fix: include user_id in JWT and validate user in passkey response

Author: yaroslav8765

index.ts

@@ -455,7 +455,7 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
             userVerification: this.options.passkeys?.settings.authenticatorSelection.userVerification || "required"
           },
         });
-        const value = this.adminforth.auth.issueJWT({ "challenge": options.challenge }, 'tempPasskeyChallenge', '10m');
+        const value = this.adminforth.auth.issueJWT({ "challenge": options.challenge, "user_id": adminUser.pk }, 'tempPasskeyChallenge', '10m');
         this.adminforth.auth.setCustomCookie({response, payload: {name: "registerPasskeyTemporaryJWT", value: value, expiry: undefined, expirySeconds: 10 * 60, httpOnly: true}});
         return { ok: true, data: options };
       }
@@ -473,6 +473,9 @@ export default class TwoFactorsAuthPlugin extends AdminForthPlugin {
         if (!decodedPasskeysCookies) {
           return { error: 'Invalid passkey token' };
         }
+        if (decodedPasskeysCookies.user_id !== adminUser.pk) {
+          return { error: 'Invalid user' };
+        }
         const settingsOrigin = this.options.passkeys?.settings.expectedOrigin;
         const expectedOrigin = body.origin;
         const expectedChallenge = decodedPasskeysCookies.challenge;