { get; }
-
-        public TimeSpan UpgradeValidFor { get; }
-        public int NonceLenBytes { get; }
-
-        public MFAConfig(IReadOnlyDictionary<string, JsonElement> conf)
-        {
-            UpgradeValidFor = conf["upgrade_expires_secs"].GetTimeSpan(TimeParseType.Seconds);
-            NonceLenBytes = conf["nonce_size"].GetInt32();
-            string siteName = conf["site_name"].GetString() ?? throw new KeyNotFoundException("Missing required key 'site_name' in 'mfa' config");
-
-            //Totp setup
-            if (conf.TryGetValue("totp", out JsonElement totpEl))
-            {
-                IReadOnlyDictionary<string, JsonElement> totp = totpEl.EnumerateObject().ToDictionary(k => k.Name, k => k.Value);
-
-                //Get totp config
-                IssuerName = siteName;
-                //Get alg name
-                string TOTPAlgName = totp["algorithm"].GetString()?.ToUpper() ?? throw new KeyNotFoundException("Missing required key 'algorithm' in plugin 'mfa' config");
-                //Parse from enum string
-                TOTPAlg = Enum.Parse<HashAlg>(TOTPAlgName);
-
-               
-                TOTPDigits = totp["digits"].GetInt32();
-                TOTPPeriod = TimeSpan.FromSeconds(totp["period_secs"].GetInt32());
-                TOTPSecretBytes = totp["secret_size"].GetInt32();
-                TOTPTimeWindowSteps = totp["window_size"].GetInt32();
-                //Set enabled flag
-                TOTPEnabled = true;
-            }
-            //Fido setup
-            if(conf.TryGetValue("fido", out JsonElement fidoEl))
-            {
-                IReadOnlyDictionary<string, JsonElement> fido = fidoEl.EnumerateObject().ToDictionary(k => k.Name, k => k.Value);
-                FIDOChallangeSize = fido["challenge_size"].GetInt32();
-                FIDOAttestationType = fido["attestation"].GetString();
-                FIDOTimeout = fido["timeout"].GetInt32();
-                FIDOSiteName = siteName;
-                //Deserailze a 
-                if(fido.TryGetValue("authenticatorSelection", out JsonElement authSel))
-                {
-                    FIDOAuthSelection = authSel.Deserialize<FidoAuthenticatorSelection>();
-                }
-                //Set enabled flag
-                FIDOEnabled = true;
-            }
-        }
-    }
-}
diff --git a/VNLib.Plugins.Essentials.Accounts/MFA/MFAType.cs b/VNLib.Plugins.Essentials.Accounts/MFA/MFAType.cs
deleted file mode 100644
index 208eea3..0000000
--- a/VNLib.Plugins.Essentials.Accounts/MFA/MFAType.cs
+++ /dev/null
@@ -1,31 +0,0 @@
-/*
-* Copyright (c) 2022 Vaughn Nugent
-* 
-* Library: VNLib
-* Package: VNLib.Plugins.Essentials.Accounts
-* File: MFAType.cs 
-*
-* MFAType.cs is part of VNLib.Plugins.Essentials.Accounts which is part of the larger 
-* VNLib collection of libraries and utilities.
-*
-* VNLib.Plugins.Essentials.Accounts is free software: you can redistribute it and/or modify 
-* it under the terms of the GNU Affero General Public License as 
-* published by the Free Software Foundation, either version 3 of the
-* License, or (at your option) any later version.
-*
-* VNLib.Plugins.Essentials.Accounts is distributed in the hope that it will be useful,
-* but WITHOUT ANY WARRANTY; without even the implied warranty of
-* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-* GNU Affero General Public License for more details.
-*
-* You should have received a copy of the GNU Affero General Public License
-* along with this program.  If not, see https://www.gnu.org/licenses/.
-*/
-
-namespace VNLib.Plugins.Essentials.Accounts.MFA
-{
-    public enum MFAType
-    {
-        TOTP, FIDO, PGP
-    }
-}
diff --git a/VNLib.Plugins.Essentials.Accounts/MFA/MFAUpgrade.cs b/VNLib.Plugins.Essentials.Accounts/MFA/MFAUpgrade.cs
deleted file mode 100644
index 5577d51..0000000
--- a/VNLib.Plugins.Essentials.Accounts/MFA/MFAUpgrade.cs
+++ /dev/null
@@ -1,65 +0,0 @@
-/*
-* Copyright (c) 2022 Vaughn Nugent
-* 
-* Library: VNLib
-* Package: VNLib.Plugins.Essentials.Accounts
-* File: MFAUpgrade.cs 
-*
-* MFAUpgrade.cs is part of VNLib.Plugins.Essentials.Accounts which is part of the larger 
-* VNLib collection of libraries and utilities.
-*
-* VNLib.Plugins.Essentials.Accounts is free software: you can redistribute it and/or modify 
-* it under the terms of the GNU Affero General Public License as 
-* published by the Free Software Foundation, either version 3 of the
-* License, or (at your option) any later version.
-*
-* VNLib.Plugins.Essentials.Accounts is distributed in the hope that it will be useful,
-* but WITHOUT ANY WARRANTY; without even the implied warranty of
-* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-* GNU Affero General Public License for more details.
-*
-* You should have received a copy of the GNU Affero General Public License
-* along with this program.  If not, see https://www.gnu.org/licenses/.
-*/
-
-using System.Text.Json.Serialization;
-
-#nullable enable
-
-namespace VNLib.Plugins.Essentials.Accounts.MFA
-{
-    internal class MFAUpgrade
-    {
-        /// <summary>
-        /// The login's client id specifier
-        /// </summary>
-        [JsonPropertyName("cid")]
-        public string? ClientID { get; set; }
-        /// <summary>
-        /// The id of the user that is requesting a login
-        /// </summary>
-        [JsonPropertyName("uname")]
-        public string? UserName{ get; set; }
-        /// <summary>
-        /// The <see cref="MFAType"/> of the upgrade request
-        /// </summary>
-        [JsonPropertyName("type")]
-        public MFAType Type { get; set; }
-        /// <summary>
-        /// The a base64 encoded string of the user's 
-        /// public key
-        /// </summary>
-        [JsonPropertyName("pubkey")]
-        public string? Base64PubKey { get; set; }
-        /// <summary>
-        /// The user's specified language
-        /// </summary>
-        [JsonPropertyName("lang")]
-        public string? ClientLocalLanguage { get; set; }
-        /// <summary>
-        /// The encrypted password token for the client
-        /// </summary>
-        [JsonPropertyName("cd")]
-        public string? PwClientData { get; set; }
-    }
-}
diff --git a/VNLib.Plugins.Essentials.Accounts/MFA/UserMFAExtensions.cs b/VNLib.Plugins.Essentials.Accounts/MFA/UserMFAExtensions.cs
deleted file mode 100644
index 1ec9953..0000000
--- a/VNLib.Plugins.Essentials.Accounts/MFA/UserMFAExtensions.cs
+++ /dev/null
@@ -1,384 +0,0 @@
-/*
-* Copyright (c) 2022 Vaughn Nugent
-* 
-* Library: VNLib
-* Package: VNLib.Plugins.Essentials.Accounts
-* File: UserMFAExtensions.cs 
-*
-* UserMFAExtensions.cs is part of VNLib.Plugins.Essentials.Accounts which is part of the larger 
-* VNLib collection of libraries and utilities.
-*
-* VNLib.Plugins.Essentials.Accounts is free software: you can redistribute it and/or modify 
-* it under the terms of the GNU Affero General Public License as 
-* published by the Free Software Foundation, either version 3 of the
-* License, or (at your option) any later version.
-*
-* VNLib.Plugins.Essentials.Accounts is distributed in the hope that it will be useful,
-* but WITHOUT ANY WARRANTY; without even the implied warranty of
-* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-* GNU Affero General Public License for more details.
-*
-* You should have received a copy of the GNU Affero General Public License
-* along with this program.  If not, see https://www.gnu.org/licenses/.
-*/
-
-using System;
-using System.Linq;
-using System.Text.Json;
-using System.Collections.Generic;
-using System.Security.Cryptography;
-using System.Text.Json.Serialization;
-using System.Diagnostics.CodeAnalysis;
-
-using VNLib.Hashing;
-using VNLib.Utils;
-using VNLib.Utils.Memory;
-using VNLib.Utils.Extensions;
-using VNLib.Hashing.IdentityUtility;
-using VNLib.Plugins.Essentials.Users;
-using VNLib.Plugins.Essentials.Sessions;
-using VNLib.Plugins.Extensions.Loading;
-
-namespace VNLib.Plugins.Essentials.Accounts.MFA
-{
-
-    internal static class UserMFAExtensions
-    {
-        public const string WEBAUTHN_KEY_ENTRY = "mfa.fido";
-        public const string TOTP_KEY_ENTRY = "mfa.totp";
-        public const string PGP_PUB_KEY = "mfa.pgpp";
-        public const string SESSION_SIG_KEY = "mfa.sig";
-
-        /// <summary>
-        /// Determines if the user account has an 
-        /// </summary>
-        /// <param name="user"></param>
-        /// <returns>True if any form of MFA is enabled for the user account</returns>
-        public static bool MFAEnabled(this IUser user)
-        {
-            return !(string.IsNullOrWhiteSpace(user[TOTP_KEY_ENTRY]) && string.IsNullOrWhiteSpace(user[WEBAUTHN_KEY_ENTRY]));
-        }
-
-        #region totp
-
-        /// <summary>
-        /// Recovers the base32 encoded TOTP secret for the current user
-        /// </summary>
-        /// <param name="user"></param>
-        /// <returns>The base32 encoded TOTP secret, or an emtpy string (user spec) if not set</returns>
-        public static string MFAGetTOTPSecret(this IUser user) => user[TOTP_KEY_ENTRY];
-
-        /// <summary>
-        /// Stores or removes the current user's TOTP secret, stored in base32 format
-        /// </summary>
-        /// <param name="user"></param>
-        /// <param name="secret">The base32 encoded TOTP secret</param>
-        public static void MFASetTOTPSecret(this IUser user, string? secret) => user[TOTP_KEY_ENTRY] = secret!;        
-     
-
-        /// <summary>
-        /// Generates/overwrites the current user's TOTP secret entry and returns a 
-        /// byte array of the generated secret bytes
-        /// </summary>
-        /// <param name="entry">The <see cref="MFAEntry"/> to modify the TOTP configuration of</param>
-        /// <returns>The raw secret that was encrypted and stored in the <see cref="MFAEntry"/>, to send to the client</returns>
-        /// <exception cref="OutOfMemoryException"></exception>
-        public static byte[] MFAGenreateTOTPSecret(this IUser user, MFAConfig config)
-        {
-            //Generate a random key
-            byte[] newSecret = RandomHash.GetRandomBytes(config.TOTPSecretBytes);
-            //Store secret in user storage
-            user.MFASetTOTPSecret(VnEncoding.ToBase32String(newSecret, false));
-            //return the raw secret bytes
-            return newSecret;
-        }
-
-        /// <summary>
-        /// Verfies the supplied TOTP code against the current user's totp codes
-        /// This method should not be used for verifying TOTP codes for authentication
-        /// </summary>
-        /// <param name="user">The user account to verify the TOTP code against</param>
-        /// <param name="code">The code to verify</param>
-        /// <param name="config">A readonly referrence to the MFA configuration structure</param>
-        /// <returns>True if the user has TOTP configured and code matches against its TOTP secret entry, false otherwise</returns>
-        /// <exception cref="FormatException"></exception>
-        /// <exception cref="OutOfMemoryException"></exception>
-        public static bool VerifyTOTP(this MFAConfig config, IUser user, uint code)
-        {
-            //Get the base32 TOTP secret for the user and make sure its actually set
-            string base32Secret = user.MFAGetTOTPSecret();
-            if (string.IsNullOrWhiteSpace(base32Secret))
-            {
-                return false;
-            }
-            //Alloc buffer with zero o
-            using UnsafeMemoryHandle<byte> buffer = Memory.UnsafeAlloc<byte>(base32Secret.Length, true);
-            ERRNO count = VnEncoding.TryFromBase32Chars(base32Secret, buffer);
-            //Verify the TOTP using the decrypted secret
-            return count && VerifyTOTP(code, buffer.AsSpan(0, count), config);
-        }
-
-        private static bool VerifyTOTP(uint totpCode, ReadOnlySpan<byte> userSecret, MFAConfig config)
-        {
-            //A basic attempt at a constant time TOTP verification, run the calculation a fixed number of times, regardless of the resutls
-            bool codeMatches = false;
-
-            //cache current time
-            DateTimeOffset currentUtc = DateTimeOffset.UtcNow;
-            //Start the current window with the minimum window
-            int currenStep = -config.TOTPTimeWindowSteps;
-            Span<byte> stepBuffer = stackalloc byte[sizeof(long)];
-            Span<byte> hashBuffer = stackalloc byte[(int)config.TOTPAlg];
-            //Run the loop at least once to allow a 0 step tight window
-            do
-            {
-                //Calculate the window by multiplying the window by the current step, then add it to the current time offset to produce a new window
-                DateTimeOffset window = currentUtc.Add(config.TOTPPeriod.Multiply(currenStep));
-                //calculate the time step
-                long timeStep = (long)Math.Floor(window.ToUnixTimeSeconds() / config.TOTPPeriod.TotalSeconds);
-                //try to compute the hash
-                _ = BitConverter.TryWriteBytes(stepBuffer, timeStep) ? 0 : throw new InternalBufferTooSmallException("Failed to format TOTP time step");
-                //If platform is little endian, reverse the byte order
-                if (BitConverter.IsLittleEndian)
-                {
-                    stepBuffer.Reverse();
-                }
-                ERRNO result = ManagedHash.ComputeHmac(userSecret, stepBuffer, hashBuffer, config.TOTPAlg);
-                //try to compute the hash of the time step
-                if (result < 1)
-                {
-                    throw new InternalBufferTooSmallException("Failed to compute TOTP time step hash because the buffer was too small");
-                }
-                //Hash bytes
-                ReadOnlySpan<byte> hash = hashBuffer[..(int)result];
-                //compute the TOTP code and compare it to the supplied, then store the result
-                codeMatches |= (totpCode == CalcTOTPCode(hash, config));
-                //next step
-                currenStep++;
-            } while (currenStep <= config.TOTPTimeWindowSteps);
-
-            return codeMatches;
-        }
-
-        private static uint CalcTOTPCode(ReadOnlySpan<byte> hash, MFAConfig config)
-        {
-            //Calculate the offset, RFC defines, the lower 4 bits of the last byte in the hash output
-            byte offset = (byte)(hash[^1] & 0x0Fu);
-
-            uint TOTPCode;
-            if (BitConverter.IsLittleEndian)
-            {
-                //Store the code components
-                TOTPCode = (hash[offset] & 0x7Fu) << 24 | (hash[offset + 1] & 0xFFu) << 16 | (hash[offset + 2] & 0xFFu) << 8 | hash[offset + 3] & 0xFFu;
-            }
-            else
-            {
-                //Store the code components (In reverse order for big-endian machines)
-                TOTPCode = (hash[offset + 3] & 0x7Fu) << 24 | (hash[offset + 2] & 0xFFu) << 16 | (hash[offset + 1] & 0xFFu) << 8 | hash[offset] & 0xFFu;
-            }
-            //calculate the modulus value
-            TOTPCode %= (uint)Math.Pow(10, config.TOTPDigits);
-            return TOTPCode;
-        }
-
-        #endregion
-
-        #region loading
-
-        const string MFA_CONFIG_KEY = "mfa";
-
-        /// <summary>
-        /// Gets the plugins ambient <see cref="PasswordHashing"/> if loaded, or loads it if required. This class will
-        /// be unloaded when the plugin us unloaded.
-        /// </summary>
-        /// <param name="plugin"></param>
-        /// <returns>The ambient <see cref="PasswordHashing"/></returns>
-        /// <exception cref="OverflowException"></exception>
-        /// <exception cref="KeyNotFoundException"></exception>
-        /// <exception cref="ObjectDisposedException"></exception>
-        public static MFAConfig? GetMfaConfig(this PluginBase plugin)
-        {
-            static MFAConfig? LoadMfaConfig(PluginBase pbase)
-            {
-                //Try to get the configuration object
-                IReadOnlyDictionary<string, JsonElement>? conf = pbase.TryGetConfig(MFA_CONFIG_KEY);
-
-                if (conf == null)
-                {
-                    return null;
-                }
-                //Init mfa config
-                MFAConfig mfa = new(conf);
-
-                //Recover secret from config and dangerous 'lazy load'
-                _ = pbase.DeferTask(async () =>
-                {
-                    mfa.MFASecret = await pbase.TryGetSecretAsync("mfa_secret").ToJsonWebKey();
-
-                }, 50);
-
-                return mfa;
-            }
-            
-            plugin.ThrowIfUnloaded();
-            //Get/load the passwords one time only
-            return LoadingExtensions.GetOrCreateSingleton(plugin, LoadMfaConfig);
-        }
-
-        #endregion
-
-        #region pgp
-
-        private class PgpMfaCred
-        {
-            [JsonPropertyName("p")]
-            public string? SpkiPublicKey { get; set; }
-
-            [JsonPropertyName("c")]
-            public string? CurveFriendlyName { get; set; }
-        }
-        
-
-        /// <summary>
-        /// Gets the stored PGP public key for the user
-        /// </summary>
-        /// <param name="user"></param>
-        /// <returns>The stored PGP signature key </returns>
-        public static string MFAGetPGPPubKey(this IUser user) => user[PGP_PUB_KEY];
-
-        public static void MFASetPGPPubKey(this IUser user, string? pubKey) => user[PGP_PUB_KEY] = pubKey!;
-
-        public static void VerifySignedData(string data)
-        {
-            
-        }
-
-        #endregion
-
-        #region webauthn
-
-        #endregion
-
-        /// <summary>
-        /// Recovers a signed MFA upgrade JWT and verifies its authenticity, and confrims its not expired,
-        /// then recovers the upgrade mssage
-        /// </summary>
-        /// <param name="config"></param>
-        /// <param name="upgradeJwtString">The signed JWT upgrade message</param>
-        /// <param name="upgrade">The recovered upgrade</param>
-        /// <param name="base64sessionSig">The stored base64 encoded signature from the session that requested an upgrade</param>
-        /// <returns>True if the upgrade was verified, not expired, and was recovered from the signed message, false otherwise</returns>
-        public static bool RecoverUpgrade(this MFAConfig config, ReadOnlySpan<char> upgradeJwtString, ReadOnlySpan<char> base64sessionSig, [NotNullWhen(true)] out MFAUpgrade? upgrade)
-        {
-            //Verifies a jwt stored signature against the actual signature
-            static bool VerifyStoredSig(ReadOnlySpan<char> base64string, ReadOnlySpan<byte> signature)
-            {
-                using UnsafeMemoryHandle<byte> buffer = Memory.UnsafeAlloc<byte>(base64string.Length, true);
-                //Recover base64
-                ERRNO count = VnEncoding.TryFromBase64Chars(base64string, buffer.Span);
-                //Compare
-                return CryptographicOperations.FixedTimeEquals(signature, buffer.Span[..(int)count]);
-            }
-
-            //Verify config secret
-            _ = config.MFASecret ?? throw new InvalidOperationException("MFA config is missing required upgrade signing key");
-
-            upgrade = null;
-            
-            //Parse jwt
-            using JsonWebToken jwt = JsonWebToken.Parse(upgradeJwtString);
-            
-            if (!jwt.VerifyFromJwk(config.MFASecret))
-            {
-                return false;
-            }
-
-            if(!VerifyStoredSig(base64sessionSig, jwt.SignatureData))
-            {
-                return false;
-            }
-            
-            //get request body
-            using JsonDocument doc = jwt.GetPayload();
-            //Recover issued at time
-            DateTimeOffset iat = DateTimeOffset.FromUnixTimeMilliseconds(doc.RootElement.GetProperty("iat").GetInt64());
-            //Verify its not timed out
-            if (iat.Add(config.UpgradeValidFor) < DateTimeOffset.UtcNow)
-            {
-                //expired
-                return false;
-            }
-
-            //Recover the upgrade message
-            upgrade = doc.RootElement.GetProperty("upgrade").Deserialize<MFAUpgrade>();
-            return upgrade != null;
-        }
-
-
-        /// <summary>
-        /// Generates an upgrade for the requested user, using the highest prirotiy method
-        /// </summary>
-        /// <param name="login">The message from the user requesting the login</param>
-        /// <returns>A signed upgrade message the client will pass back to the server after the MFA verification</returns>
-        /// <exception cref="InvalidOperationException"></exception>
-        public static Tuple<string, string>? MFAGetUpgradeIfEnabled(this IUser user, MFAConfig? conf, LoginMessage login, string pwClientData)
-        {
-            //Webauthn config
-
-
-            //Search for totp secret entry
-            string base32Secret = user.MFAGetTOTPSecret();
-
-            //Check totp entry
-            if (!string.IsNullOrWhiteSpace(base32Secret))
-            {
-                //Verify config secret
-                _ = conf?.MFASecret ?? throw new InvalidOperationException("MFA config is missing required upgrade signing key");
-                
-                //setup the upgrade
-                MFAUpgrade upgrade = new()
-                {
-                    //Set totp upgrade type
-                    Type = MFAType.TOTP,
-                    //Store login message details
-                    UserName = login.UserName,
-                    ClientID = login.ClientID,
-                    Base64PubKey = login.ClientPublicKey,
-                    ClientLocalLanguage = login.LocalLanguage,
-                    PwClientData = pwClientData
-                };
-
-                //Init jwt for upgrade
-                return GetUpgradeMessage(upgrade, conf.MFASecret, conf.UpgradeValidFor);
-            }
-            return null;
-        }
-
-        private static Tuple<string, string> GetUpgradeMessage(MFAUpgrade upgrade, ReadOnlyJsonWebKey secret, TimeSpan expires)
-        {
-            //Add some random entropy to the upgrade message, to help prevent forgery
-            string entropy = RandomHash.GetRandomBase32(16);
-            //Init jwt
-            using JsonWebToken upgradeJwt = new();
-            upgradeJwt.WriteHeader(secret.JwtHeader);
-            //Write claims
-            upgradeJwt.InitPayloadClaim()
-                .AddClaim("iat", DateTimeOffset.UtcNow.ToUnixTimeMilliseconds())
-                .AddClaim("upgrade", upgrade)
-                .AddClaim("type", upgrade.Type.ToString().ToLower())
-                .AddClaim("expires", expires.TotalSeconds)
-                .AddClaim("a", entropy)
-                .CommitClaims();
-            
-            //Sign with jwk
-            upgradeJwt.SignFromJwk(secret);
-            
-            //compile and return jwt upgrade
-            return new(upgradeJwt.Compile(), Convert.ToBase64String(upgradeJwt.SignatureData));
-        }
-
-        public static void MfaUpgradeSignature(this in SessionInfo session, string? base64Signature) => session[SESSION_SIG_KEY] = base64Signature!;
-
-        public static string? MfaUpgradeSignature(this in SessionInfo session) => session[SESSION_SIG_KEY];
-    }
-}
diff --git a/VNLib.Plugins.Essentials.Accounts/README.md b/VNLib.Plugins.Essentials.Accounts/README.md
deleted file mode 100644
index fd1098c..0000000
--- a/VNLib.Plugins.Essentials.Accounts/README.md
+++ /dev/null
@@ -1,3 +0,0 @@
-# VNLib.Plugins.Essentials.Accounts
-
-An essentials web plugin that provides endpoints for authenticating, registering, resetting, local user accounts including multi-factor authentication using TOTP (for now).
\ No newline at end of file
diff --git a/VNLib.Plugins.Essentials.Accounts/VNLib.Plugins.Essentials.Accounts.csproj b/VNLib.Plugins.Essentials.Accounts/VNLib.Plugins.Essentials.Accounts.csproj
deleted file mode 100644
index d710cfc..0000000
--- a/VNLib.Plugins.Essentials.Accounts/VNLib.Plugins.Essentials.Accounts.csproj
+++ /dev/null
@@ -1,61 +0,0 @@
-<Project Sdk="Microsoft.NET.Sdk">
-
-  <PropertyGroup>
-    <TargetFramework>net6.0</TargetFramework>
-    <RootNamespace>VNLib.Plugins.Essentials.Accounts</RootNamespace>
-    <Copyright>Copyright © 2022 Vaughn Nugent</Copyright>
-    <Authors>Vaughn Nugent</Authors>
-    <AssemblyName>Accounts</AssemblyName>
-    
-    <PackageId>VNLib.Plugins.Essentials.Accounts</PackageId>
-    <Version>1.0.1.5</Version>
-    <PackageProjectUrl>https://www.vaughnnugent.com/resources</PackageProjectUrl>
-    <SignAssembly>True</SignAssembly>
-    <AssemblyOriginatorKeyFile>\\vaughnnugent.com\Internal\Folder Redirection\vman\Documents\Programming\Software\StrongNameingKey.snk</AssemblyOriginatorKeyFile>
-  </PropertyGroup>
-
-
-  <!-- Resolve nuget dll files and store them in the output dir -->
-  <PropertyGroup>
-    <!--Enable dynamic loading-->
-    <EnableDynamicLoading>true</EnableDynamicLoading>
-    <Nullable>enable</Nullable>
-    <AnalysisLevel>latest-all</AnalysisLevel>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|AnyCPU'">
-    <Deterministic>False</Deterministic>
-  </PropertyGroup>
-  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|AnyCPU'">
-    <Deterministic>False</Deterministic>
-  </PropertyGroup>
-
-  <ItemGroup>
-    <PackageReference Include="ErrorProne.NET.CoreAnalyzers" Version="0.1.2">
-      <PrivateAssets>all</PrivateAssets>
-      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
-    </PackageReference>
-    <PackageReference Include="ErrorProne.NET.Structs" Version="0.1.2">
-      <PrivateAssets>all</PrivateAssets>
-      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
-    </PackageReference>
-    <PackageReference Include="FluentValidation" Version="11.3.0" />
-  </ItemGroup>
-
-  <ItemGroup>
-    <ProjectReference Include="..\..\..\VNLib\Essentials\src\VNLib.Plugins.Essentials.csproj" />
-    <ProjectReference Include="..\..\Extensions\VNLib.Plugins.Extensions.Loading.Sql\VNLib.Plugins.Extensions.Loading.Sql.csproj" />
-    <ProjectReference Include="..\..\Extensions\VNLib.Plugins.Extensions.Validation\VNLib.Plugins.Extensions.Validation.csproj" />
-    <ProjectReference Include="..\..\PluginBase\VNLib.Plugins.PluginBase.csproj" />
-  </ItemGroup>
-
-  <ItemGroup>
-    <None Update="Accounts.json">
-      <CopyToOutputDirectory>Always</CopyToOutputDirectory>
-    </None>
-  </ItemGroup>
-
-  <Target Name="PostBuild" AfterTargets="PostBuildEvent">
-    <Exec Command="start xcopy &quot;$(TargetDir)&quot; &quot;F:\Programming\Web Plugins\DevPlugins\$(TargetName)&quot; /E /Y /R" />
-  </Target>
-
-</Project>
diff --git a/VNLib.Plugins.Essentials.Accounts/Validators/LoginMessageValidation.cs b/VNLib.Plugins.Essentials.Accounts/Validators/LoginMessageValidation.cs
deleted file mode 100644
index 6d96695..0000000
--- a/VNLib.Plugins.Essentials.Accounts/Validators/LoginMessageValidation.cs
+++ /dev/null
@@ -1,70 +0,0 @@
-/*
-* Copyright (c) 2022 Vaughn Nugent
-* 
-* Library: VNLib
-* Package: VNLib.Plugins.Essentials.Accounts
-* File: LoginMessageValidation.cs 
-*
-* LoginMessageValidation.cs is part of VNLib.Plugins.Essentials.Accounts which is part of the larger 
-* VNLib collection of libraries and utilities.
-*
-* VNLib.Plugins.Essentials.Accounts is free software: you can redistribute it and/or modify 
-* it under the terms of the GNU Affero General Public License as 
-* published by the Free Software Foundation, either version 3 of the
-* License, or (at your option) any later version.
-*
-* VNLib.Plugins.Essentials.Accounts is distributed in the hope that it will be useful,
-* but WITHOUT ANY WARRANTY; without even the implied warranty of
-* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-* GNU Affero General Public License for more details.
-*
-* You should have received a copy of the GNU Affero General Public License
-* along with this program.  If not, see https://www.gnu.org/licenses/.
-*/
-
-using System;
-
-using FluentValidation;
-
-using VNLib.Plugins.Extensions.Validation;
-
-namespace VNLib.Plugins.Essentials.Accounts.Validators
-{
-
-    internal class LoginMessageValidation : AbstractValidator<LoginMessage>
-    {
-        public LoginMessageValidation()
-        {
-            RuleFor(static t => t.ClientID)
-                .Length(min: 10, max: 100)
-                .WithMessage(errorMessage: "Your browser is not sending required security information");
-
-            RuleFor(static t => t.ClientPublicKey)
-             .NotEmpty()
-             .Length(min: 50, max: 1000)
-             .WithMessage(errorMessage: "Your browser is not sending required security information");
-
-            /* Rules for user-input on passwords, set max length to avoid DOS */
-            RuleFor(static t => t.Password)
-                .SetValidator(AccountValidations.PasswordValidator);
-            
-            //Username/email address
-            RuleFor(static t => t.UserName)
-                .Length(min: 1, max: 64)
-                .WithName(overridePropertyName: "Email")
-                .EmailAddress()
-                .WithName(overridePropertyName: "Email")
-                .IllegalCharacters()
-                .WithName(overridePropertyName: "Email");               
-
-            RuleFor(static t => t.LocalLanguage)
-                .NotEmpty()
-                .IllegalCharacters()
-                .WithMessage(errorMessage: "Your language is not supported");   
-
-            RuleFor(static t => t.LocalTime.ToUniversalTime())
-                .Must(static time => time > DateTime.UtcNow.AddSeconds(-60) && time < DateTime.UtcNow.AddSeconds(60))
-                .WithMessage(errorMessage: "Please check your system clock");
-        }
-    }
-}