From df582f15340116e4ab8706b36c265a0d9e00f54b Mon Sep 17 00:00:00 2001
From: Bradley Shellnut <bradleyshellnut@protonmail.com>
Date: Thu, 29 Aug 2024 16:12:40 -0700
Subject: [PATCH] Adding mfa page instead of 2FA, starting controller based
 password verification and totp generation.

---
 .../cleanupSessions/+server.ts                |   0
 .../api => oldApis}/collection/+server.ts     |   0
 .../collection}/[id]/items/+server.ts         |  12 +-
 .../collection/[id]/search/+server.ts         |   6 +-
 .../external/game/[id]/+server.ts             |   0
 .../external/search/+server.ts                |   0
 .../api => oldApis}/games/[id]/+server.ts     |   0
 .../api => oldApis}/games/random/+server.ts   |   0
 .../api => oldApis}/games/search/+server.ts   |   0
 .../api => oldApis}/publisher/+server.ts      |   0
 .../api => oldApis}/publisher/[id]/+server.ts |   0
 .../reset-password/+server.ts                 |   4 +-
 .../reset-password/[token]/+server.ts         |  19 +-
 .../api => oldApis}/wishlist/+server.ts       |   0
 .../wishlist}/[id]/items/+server.ts           |  12 +-
 .../wishlist/[id]/search/+server.ts           |   0
 package.json                                  |   6 +-
 pnpm-lock.yaml                                |  78 +++----
 src/lib/components/Header.svelte              |   2 +-
 src/lib/components/signup.svelte              |   2 +-
 src/lib/dtos/verify-password.dto.ts           |   7 +
 .../server/api/controllers/iam.controller.ts  |  10 +
 .../server/api/controllers/mfa.controller.ts  |  39 ++++
 src/lib/server/api/index.ts                   |   2 +
 .../api/infrastructure/database/seed.ts       |   2 +-
 .../infrastructure/database/tables/index.ts   |   2 +-
 ...coveryCodes.ts => recovery-codes.table.ts} |   4 +-
 .../repositories/credentials.repository.ts    |  21 ++
 src/lib/server/api/services/iam.service.ts    |   9 +
 src/lib/server/api/services/totp.service.ts   |  36 ++++
 src/lib/server/api/services/users.service.ts  |  13 ++
 .../(app)/(protected)/list/+layout.server.ts  |  14 +-
 .../(app)/(protected)/profile/+page.server.ts | 198 +++++++++---------
 .../(app)/(protected)/profile/+page.svelte    |  12 +-
 .../{two-factor => mfa}/+page.server.ts       | 198 ++++++++----------
 .../security/{two-factor => mfa}/+page.svelte |   4 +-
 .../recovery-codes/+page.server.ts            |  23 +-
 .../recovery-codes/+page.svelte               |   0
 .../security/password/change/+page.server.ts  |  29 +--
 src/routes/(app)/game/[id]/+page.svelte       |   2 +-
 src/routes/(auth)/+layout.svelte              |   4 +-
 .../{sign-up => signup}/+page.server.ts       |   0
 .../(auth)/{sign-up => signup}/+page.svelte   |   2 +-
 svelte.config.js                              |   3 +-
 44 files changed, 443 insertions(+), 332 deletions(-)
 rename {src/routes/api/crons => oldApis}/cleanupSessions/+server.ts (100%)
 rename {src/routes/api => oldApis}/collection/+server.ts (100%)
 rename {src/routes/api/wishlist => oldApis/collection}/[id]/items/+server.ts (96%)
 rename {src/routes/api => oldApis}/collection/[id]/search/+server.ts (89%)
 rename {src/routes/api => oldApis}/external/game/[id]/+server.ts (100%)
 rename {src/routes/api => oldApis}/external/search/+server.ts (100%)
 rename {src/routes/api => oldApis}/games/[id]/+server.ts (100%)
 rename {src/routes/api => oldApis}/games/random/+server.ts (100%)
 rename {src/routes/api => oldApis}/games/search/+server.ts (100%)
 rename {src/routes/api => oldApis}/publisher/+server.ts (100%)
 rename {src/routes/api => oldApis}/publisher/[id]/+server.ts (100%)
 rename {src/routes/api/auth => oldApis}/reset-password/+server.ts (86%)
 rename {src/routes/api/auth => oldApis}/reset-password/[token]/+server.ts (61%)
 rename {src/routes/api => oldApis}/wishlist/+server.ts (100%)
 rename {src/routes/api/collection => oldApis/wishlist}/[id]/items/+server.ts (96%)
 rename {src/routes/api => oldApis}/wishlist/[id]/search/+server.ts (100%)
 create mode 100644 src/lib/dtos/verify-password.dto.ts
 create mode 100644 src/lib/server/api/controllers/mfa.controller.ts
 rename src/lib/server/api/infrastructure/database/tables/{recoveryCodes.ts => recovery-codes.table.ts} (74%)
 create mode 100644 src/lib/server/api/services/totp.service.ts
 rename src/routes/(app)/(protected)/profile/security/{two-factor => mfa}/+page.server.ts (53%)
 rename src/routes/(app)/(protected)/profile/security/{two-factor => mfa}/+page.svelte (93%)
 rename src/routes/(app)/(protected)/profile/security/{two-factor => mfa}/recovery-codes/+page.server.ts (72%)
 rename src/routes/(app)/(protected)/profile/security/{two-factor => mfa}/recovery-codes/+page.svelte (100%)
 rename src/routes/(auth)/{sign-up => signup}/+page.server.ts (100%)
 rename src/routes/(auth)/{sign-up => signup}/+page.svelte (98%)

diff --git a/src/routes/api/crons/cleanupSessions/+server.ts b/oldApis/cleanupSessions/+server.ts
similarity index 100%
rename from src/routes/api/crons/cleanupSessions/+server.ts
rename to oldApis/cleanupSessions/+server.ts
diff --git a/src/routes/api/collection/+server.ts b/oldApis/collection/+server.ts
similarity index 100%
rename from src/routes/api/collection/+server.ts
rename to oldApis/collection/+server.ts
diff --git a/src/routes/api/wishlist/[id]/items/+server.ts b/oldApis/collection/[id]/items/+server.ts
similarity index 96%
rename from src/routes/api/wishlist/[id]/items/+server.ts
rename to oldApis/collection/[id]/items/+server.ts
index fc7727d..4d9ebe1 100644
--- a/src/routes/api/wishlist/[id]/items/+server.ts
+++ b/oldApis/collection/[id]/items/+server.ts
@@ -1,6 +1,6 @@
-import { error, json } from '@sveltejs/kit';
-
-export async function GET({ url, locals, params }) {
-	const searchParams = Object.fromEntries(url.searchParams);
-	return json({});
-}
+import { error, json } from '@sveltejs/kit';
+
+export async function GET({ url, locals, params }) {
+	const searchParams = Object.fromEntries(url.searchParams);
+	return json({});
+}
diff --git a/src/routes/api/collection/[id]/search/+server.ts b/oldApis/collection/[id]/search/+server.ts
similarity index 89%
rename from src/routes/api/collection/[id]/search/+server.ts
rename to oldApis/collection/[id]/search/+server.ts
index 046f107..528c6f6 100644
--- a/src/routes/api/collection/[id]/search/+server.ts
+++ b/oldApis/collection/[id]/search/+server.ts
@@ -1,14 +1,14 @@
 import { error, json } from '@sveltejs/kit';
 import { eq } from 'drizzle-orm';
-import db from '../../../../../db';
+import {db} from '$lib/server/api/infrastructure/database';
 import { collection_items, usersTable } from '$db/schema';
 
 // Search a user's collection
 export async function GET({ url, locals, params }) {
 	const searchParams = Object.fromEntries(url.searchParams);
 	const q = searchParams?.q || '';
-	const limit = parseInt(searchParams?.limit) || 10;
-	const skip = parseInt(searchParams?.skip) || 0;
+	const limit = Number.parseInt(searchParams?.limit) || 10;
+	const skip = Number.parseInt(searchParams?.skip) || 0;
 	const order = searchParams?.order || 'asc';
 	const sort = searchParams?.sort || 'name';
 	const collection_id = params.id;
diff --git a/src/routes/api/external/game/[id]/+server.ts b/oldApis/external/game/[id]/+server.ts
similarity index 100%
rename from src/routes/api/external/game/[id]/+server.ts
rename to oldApis/external/game/[id]/+server.ts
diff --git a/src/routes/api/external/search/+server.ts b/oldApis/external/search/+server.ts
similarity index 100%
rename from src/routes/api/external/search/+server.ts
rename to oldApis/external/search/+server.ts
diff --git a/src/routes/api/games/[id]/+server.ts b/oldApis/games/[id]/+server.ts
similarity index 100%
rename from src/routes/api/games/[id]/+server.ts
rename to oldApis/games/[id]/+server.ts
diff --git a/src/routes/api/games/random/+server.ts b/oldApis/games/random/+server.ts
similarity index 100%
rename from src/routes/api/games/random/+server.ts
rename to oldApis/games/random/+server.ts
diff --git a/src/routes/api/games/search/+server.ts b/oldApis/games/search/+server.ts
similarity index 100%
rename from src/routes/api/games/search/+server.ts
rename to oldApis/games/search/+server.ts
diff --git a/src/routes/api/publisher/+server.ts b/oldApis/publisher/+server.ts
similarity index 100%
rename from src/routes/api/publisher/+server.ts
rename to oldApis/publisher/+server.ts
diff --git a/src/routes/api/publisher/[id]/+server.ts b/oldApis/publisher/[id]/+server.ts
similarity index 100%
rename from src/routes/api/publisher/[id]/+server.ts
rename to oldApis/publisher/[id]/+server.ts
diff --git a/src/routes/api/auth/reset-password/+server.ts b/oldApis/reset-password/+server.ts
similarity index 86%
rename from src/routes/api/auth/reset-password/+server.ts
rename to oldApis/reset-password/+server.ts
index d793b58..c661f15 100644
--- a/src/routes/api/auth/reset-password/+server.ts
+++ b/oldApis/reset-password/+server.ts
@@ -1,7 +1,7 @@
-import db from '../../../../db';
+import { db } from '$lib/server/api/infrastructure/database';
 import { error } from '@sveltejs/kit';
 import { eq } from 'drizzle-orm';
-import { usersTable } from '$db/schema';
+import { usersTable } from '$lib/server/api/infrastructure/database/tables';
 import { createPasswordResetToken } from '$lib/server/auth-utils.js';
 import { PUBLIC_SITE_URL } from '$env/static/public';
 
diff --git a/src/routes/api/auth/reset-password/[token]/+server.ts b/oldApis/reset-password/[token]/+server.ts
similarity index 61%
rename from src/routes/api/auth/reset-password/[token]/+server.ts
rename to oldApis/reset-password/[token]/+server.ts
index 938137d..2b50676 100644
--- a/src/routes/api/auth/reset-password/[token]/+server.ts
+++ b/oldApis/reset-password/[token]/+server.ts
@@ -1,9 +1,8 @@
 import { eq } from 'drizzle-orm';
-import { password_reset_tokens, usersTable } from '$db/schema';
+import { password_reset_tokens } from '$lib/server/api/infrastructure/database/tables';
 import { isWithinExpirationDate } from 'oslo';
-import { lucia } from '$lib/server/auth.js';
-import { Argon2id } from 'oslo/password';
-import db from '$db';
+// import { lucia } from '$lib/server/lucia';
+import {db} from '$lib/server/api/infrastructure/database';
 
 export async function POST({ request, params }) {
 	const { password } = await request.json();
@@ -32,12 +31,12 @@ export async function POST({ request, params }) {
 		});
 	}
 
-	await lucia.invalidateUserSessions(token.user_id);
-	const hashPassword = await new Argon2id().hash(password);
-	// await db.update(usersTable).set({ hashed_password: hashPassword }).where(eq(usersTable.id, token.user_id));
-
-	const session = await lucia.createSession(token.user_id, {});
-	const sessionCookie = lucia.createSessionCookie(session.id);
+	// await lucia.invalidateUserSessions(token.user_id);
+	// const hashPassword = await new Argon2id().hash(password);
+	// // await db.update(usersTable).set({ hashed_password: hashPassword }).where(eq(usersTable.id, token.user_id));
+	//
+	// const session = await lucia.createSession(token.user_id, {});
+	// const sessionCookie = lucia.createSessionCookie(session.id);
 
 	return new Response(null, {
 		status: 302,
diff --git a/src/routes/api/wishlist/+server.ts b/oldApis/wishlist/+server.ts
similarity index 100%
rename from src/routes/api/wishlist/+server.ts
rename to oldApis/wishlist/+server.ts
diff --git a/src/routes/api/collection/[id]/items/+server.ts b/oldApis/wishlist/[id]/items/+server.ts
similarity index 96%
rename from src/routes/api/collection/[id]/items/+server.ts
rename to oldApis/wishlist/[id]/items/+server.ts
index fc7727d..4d9ebe1 100644
--- a/src/routes/api/collection/[id]/items/+server.ts
+++ b/oldApis/wishlist/[id]/items/+server.ts
@@ -1,6 +1,6 @@
-import { error, json } from '@sveltejs/kit';
-
-export async function GET({ url, locals, params }) {
-	const searchParams = Object.fromEntries(url.searchParams);
-	return json({});
-}
+import { error, json } from '@sveltejs/kit';
+
+export async function GET({ url, locals, params }) {
+	const searchParams = Object.fromEntries(url.searchParams);
+	return json({});
+}
diff --git a/src/routes/api/wishlist/[id]/search/+server.ts b/oldApis/wishlist/[id]/search/+server.ts
similarity index 100%
rename from src/routes/api/wishlist/[id]/search/+server.ts
rename to oldApis/wishlist/[id]/search/+server.ts
diff --git a/package.json b/package.json
index 5d4c785..c00a9a0 100644
--- a/package.json
+++ b/package.json
@@ -59,7 +59,7 @@
 		"svelte": "5.0.0-next.175",
 		"svelte-check": "^3.8.6",
 		"svelte-headless-table": "^0.18.2",
-		"svelte-meta-tags": "^3.1.3",
+		"svelte-meta-tags": "^3.1.4",
 		"svelte-preprocess": "^6.0.2",
 		"svelte-sequential-preprocessor": "^2.0.1",
 		"sveltekit-flash-message": "^2.4.4",
@@ -68,7 +68,7 @@
 		"tailwindcss": "^3.4.10",
 		"ts-node": "^10.9.2",
 		"tslib": "^2.7.0",
-		"tsx": "^4.18.0",
+		"tsx": "^4.19.0",
 		"typescript": "^5.5.4",
 		"vite": "^5.4.2",
 		"vitest": "^1.6.0",
@@ -106,7 +106,7 @@
 		"feather-icons": "^4.29.2",
 		"formsnap": "^1.0.1",
 		"handlebars": "^4.7.8",
-		"hono": "^4.5.8",
+		"hono": "^4.5.9",
 		"hono-rate-limiter": "^0.4.0",
 		"html-entities": "^2.5.2",
 		"iconify-icon": "^2.1.0",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 739aaed..88491f8 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -13,13 +13,13 @@ importers:
         version: 5.0.14
       '@hono/swagger-ui':
         specifier: ^0.4.1
-        version: 0.4.1(hono@4.5.8)
+        version: 0.4.1(hono@4.5.9)
       '@hono/zod-openapi':
         specifier: ^0.15.3
-        version: 0.15.3(hono@4.5.8)(zod@3.23.8)
+        version: 0.15.3(hono@4.5.9)(zod@3.23.8)
       '@hono/zod-validator':
         specifier: ^0.2.2
-        version: 0.2.2(hono@4.5.8)(zod@3.23.8)
+        version: 0.2.2(hono@4.5.9)(zod@3.23.8)
       '@iconify-icons/line-md':
         specifier: ^1.2.30
         version: 1.2.30
@@ -99,11 +99,11 @@ importers:
         specifier: ^4.7.8
         version: 4.7.8
       hono:
-        specifier: ^4.5.8
-        version: 4.5.8
+        specifier: ^4.5.9
+        version: 4.5.9
       hono-rate-limiter:
         specifier: ^0.4.0
-        version: 0.4.0(hono@4.5.8)
+        version: 0.4.0(hono@4.5.9)
       html-entities:
         specifier: ^2.5.2
         version: 2.5.2
@@ -248,7 +248,7 @@ importers:
         version: 16.1.0(postcss@8.4.41)
       postcss-load-config:
         specifier: ^5.1.0
-        version: 5.1.0(jiti@1.21.6)(postcss@8.4.41)(tsx@4.18.0)
+        version: 5.1.0(jiti@1.21.6)(postcss@8.4.41)(tsx@4.19.0)
       postcss-preset-env:
         specifier: ^9.6.0
         version: 9.6.0(postcss@8.4.41)
@@ -272,16 +272,16 @@ importers:
         version: 5.0.0-next.175
       svelte-check:
         specifier: ^3.8.6
-        version: 3.8.6(postcss-load-config@5.1.0(jiti@1.21.6)(postcss@8.4.41)(tsx@4.18.0))(postcss@8.4.41)(sass@1.77.8)(svelte@5.0.0-next.175)
+        version: 3.8.6(postcss-load-config@5.1.0(jiti@1.21.6)(postcss@8.4.41)(tsx@4.19.0))(postcss@8.4.41)(sass@1.77.8)(svelte@5.0.0-next.175)
       svelte-headless-table:
         specifier: ^0.18.2
         version: 0.18.2(svelte@5.0.0-next.175)
       svelte-meta-tags:
-        specifier: ^3.1.3
-        version: 3.1.3(svelte@5.0.0-next.175)(typescript@5.5.4)
+        specifier: ^3.1.4
+        version: 3.1.4(svelte@5.0.0-next.175)(typescript@5.5.4)
       svelte-preprocess:
         specifier: ^6.0.2
-        version: 6.0.2(postcss-load-config@5.1.0(jiti@1.21.6)(postcss@8.4.41)(tsx@4.18.0))(postcss@8.4.41)(sass@1.77.8)(svelte@5.0.0-next.175)(typescript@5.5.4)
+        version: 6.0.2(postcss-load-config@5.1.0(jiti@1.21.6)(postcss@8.4.41)(tsx@4.19.0))(postcss@8.4.41)(sass@1.77.8)(svelte@5.0.0-next.175)(typescript@5.5.4)
       svelte-sequential-preprocessor:
         specifier: ^2.0.1
         version: 2.0.1
@@ -304,8 +304,8 @@ importers:
         specifier: ^2.7.0
         version: 2.7.0
       tsx:
-        specifier: ^4.18.0
-        version: 4.18.0
+        specifier: ^4.19.0
+        version: 4.19.0
       typescript:
         specifier: ^5.5.4
         version: 5.5.4
@@ -3178,8 +3178,8 @@ packages:
     peerDependencies:
       hono: ^4.1.1
 
-  hono@4.5.8:
-    resolution: {integrity: sha512-pqpSlcdqGkpTTRpLYU1PnCz52gVr0zVR9H5GzMyJWuKQLLEBQxh96q45QizJ2PPX8NATtz2mu31/PKW/Jt+90Q==}
+  hono@4.5.9:
+    resolution: {integrity: sha512-zz8ktqMDRrZETjxBrv8C5PQRFbrTRCLNVAjD1SNQyOzv4VjmX68Uxw83xQ6oxdAB60HiWnGEatiKA8V3SZLDkQ==}
     engines: {node: '>=16.0.0'}
 
   html-entities@2.5.2:
@@ -4493,8 +4493,8 @@ packages:
   svelte-lazy-loader@1.0.0:
     resolution: {integrity: sha512-AZD6R60vksyojn21FgXLglmBiBB9K5Dkdu0hdGrLbCaRCYT68IsWkZfRUqKhMx1IfzqWcZQ8X9y/f+Ih0oNQkQ==}
 
-  svelte-meta-tags@3.1.3:
-    resolution: {integrity: sha512-iIdJgxKdMUqFGR4m88jBE9KTSO2jdKE5CRjyRtAjdevW51jL4TtDZwL7GOtr5Fd2dw/+jyQIPD7APATP191qIA==}
+  svelte-meta-tags@3.1.4:
+    resolution: {integrity: sha512-TUIfhut0iVeTm7f5v/ZuU/tZ9XsNig9bNN8yK0t2x2WL9qw6AxAVRe9i5XddYJE0SuVwkoDCzjoSg5hXv7oWbQ==}
     peerDependencies:
       svelte: ^3.55.0 || ^4.0.0
 
@@ -4737,8 +4737,8 @@ packages:
   tslib@2.7.0:
     resolution: {integrity: sha512-gLXCKdN1/j47AiHiOkJN69hJmcbGTHI0ImLmbYLHykhgeN0jVGola9yVjFgzCUklsZQMW55o+dW7IXv3RCXDzA==}
 
-  tsx@4.18.0:
-    resolution: {integrity: sha512-a1jaKBSVQkd6yEc1/NI7G6yHFfefIcuf3QJST7ZEyn4oQnxLYrZR5uZAM8UrwUa3Ge8suiZHcNS1gNrEvmobqg==}
+  tsx@4.19.0:
+    resolution: {integrity: sha512-bV30kM7bsLZKZIOCHeMNVMJ32/LuJzLVajkQI/qf92J2Qr08ueLQvW00PUZGiuLPP760UINwupgUj8qrSCPUKg==}
     engines: {node: '>=18.0.0'}
     hasBin: true
 
@@ -5695,20 +5695,20 @@ snapshots:
       '@hapi/hoek': 9.3.0
     optional: true
 
-  '@hono/swagger-ui@0.4.1(hono@4.5.8)':
+  '@hono/swagger-ui@0.4.1(hono@4.5.9)':
     dependencies:
-      hono: 4.5.8
+      hono: 4.5.9
 
-  '@hono/zod-openapi@0.15.3(hono@4.5.8)(zod@3.23.8)':
+  '@hono/zod-openapi@0.15.3(hono@4.5.9)(zod@3.23.8)':
     dependencies:
       '@asteasolutions/zod-to-openapi': 7.1.1(zod@3.23.8)
-      '@hono/zod-validator': 0.2.2(hono@4.5.8)(zod@3.23.8)
-      hono: 4.5.8
+      '@hono/zod-validator': 0.2.2(hono@4.5.9)(zod@3.23.8)
+      hono: 4.5.9
       zod: 3.23.8
 
-  '@hono/zod-validator@0.2.2(hono@4.5.8)(zod@3.23.8)':
+  '@hono/zod-validator@0.2.2(hono@4.5.9)(zod@3.23.8)':
     dependencies:
-      hono: 4.5.8
+      hono: 4.5.9
       zod: 3.23.8
 
   '@humanwhocodes/config-array@0.11.14':
@@ -7562,11 +7562,11 @@ snapshots:
 
   hex-rgb@4.3.0: {}
 
-  hono-rate-limiter@0.4.0(hono@4.5.8):
+  hono-rate-limiter@0.4.0(hono@4.5.9):
     dependencies:
-      hono: 4.5.8
+      hono: 4.5.9
 
-  hono@4.5.8: {}
+  hono@4.5.9: {}
 
   html-entities@2.5.2: {}
 
@@ -8301,14 +8301,14 @@ snapshots:
       postcss: 8.4.41
       ts-node: 10.9.2(@types/node@20.16.1)(typescript@5.5.4)
 
-  postcss-load-config@5.1.0(jiti@1.21.6)(postcss@8.4.41)(tsx@4.18.0):
+  postcss-load-config@5.1.0(jiti@1.21.6)(postcss@8.4.41)(tsx@4.19.0):
     dependencies:
       lilconfig: 3.1.1
       yaml: 2.4.2
     optionalDependencies:
       jiti: 1.21.6
       postcss: 8.4.41
-      tsx: 4.18.0
+      tsx: 4.19.0
 
   postcss-logical@7.0.1(postcss@8.4.41):
     dependencies:
@@ -8878,14 +8878,14 @@ snapshots:
 
   supports-preserve-symlinks-flag@1.0.0: {}
 
-  svelte-check@3.8.6(postcss-load-config@5.1.0(jiti@1.21.6)(postcss@8.4.41)(tsx@4.18.0))(postcss@8.4.41)(sass@1.77.8)(svelte@5.0.0-next.175):
+  svelte-check@3.8.6(postcss-load-config@5.1.0(jiti@1.21.6)(postcss@8.4.41)(tsx@4.19.0))(postcss@8.4.41)(sass@1.77.8)(svelte@5.0.0-next.175):
     dependencies:
       '@jridgewell/trace-mapping': 0.3.25
       chokidar: 3.6.0
       picocolors: 1.0.0
       sade: 1.8.1
       svelte: 5.0.0-next.175
-      svelte-preprocess: 5.1.4(postcss-load-config@5.1.0(jiti@1.21.6)(postcss@8.4.41)(tsx@4.18.0))(postcss@8.4.41)(sass@1.77.8)(svelte@5.0.0-next.175)(typescript@5.5.4)
+      svelte-preprocess: 5.1.4(postcss-load-config@5.1.0(jiti@1.21.6)(postcss@8.4.41)(tsx@4.19.0))(postcss@8.4.41)(sass@1.77.8)(svelte@5.0.0-next.175)(typescript@5.5.4)
       typescript: 5.5.4
     transitivePeerDependencies:
       - '@babel/core'
@@ -8930,7 +8930,7 @@ snapshots:
 
   svelte-lazy-loader@1.0.0: {}
 
-  svelte-meta-tags@3.1.3(svelte@5.0.0-next.175)(typescript@5.5.4):
+  svelte-meta-tags@3.1.4(svelte@5.0.0-next.175)(typescript@5.5.4):
     dependencies:
       schema-dts: 1.1.2(typescript@5.5.4)
       svelte: 5.0.0-next.175
@@ -8941,7 +8941,7 @@ snapshots:
     dependencies:
       svelte: 5.0.0-next.175
 
-  svelte-preprocess@5.1.4(postcss-load-config@5.1.0(jiti@1.21.6)(postcss@8.4.41)(tsx@4.18.0))(postcss@8.4.41)(sass@1.77.8)(svelte@5.0.0-next.175)(typescript@5.5.4):
+  svelte-preprocess@5.1.4(postcss-load-config@5.1.0(jiti@1.21.6)(postcss@8.4.41)(tsx@4.19.0))(postcss@8.4.41)(sass@1.77.8)(svelte@5.0.0-next.175)(typescript@5.5.4):
     dependencies:
       '@types/pug': 2.0.10
       detect-indent: 6.1.0
@@ -8951,16 +8951,16 @@ snapshots:
       svelte: 5.0.0-next.175
     optionalDependencies:
       postcss: 8.4.41
-      postcss-load-config: 5.1.0(jiti@1.21.6)(postcss@8.4.41)(tsx@4.18.0)
+      postcss-load-config: 5.1.0(jiti@1.21.6)(postcss@8.4.41)(tsx@4.19.0)
       sass: 1.77.8
       typescript: 5.5.4
 
-  svelte-preprocess@6.0.2(postcss-load-config@5.1.0(jiti@1.21.6)(postcss@8.4.41)(tsx@4.18.0))(postcss@8.4.41)(sass@1.77.8)(svelte@5.0.0-next.175)(typescript@5.5.4):
+  svelte-preprocess@6.0.2(postcss-load-config@5.1.0(jiti@1.21.6)(postcss@8.4.41)(tsx@4.19.0))(postcss@8.4.41)(sass@1.77.8)(svelte@5.0.0-next.175)(typescript@5.5.4):
     dependencies:
       svelte: 5.0.0-next.175
     optionalDependencies:
       postcss: 8.4.41
-      postcss-load-config: 5.1.0(jiti@1.21.6)(postcss@8.4.41)(tsx@4.18.0)
+      postcss-load-config: 5.1.0(jiti@1.21.6)(postcss@8.4.41)(tsx@4.19.0)
       sass: 1.77.8
       typescript: 5.5.4
 
@@ -9174,7 +9174,7 @@ snapshots:
 
   tslib@2.7.0: {}
 
-  tsx@4.18.0:
+  tsx@4.19.0:
     dependencies:
       esbuild: 0.23.0
       get-tsconfig: 4.7.5
diff --git a/src/lib/components/Header.svelte b/src/lib/components/Header.svelte
index d632423..5768ad5 100644
--- a/src/lib/components/Header.svelte
+++ b/src/lib/components/Header.svelte
@@ -92,7 +92,7 @@
 			</DropdownMenu.Root>
 		{:else}
 			<a href="/login"> <span class="flex-auto">Login</span></a>
-			<a href="/sign-up"> <span class="flex-auto">Sign Up</span></a>
+			<a href="/signup"> <span class="flex-auto">Sign Up</span></a>
 		{/if}
 	</nav>
 </header>
diff --git a/src/lib/components/signup.svelte b/src/lib/components/signup.svelte
index d3ee0d9..ca5db91 100644
--- a/src/lib/components/signup.svelte
+++ b/src/lib/components/signup.svelte
@@ -13,7 +13,7 @@
 	// $: termsValue = $form.terms as Writable<boolean>;
 </script>
 
-<form method="POST" action="/sign-up" use:enhance>
+<form method="POST" action="/signup" use:enhance>
 	<h1>Signup user</h1>
 	<label class="label">
 		<span class="sr-only">First Name</span>
diff --git a/src/lib/dtos/verify-password.dto.ts b/src/lib/dtos/verify-password.dto.ts
new file mode 100644
index 0000000..a883135
--- /dev/null
+++ b/src/lib/dtos/verify-password.dto.ts
@@ -0,0 +1,7 @@
+import { z } from 'zod'
+
+export const verifyPasswordDto = z.object({
+	password: z.string({ required_error: 'Password is required' }).trim(),
+})
+
+export type VerifyPasswordDto = z.infer<typeof verifyPasswordDto>
diff --git a/src/lib/server/api/controllers/iam.controller.ts b/src/lib/server/api/controllers/iam.controller.ts
index 2cd0a08..d872758 100644
--- a/src/lib/server/api/controllers/iam.controller.ts
+++ b/src/lib/server/api/controllers/iam.controller.ts
@@ -11,6 +11,7 @@ import { limiter } from '$lib/server/api/middleware/rate-limiter.middleware'
 import { updateProfileDto } from '$lib/dtos/update-profile.dto'
 import { updateEmailDto } from '$lib/dtos/update-email.dto'
 import { StatusCodes } from '$lib/constants/status-codes'
+import { verifyPasswordDto } from '$lib/dtos/verify-password.dto'
 
 @injectable()
 export class IamController implements Controller {
@@ -36,6 +37,15 @@ export class IamController implements Controller {
 				}
 				return c.json({ user: updatedUser }, StatusCodes.OK)
 			})
+			.post('/verify/password', requireAuth, zValidator('json', verifyPasswordDto), limiter({ limit: 10, minutes: 60 }), async (c) => {
+				const user = c.var.user
+				const { password } = c.req.valid('json')
+				const passwordVerified = await this.iamService.verifyPassword(user.id, { password })
+				if (!passwordVerified) {
+					return c.json('Incorrect password', StatusCodes.BAD_REQUEST)
+				}
+				return c.json({ }, StatusCodes.OK)
+			})
 			.post('/update/email', requireAuth, zValidator('json', updateEmailDto), limiter({ limit: 10, minutes: 60 }), async (c) => {
 				const user = c.var.user
 				const { email } = c.req.valid('json')
diff --git a/src/lib/server/api/controllers/mfa.controller.ts b/src/lib/server/api/controllers/mfa.controller.ts
new file mode 100644
index 0000000..7c72abf
--- /dev/null
+++ b/src/lib/server/api/controllers/mfa.controller.ts
@@ -0,0 +1,39 @@
+import 'reflect-metadata';
+import { Hono } from 'hono';
+import { inject, injectable } from 'tsyringe';
+import { requireAuth } from "../middleware/auth.middleware";
+import type { HonoTypes } from '../types';
+import type { Controller } from '$lib/server/api/interfaces/controller.interface';
+import { TotpService } from '$lib/server/api/services/totp.service';
+import {StatusCodes} from "$lib/constants/status-codes";
+
+@injectable()
+export class MfaController implements Controller {
+	controller = new Hono<HonoTypes>();
+
+	constructor(
+		@inject(TotpService) private readonly totpService: TotpService
+	) {
+	}
+
+
+	routes() {
+		return this.controller
+			.get('/totp', requireAuth, async (c) => {
+				const user = c.var.user;
+				const totpCredential = await this.totpService.findOneByUserId(user.id);
+				return c.json({ totpCredential });
+			})
+			.post('/totp', requireAuth, async (c) => {
+				const user = c.var.user;
+				const totpCredential = await this.totpService.create(user.id);
+				return c.json({ totpCredential })
+			})
+			.delete('/totp', requireAuth, async (c) => {
+				const user = c.var.user;
+				await this.totpService.deleteOneByUserId(user.id);
+				return c.status(StatusCodes.NO_CONTENT);
+			});
+	}
+
+}
\ No newline at end of file
diff --git a/src/lib/server/api/index.ts b/src/lib/server/api/index.ts
index 9c22833..d6a6b16 100644
--- a/src/lib/server/api/index.ts
+++ b/src/lib/server/api/index.ts
@@ -8,6 +8,7 @@ import { config } from './common/config';
 import { container } from 'tsyringe';
 import { IamController } from './controllers/iam.controller';
 import { LoginController } from './controllers/login.controller';
+import { MfaController} from "$lib/server/api/controllers/mfa.controller";
 import {UserController} from "$lib/server/api/controllers/user.controller";
 import {SignupController} from "$lib/server/api/controllers/signup.controller";
 import {WishlistController} from "$lib/server/api/controllers/wishlist.controller";
@@ -44,6 +45,7 @@ const routes = app
 		.route('/signup', container.resolve(SignupController).routes())
 		.route('/wishlists', container.resolve(WishlistController).routes())
 		.route('/collections', container.resolve(CollectionController).routes())
+		.route('/mfa', container.resolve(MfaController).routes())
 		.get('/', (c) => c.json({ message: 'Server is healthy' }));
 
 /* -------------------------------------------------------------------------- */
diff --git a/src/lib/server/api/infrastructure/database/seed.ts b/src/lib/server/api/infrastructure/database/seed.ts
index 68152aa..1223370 100644
--- a/src/lib/server/api/infrastructure/database/seed.ts
+++ b/src/lib/server/api/infrastructure/database/seed.ts
@@ -31,7 +31,7 @@ for (const table of [
 	schema.publishers,
 	schema.publishersToExternalIds,
 	schema.publishers_to_games,
-	schema.recovery_codes,
+	schema.recoveryCodesTable,
 	schema.roles,
 	schema.sessionsTable,
 	schema.twoFactorTable,
diff --git a/src/lib/server/api/infrastructure/database/tables/index.ts b/src/lib/server/api/infrastructure/database/tables/index.ts
index e706804..3f96c54 100644
--- a/src/lib/server/api/infrastructure/database/tables/index.ts
+++ b/src/lib/server/api/infrastructure/database/tables/index.ts
@@ -16,7 +16,7 @@ export * from './passwordResetTokens';
 export * from './publishers';
 export * from './publishersToExternalIds';
 export * from './publishersToGames';
-export * from './recoveryCodes';
+export * from './recovery-codes.table';
 export * from './roles';
 export * from './sessions.table';
 export * from './two-factor.table';
diff --git a/src/lib/server/api/infrastructure/database/tables/recoveryCodes.ts b/src/lib/server/api/infrastructure/database/tables/recovery-codes.table.ts
similarity index 74%
rename from src/lib/server/api/infrastructure/database/tables/recoveryCodes.ts
rename to src/lib/server/api/infrastructure/database/tables/recovery-codes.table.ts
index 936ae79..80495b9 100644
--- a/src/lib/server/api/infrastructure/database/tables/recoveryCodes.ts
+++ b/src/lib/server/api/infrastructure/database/tables/recovery-codes.table.ts
@@ -3,7 +3,7 @@ import type { InferSelectModel } from 'drizzle-orm';
 import { usersTable } from './users.table';
 import { timestamps } from '../utils';
 
-export const recovery_codes = pgTable('recovery_codes', {
+export const recoveryCodesTable = pgTable('recovery_codes', {
 	id: uuid('id').primaryKey().defaultRandom(),
 	userId: uuid('user_id')
 		.notNull()
@@ -13,4 +13,4 @@ export const recovery_codes = pgTable('recovery_codes', {
 	...timestamps,
 });
 
-export type RecoveryCodes = InferSelectModel<typeof recovery_codes>;
+export type RecoveryCodesTable = InferSelectModel<typeof recoveryCodesTable>;
diff --git a/src/lib/server/api/repositories/credentials.repository.ts b/src/lib/server/api/repositories/credentials.repository.ts
index 2084a6b..84d3334 100644
--- a/src/lib/server/api/repositories/credentials.repository.ts
+++ b/src/lib/server/api/repositories/credentials.repository.ts
@@ -17,6 +17,15 @@ export class CredentialsRepository {
 		});
 	}
 
+	async findOneByUserIdAndType(userId: string, type: CredentialsType) {
+		return this.db.query.credentialsTable.findFirst({
+			where: and(
+				eq(credentialsTable.user_id, userId),
+				eq(credentialsTable.type, type)
+			)
+		});
+	}
+
 	async findPasswordCredentialsByUserId(userId: string) {
 		return this.db.query.credentialsTable.findFirst({
 			where: and(
@@ -59,4 +68,16 @@ export class CredentialsRepository {
 			.returning()
 			.then(takeFirstOrThrow);
 	}
+
+	async delete(id: string) {
+		return this.db
+			.delete(credentialsTable)
+			.where(eq(credentialsTable.id, id));
+	}
+
+	async deleteByUserId(userId: string) {
+		return this.db
+			.delete(credentialsTable)
+			.where(eq(credentialsTable.user_id, userId));
+	}
 }
\ No newline at end of file
diff --git a/src/lib/server/api/services/iam.service.ts b/src/lib/server/api/services/iam.service.ts
index 3455b4f..16a8cba 100644
--- a/src/lib/server/api/services/iam.service.ts
+++ b/src/lib/server/api/services/iam.service.ts
@@ -66,4 +66,13 @@ export class IamService {
 			email,
 		});
 	}
+
+	async verifyPassword(userId: string, data: VerifyPasswordDto) {
+		const user = await this.usersService.findOneById(userId);
+		if (!user) {
+			return null;
+		}
+		const { password } = data;
+		return this.usersService.verifyPassword(userId, { password });
+	}
 }
diff --git a/src/lib/server/api/services/totp.service.ts b/src/lib/server/api/services/totp.service.ts
new file mode 100644
index 0000000..77bb004
--- /dev/null
+++ b/src/lib/server/api/services/totp.service.ts
@@ -0,0 +1,36 @@
+import { inject, injectable } from "tsyringe";
+import { HMAC } from 'oslo/crypto';
+import { encodeHex } from 'oslo/encoding';
+import {CredentialsRepository} from "$lib/server/api/repositories/credentials.repository";
+
+@injectable()
+export class TotpService {
+
+	constructor(
+			@inject(CredentialsRepository) private readonly credentialsRepository: CredentialsRepository
+	) {
+	}
+
+	async findOneByUserId(userId: string) {
+		return this.credentialsRepository.findTOTPCredentialsByUserId(userId);
+	}
+
+	async create(userId: string) {
+		const twoFactorSecret = await new HMAC('SHA-1').generateKey();
+
+		try {
+			return await this.credentialsRepository.create({
+				user_id: userId,
+				secret_data: encodeHex(twoFactorSecret),
+				type: 'totp'
+			});
+		} catch (e) {
+			console.error(e);
+			return null;
+		}
+	}
+
+	async deleteOneByUserId(userId: string) {
+		return this.credentialsRepository.deleteByUserId(userId);
+	}
+}
\ No newline at end of file
diff --git a/src/lib/server/api/services/users.service.ts b/src/lib/server/api/services/users.service.ts
index a898040..75ca372 100644
--- a/src/lib/server/api/services/users.service.ts
+++ b/src/lib/server/api/services/users.service.ts
@@ -68,4 +68,17 @@ export class UsersService {
 	async findOneById(id: string) {
 		return this.usersRepository.findOneById(id);
 	}
+
+	async verifyPassword(userId: string, data: { password: string }) {
+		const user = await this.usersRepository.findOneById(userId);
+		if (!user) {
+			throw new Error('User not found');
+		}
+		const credential = await this.credentialsRepository.findOneByUserIdAndType(userId, CredentialsType.PASSWORD);
+		if (!credential) {
+			throw new Error('Password credentials not found');
+		}
+		const { password } = data;
+		return this.tokenService.verifyHashedToken(credential.secret_data, password);
+	}
 }
\ No newline at end of file
diff --git a/src/routes/(app)/(protected)/list/+layout.server.ts b/src/routes/(app)/(protected)/list/+layout.server.ts
index f0aa34c..c9b2c17 100644
--- a/src/routes/(app)/(protected)/list/+layout.server.ts
+++ b/src/routes/(app)/(protected)/list/+layout.server.ts
@@ -1,20 +1,20 @@
 import { redirect } from 'sveltekit-flash-message/server';
 import { eq } from 'drizzle-orm';
-import db from '../../../../db';
-import { wishlists } from '$db/schema';
-import { userNotAuthenticated } from '$lib/server/auth-utils';
+import { db } from '$lib/server/api/infrastructure/database';
+import { wishlists } from '$lib/server/api/infrastructure/database/tables';
 import { notSignedInMessage } from '$lib/flashMessages';
 
 export async function load(event) {
 	const { locals } = event;
-	const { user, session } = locals;
-	if (userNotAuthenticated(user, session)) {
-		redirect(302, '/login', notSignedInMessage, event);
+
+	const authedUser = await locals.getAuthedUser();
+	if (!authedUser) {
+		throw redirect(302, '/login', notSignedInMessage, event);
 	}
 
 	try {
 		const dbWishlists = await db.query.wishlists.findMany({
-			where: eq(wishlists.user_id, user!.id!),
+			where: eq(wishlists.user_id, authedUser.id),
 		});
 
 		return {
diff --git a/src/routes/(app)/(protected)/profile/+page.server.ts b/src/routes/(app)/(protected)/profile/+page.server.ts
index 69c6bc8..0c732cd 100644
--- a/src/routes/(app)/(protected)/profile/+page.server.ts
+++ b/src/routes/(app)/(protected)/profile/+page.server.ts
@@ -10,129 +10,129 @@ import { db } from '$lib/server/api/infrastructure/database';
 import type { PageServerLoad } from './$types';
 import { usersTable, credentialsTable } from '$lib/server/api/infrastructure/database/tables';
 import { userNotAuthenticated } from '$lib/server/auth-utils';
-import {updateProfileDto} from "$lib/dtos/update-profile.dto";
-import {updateEmailDto} from "$lib/dtos/update-email.dto";
+import { updateProfileDto } from "$lib/dtos/update-profile.dto";
+import { updateEmailDto } from "$lib/dtos/update-email.dto";
 
 export const load: PageServerLoad = async (event) => {
-	const { locals } = event;
+  const { locals } = event;
 
-	const authedUser = await locals.getAuthedUser();
-	if (!authedUser) {
-		throw redirect(302, '/login', notSignedInMessage, event);
-	}
+  const authedUser = await locals.getAuthedUser();
+  if (!authedUser) {
+    throw redirect(302, '/login', notSignedInMessage, event);
+  }
 
-	console.log('authedUser', authedUser);
-	// if (userNotAuthenticated(user, session)) {
-	// 	redirect(302, '/login', notSignedInMessage, event);
-	// }
-	// const dbUser = await db.query.usersTable.findFirst({
-	// 	where: eq(usersTable.id, user!.id!),
-	// });
+  console.log('authedUser', authedUser);
+  // if (userNotAuthenticated(user, session)) {
+  // 	redirect(302, '/login', notSignedInMessage, event);
+  // }
+  // const dbUser = await db.query.usersTable.findFirst({
+  // 	where: eq(usersTable.id, user!.id!),
+  // });
 
-	const profileForm = await superValidate(zod(profileSchema), {
-		defaults: {
-			firstName: authedUser?.firstName ?? '',
-			lastName: authedUser?.lastName ?? '',
-			username: authedUser?.username ?? '',
-		},
-	});
-	const emailForm = await superValidate(zod(changeEmailSchema), {
-		defaults: {
-			email: authedUser?.email ?? '',
-		},
-	});
+  const profileForm = await superValidate(zod(profileSchema), {
+    defaults: {
+      firstName: authedUser?.firstName ?? '',
+      lastName: authedUser?.lastName ?? '',
+      username: authedUser?.username ?? '',
+    },
+  });
+  const emailForm = await superValidate(zod(changeEmailSchema), {
+    defaults: {
+      email: authedUser?.email ?? '',
+    },
+  });
 
-	// const twoFactorDetails = await db.query.twoFactor.findFirst({
-	// 	where: eq(twoFactor.userId, authedUser!.id!),
-	// });
+  // const twoFactorDetails = await db.query.twoFactor.findFirst({
+  // 	where: eq(twoFactor.userId, authedUser!.id!),
+  // });
 
-	return {
-		profileForm,
-		emailForm,
-		hasSetupTwoFactor: false //!!twoFactorDetails?.enabled,
-	};
+  return {
+    profileForm,
+    emailForm,
+    hasSetupTwoFactor: false //!!twoFactorDetails?.enabled,
+  };
 };
 
 const changeEmailIfNotEmpty = z.object({
-	email: z
-		.string()
-		.trim()
-		.max(64, { message: 'Email must be less than 64 characters' })
-		.email({ message: 'Please enter a valid email' }),
+  email: z
+    .string()
+    .trim()
+    .max(64, { message: 'Email must be less than 64 characters' })
+    .email({ message: 'Please enter a valid email' }),
 });
 
 export const actions: Actions = {
-	profileUpdate: async (event) => {
-		const { locals } = event;
+  profileUpdate: async (event) => {
+    const { locals } = event;
 
-		const authedUser = await locals.getAuthedUser();
+    const authedUser = await locals.getAuthedUser();
 
-		if (!authedUser) {
-			redirect(302, '/login', notSignedInMessage, event);
-		}
+    if (!authedUser) {
+      redirect(302, '/login', notSignedInMessage, event);
+    }
 
-		const form = await superValidate(event, zod(updateProfileDto));
+    const form = await superValidate(event, zod(updateProfileDto));
 
-		const { error } = await locals.api.me.update.profile.$put({ json: form.data }).then(locals.parwseApiResponse);
-		console.log('data from profile update', error);
-		if (error) {
-			return setError(form, 'username', error);
-		}
+    const { error } = await locals.api.me.update.profile.$put({ json: form.data }).then(locals.parseApiResponse);
+    console.log('data from profile update', error);
+    if (error) {
+      return setError(form, 'username', error);
+    }
 
-		if (!form.valid) {
-			return fail(400, {
-				form,
-			});
-		}
+    if (!form.valid) {
+      return fail(400, {
+        form,
+      });
+    }
 
-		console.log('profile updated successfully');
-		return message(form, { type: 'success', message: 'Profile updated successfully!' });
-	},
-	changeEmail: async (event) => {
-		const form = await superValidate(event, zod(updateEmailDto));
+    console.log('profile updated successfully');
+    return message(form, { type: 'success', message: 'Profile updated successfully!' });
+  },
+  changeEmail: async (event) => {
+    const form = await superValidate(event, zod(updateEmailDto));
 
-		const newEmail = form.data?.email;
-		if (
-			!form.valid ||
-			!newEmail ||
-			(newEmail !== '' && !changeEmailIfNotEmpty.safeParse(form.data).success)
-		) {
-			return fail(400, {
-				form,
-			});
-		}
+    const newEmail = form.data?.email;
+    if (
+      !form.valid ||
+      !newEmail ||
+      (newEmail !== '' && !changeEmailIfNotEmpty.safeParse(form.data).success)
+    ) {
+      return fail(400, {
+        form,
+      });
+    }
 
-		if (!event.locals.user) {
-			redirect(302, '/login', notSignedInMessage, event);
-		}
+    if (!event.locals.user) {
+      redirect(302, '/login', notSignedInMessage, event);
+    }
 
-		const user = event.locals.user;
-		const existingUser = await db.query.usersTable.findFirst({
-			where: eq(usersTable.email, newEmail),
-		});
+    const user = event.locals.user;
+    const existingUser = await db.query.usersTable.findFirst({
+      where: eq(usersTable.email, newEmail),
+    });
 
-		if (existingUser && existingUser.id !== user.id) {
-			return setError(form, 'email', 'That email is already taken');
-		}
+    if (existingUser && existingUser.id !== user.id) {
+      return setError(form, 'email', 'That email is already taken');
+    }
 
-		await db.update(usersTable).set({ email: form.data.email }).where(eq(usersTable.id, user.id));
+    await db.update(usersTable).set({ email: form.data.email }).where(eq(usersTable.id, user.id));
 
-		// if (user.email !== form.data.email) {
-			// Send email to confirm new email?
-			// auth.update
-			// await locals.prisma.key.update({
-			// 	where: {
-			// 		id: 'emailpassword:' + user.email
-			// 	},
-			// 	data: {
-			// 		id: 'emailpassword:' + form.data.email
-			// 	}
-			// });
-			// auth.updateUserAttributes(user.user_id, {
-			// 	receiveEmail: false
-			// });
-		// }
+    // if (user.email !== form.data.email) {
+    // Send email to confirm new email?
+    // auth.update
+    // await locals.prisma.key.update({
+    // 	where: {
+    // 		id: 'emailpassword:' + user.email
+    // 	},
+    // 	data: {
+    // 		id: 'emailpassword:' + form.data.email
+    // 	}
+    // });
+    // auth.updateUserAttributes(user.user_id, {
+    // 	receiveEmail: false
+    // });
+    // }
 
-		return message(form, { type: 'success', message: 'Email updated successfully!' });
-	},
+    return message(form, { type: 'success', message: 'Email updated successfully!' });
+  },
 };
diff --git a/src/routes/(app)/(protected)/profile/+page.svelte b/src/routes/(app)/(protected)/profile/+page.svelte
index 18dfd18..c6bc370 100644
--- a/src/routes/(app)/(protected)/profile/+page.svelte
+++ b/src/routes/(app)/(protected)/profile/+page.svelte
@@ -96,16 +96,16 @@
 </form>
 <div class="mt-6">
 	{#if !hasSetupTwoFactor}
-		<p>Two Factor Authentication is: <strong>Disabled</strong></p>
-		<Button variant="link" class="text-secondary-foreground" href="/profile/security/two-factor">
+		<p>Multi Factor Authentication is: <strong>Disabled</strong></p>
+		<Button variant="link" class="text-secondary-foreground" href="/profile/security/mfa">
 			<KeyRound class="mr-2 h-4 w-4" />
-			Setup 2FA
+			Setup Multi-factor Authentication
 		</Button>
 	{:else}
-		<p>Two Factor Authentication is: <strong>Enabled</strong></p>
-		<Button variant="link" class="text-secondary-foreground" href="/profile/security/two-factor">
+		<p>Multi Factor Authentication is: <strong>Enabled</strong></p>
+		<Button variant="link" class="text-secondary-foreground" href="/profile/security/mfa">
 			<KeyRound class="mr-2 h-4 w-4" />
-			Disable 2FA
+			Disable Multi-factor Authentication
 		</Button>
 	{/if}
 </div>
diff --git a/src/routes/(app)/(protected)/profile/security/two-factor/+page.server.ts b/src/routes/(app)/(protected)/profile/security/mfa/+page.server.ts
similarity index 53%
rename from src/routes/(app)/(protected)/profile/security/two-factor/+page.server.ts
rename to src/routes/(app)/(protected)/profile/security/mfa/+page.server.ts
index a074ba2..64a2394 100644
--- a/src/routes/(app)/(protected)/profile/security/two-factor/+page.server.ts
+++ b/src/routes/(app)/(protected)/profile/security/mfa/+page.server.ts
@@ -12,30 +12,32 @@ import { redirect, setFlash } from 'sveltekit-flash-message/server';
 import type { PageServerLoad } from '../../$types';
 import { addTwoFactorSchema, removeTwoFactorSchema } from '$lib/validations/account';
 import { notSignedInMessage } from '$lib/flashMessages';
-import db from '$lib/server/api/infrastructure/database';
-import { recoveryCodes, twoFactor, usersTable } from '$lib/server/api/infrastructure/database/tables';
+import { db } from '$lib/server/api/infrastructure/database';
+import { recoveryCodesTable, credentialsTable, usersTable, type Credentials } from '$lib/server/api/infrastructure/database/tables';
 import { userNotAuthenticated } from '$lib/server/auth-utils';
-import env from '../../../../../../env';
+import env from '$src/env';
 
 export const load: PageServerLoad = async (event) => {
-	const addTwoFactorForm = await superValidate(event, zod(addTwoFactorSchema));
-	const removeTwoFactorForm = await superValidate(event, zod(removeTwoFactorSchema));
-
 	const { locals } = event;
-	const { user, session } = locals;
-	if (userNotAuthenticated(user, session)) {
-		redirect(302, '/login', notSignedInMessage, event);
+
+	const authedUser = await locals.getAuthedUser();
+	if (!authedUser) {
+		throw redirect(302, '/login', notSignedInMessage, event);
 	}
 
-	const dbUser = await db.query.usersTable.findFirst({
-		where: eq(usersTable.id, user!.id!),
-	});
+	const addTwoFactorForm = await superValidate(event, zod(addTwoFactorSchema));
+	const removeTwoFactorForm = await superValidate(event, zod(removeTwoFactorSchema));
+	// const addAuthNFactorForm = await superValidate(event, zod(addAuthNFactorSchema));
 
-	const twoFactorDetails = await db.query.twoFactor.findFirst({
-		where: eq(twoFactor.userId, dbUser!.id!),
-	});
+	const { data, error } = await locals.api.mfa.totp.$get().then(locals.parseApiResponse);
+	if (error || !data) {
+		return fail(500, {
+			addTwoFactorForm,
+		});
+	}
+	const { totpCredential } = data
 
-	if (twoFactorDetails?.enabled) {
+	if (totpCredential) {
 		return {
 			addTwoFactorForm,
 			removeTwoFactorForm,
@@ -43,35 +45,27 @@ export const load: PageServerLoad = async (event) => {
 			recoveryCodes: [],
 			totpUri: '',
 			qrCode: '',
-		};
-	}
-
-	const twoFactorSecret = await new HMAC('SHA-1').generateKey();
-
-	try {
-		await db
-			.insert(twoFactor)
-			.values({
-				secret: encodeHex(twoFactorSecret),
-				enabled: false,
-				userId: dbUser!.id!,
-			})
-			.onConflictDoUpdate({
-				target: twoFactor.userId,
-				set: {
-					secret: encodeHex(twoFactorSecret),
-					enabled: false,
-				},
-			});
-	} catch (e) {
-		console.error(e);
-		error(500);
+		}
 	}
 
 	const issuer = kebabCase(env.PUBLIC_SITE_NAME);
-	const accountName = dbUser!.email! || dbUser!.username!;
+	const accountName = authedUser.email || authedUser.username;
+	const { data: createdTotpData, error: createdTotpError } = await locals.api.mfa.totp.$post().then(locals.parseApiResponse);
+
+	if (createdTotpError || !createdTotpData) {
+		return fail(500, {
+			addTwoFactorForm,
+		})
+	}
+
+	const { totpCredential: createdTotpCredentials } = createdTotpData;
 	// pass the website's name and the user identifier (e.g. email, username)
-	const totpUri = createTOTPKeyURI(issuer, accountName, twoFactorSecret);
+	if (!createdTotpCredentials?.secret_data) {
+		return fail(500, {
+			addTwoFactorForm,
+		})
+	}
+	const totpUri = createTOTPKeyURI(issuer, accountName, createdTotpCredentials.secret_data);
 
 	addTwoFactorForm.data = {
 		current_password: '',
@@ -88,111 +82,85 @@ export const load: PageServerLoad = async (event) => {
 };
 
 export const actions: Actions = {
-	enableTwoFactor: async (event) => {
-		const { locals } = event;
-		const { user, session } = locals;
-		if (userNotAuthenticated(user, session)) {
-			return fail(401);
+	enableTotp: async (event) => {
+		const { locals } = event
+
+		const authedUser = await locals.getAuthedUser()
+		if (!authedUser) {
+			throw redirect(302, '/login', notSignedInMessage, event)
 		}
 
-		const addTwoFactorForm = await superValidate(event, zod(addTwoFactorSchema));
+		const addTwoFactorForm = await superValidate(event, zod(addTwoFactorSchema))
 
 		if (!addTwoFactorForm.valid) {
 			return fail(400, {
 				addTwoFactorForm,
-			});
+			})
 		}
 
-		if (!event.locals.user) {
-			redirect(302, '/login', notSignedInMessage, event);
-		}
-
-		if (!event.locals.session) {
-			return fail(401);
-		}
-
-		const dbUser = await db.query.usersTable.findFirst({
-			where: eq(usersTable.id, user!.id!),
-		});
-
-		// if (!dbUser?.hashed_password) {
-		// 	addTwoFactorForm.data.current_password = '';
-		// 	addTwoFactorForm.data.two_factor_code = '';
-		// 	return setError(
-		// 		addTwoFactorForm,
-		// 		'Error occurred. Please try again or contact support if you need further help.',
-		// 	);
-		// }
-
-		const twoFactorDetails = await db.query.twoFactor.findFirst({
-			where: eq(twoFactor.userId, dbUser?.id),
-		});
-
-		if (!twoFactorDetails) {
-			addTwoFactorForm.data.current_password = '';
-			addTwoFactorForm.data.two_factor_code = '';
-			return setError(
+		const { data, error } = await locals.api.mfa.totp.$get().then(locals.parseApiResponse)
+		if (error || !data) {
+			return fail(500, {
 				addTwoFactorForm,
-				'Error occurred. Please try again or contact support if you need further help.',
-			);
+			})
+		}
+		const { totpCredential } = data
+
+		if (!totpCredential) {
+			addTwoFactorForm.data.current_password = ''
+			addTwoFactorForm.data.two_factor_code = ''
+			return setError(addTwoFactorForm, 'Error occurred. Please try again or contact support if you need further help.')
 		}
 
-		if (twoFactorDetails.secret === '' || twoFactorDetails.secret === null) {
-			addTwoFactorForm.data.current_password = '';
-			addTwoFactorForm.data.two_factor_code = '';
-			return setError(
-				addTwoFactorForm,
-				'Error occurred. Please try again or contact support if you need further help.',
-			);
+		if (totpCredential.secret_data === '' || totpCredential.secret_data === null) {
+			addTwoFactorForm.data.current_password = ''
+			addTwoFactorForm.data.two_factor_code = ''
+			return setError(addTwoFactorForm, 'Error occurred. Please try again or contact support if you need further help.')
 		}
 
-		const currentPasswordVerified = await new Argon2id().verify(
-			// dbUser.hashed_password,
-			addTwoFactorForm.data.current_password,
-		);
+		const currentPasswordVerified = await locals.api.me.verify.password.$post({
+			json: { password: addTwoFactorForm.data.current_password },
+		});
 
 		if (!currentPasswordVerified) {
-			return setError(addTwoFactorForm, 'current_password', 'Your password is incorrect');
+			return setError(addTwoFactorForm, 'current_password', 'Your password is incorrect')
 		}
 
 		if (addTwoFactorForm.data.two_factor_code === '') {
-			return setError(addTwoFactorForm, 'two_factor_code', 'Please enter a code');
+			return setError(addTwoFactorForm, 'two_factor_code', 'Please enter a code')
 		}
 
-		const twoFactorCode = addTwoFactorForm.data.two_factor_code;
-		const validOTP = await new TOTPController().verify(
-			twoFactorCode,
-			decodeHex(twoFactorDetails.secret),
-		);
+		const twoFactorCode = addTwoFactorForm.data.two_factor_code
+		const validOTP = await new TOTPController().verify(twoFactorCode, decodeHex(twoFactorDetails.secret))
 
 		if (!validOTP) {
-			return setError(addTwoFactorForm, 'two_factor_code', 'Invalid code');
+			return setError(addTwoFactorForm, 'two_factor_code', 'Invalid code')
 		}
 
-		await db.update(twoFactor).set({ enabled: true }).where(eq(twoFactor.userId, user!.id!));
+		await db.update(twoFactor).set({ enabled: true }).where(eq(twoFactor.userId, user!.id!))
 
-		redirect(302, '/profile/security/two-factor/recovery-codes');
+		redirect(302, '/profile/security/two-factor/recovery-codes')
 	},
-	disableTwoFactor: async (event) => {
-		const { locals } = event;
-		const { user, session } = locals;
-		const removeTwoFactorForm = await superValidate(event, zod(removeTwoFactorSchema));
+	disableTotp: async (event) => {
+		const { locals } = event
+		const { user, session } = locals
+		const removeTwoFactorForm = await superValidate(event, zod(removeTwoFactorSchema))
 
 		if (!removeTwoFactorForm.valid) {
 			return fail(400, {
 				removeTwoFactorForm,
-			});
+			})
 		}
 
 		if (!user || !session) {
 			return fail(401, {
 				removeTwoFactorForm,
-			});
+			})
 		}
 
 		const dbUser = await db.query.usersTable.findFirst({
 			where: eq(usersTable.id, user.id),
-		});
+		})
 
 		// if (!dbUser?.hashed_password) {
 		// 	removeTwoFactorForm.data.current_password = '';
@@ -205,24 +173,24 @@ export const actions: Actions = {
 		const currentPasswordVerified = await new Argon2id().verify(
 			// dbUser.hashed_password,
 			removeTwoFactorForm.data.current_password,
-		);
+		)
 
 		if (!currentPasswordVerified) {
-			return setError(removeTwoFactorForm, 'current_password', 'Your password is incorrect');
+			return setError(removeTwoFactorForm, 'current_password', 'Your password is incorrect')
 		}
 
 		const twoFactorDetails = await db.query.twoFactor.findFirst({
 			where: eq(twoFactor.userId, dbUser.id),
-		});
+		})
 
 		if (!twoFactorDetails) {
 			return fail(500, {
 				removeTwoFactorForm,
-			});
+			})
 		}
 
-		await db.update(twoFactor).set({ enabled: false }).where(eq(twoFactor.userId, user.id));
-		await db.delete(recoveryCodes).where(eq(recoveryCodes.userId, user.id));
+		await db.update(twoFactor).set({ enabled: false }).where(eq(twoFactor.userId, user.id))
+		await db.delete(recoveryCodes).where(eq(recoveryCodes.userId, user.id))
 
 		// setFlash({ type: 'success', message: 'Two-Factor Authentication has been disabled.' }, cookies);
 		redirect(
@@ -233,6 +201,6 @@ export const actions: Actions = {
 				message: 'Two-Factor Authentication has been disabled.',
 			},
 			event,
-		);
+		)
 	},
-};
+}
diff --git a/src/routes/(app)/(protected)/profile/security/two-factor/+page.svelte b/src/routes/(app)/(protected)/profile/security/mfa/+page.svelte
similarity index 93%
rename from src/routes/(app)/(protected)/profile/security/two-factor/+page.svelte
rename to src/routes/(app)/(protected)/profile/security/mfa/+page.svelte
index eb1c37a..3270b03 100644
--- a/src/routes/(app)/(protected)/profile/security/two-factor/+page.svelte
+++ b/src/routes/(app)/(protected)/profile/security/mfa/+page.svelte
@@ -37,7 +37,7 @@
 {#if twoFactorEnabled}
 	<h2>Currently you have two factor authentication <span class="text-green-500">enabled</span></h2>
 	<p>To disable two factor authentication, please enter your current password.</p>
-	<form method="POST" action="?/disableTwoFactor" use:removeTwoFactorEnhance data-sveltekit-replacestate>
+	<form method="POST" action="?/disableTotp" use:removeTwoFactorEnhance data-sveltekit-replacestate>
 		<Form.Field form={removeTwoFactorForm} name="current_password">
 			<Form.Control let:attrs>
 				<Form.Label for="password">Current Password</Form.Label>
@@ -51,7 +51,7 @@
 {:else}
 	<h2>Please scan the following QR Code</h2>
 	<img src={qrCode} alt="QR Code" />
-	<form method="POST" action="?/enableTwoFactor" use:addTwoFactorEnhance data-sveltekit-replacestate>
+	<form method="POST" action="?/enableTotp" use:addTwoFactorEnhance data-sveltekit-replacestate>
 		<Form.Field form={addTwoFactorForm} name="two_factor_code">
 			<Form.Control let:attrs>
 				<Form.Label for="code">Enter Code</Form.Label>
diff --git a/src/routes/(app)/(protected)/profile/security/two-factor/recovery-codes/+page.server.ts b/src/routes/(app)/(protected)/profile/security/mfa/recovery-codes/+page.server.ts
similarity index 72%
rename from src/routes/(app)/(protected)/profile/security/two-factor/recovery-codes/+page.server.ts
rename to src/routes/(app)/(protected)/profile/security/mfa/recovery-codes/+page.server.ts
index fb8b009..b14c28e 100644
--- a/src/routes/(app)/(protected)/profile/security/two-factor/recovery-codes/+page.server.ts
+++ b/src/routes/(app)/(protected)/profile/security/mfa/recovery-codes/+page.server.ts
@@ -1,31 +1,36 @@
-import db from '../../../../../../../db';
 import { eq } from 'drizzle-orm';
 import { Argon2id } from 'oslo/password';
 import { alphabet, generateRandomString } from 'oslo/crypto';
 import { redirect } from 'sveltekit-flash-message/server';
+import { db } from '$lib/server/api/infrastructure/database';
 import { notSignedInMessage } from '$lib/flashMessages';
 import type { PageServerLoad } from '../../../$types';
-import {recoveryCodes, twoFactor, usersTable} from '$db/schema';
+import { recoveryCodesTable, twoFactorTable, usersTable} from '$lib/server/api/infrastructure/database/tables';
 import { userNotAuthenticated } from '$lib/server/auth-utils';
 
 export const load: PageServerLoad = async (event) => {
 	const { locals } = event;
-	const { user, session } = locals;
-	if (userNotAuthenticated(user, session)) {
-		redirect(302, '/login', notSignedInMessage, event);
+
+	const authedUser = await locals.getAuthedUser();
+	if (!authedUser) {
+		throw redirect(302, '/login', notSignedInMessage, event);
 	}
 
 	const dbUser = await db.query.usersTable.findFirst({
-		where: eq(usersTable.id, user!.id),
+		where: eq(usersTable.id, authedUser.id),
 	});
 
+	if (!dbUser) {
+		throw redirect(302, '/login', notSignedInMessage, event);
+	}
+
 	const twoFactorDetails = await db.query.twoFactor.findFirst({
-		where: eq(twoFactor.userId, dbUser!.id),
+		where: eq(twoFactor.userId, dbUser.id),
 	});
 
 	if (twoFactorDetails?.enabled) {
 		const dbRecoveryCodes = await db.query.recoveryCodes.findMany({
-			where: eq(recoveryCodes.userId, user!.id),
+			where: eq(recoveryCodes.userId, authedUser.id),
 		});
 
 		if (dbRecoveryCodes.length === 0) {
@@ -37,7 +42,7 @@ export const load: PageServerLoad = async (event) => {
 					const hashedCode = await new Argon2id().hash(code);
 					console.log('Inserting recovery code', code, hashedCode);
 					await db.insert(recoveryCodes).values({
-						userId: user!.id,
+						userId: authedUser.id,
 						code: hashedCode,
 					});
 				}
diff --git a/src/routes/(app)/(protected)/profile/security/two-factor/recovery-codes/+page.svelte b/src/routes/(app)/(protected)/profile/security/mfa/recovery-codes/+page.svelte
similarity index 100%
rename from src/routes/(app)/(protected)/profile/security/two-factor/recovery-codes/+page.svelte
rename to src/routes/(app)/(protected)/profile/security/mfa/recovery-codes/+page.svelte
diff --git a/src/routes/(app)/(protected)/profile/security/password/change/+page.server.ts b/src/routes/(app)/(protected)/profile/security/password/change/+page.server.ts
index ae0168f..ed158f6 100644
--- a/src/routes/(app)/(protected)/profile/security/password/change/+page.server.ts
+++ b/src/routes/(app)/(protected)/profile/security/password/change/+page.server.ts
@@ -5,22 +5,22 @@ import { setError, superValidate } from 'sveltekit-superforms/server';
 import { redirect } from 'sveltekit-flash-message/server';
 import { Argon2id } from 'oslo/password';
 import type { PageServerLoad } from '../../../$types';
-import db from '../../../../../../../db';
+import { db } from '$lib/server/api/infrastructure/database';
 import { changeUserPasswordSchema } from '$lib/validations/account';
-import { lucia } from '$lib/server/auth.js';
-import { usersTable } from '$db/schema';
+import { usersTable } from '$lib/server/api/infrastructure/database/tables';
 import { notSignedInMessage } from '$lib/flashMessages';
 import type { Cookie } from 'lucia';
-import { userNotAuthenticated } from '$lib/server/auth-utils';
 
 export const load: PageServerLoad = async (event) => {
-	const form = await superValidate(event, zod(changeUserPasswordSchema));
 	const { locals } = event;
-	const { user, session } = locals;
-	if (userNotAuthenticated(user, session)) {
-		redirect(302, '/login', notSignedInMessage, event);
+
+	const authedUser = await locals.getAuthedUser();
+	if (!authedUser) {
+		throw redirect(302, '/login', notSignedInMessage, event);
 	}
 
+	const form = await superValidate(event, zod(changeUserPasswordSchema));
+
 	form.data = {
 		current_password: '',
 		password: '',
@@ -34,9 +34,10 @@ export const load: PageServerLoad = async (event) => {
 export const actions: Actions = {
 	default: async (event) => {
 		const { locals } = event;
-		const { user, session } = locals;
-		if (userNotAuthenticated(user, session)) {
-			return fail(401);
+
+		const authedUser = await locals.getAuthedUser();
+		if (!authedUser) {
+			throw redirect(302, '/login', notSignedInMessage, event);
 		}
 
 		const form = await superValidate(event, zod(changeUserPasswordSchema));
@@ -57,7 +58,7 @@ export const actions: Actions = {
 		}
 
 		const dbUser = await db.query.usersTable.findFirst({
-			where: eq(usersTable.id, user!.id),
+			where: eq(usersTable.id, authedUser.id),
 		});
 
 		// if (!dbUser?.hashed_password) {
@@ -78,14 +79,14 @@ export const actions: Actions = {
 		if (!currentPasswordVerified) {
 			return setError(form, 'current_password', 'Your password is incorrect');
 		}
-		if (user?.username) {
+		if (authedUser?.username) {
 			let sessionCookie: Cookie;
 			try {
 				if (form.data.password !== form.data.confirm_password) {
 					return setError(form, 'Password and confirm password do not match');
 				}
 				const hashedPassword = await new Argon2id().hash(form.data.password);
-				await lucia.invalidateUserSessions(user.id);
+				await lucia.invalidateUserSessions(authedUser.id);
 				// await db
 				// 	.update(usersTable)
 				// 	.set({ hashed_password: hashedPassword })
diff --git a/src/routes/(app)/game/[id]/+page.svelte b/src/routes/(app)/game/[id]/+page.svelte
index 354689f..5edca30 100644
--- a/src/routes/(app)/game/[id]/+page.svelte
+++ b/src/routes/(app)/game/[id]/+page.svelte
@@ -52,7 +52,7 @@
 			<AddToList {in_collection} {in_wishlist} game_id={game.id} {wishlist} {collection} />
 		{:else}
 			<span>
-				<Button href="/sign-up">Sign Up</Button> or <Button href="/login">Sign In</Button> to add to a list.
+				<Button href="/signup">Sign Up</Button> or <Button href="/login">Sign In</Button> to add to a list.
 			</span>
 		{/if}
 	</div>
diff --git a/src/routes/(auth)/+layout.svelte b/src/routes/(auth)/+layout.svelte
index 5524879..0c042f8 100644
--- a/src/routes/(auth)/+layout.svelte
+++ b/src/routes/(auth)/+layout.svelte
@@ -18,8 +18,8 @@
 		{#if $page.url.pathname !== '/login'}
 			<Button href="/login" variant="ghost">Login</Button>
 		{/if}
-		{#if $page.url.pathname !== '/sign-up'}
-			<Button href="/sign-up" variant="ghost">Sign up</Button>
+		{#if $page.url.pathname !== '/signup'}
+			<Button href="/signup" variant="ghost">Sign up</Button>
 		{/if}
 	</div>
 	<div class="auth-marketing">
diff --git a/src/routes/(auth)/sign-up/+page.server.ts b/src/routes/(auth)/signup/+page.server.ts
similarity index 100%
rename from src/routes/(auth)/sign-up/+page.server.ts
rename to src/routes/(auth)/signup/+page.server.ts
diff --git a/src/routes/(auth)/sign-up/+page.svelte b/src/routes/(auth)/signup/+page.svelte
similarity index 98%
rename from src/routes/(auth)/sign-up/+page.svelte
rename to src/routes/(auth)/signup/+page.svelte
index a126a5b..54c563b 100644
--- a/src/routes/(auth)/sign-up/+page.svelte
+++ b/src/routes/(auth)/signup/+page.svelte
@@ -46,7 +46,7 @@
 			<Card.Title class="text-2xl">Signup for an account</Card.Title>
 		</Card.Header>
 		<Card.Content>
-			<form method="POST" action="/sign-up" use:enhance class="grid gap-2 mt-4">
+			<form method="POST" action="/signup" use:enhance class="grid gap-2 mt-4">
 				<Label for="username">Username <small>(required)</small></Label>
 				<Input type="text" id="username" class={$errors.username && "outline outline-destructive"} name="username"
 							 placeholder="Username" autocomplete="username" data-invalid={$errors.username} bind:value={$form.username} />
diff --git a/svelte.config.js b/svelte.config.js
index 435efb8..c4d0477 100644
--- a/svelte.config.js
+++ b/svelte.config.js
@@ -22,9 +22,10 @@ const config = {
 			$assets: './src/assets',
 			$components: './src/components',
 			'$components/*': 'src/lib/components/*',
-			$db: './src/db',
+			$db: './src/lib/server/api/infrastructure/database',
 			$server: './src/server',
 			$lib: './src/lib',
+			$src: './src',
 			$state: './src/state',
 			$styles: './src/styles',
 			$themes: './src/themes',