@better-auth/infra 0.2.12 → 0.2.14

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (9) hide show
  1. package/CHANGELOG.md +41 -0
  2. package/dist/client.mjs +2 -2
  3. package/dist/{constants-CvriWQVc.mjs → constants-CLYqEwMV.mjs} +7 -1
  4. package/dist/email.mjs +5 -2
  5. package/dist/{fetch-DiAhoiKA.mjs → fetch-Bl0S3xUi.mjs} +3 -3
  6. package/dist/index.d.mts +13 -2
  7. package/dist/index.mjs +475 -230
  8. package/dist/native.mjs +2 -2
  9. package/package.json +7 -5
package/CHANGELOG.md ADDED
@@ -0,0 +1,41 @@
1
+ # Changelog
2
+
3
+ All notable changes to `@better-auth/infra` are documented in this file.
4
+
5
+ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
6
+ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
7
+
8
+ ## [0.2.14] - 2026-06-09
9
+
10
+ ### Added
11
+
12
+ - **`dashCompleteTwoFactorSetup`** — New dashboard endpoint (`POST /dash/complete-two-factor-setup`) to mark 2FA as enabled after the user verifies their TOTP code, separating "setup started" from "setup complete"
13
+ - **`twoFactorStatus` on user details** — `getUserDetails` now returns `twoFactorStatus: "disabled" | "pending" | "enabled"`, so the dashboard can distinguish users who started but haven't finished 2FA setup.
14
+
15
+ ### Changed
16
+
17
+ - **Two-factor routes align with Better Auth** — Dashboard 2FA endpoints now respect the two-factor plugin's configuration: custom `twoFactorTable`, TOTP issuer/digits/period, and backup code options.
18
+ - **`enableTwoFactor` behavior** — Orphaned setup records (user started `/two-factor/enable` but never verified) are cleared and replaced instead of returning "already enabled." Only users with `twoFactorEnabled: true` are treated as fully enabled.
19
+ - **Event location coverage** — Tracked events now consistently include location, including: email verification, magic link verification, invitation acceptance, and social invitation completion.
20
+ - **Outbound HTTP clients** — All outbound HTTP clients now send the same `User-Agent` header (`@better-auth/infra v{version}`) for simpler observability.
21
+
22
+ ### Fixed
23
+
24
+ - **OAuth social sign-in failures** — Failed social login attempts are now correctly attributed to the user.
25
+
26
+ ### Security
27
+
28
+ - **Timing-safe API key comparison** — JWT middleware now uses constant-time hash comparison when validating API keys.
29
+
30
+ ## [0.2.13] - 2026-06-05
31
+
32
+ ### Changed
33
+
34
+ - Event tracking now consistently records location data on tracked events.
35
+
36
+ ### Fixed
37
+
38
+ - Fixed impossible travel security challenges.
39
+
40
+ [0.2.14]: https://github.com/better-auth/better-auth-infra/compare/@better-auth/infra@0.2.13...@better-auth/infra@0.2.14
41
+ [0.2.13]: https://github.com/better-auth/better-auth-infra/compare/@better-auth/infra@0.2.12...@better-auth/infra@0.2.13
package/dist/client.mjs CHANGED
@@ -1,5 +1,5 @@
1
- import "./constants-CvriWQVc.mjs";
2
- import { n as createKV } from "./fetch-DiAhoiKA.mjs";
1
+ import "./constants-CLYqEwMV.mjs";
2
+ import { n as createKV } from "./fetch-Bl0S3xUi.mjs";
3
3
  import { a as resolveSentinelClientIdentifyUrl, i as solvePoWChallenge, l as hash, n as decodePoWChallenge, o as generateRequestId, r as encodePoWSolution, s as identify, t as createPowRetryTimeout, u as dashClient } from "./pow-retry-D2RRftJr.mjs";
4
4
  import { env } from "@better-auth/core/env";
5
5
  //#region src/sentinel/fingerprint.ts
package/dist/{constants-CvriWQVc.mjs → constants-CLYqEwMV.mjs} RENAMED
@@ -1,4 +1,8 @@
1
1
  import { env } from "@better-auth/core/env";
2
+ //#endregion
3
+ //#region src/version.ts
4
+ const PLUGIN_VERSION = "0.2.14";
5
+ //#endregion
2
6
  //#region src/constants.ts
3
7
  /**
4
8
  * Infrastructure API URL
@@ -16,5 +20,7 @@ const KV_TIMEOUT_MS = 1e3;
16
20
  * Timeout for API calls HTTP calls (ms)
17
21
  */
18
22
  const INFRA_API_TIMEOUT_MS = 3e3;
23
+ /** User-Agent for outbound @better-auth/infra HTTP clients. */
24
+ const INFRA_USER_AGENT = `@better-auth/infra v${PLUGIN_VERSION}`;
19
25
  //#endregion
20
- export { KV_TIMEOUT_MS as i, INFRA_API_URL as n, INFRA_KV_URL as r, INFRA_API_TIMEOUT_MS as t };
26
+ export { KV_TIMEOUT_MS as a, INFRA_USER_AGENT as i, INFRA_API_URL as n, PLUGIN_VERSION as o, INFRA_KV_URL as r, INFRA_API_TIMEOUT_MS as t };
package/dist/email.mjs CHANGED
@@ -1,4 +1,4 @@
1
- import { n as INFRA_API_URL } from "./constants-CvriWQVc.mjs";
1
+ import { i as INFRA_USER_AGENT, n as INFRA_API_URL } from "./constants-CLYqEwMV.mjs";
2
2
  import { logger } from "better-auth";
3
3
  import { env } from "@better-auth/core/env";
4
4
  import { createFetch } from "@better-fetch/fetch";
@@ -37,7 +37,10 @@ function createEmailSender(config) {
37
37
  if (!apiKey) logger.warn("[Dash] No API key provided for email sending. Set BETTER_AUTH_API_KEY environment variable or pass apiKey in config.");
38
38
  const $api = createFetch({
39
39
  baseURL: apiUrl,
40
- headers: { Authorization: `Bearer ${apiKey}` },
40
+ headers: {
41
+ "user-agent": INFRA_USER_AGENT,
42
+ Authorization: `Bearer ${apiKey}`
43
+ },
41
44
  timeout: config?.apiTimeout ?? 3e3
42
45
  });
43
46
  /**
package/dist/{fetch-DiAhoiKA.mjs → fetch-Bl0S3xUi.mjs} RENAMED
@@ -1,11 +1,11 @@
1
- import "./constants-CvriWQVc.mjs";
1
+ import { i as INFRA_USER_AGENT } from "./constants-CLYqEwMV.mjs";
2
2
  import { createFetch } from "@better-fetch/fetch";
3
3
  //#region src/fetch.ts
4
4
  function createAPI(options, fetchOptions) {
5
5
  return createFetch({
6
6
  baseURL: options.apiUrl,
7
7
  headers: {
8
- "user-agent": "better-auth",
8
+ "user-agent": INFRA_USER_AGENT,
9
9
  "x-api-key": options.apiKey
10
10
  },
11
11
  timeout: options.apiTimeout,
@@ -13,7 +13,7 @@ function createAPI(options, fetchOptions) {
13
13
  });
14
14
  }
15
15
  function createKV(options, fetchOptions) {
16
- const headers = { "user-agent": "better-auth" };
16
+ const headers = { "user-agent": INFRA_USER_AGENT };
17
17
  if (options.apiKey) headers["x-api-key"] = options.apiKey;
18
18
  return createFetch({
19
19
  baseURL: options.kvUrl,
package/dist/index.d.mts CHANGED
@@ -132,6 +132,7 @@ interface ImpossibleTravelResult {
132
132
  action?: "allow" | "challenge" | "block";
133
133
  challenged?: boolean;
134
134
  challenge?: string;
135
+ powVerified?: boolean;
135
136
  distance?: number;
136
137
  timeElapsedHours?: number;
137
138
  speedRequired?: number;
@@ -774,7 +775,7 @@ interface DashIdRow {
774
775
  id: string;
775
776
  }
776
777
  //#endregion
777
- //#region ../../node_modules/.bun/@better-auth+scim@1.6.11+25e6a1339d5195dd/node_modules/@better-auth/scim/dist/index.d.mts
778
+ //#region ../../node_modules/.bun/@better-auth+scim@1.6.15+095c64a03bdccbe8/node_modules/@better-auth/scim/dist/index.d.mts
778
779
  //#region src/types.d.ts
779
780
  interface SCIMProvider {
780
781
  id: string;
@@ -4531,6 +4532,7 @@ interface DashTwoFactorTotpViewResponse {
4531
4532
  interface DashTwoFactorBackupCodesResponse {
4532
4533
  backupCodes: string[];
4533
4534
  }
4535
+ type DashTwoFactorStatus = "disabled" | "pending" | "enabled";
4534
4536
  //#endregion
4535
4537
  //#region src/routes/users/types.d.ts
4536
4538
  type DashUser = User & {
@@ -4553,6 +4555,7 @@ type DashUserDetailsResponse = DashUser & {
4553
4555
  city?: string | null;
4554
4556
  country?: string | null;
4555
4557
  countryCode?: string | null;
4558
+ twoFactorStatus?: DashTwoFactorStatus;
4556
4559
  };
4557
4560
  type DashUserOrganization = Pick<Organization, "id" | "name" | "slug" | "logo" | "createdAt"> & {
4558
4561
  role: string;
@@ -5590,6 +5593,14 @@ declare const dash: <O extends DashOptions>(options?: O) => {
5590
5593
  };
5591
5594
  }>)[];
5592
5595
  }, DashTwoFactorEnableResponse>;
5596
+ dashCompleteTwoFactorSetup: import("better-call").StrictEndpoint<"/dash/complete-two-factor-setup", {
5597
+ method: "POST";
5598
+ use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
5599
+ payload: {
5600
+ userId: string;
5601
+ };
5602
+ }>)[];
5603
+ }, DashSuccessResponse>;
5593
5604
  dashViewTwoFactorTotpUri: import("better-call").StrictEndpoint<"/dash/view-two-factor-totp-uri", {
5594
5605
  method: "POST";
5595
5606
  metadata: {
@@ -6000,4 +6011,4 @@ declare const dash: <O extends DashOptions>(options?: O) => {
6000
6011
  } : {};
6001
6012
  };
6002
6013
  //#endregion
6003
- export { type APIError, CHALLENGE_TTL, type CompromisedPasswordResult, type CredentialStuffingResult, type DBField, DEFAULT_DIFFICULTY, type DashAddTeamMemberResponse, type DashBanManyResponse, type DashCheckUserByEmailResponse, type DashCheckUserExistsResponse, type DashCompleteInvitationResponse, type DashConfigResponse, type DashCreateOrganizationBody, type DashCreateOrganizationResponse, type DashCreateTeamResponse, type DashCreateUserResponse, type DashDeleteManyUsersResponse, type DashDirectoryCreateResponse, type DashDirectoryDeleteResponse, type DashDirectoryItem, type DashDirectoryRegenerateTokenResponse, type DashExecuteAdapterCountResponse, type DashExecuteAdapterFindManyResponse, type DashExecuteAdapterFindOneResponse, type DashExecuteAdapterMutationResponse, type DashExecuteAdapterResponse, type DashExportOrganizationsResponse, type DashIdRow, type DashInviteMemberResponse, type DashMaybeSuccessResponse, type DashOptions, type DashOptionsInternal, type DashOptionsResolved, type DashOrganizationAddMemberResponse, type DashOrganizationDeleteManyResponse, type DashOrganizationDetailResponse, type DashOrganizationInvitationItem, type DashOrganizationInvitationListResponse, type DashOrganizationInvitationStatusItem, type DashOrganizationListResponse, type DashOrganizationMember, type DashOrganizationMemberListItem, type DashOrganizationMemberListResponse, type DashOrganizationMemberUser, type DashOrganizationOptionsResponse, type DashOrganizationTeamItem, type DashOrganizationTeamListResponse, type DashOrganizationUpdateMemberRoleResponse, type DashOrganizationUpdateResponse, type DashSendManyVerificationEmailsResponse, type DashSessionRevokeManyResponse, type DashSsoCreateProviderResponse, type DashSsoDeleteResponse, type DashSsoMarkDomainVerifiedResponse, type DashSsoProviderItem, type DashSsoProviderSummary, type DashSsoUpdateProviderResponse, type DashSsoVerificationTokenResponse, type DashSsoVerifyDomainResponse, type DashSuccessResponse, type DashTeam, type DashTeamMember, type DashTeamMemberListResponse, type DashTwoFactorBackupCodesResponse, type DashTwoFactorEnableResponse, type DashTwoFactorTotpViewResponse, type DashUpdateTeamResponse, type DashUpdateUserResponse, type DashUserDetailsResponse, type DashUserGraphDataResponse, type DashUserListResponse, type DashUserOrganizationsResponse, type DashUserRetentionDataResponse, type DashUserStatsActivePeriod, type DashUserStatsResponse, type DashUserStatsSignUpPeriod, type DashValidateResponse, type DirectorySyncConnection, EMAIL_TEMPLATES, type EmailConfig, type EmailTemplateId, type EmailTemplateVariables, type Endpoint, type EndpointOptions, type EventLocation, type EventTypesResponse, type ImpossibleTravelResult, type InfraEndpointContext, type InfraPluginConnectionOptions, type InfraPluginConnectionOptionsInternal, type LocationData, type LocationDataContext, type PoWChallenge, type PoWSolution, type SCIMPlugin, type SMSConfig, type SMSTemplateId, type SMSTemplateVariables, SMS_TEMPLATES, type SecurityEvent, type SecurityEventType, type SecurityOptions, type SecurityVerdict, type SendBulkEmailsOptions, type SendBulkEmailsResult, type SendEmailOptions, type SendEmailResult, type SendSMSOptions, type SendSMSResult, type SentinelOptions, type SentinelOptionsInternal, type StaleUserResult, type ThresholdConfig, USER_EVENT_TYPES, type UserEvent, type UserEventType, type UserEventsResponse, createEmailSender, createSMSSender, dash, decodePoWChallenge, encodePoWSolution, normalizeEmail, sendBulkEmails, sendEmail, sendSMS, sentinel, solvePoWChallenge, verifyPoWSolution };
6014
+ export { type APIError, CHALLENGE_TTL, type CompromisedPasswordResult, type CredentialStuffingResult, type DBField, DEFAULT_DIFFICULTY, type DashAddTeamMemberResponse, type DashBanManyResponse, type DashCheckUserByEmailResponse, type DashCheckUserExistsResponse, type DashCompleteInvitationResponse, type DashConfigResponse, type DashCreateOrganizationBody, type DashCreateOrganizationResponse, type DashCreateTeamResponse, type DashCreateUserResponse, type DashDeleteManyUsersResponse, type DashDirectoryCreateResponse, type DashDirectoryDeleteResponse, type DashDirectoryItem, type DashDirectoryRegenerateTokenResponse, type DashExecuteAdapterCountResponse, type DashExecuteAdapterFindManyResponse, type DashExecuteAdapterFindOneResponse, type DashExecuteAdapterMutationResponse, type DashExecuteAdapterResponse, type DashExportOrganizationsResponse, type DashIdRow, type DashInviteMemberResponse, type DashMaybeSuccessResponse, type DashOptions, type DashOptionsInternal, type DashOptionsResolved, type DashOrganizationAddMemberResponse, type DashOrganizationDeleteManyResponse, type DashOrganizationDetailResponse, type DashOrganizationInvitationItem, type DashOrganizationInvitationListResponse, type DashOrganizationInvitationStatusItem, type DashOrganizationListResponse, type DashOrganizationMember, type DashOrganizationMemberListItem, type DashOrganizationMemberListResponse, type DashOrganizationMemberUser, type DashOrganizationOptionsResponse, type DashOrganizationTeamItem, type DashOrganizationTeamListResponse, type DashOrganizationUpdateMemberRoleResponse, type DashOrganizationUpdateResponse, type DashSendManyVerificationEmailsResponse, type DashSessionRevokeManyResponse, type DashSsoCreateProviderResponse, type DashSsoDeleteResponse, type DashSsoMarkDomainVerifiedResponse, type DashSsoProviderItem, type DashSsoProviderSummary, type DashSsoUpdateProviderResponse, type DashSsoVerificationTokenResponse, type DashSsoVerifyDomainResponse, type DashSuccessResponse, type DashTeam, type DashTeamMember, type DashTeamMemberListResponse, type DashTwoFactorBackupCodesResponse, type DashTwoFactorEnableResponse, type DashTwoFactorStatus, type DashTwoFactorTotpViewResponse, type DashUpdateTeamResponse, type DashUpdateUserResponse, type DashUserDetailsResponse, type DashUserGraphDataResponse, type DashUserListResponse, type DashUserOrganizationsResponse, type DashUserRetentionDataResponse, type DashUserStatsActivePeriod, type DashUserStatsResponse, type DashUserStatsSignUpPeriod, type DashValidateResponse, type DirectorySyncConnection, EMAIL_TEMPLATES, type EmailConfig, type EmailTemplateId, type EmailTemplateVariables, type Endpoint, type EndpointOptions, type EventLocation, type EventTypesResponse, type ImpossibleTravelResult, type InfraEndpointContext, type InfraPluginConnectionOptions, type InfraPluginConnectionOptionsInternal, type LocationData, type LocationDataContext, type PoWChallenge, type PoWSolution, type SCIMPlugin, type SMSConfig, type SMSTemplateId, type SMSTemplateVariables, SMS_TEMPLATES, type SecurityEvent, type SecurityEventType, type SecurityOptions, type SecurityVerdict, type SendBulkEmailsOptions, type SendBulkEmailsResult, type SendEmailOptions, type SendEmailResult, type SendSMSOptions, type SendSMSResult, type SentinelOptions, type SentinelOptionsInternal, type StaleUserResult, type ThresholdConfig, USER_EVENT_TYPES, type UserEvent, type UserEventType, type UserEventsResponse, createEmailSender, createSMSSender, dash, decodePoWChallenge, encodePoWSolution, normalizeEmail, sendBulkEmails, sendEmail, sendSMS, sentinel, solvePoWChallenge, verifyPoWSolution };