@better-auth/infra 0.2.12 → 0.2.14

package/dist/index.mjs

@@ -1,15 +1,17 @@
-import { n as INFRA_API_URL, r as INFRA_KV_URL } from "./constants-CvriWQVc.mjs";
-import { n as createKV, t as createAPI } from "./fetch-DiAhoiKA.mjs";
+import { i as INFRA_USER_AGENT, n as INFRA_API_URL, o as PLUGIN_VERSION, r as INFRA_KV_URL } from "./constants-CLYqEwMV.mjs";
+import { n as createKV, t as createAPI } from "./fetch-Bl0S3xUi.mjs";
 import { EMAIL_TEMPLATES, createEmailSender, sendBulkEmails, sendEmail } from "./email.mjs";
-import { APIError, generateId, getAuthTables, logger, parseState } from "better-auth";
+import { getCurrentAuthContext } from "@better-auth/core/context";
+import { APIError, generateId, getAuthTables, logger } from "better-auth";
 import { env } from "@better-auth/core/env";
 import { APIError as APIError$1, createAuthEndpoint, createAuthMiddleware, requestPasswordReset, sendVerificationEmailFn, sessionMiddleware } from "better-auth/api";
-import { getCurrentAuthContext } from "@better-auth/core/context";
 import { createFetch } from "@better-fetch/fetch";
 import { isValidPhoneNumber, parsePhoneNumberFromString } from "libphonenumber-js";
 import { createLocalJWKSet, jwtVerify } from "jose";
 import z$1, { z } from "zod";
 import { setSessionCookie } from "better-auth/cookies";
+import { generateRandomString, symmetricEncrypt } from "better-auth/crypto";
+import { createOTP } from "@better-auth/utils/otp";
 //#region src/options.ts
 function resolveConnectionOptions(options) {
 	return {
@@ -66,6 +68,7 @@ const EVENT_TYPES = {
 	USER_IMPERSONATED: "user_impersonated",
 	USER_IMPERSONATED_STOPPED: "user_impersonated_stopped"
 };
+const UNKNOWN_USER = "unknown";
 const routes = {
 	SEND_VERIFICATION_EMAIL: "/send-verification-email",
 	SIGN_IN: "/sign-in",
@@ -106,8 +109,11 @@ const routes = {
 	API_KEY_CREATE: "/api-key/create",
 	LINK_SOCIAL: "/link-social",
 	DASH_ROUTE: "/dash",
+	DASH_ACCEPT_INVITATION: "/dash/accept-invitation",
+	DASH_COMPLETE_INVITATION_SOCIAL: "/dash/complete-invitation-social",
 	DASH_UPDATE_USER: "/dash/update-user",
 	DASH_REVOKE_SESSIONS_ALL: "/dash/sessions/revoke-all",
+	DASH_IMPERSONATE_USER: "/dash/impersonate-user",
 	DASH_BAN_USER: "/dash/ban-user",
 	DASH_UNBAN_USER: "/dash/unban-user",
 	ADMIN_ROUTE: "/admin",
@@ -180,34 +186,6 @@ async function getUserById(userId, ctx) {
 	}
 	return user;
 }
-const getUserByIdToken = async (providerId, idToken, ctx) => {
-	const provider = ctx.context.socialProviders.find((p) => p.id === providerId);
-	let user = null;
-	if (provider) try {
-		user = await provider.getUserInfo(idToken);
-	} catch (error) {
-		logger.debug("[Dash] Failed to fetch user info:", error);
-	}
-	return user;
-};
-const getUserByAuthorizationCode = async (providerId, ctx) => {
-	let userInfo = null;
-	const provider = ctx.context.socialProviders.find((p) => p.id === providerId);
-	if (provider) try {
-		const codeVerifier = (await parseState(ctx)).codeVerifier;
-		const { code, device_id } = ctx.query ?? {};
-		const tokens = await provider.validateAuthorizationCode({
-			code,
-			codeVerifier,
-			deviceId: device_id,
-			redirectURI: `${ctx.context.baseURL}/callback/${provider.id}`
-		});
-		userInfo = await provider.getUserInfo({ ...tokens }).then((res) => res?.user);
-	} catch (error) {
-		logger.debug("[Dash] Failed to fetch user info:", error);
-	}
-	return userInfo;
-};
 //#endregion
 //#region src/events/core/events-account.ts
 const initAccountEvents = (tracker) => {
@@ -309,6 +287,7 @@ const routeToRegex = (route) => {
 	return new RegExp(`${pattern}(?:$|[/?])`);
 };
 const matchesAnyRoute = (path, routes) => {
+	if (!path) return false;
 	const cleanPath = stripQuery(path);
 	return routes.some((route) => routeToRegex(route).test(cleanPath));
 };
@@ -344,6 +323,53 @@ const getLoginMethod = (ctx) => {
 	return null;
 };
 //#endregion
+//#region src/events/core/oauth-callback-user.ts
+const OAUTH_CALLBACK_USER = Symbol.for("dash.oauthCallbackUser");
+/**
+* Stash OAuth profile on the request context when better-auth calls getUserInfo
+* during the callback, before the authorization code is consumed.
+*/
+function instrumentSocialProviders(providers) {
+	for (const provider of providers) {
+		const originalGetUserInfo = provider.getUserInfo.bind(provider);
+		provider.getUserInfo = async (token) => {
+			const result = await originalGetUserInfo(token);
+			const user = result?.user;
+			if (user) try {
+				const endpointCtx = await getCurrentAuthContext();
+				endpointCtx.context[OAUTH_CALLBACK_USER] = user;
+			} catch {}
+			return result;
+		};
+	}
+}
+async function resolveOAuthUser(providerId, ctx) {
+	const oauthUser = ctx.context[OAUTH_CALLBACK_USER];
+	if (!oauthUser) return null;
+	const email = oauthUser.email?.toLowerCase();
+	const accountId = oauthUser.id !== void 0 && oauthUser.id !== null ? String(oauthUser.id) : void 0;
+	if (email && accountId) try {
+		const result = await ctx.context.internalAdapter.findOAuthUser(email, accountId, providerId);
+		if (result?.user) return {
+			id: result.user.id,
+			email: result.user.email,
+			name: result.user.name
+		};
+	} catch (error) {
+		logger.debug("[Dash] Failed to find OAuth user:", error);
+	}
+	if (email) {
+		const user = await getUserByEmail(email, ctx);
+		if (user) return user;
+	}
+	if (!email && !oauthUser.name) return null;
+	return {
+		id: UNKNOWN_USER,
+		email: oauthUser.email ?? null,
+		name: oauthUser.name ?? "unknown"
+	};
+}
+//#endregion
 //#region src/events/core/events-session.ts
 const initSessionEvents = (tracker) => {
 	const { trackEvent } = tracker;
@@ -425,7 +451,7 @@ const initSessionEvents = (tracker) => {
 		};
 		ctx.context.runInBackground(track());
 	};
-	const trackSessionRevokedAll = (session, trigger, ctx, _location) => {
+	const trackSessionRevokedAll = (session, trigger, ctx, location) => {
 		const track = async () => {
 			const user = await getUserById(session.userId, ctx);
 			trackEvent({
@@ -438,7 +464,11 @@ const initSessionEvents = (tracker) => {
 					userEmail: user?.email ?? "unknown",
 					triggeredBy: trigger.triggeredBy,
 					triggerContext: trigger.triggerContext
-				}
+				},
+				ipAddress: location?.ipAddress,
+				city: location?.city,
+				country: location?.country,
+				countryCode: location?.countryCode
 			});
 		};
 		ctx.context.runInBackground(track());
@@ -527,7 +557,7 @@ const initSessionEvents = (tracker) => {
 		};
 		ctx.context.runInBackground(track());
 	};
-	const trackEmailVerificationSent = (session, user, trigger, _ctx) => {
+	const trackEmailVerificationSent = (session, user, trigger, location) => {
 		trackEvent({
 			eventKey: session.userId,
 			eventType: EVENT_TYPES.EMAIL_VERIFICATION_SENT,
@@ -539,10 +569,14 @@ const initSessionEvents = (tracker) => {
 				sessionId: session.id,
 				triggeredBy: trigger.triggeredBy,
 				triggerContext: trigger.triggerContext
-			}
+			},
+			ipAddress: location?.ipAddress,
+			city: location?.city,
+			country: location?.country,
+			countryCode: location?.countryCode
 		});
 	};
-	const trackEmailSignInAttempt = (ctx, trigger) => {
+	const trackEmailSignInAttempt = (ctx, trigger, location) => {
 		const track = async () => {
 			const user = await getUserByEmail(ctx.body.email, ctx);
 			trackEvent({
@@ -556,49 +590,44 @@ const initSessionEvents = (tracker) => {
 					loginMethod: getLoginMethod(ctx),
 					triggeredBy: user?.id ?? trigger.triggeredBy,
 					triggerContext: trigger.triggerContext
-				}
-			});
-		};
-		ctx.context.runInBackground(track());
-	};
-	const trackSocialSignInAttempt = (ctx, trigger) => {
-		const track = async () => {
-			const user = await getUserByIdToken(ctx.body.provider, ctx.body.idToken, ctx);
-			trackEvent({
-				eventKey: user?.user.id.toString() ?? "unknown",
-				eventType: EVENT_TYPES.USER_SIGN_IN_FAILED,
-				eventDisplayName: "User sign-in attempt failed",
-				eventData: {
-					userId: user?.user.id.toString() ?? "unknown",
-					userName: user?.user.name ?? "unknown",
-					userEmail: user?.user.email ?? "unknown",
-					loginMethod: getLoginMethod(ctx),
-					triggeredBy: user?.user.id ?? trigger.triggeredBy,
-					triggerContext: trigger.triggerContext
-				}
+				},
+				ipAddress: location?.ipAddress,
+				city: location?.city,
+				country: location?.country,
+				countryCode: location?.countryCode
 			});
 		};
 		ctx.context.runInBackground(track());
 	};
-	const trackSocialSignInRedirectionAttempt = (ctx, trigger) => {
+	const trackSocialSignInFailure = (ctx, providerId, trigger, location) => {
 		const track = async () => {
-			const user = await getUserByAuthorizationCode(tryDecode(ctx.params?.id), ctx);
+			const user = await resolveOAuthUser(providerId, ctx);
 			trackEvent({
-				eventKey: user?.id.toString() ?? "unknown",
+				eventKey: user?.id ?? "unknown",
 				eventType: EVENT_TYPES.USER_SIGN_IN_FAILED,
 				eventDisplayName: "User sign-in attempt failed",
 				eventData: {
-					userId: user?.id.toString() ?? "unknown",
+					userId: user?.id ?? "unknown",
 					userName: user?.name ?? "unknown",
-					userEmail: user?.id ?? "unknown",
+					userEmail: user?.email ?? "unknown",
 					loginMethod: getLoginMethod(ctx),
-					triggeredBy: trigger.triggeredBy,
+					triggeredBy: user && user.id !== "unknown" ? user.id : trigger.triggeredBy,
 					triggerContext: trigger.triggerContext
-				}
+				},
+				ipAddress: location?.ipAddress,
+				city: location?.city,
+				country: location?.country,
+				countryCode: location?.countryCode
 			});
 		};
 		ctx.context.runInBackground(track());
 	};
+	const trackSocialSignInAttempt = (ctx, trigger, location) => {
+		trackSocialSignInFailure(ctx, ctx.body.provider, trigger, location);
+	};
+	const trackSocialSignInRedirectionAttempt = (ctx, trigger, location) => {
+		trackSocialSignInFailure(ctx, tryDecode(ctx.params?.id), trigger, location);
+	};
 	return {
 		trackUserSignedIn,
 		trackUserSignedOut,
@@ -983,23 +1012,22 @@ function createIdentificationMiddleware($kv) {
 		ctx.context.visitorId = visitorId;
 		const ipConfig = ctx.context.options?.advanced?.ipAddress;
 		let location;
+		const requestIp = getClientIpFromRequest(ctx.request, ipConfig?.ipAddressHeaders || null);
+		const requestCountryCode = getCountryCodeFromRequest(ctx.request);
 		if (ipConfig?.disableIpTracking === true) location = void 0;
 		else if (requestId && identification) {
 			const loc = getLocation(identification);
 			location = {
-				ipAddress: identification.ip || void 0,
+				ipAddress: identification.ip || requestIp || void 0,
 				city: loc?.city || void 0,
 				country: loc?.country?.name || void 0,
-				countryCode: loc?.country?.code || void 0
-			};
-		} else {
-			const ipAddress = getClientIpFromRequest(ctx.request, ipConfig?.ipAddressHeaders || null);
-			if (ipAddress) location = {
-				ipAddress,
-				countryCode: getCountryCodeFromRequest(ctx.request)
+				countryCode: loc?.country?.code || requestCountryCode || void 0
 			};
-			else location = void 0;
-		}
+		} else if (requestIp) location = {
+			ipAddress: requestIp,
+			countryCode: requestCountryCode
+		};
+		else location = void 0;
 		ctx.context.location = location;
 		ctx.context.ip = resolveSecurityIp(identification, location);
 		ctx.context.untrustedVisitorId = resolveUntrustedVisitorId(visitorId, ctx.context.ip, headerVisitorId);
@@ -1071,9 +1099,11 @@ function emitEvaluation(ctx, trackEvent, options = {}) {
 	ev.emitted = true;
 	const identification = ctx.context.identification ?? null;
 	const visitorId = ctx.context.visitorId ?? null;
+	const location = ctx.context.location;
 	const path = ctx.path ?? "";
+	const ipAddress = location?.ipAddress || identification?.ip || ctx.context.ip || void 0;
 	trackEvent({
-		eventKey: visitorId || identification?.ip || "unknown",
+		eventKey: visitorId || ipAddress || "unknown",
 		eventType: "security_check",
 		eventDisplayName: ev.outcome === "blocked" ? "Security: blocked" : ev.outcome === "challenged" ? "Security: challenged" : "Security: passed",
 		eventData: {
@@ -1086,10 +1116,10 @@ function emitEvaluation(ctx, trackEvent, options = {}) {
 			userAgent: options.userAgent,
 			details: ev.details
 		},
-		ipAddress: identification?.ip || void 0,
-		city: identification?.location?.city || void 0,
-		country: identification?.location?.country?.name || void 0,
-		countryCode: identification?.location?.country?.code || void 0
+		ipAddress,
+		city: location?.city || identification?.location?.city || void 0,
+		country: location?.country || identification?.location?.country?.name || void 0,
+		countryCode: location?.countryCode || identification?.location?.country?.code || void 0
 	});
 }
 //#endregion
@@ -1241,7 +1271,7 @@ function createSecurityClient(conn, $api, options, onSecurityEvent) {
 				return "";
 			}
 		},
-		async checkImpossibleTravel(userId, currentLocation, visitorId, ip = null) {
+		async checkImpossibleTravel(userId, currentLocation, visitorId, ip = null, powSolution) {
 			if (!options.impossibleTravel?.enabled || !currentLocation) return null;
 			try {
 				const data = await $api("/security/impossible-travel", {
@@ -1251,7 +1281,8 @@ function createSecurityClient(conn, $api, options, onSecurityEvent) {
 						visitorId,
 						location: currentLocation,
 						ip,
-						config: options
+						config: options,
+						...powSolution ? { powSolution } : {}
 					}
 				});
 				if (data.isImpossible) {
@@ -2190,7 +2221,9 @@ const sentinel = (options) => {
 							const identification = ctx.context.identification;
 							if (session.userId && identification?.location && visitorId) {
 								recordCheck(ctx, "impossible_travel");
-								const travelCheck = await securityService.checkImpossibleTravel(session.userId, identification.location, visitorId, identification.ip);
+								const powSolution = ctx.headers?.get?.("X-PoW-Solution") ?? null;
+								const travelCheck = await securityService.checkImpossibleTravel(session.userId, identification.location, visitorId, identification.ip, powSolution);
+								if (travelCheck?.powVerified) recordCheck(ctx, "pow_challenge");
 								if (travelCheck?.isImpossible) {
 									if (travelCheck.action === "block") {
 										setOutcome(ctx, "blocked", "impossible_travel", {
@@ -2399,7 +2432,7 @@ const sentinel = (options) => {
 //#region src/events/organization/events-invitation.ts
 const initInvitationEvents = (tracker) => {
 	const { trackEvent } = tracker;
-	const trackOrganizationMemberInvited = (organization, invitation, inviter, trigger) => {
+	const trackOrganizationMemberInvited = (organization, invitation, inviter, trigger, location) => {
 		trackEvent({
 			eventKey: organization.id,
 			eventType: ORGANIZATION_EVENT_TYPES.ORGANIZATION_MEMBER_INVITED,
@@ -2417,10 +2450,14 @@ const initInvitationEvents = (tracker) => {
 				inviterEmail: inviter.email ?? "unknown",
 				triggeredBy: trigger.triggeredBy,
 				triggerContext: trigger.triggerContext
-			}
+			},
+			ipAddress: location?.ipAddress,
+			city: location?.city,
+			country: location?.country,
+			countryCode: location?.countryCode
 		});
 	};
-	const trackOrganizationMemberInviteAccepted = (organization, invitation, member, acceptedBy, trigger) => {
+	const trackOrganizationMemberInviteAccepted = (organization, invitation, member, acceptedBy, trigger, location) => {
 		trackEvent({
 			eventKey: organization.id,
 			eventType: ORGANIZATION_EVENT_TYPES.ORGANIZATION_MEMBER_INVITE_ACCEPTED,
@@ -2440,10 +2477,14 @@ const initInvitationEvents = (tracker) => {
 				memberRole: member.role,
 				triggeredBy: trigger.triggeredBy,
 				triggerContext: trigger.triggerContext
-			}
+			},
+			ipAddress: location?.ipAddress,
+			city: location?.city,
+			country: location?.country,
+			countryCode: location?.countryCode
 		});
 	};
-	const trackOrganizationMemberInviteRejected = (organization, invitation, rejectedBy, trigger) => {
+	const trackOrganizationMemberInviteRejected = (organization, invitation, rejectedBy, trigger, location) => {
 		trackEvent({
 			eventKey: organization.id,
 			eventType: ORGANIZATION_EVENT_TYPES.ORGANIZATION_MEMBER_INVITE_REJECTED,
@@ -2461,10 +2502,14 @@ const initInvitationEvents = (tracker) => {
 				rejectedByName: rejectedBy.name,
 				triggeredBy: trigger.triggeredBy,
 				triggerContext: trigger.triggerContext
-			}
+			},
+			ipAddress: location?.ipAddress,
+			city: location?.city,
+			country: location?.country,
+			countryCode: location?.countryCode
 		});
 	};
-	const trackOrganizationMemberInviteCanceled = (organization, invitation, cancelledBy, trigger) => {
+	const trackOrganizationMemberInviteCanceled = (organization, invitation, cancelledBy, trigger, location) => {
 		trackEvent({
 			eventKey: organization.id,
 			eventType: ORGANIZATION_EVENT_TYPES.ORGANIZATION_MEMBER_INVITE_CANCELED,
@@ -2482,7 +2527,11 @@ const initInvitationEvents = (tracker) => {
 				cancelledByEmail: cancelledBy.email ?? "unknown",
 				triggeredBy: trigger.triggeredBy,
 				triggerContext: trigger.triggerContext
-			}
+			},
+			ipAddress: location?.ipAddress,
+			city: location?.city,
+			country: location?.country,
+			countryCode: location?.countryCode
 		});
 	};
 	return {
@@ -2496,7 +2545,7 @@ const initInvitationEvents = (tracker) => {
 //#region src/events/organization/events-member.ts
 const initMemberEvents = (tracker) => {
 	const { trackEvent } = tracker;
-	const trackOrganizationMemberAdded = (organization, member, user, trigger) => {
+	const trackOrganizationMemberAdded = (organization, member, user, trigger, location) => {
 		trackEvent({
 			eventKey: organization.id,
 			eventType: ORGANIZATION_EVENT_TYPES.ORGANIZATION_MEMBER_ADDED,
@@ -2512,10 +2561,14 @@ const initMemberEvents = (tracker) => {
 				memberEmail: user.email ?? "unknown",
 				triggeredBy: trigger.triggeredBy,
 				triggerContext: trigger.triggerContext
-			}
+			},
+			ipAddress: location?.ipAddress,
+			city: location?.city,
+			country: location?.country,
+			countryCode: location?.countryCode
 		});
 	};
-	const trackOrganizationMemberRemoved = (organization, member, user, trigger) => {
+	const trackOrganizationMemberRemoved = (organization, member, user, trigger, location) => {
 		trackEvent({
 			eventKey: organization.id,
 			eventType: ORGANIZATION_EVENT_TYPES.ORGANIZATION_MEMBER_REMOVED,
@@ -2531,10 +2584,14 @@ const initMemberEvents = (tracker) => {
 				memberEmail: user.email ?? "unknown",
 				triggeredBy: trigger.triggeredBy,
 				triggerContext: trigger.triggerContext
-			}
+			},
+			ipAddress: location?.ipAddress,
+			city: location?.city,
+			country: location?.country,
+			countryCode: location?.countryCode
 		});
 	};
-	const trackOrganizationMemberRoleUpdated = (organization, member, user, previousRole, trigger) => {
+	const trackOrganizationMemberRoleUpdated = (organization, member, user, previousRole, trigger, location) => {
 		trackEvent({
 			eventKey: organization.id,
 			eventType: ORGANIZATION_EVENT_TYPES.ORGANIZATION_MEMBER_ROLE_UPDATED,
@@ -2551,7 +2608,11 @@ const initMemberEvents = (tracker) => {
 				memberEmail: user.email ?? "unknown",
 				triggeredBy: trigger.triggeredBy,
 				triggerContext: trigger.triggerContext
-			}
+			},
+			ipAddress: location?.ipAddress,
+			city: location?.city,
+			country: location?.country,
+			countryCode: location?.countryCode
 		});
 	};
 	return {
@@ -2564,7 +2625,7 @@ const initMemberEvents = (tracker) => {
 //#region src/events/organization/events-organization.ts
 const initOrganizationEvents = (tracker) => {
 	const { trackEvent } = tracker;
-	const trackOrganizationCreated = (organization, trigger) => {
+	const trackOrganizationCreated = (organization, trigger, location) => {
 		trackEvent({
 			eventKey: organization.id,
 			eventType: ORGANIZATION_EVENT_TYPES.ORGANIZATION_CREATED,
@@ -2575,10 +2636,14 @@ const initOrganizationEvents = (tracker) => {
 				organizationName: organization.name,
 				triggeredBy: trigger.triggeredBy,
 				triggerContext: trigger.triggerContext
-			}
+			},
+			ipAddress: location?.ipAddress,
+			city: location?.city,
+			country: location?.country,
+			countryCode: location?.countryCode
 		});
 	};
-	const trackOrganizationUpdated = (organization, trigger) => {
+	const trackOrganizationUpdated = (organization, trigger, location) => {
 		trackEvent({
 			eventKey: organization.id,
 			eventType: ORGANIZATION_EVENT_TYPES.ORGANIZATION_UPDATED,
@@ -2589,7 +2654,11 @@ const initOrganizationEvents = (tracker) => {
 				organizationName: organization.name,
 				triggeredBy: trigger.triggeredBy,
 				triggerContext: trigger.triggerContext
-			}
+			},
+			ipAddress: location?.ipAddress,
+			city: location?.city,
+			country: location?.country,
+			countryCode: location?.countryCode
 		});
 	};
 	return {
@@ -2601,7 +2670,7 @@ const initOrganizationEvents = (tracker) => {
 //#region src/events/organization/events-team.ts
 const initTeamEvents = (tracker) => {
 	const { trackEvent } = tracker;
-	const trackOrganizationTeamCreated = (organization, team, trigger) => {
+	const trackOrganizationTeamCreated = (organization, team, trigger, location) => {
 		trackEvent({
 			eventKey: organization.id,
 			eventType: ORGANIZATION_EVENT_TYPES.ORGANIZATION_TEAM_CREATED,
@@ -2614,10 +2683,14 @@ const initTeamEvents = (tracker) => {
 				teamName: team.name,
 				triggeredBy: trigger.triggeredBy,
 				triggerContext: trigger.triggerContext
-			}
+			},
+			ipAddress: location?.ipAddress,
+			city: location?.city,
+			country: location?.country,
+			countryCode: location?.countryCode
 		});
 	};
-	const trackOrganizationTeamUpdated = (organization, team, trigger) => {
+	const trackOrganizationTeamUpdated = (organization, team, trigger, location) => {
 		trackEvent({
 			eventKey: organization.id,
 			eventType: ORGANIZATION_EVENT_TYPES.ORGANIZATION_TEAM_UPDATED,
@@ -2630,10 +2703,14 @@ const initTeamEvents = (tracker) => {
 				teamName: team.name,
 				triggeredBy: trigger.triggeredBy,
 				triggerContext: trigger.triggerContext
-			}
+			},
+			ipAddress: location?.ipAddress,
+			city: location?.city,
+			country: location?.country,
+			countryCode: location?.countryCode
 		});
 	};
-	const trackOrganizationTeamDeleted = (organization, team, trigger) => {
+	const trackOrganizationTeamDeleted = (organization, team, trigger, location) => {
 		trackEvent({
 			eventKey: organization.id,
 			eventType: ORGANIZATION_EVENT_TYPES.ORGANIZATION_TEAM_DELETED,
@@ -2646,10 +2723,14 @@ const initTeamEvents = (tracker) => {
 				teamName: team.name,
 				triggeredBy: trigger.triggeredBy,
 				triggerContext: trigger.triggerContext
-			}
+			},
+			ipAddress: location?.ipAddress,
+			city: location?.city,
+			country: location?.country,
+			countryCode: location?.countryCode
 		});
 	};
-	const trackOrganizationTeamMemberAdded = (organization, team, user, teamMember, trigger) => {
+	const trackOrganizationTeamMemberAdded = (organization, team, user, teamMember, trigger, location) => {
 		trackEvent({
 			eventKey: organization.id,
 			eventType: ORGANIZATION_EVENT_TYPES.ORGANIZATION_TEAM_MEMBER_ADDED,
@@ -2664,10 +2745,14 @@ const initTeamEvents = (tracker) => {
 				memberName: user.name,
 				triggeredBy: trigger.triggeredBy,
 				triggerContext: trigger.triggerContext
-			}
+			},
+			ipAddress: location?.ipAddress,
+			city: location?.city,
+			country: location?.country,
+			countryCode: location?.countryCode
 		});
 	};
-	const trackOrganizationTeamMemberRemoved = (organization, team, user, teamMember, trigger) => {
+	const trackOrganizationTeamMemberRemoved = (organization, team, user, teamMember, trigger, location) => {
 		trackEvent({
 			eventKey: organization.id,
 			eventType: ORGANIZATION_EVENT_TYPES.ORGANIZATION_TEAM_MEMBER_REMOVED,
@@ -2682,7 +2767,11 @@ const initTeamEvents = (tracker) => {
 				memberName: user.name,
 				triggeredBy: trigger.triggeredBy,
 				triggerContext: trigger.triggerContext
-			}
+			},
+			ipAddress: location?.ipAddress,
+			city: location?.city,
+			country: location?.country,
+			countryCode: location?.countryCode
 		});
 	};
 	return {
@@ -2694,11 +2783,10 @@ const initTeamEvents = (tracker) => {
 	};
 };
 //#endregion
-//#region src/jwt.ts
+//#region ../utils/dist/crypto/index.mjs
 /**
-* Hash the given value
-* Note: Must match @infra/utils/crypto hash()
-* @param value - The value to hash
+* One-way hash for storage and lookup. Returns hex-encoded digest.
+* Use to verify values without ever storing plaintext.
 */
 async function hash(value) {
 	const data = new TextEncoder().encode(value);
@@ -2706,6 +2794,32 @@ async function hash(value) {
 	const hashArray = new Uint8Array(hashBuffer);
 	return Array.from(hashArray).map((b) => b.toString(16).padStart(2, "0")).join("");
 }
+function hexToBytes(hex) {
+	if (hex.length % 2 !== 0) return null;
+	const bytes = new Uint8Array(hex.length / 2);
+	for (let i = 0; i < bytes.length; i++) {
+		const byte = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+		if (Number.isNaN(byte)) return null;
+		bytes[i] = byte;
+	}
+	return bytes;
+}
+function timingSafeEqualBytes(a, b) {
+	if (a.length !== b.length) return false;
+	let diff = 0;
+	for (let i = 0; i < a.length; i++) diff |= a[i] ^ b[i];
+	return diff === 0;
+}
+/** Constant-time comparison for hex-encoded digests (e.g. SHA-256 hashes). */
+function timingSafeEqualHash(a, b) {
+	if (a.length !== b.length) return false;
+	const aBytes = hexToBytes(a);
+	const bBytes = hexToBytes(b);
+	if (!aBytes || !bBytes || aBytes.length !== bBytes.length) return false;
+	return timingSafeEqualBytes(aBytes, bBytes);
+}
+//#endregion
+//#region src/jwt.ts
 /**
 * Skip JTI check for JWTs issued within this many seconds.
 * This is safe because replay attacks require time for interception.
@@ -2773,9 +2887,8 @@ const jwtMiddleware = (options, schema, getJWT) => {
 			});
 			throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
 		}
-		const expectedHash = await hash(options.apiKey);
-		if (apiKeyHash !== expectedHash) {
-			ctx.context.logger.warn("[Dash] API key hash is invalid", apiKeyHash, expectedHash);
+		if (!timingSafeEqualHash(apiKeyHash, await hash(options.apiKey))) {
+			ctx.context.logger.warn("[Dash] API key hash mismatch");
 			throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
 		}
 		if (!isRecentlyIssued(payload)) {
@@ -2828,7 +2941,7 @@ const jwtValidateMiddleware = (options) => {
 			});
 			throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
 		}
-		if (apiKeyHash !== await hash(options.apiKey)) {
+		if (!timingSafeEqualHash(apiKeyHash, await hash(options.apiKey))) {
 			ctx.context.logger.warn("[Dash] API key hash mismatch");
 			throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
 		}
@@ -2836,9 +2949,6 @@ const jwtValidateMiddleware = (options) => {
 	});
 };
 //#endregion
-//#region src/version.ts
-const PLUGIN_VERSION = "0.2.12";
-//#endregion
 //#region src/routes/auth/config.ts
 const PLUGIN_OPTIONS_EXCLUDE_KEYS = { stripe: new Set(["stripeClient"]) };
 const EXACT_SENSITIVE_STRING_KEYS_LOWER = new Set([...new Set([
@@ -5717,7 +5827,7 @@ const revokeAllSessions = (options) => createAuthEndpoint("/dash/sessions/revoke
 }, async (ctx) => {
 	const { userId } = ctx.body;
 	if (!await ctx.context.internalAdapter.findUserById(userId)) throw ctx.error("NOT_FOUND", { message: "User not found" });
-	await ctx.context.internalAdapter.deleteSessions(userId);
+	await ctx.context.internalAdapter.deleteUserSessions(userId);
 	return ctx.json({ success: true });
 });
 const revokeManySessions = (options) => createAuthEndpoint("/dash/sessions/revoke-many", {
@@ -5726,7 +5836,7 @@ const revokeManySessions = (options) => createAuthEndpoint("/dash/sessions/revok
 }, async (ctx) => {
 	const { userIds } = ctx.context.payload;
 	await withConcurrency(chunkArray(userIds, { batchSize: 50 }), async (chunk) => {
-		for (const userId of chunk) await ctx.context.internalAdapter.deleteSessions(userId);
+		for (const userId of chunk) await ctx.context.internalAdapter.deleteUserSessions(userId);
 	}, { concurrency: 3 });
 	return ctx.json({
 		success: true,
@@ -5848,39 +5958,41 @@ async function resolveHostnameAddresses(hostname) {
 		return null;
 	}
 }
-function validateUrlSync(rawUrl, options = {}) {
-	const trimmed = rawUrl.trim();
+function validateUrlSync(input, options = {}) {
 	let parsed;
-	try {
-		parsed = new URL(trimmed);
-	} catch {
-		return {
-			ok: false,
-			reason: "invalid_url",
-			url: trimmed
-		};
+	if (input instanceof URL) parsed = input;
+	else {
+		const trimmed = input.trim();
+		try {
+			parsed = new URL(trimmed);
+		} catch {
+			return {
+				ok: false,
+				reason: "invalid_url"
+			};
+		}
 	}
 	if (!isAllowedProtocol(parsed.protocol, options.allowedProtocols)) return {
 		ok: false,
 		reason: "disallowed_protocol",
-		url: trimmed,
+		url: parsed,
 		protocol: parsed.protocol
 	};
 	if (parsed.username !== "" || parsed.password !== "") return {
 		ok: false,
 		reason: "embedded_credentials",
-		url: trimmed
+		url: parsed
 	};
 	if (isPrivateHost(parsed.hostname)) return {
 		ok: false,
 		reason: "private_host",
-		url: trimmed
+		url: parsed
 	};
 	if (options.allowedOrigins?.length) {
 		if (!isAllowedOrigin(parsed.origin, options.allowedOrigins)) return {
 			ok: false,
 			reason: "disallowed_origin",
-			url: trimmed,
+			url: parsed,
 			hostname: parsed.hostname,
 			origin: parsed.origin
 		};
@@ -5891,8 +6003,8 @@ function validateUrlSync(rawUrl, options = {}) {
 	};
 }
 /** SSRF checks with DNS resolution when available. */
-async function validateUrl(rawUrl, options = {}) {
-	const sync = validateUrlSync(rawUrl, options);
+async function validateUrl(input, options = {}) {
+	const sync = validateUrlSync(input, options);
 	if (!sync.ok) return sync;
 	if (options.dns === false) return sync;
 	const hostname = sync.url.hostname;
@@ -5900,19 +6012,23 @@ async function validateUrl(rawUrl, options = {}) {
 	if (!isIpLiteralHostname(hostname) && !addresses?.length) return {
 		ok: false,
 		reason: "unresolved_host",
-		url: sync.url.href,
+		url: sync.url,
 		hostname
 	};
 	if (addresses) {
 		for (const addr of addresses) if (isPrivateHost(addr)) return {
 			ok: false,
 			reason: "private_dns",
-			url: sync.url.href,
+			url: sync.url,
 			hostname,
 			address: addr
 		};
 	}
-	return sync;
+	return {
+		ok: true,
+		url: sync.url,
+		...addresses ? { addresses } : {}
+	};
 }
 function safeResolveUrl(raw, baseURL) {
 	const trim = raw.trim();
@@ -5928,12 +6044,6 @@ function safeResolveUrl(raw, baseURL) {
 }
 //#endregion
 //#region src/validation/ssrf.ts
-/**
-* SSRF protection for dash plugin outbound fetches.
-*
-* Uses @infra/utils at build time; tsdown bundles it into published dist so
-* consumers do not install the private workspace package.
-*/
 const REDIRECT_STATUSES = new Set([
 	301,
 	302,
@@ -5948,11 +6058,6 @@ var SsrfBlockedError = class extends Error {
 function isSsrfBlockedError(error) {
 	return error instanceof SsrfBlockedError;
 }
-/** Validates URL hostname literals and resolved DNS addresses. */
-async function parseAndValidateUrl(url) {
-	const result = await validateUrl(url);
-	return result.ok ? result.url : null;
-}
 /**
 * Fetch with SSRF checks on the initial URL and every redirect target.
 */
@@ -5960,8 +6065,9 @@ async function $outbound(url, options = {}) {
 	const { timeout, signal: callerSignal, ...fetchInit } = options;
 	let currentUrl = url;
 	for (let hop = 0;; hop++) {
-		const validated = await parseAndValidateUrl(currentUrl);
-		if (!validated) throw new SsrfBlockedError("Invalid or blocked URL");
+		const result = await validateUrl(currentUrl);
+		if (!result.ok) throw new SsrfBlockedError("Invalid or blocked URL");
+		const validated = result.url;
 		const signals = [];
 		if (callerSignal) signals.push(callerSignal);
 		if (timeout !== void 0 && timeout > 0) signals.push(AbortSignal.timeout(timeout));
@@ -5976,7 +6082,7 @@ async function $outbound(url, options = {}) {
 		const location = response.headers.get("location");
 		const next = location ? safeResolveUrl(location, validated.href) : null;
 		if (!next) throw new SsrfBlockedError("Invalid redirect location");
-		currentUrl = next.href;
+		currentUrl = next;
 	}
 }
 //#endregion
@@ -6091,23 +6197,19 @@ const oidcConfigSchema = z$1.object({
 });
 async function resolveSAMLConfig(samlConfig, providerId, baseURL, ctx) {
 	let idpMetadataXml = samlConfig.idpMetadata?.metadata;
-	if (!idpMetadataXml && samlConfig.idpMetadata?.metadataUrl) {
-		const validatedMetadataUrl = await parseAndValidateUrl(samlConfig.idpMetadata.metadataUrl);
-		if (!validatedMetadataUrl) throw ctx.error("BAD_REQUEST", { message: "Invalid or blocked IdP metadata URL" });
-		try {
-			const metadataResponse = await $outbound(validatedMetadataUrl.href, {
-				method: "GET",
-				headers: { Accept: "application/xml, text/xml" },
-				timeout: 15e3
-			});
-			if (!metadataResponse.ok) throw ctx.error("BAD_REQUEST", { message: `Failed to fetch IdP metadata from URL: ${metadataResponse.status} ${metadataResponse.statusText}` });
-			idpMetadataXml = await metadataResponse.text();
-		} catch (e) {
-			if (isSsrfBlockedError(e)) throw ctx.error("BAD_REQUEST", { message: "Invalid or blocked IdP metadata URL" });
-			if (e instanceof APIError$1) throw e;
-			ctx.context.logger.error("[Dash] Failed to fetch IdP metadata from URL:", e);
-			throw ctx.error("BAD_REQUEST", { message: "Failed to fetch IdP metadata from URL" });
-		}
+	if (!idpMetadataXml && samlConfig.idpMetadata?.metadataUrl) try {
+		const metadataResponse = await $outbound(samlConfig.idpMetadata.metadataUrl, {
+			method: "GET",
+			headers: { Accept: "application/xml, text/xml" },
+			timeout: 15e3
+		});
+		if (!metadataResponse.ok) throw ctx.error("BAD_REQUEST", { message: `Failed to fetch IdP metadata from URL: ${metadataResponse.status} ${metadataResponse.statusText}` });
+		idpMetadataXml = await metadataResponse.text();
+	} catch (e) {
+		if (isSsrfBlockedError(e)) throw ctx.error("BAD_REQUEST", { message: "Invalid or blocked IdP metadata URL" });
+		if (e instanceof APIError$1) throw e;
+		ctx.context.logger.error("[Dash] Failed to fetch IdP metadata from URL:", e);
+		throw ctx.error("BAD_REQUEST", { message: "Failed to fetch IdP metadata from URL" });
 	}
 	const metadataAlgorithmWarnings = [];
 	if (idpMetadataXml) {
@@ -6574,6 +6676,64 @@ const markSsoProviderDomainVerified = (options) => {
 	});
 };
 //#endregion
+//#region src/routes/two-factor/backup-codes.ts
+/** Mirrors better-auth/plugins/two-factor/backup-codes generateBackupCodesFn. */
+function generateBackupCodesPlain(options) {
+	if (options?.customBackupCodesGenerate) return options.customBackupCodesGenerate();
+	const amount = options?.amount ?? 10;
+	const length = options?.length ?? 10;
+	return Array.from({ length: amount }, () => {
+		const code = generateRandomString(length, "a-z", "0-9", "A-Z");
+		return `${code.slice(0, 5)}-${code.slice(5)}`;
+	});
+}
+/** Mirrors better-auth/plugins/two-factor/backup-codes generateBackupCodes. */
+async function generateBackupCodes$1(secret, options) {
+	const backupCodes = generateBackupCodesPlain(options);
+	const json = JSON.stringify(backupCodes);
+	const storeBackupCodes = options?.storeBackupCodes ?? "encrypted";
+	if (storeBackupCodes === "encrypted") return {
+		backupCodes,
+		encryptedBackupCodes: await symmetricEncrypt({
+			key: secret,
+			data: json
+		})
+	};
+	if (typeof storeBackupCodes === "object" && "encrypt" in storeBackupCodes) return {
+		backupCodes,
+		encryptedBackupCodes: await storeBackupCodes.encrypt(json)
+	};
+	return {
+		backupCodes,
+		encryptedBackupCodes: json
+	};
+}
+function resolveBackupCodeOptions(twoFactorPlugin) {
+	return {
+		storeBackupCodes: "encrypted",
+		...twoFactorPlugin?.options?.backupCodeOptions
+	};
+}
+//#endregion
+//#region src/routes/two-factor/two-factor-options.ts
+function resolveTotpIssuer(twoFactorPlugin, appName) {
+	const options = twoFactorPlugin?.options;
+	return (options?.totpOptions)?.issuer ?? options?.issuer ?? appName ?? "BetterAuth";
+}
+function resolveTotpConfig(twoFactorPlugin) {
+	const totpOptions = twoFactorPlugin?.options?.totpOptions;
+	return {
+		digits: totpOptions?.digits ?? 6,
+		period: totpOptions?.period ?? 30
+	};
+}
+function buildTotpUri(params) {
+	return createOTP(params.secret, {
+		digits: params.digits,
+		period: params.period
+	}).url(params.issuer, params.account);
+}
+//#endregion
 //#region src/routes/two-factor/index.ts
 const enableTwoFactor = (options) => createAuthEndpoint("/dash/enable-two-factor", {
 	method: "POST",
@@ -6582,31 +6742,37 @@ const enableTwoFactor = (options) => createAuthEndpoint("/dash/enable-two-factor
 	const { userId } = ctx.context.payload;
 	const twoFactorPlugin = ctx.context.getPlugin("two-factor");
 	if (!twoFactorPlugin) throw new APIError("BAD_REQUEST", { message: "Two-factor authentication plugin is not enabled" });
+	if (twoFactorPlugin.options?.totpOptions?.disable === true) throw new APIError("BAD_REQUEST", {
+		message: "TOTP is not configured",
+		code: "TOTP_NOT_CONFIGURED"
+	});
+	const twoFactorTable = twoFactorPlugin.options?.twoFactorTable ?? "twoFactor";
+	const user = await ctx.context.internalAdapter.findUserById(userId);
+	if (!user) throw new APIError("NOT_FOUND", { message: "User not found" });
+	if (user.twoFactorEnabled === true) throw new APIError("BAD_REQUEST", { message: "Two-factor authentication is already enabled for this user" });
 	if (await ctx.context.adapter.findOne({
-		model: "twoFactor",
+		model: twoFactorTable,
 		where: [{
 			field: "userId",
 			value: userId
 		}]
-	})) throw new APIError("BAD_REQUEST", { message: "Two-factor authentication is already enabled for this user" });
+	})) await ctx.context.adapter.delete({
+		model: twoFactorTable,
+		where: [{
+			field: "userId",
+			value: userId
+		}]
+	});
 	const { generateRandomString, symmetricEncrypt } = await import("better-auth/crypto");
-	const secret = generateRandomString(32, "A-Z");
-	const backupCodeAmount = 10;
-	const backupCodeLength = 10;
-	const backupCodes = [];
-	for (let i = 0; i < backupCodeAmount; i++) backupCodes.push(generateId(backupCodeLength).toUpperCase());
+	const secret = generateRandomString(32);
+	const { backupCodes, encryptedBackupCodes } = await generateBackupCodes$1(ctx.context.secret, resolveBackupCodeOptions(twoFactorPlugin));
 	const encryptedSecret = await symmetricEncrypt({
 		key: ctx.context.secret,
 		data: secret
 	});
-	const encryptedBackupCodes = await symmetricEncrypt({
-		key: ctx.context.secret,
-		data: JSON.stringify(backupCodes)
-	});
 	await ctx.context.adapter.create({
-		model: "twoFactor",
+		model: twoFactorTable,
 		data: {
-			id: generateId(32),
 			userId,
 			secret: encryptedSecret,
 			backupCodes: encryptedBackupCodes
@@ -6616,15 +6782,47 @@ const enableTwoFactor = (options) => createAuthEndpoint("/dash/enable-two-factor
 		twoFactorEnabled: true,
 		updatedAt: /* @__PURE__ */ new Date()
 	});
-	const user = await ctx.context.internalAdapter.findUserById(userId);
-	const issuer = twoFactorPlugin.options?.issuer || ctx.context.appName || "BetterAuth";
+	const totpConfig = resolveTotpConfig(twoFactorPlugin);
 	return {
 		success: true,
-		totpURI: `otpauth://totp/${encodeURIComponent(issuer)}:${encodeURIComponent(user?.email || userId)}?secret=${secret}&issuer=${encodeURIComponent(issuer)}&algorithm=SHA1&digits=6&period=30`,
+		totpURI: buildTotpUri({
+			secret,
+			issuer: resolveTotpIssuer(twoFactorPlugin, ctx.context.appName),
+			account: user?.email || userId,
+			digits: totpConfig.digits,
+			period: totpConfig.period
+		}),
 		secret,
 		backupCodes
 	};
 });
+const completeTwoFactorSetup = (options) => createAuthEndpoint("/dash/complete-two-factor-setup", {
+	method: "POST",
+	use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))]
+}, async (ctx) => {
+	const { userId } = ctx.context.payload;
+	const twoFactorPlugin = ctx.context.getPlugin("two-factor");
+	if (!twoFactorPlugin) throw new APIError("BAD_REQUEST", { message: "Two-factor authentication plugin is not enabled" });
+	const user = await ctx.context.internalAdapter.findUserById(userId);
+	if (!user) throw new APIError("NOT_FOUND", { message: "User not found" });
+	if (user.twoFactorEnabled === true) throw new APIError("BAD_REQUEST", { message: "Two-factor authentication is already enabled for this user" });
+	const twoFactorTable = twoFactorPlugin.options?.twoFactorTable ?? "twoFactor";
+	if (!await ctx.context.adapter.findOne({
+		model: twoFactorTable,
+		where: [{
+			field: "userId",
+			value: userId
+		}]
+	})) throw new APIError("BAD_REQUEST", {
+		message: "Two-factor authentication setup has not been started",
+		code: "TWO_FACTOR_SETUP_NOT_PENDING"
+	});
+	await ctx.context.internalAdapter.updateUser(userId, {
+		twoFactorEnabled: true,
+		updatedAt: /* @__PURE__ */ new Date()
+	});
+	return { success: true };
+});
 const viewTwoFactorTotpUri = (options) => createAuthEndpoint("/dash/view-two-factor-totp-uri", {
 	method: "POST",
 	metadata: { scope: "http" },
@@ -6633,8 +6831,13 @@ const viewTwoFactorTotpUri = (options) => createAuthEndpoint("/dash/view-two-fac
 	const { userId } = ctx.context.payload;
 	const twoFactorPlugin = ctx.context.getPlugin("two-factor");
 	if (!twoFactorPlugin) throw new APIError("BAD_REQUEST", { message: "Two-factor authentication plugin is not enabled" });
+	if (twoFactorPlugin.options?.totpOptions?.disable === true) throw new APIError("BAD_REQUEST", {
+		message: "TOTP is not configured",
+		code: "TOTP_NOT_CONFIGURED"
+	});
+	const twoFactorTable = twoFactorPlugin.options?.twoFactorTable ?? "twoFactor";
 	const twoFactorRecord = await ctx.context.adapter.findOne({
-		model: "twoFactor",
+		model: twoFactorTable,
 		where: [{
 			field: "userId",
 			value: userId
@@ -6650,8 +6853,14 @@ const viewTwoFactorTotpUri = (options) => createAuthEndpoint("/dash/view-two-fac
 		});
 	} catch {}
 	const user = await ctx.context.internalAdapter.findUserById(userId);
-	const issuer = twoFactorPlugin.options?.issuer || ctx.context.appName || "BetterAuth";
-	return { totpURI: `otpauth://totp/${encodeURIComponent(issuer)}:${encodeURIComponent(user?.email || userId)}?secret=${secret}&issuer=${encodeURIComponent(issuer)}&algorithm=SHA1&digits=6&period=30` };
+	const totpConfig = resolveTotpConfig(twoFactorPlugin);
+	return { totpURI: buildTotpUri({
+		secret,
+		issuer: resolveTotpIssuer(twoFactorPlugin, ctx.context.appName),
+		account: user?.email || userId,
+		digits: totpConfig.digits,
+		period: totpConfig.period
+	}) };
 });
 const viewBackupCodes = (options) => createAuthEndpoint("/dash/view-backup-codes", {
 	method: "POST",
@@ -6664,9 +6873,11 @@ const disableTwoFactor = (options) => createAuthEndpoint("/dash/disable-two-fact
 	use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))]
 }, async (ctx) => {
 	const { userId } = ctx.context.payload;
-	if (!ctx.context.getPlugin("two-factor")) throw new APIError("BAD_REQUEST", { message: "Two-factor authentication is not enabled" });
+	const twoFactorPlugin = ctx.context.getPlugin("two-factor");
+	if (!twoFactorPlugin) throw new APIError("BAD_REQUEST", { message: "Two-factor authentication is not enabled" });
+	const twoFactorTable = twoFactorPlugin.options?.twoFactorTable ?? "twoFactor";
 	await ctx.context.adapter.delete({
-		model: "twoFactor",
+		model: twoFactorTable,
 		where: [{
 			field: "userId",
 			value: userId
@@ -6683,25 +6894,19 @@ const generateBackupCodes = (options) => createAuthEndpoint("/dash/generate-back
 	use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))]
 }, async (ctx) => {
 	const { userId } = ctx.context.payload;
+	const twoFactorPlugin = ctx.context.getPlugin("two-factor");
+	const twoFactorTable = twoFactorPlugin?.options?.twoFactorTable ?? "twoFactor";
 	const twoFactorRecord = await ctx.context.adapter.findOne({
-		model: "twoFactor",
+		model: twoFactorTable,
 		where: [{
 			field: "userId",
 			value: userId
 		}]
 	});
 	if (!twoFactorRecord) throw new APIError("NOT_FOUND", { message: "Two-factor authentication not set up for this user" });
-	const backupCodeAmount = 10;
-	const backupCodeLength = 10;
-	const newBackupCodes = [];
-	for (let i = 0; i < backupCodeAmount; i++) newBackupCodes.push(generateId(backupCodeLength).toUpperCase());
-	const { symmetricEncrypt } = await import("better-auth/crypto");
-	const encryptedCodes = await symmetricEncrypt({
-		key: ctx.context.secret,
-		data: JSON.stringify(newBackupCodes)
-	});
+	const { backupCodes: newBackupCodes, encryptedBackupCodes: encryptedCodes } = await generateBackupCodes$1(ctx.context.secret, resolveBackupCodeOptions(twoFactorPlugin));
 	await ctx.context.adapter.update({
-		model: "twoFactor",
+		model: twoFactorTable,
 		where: [{
 			field: "id",
 			value: twoFactorRecord.id
@@ -6711,6 +6916,20 @@ const generateBackupCodes = (options) => createAuthEndpoint("/dash/generate-back
 	return { backupCodes: newBackupCodes };
 });
 //#endregion
+//#region src/routes/two-factor/two-factor-status.ts
+async function resolveTwoFactorStatus(context, userId, user) {
+	if (!hasPlugin(context, "two-factor")) return;
+	if (user.twoFactorEnabled === true) return "enabled";
+	const twoFactorTable = context.getPlugin("two-factor")?.options?.twoFactorTable ?? "twoFactor";
+	return await context.adapter.findOne({
+		model: twoFactorTable,
+		where: [{
+			field: "userId",
+			value: userId
+		}]
+	}) ? "pending" : "disabled";
+}
+//#endregion
 //#region src/routes/users/index.ts
 function parseWhereClause(val) {
 	if (!val) return [];
@@ -7064,6 +7283,7 @@ const getUserDetails = (options) => {
 			} }
 		});
 		if (!user) throw ctx.error("NOT_FOUND", { message: "User not found" });
+		const twoFactorStatus = await resolveTwoFactorStatus(ctx.context, userId, user);
 		if (minimal) return {
 			...user,
 			lastActiveAt: user.lastActiveAt ?? null,
@@ -7071,7 +7291,8 @@ const getUserDetails = (options) => {
 			banReason: hasAdminPlugin ? user.banReason ?? null : null,
 			banExpires: hasAdminPlugin ? user.banExpires ?? null : null,
 			account: [],
-			session: []
+			session: [],
+			twoFactorStatus
 		};
 		const activityTrackingEnabled = !!options.activityTracking?.enabled;
 		const sessions = secondaryStorageOnly ? await ctx.context.internalAdapter.listSessions(userId) : user.session || [];
@@ -7109,7 +7330,8 @@ const getUserDetails = (options) => {
 			lastActiveAt,
 			banned: hasAdminPlugin ? user.banned ?? false : false,
 			banReason: hasAdminPlugin ? user.banReason ?? null : null,
-			banExpires: hasAdminPlugin ? user.banExpires ?? null : null
+			banExpires: hasAdminPlugin ? user.banExpires ?? null : null,
+			twoFactorStatus
 		};
 	});
 };
@@ -7651,7 +7873,7 @@ const banUser = (options) => createAuthEndpoint("/dash/ban-user", {
 		banExpires: banExpires ? new Date(banExpires) : null,
 		updatedAt: /* @__PURE__ */ new Date()
 	});
-	await ctx.context.internalAdapter.deleteSessions(userId);
+	await ctx.context.internalAdapter.deleteUserSessions(userId);
 	return { success: true };
 });
 const banManyUsers = (options) => {
@@ -7906,7 +8128,10 @@ function createSMSSender(config) {
 	if (!apiKey) logger.warn("[Dash] No API key provided for SMS sending. Set BETTER_AUTH_API_KEY environment variable or pass apiKey in config.");
 	const $api = createFetch({
 		baseURL: apiUrl,
-		headers: { Authorization: `Bearer ${apiKey}` },
+		headers: {
+			"user-agent": INFRA_USER_AGENT,
+			Authorization: `Bearer ${apiKey}`
+		},
 		timeout: config?.apiTimeout ?? 3e3
 	});
 	/**
@@ -7981,6 +8206,13 @@ async function sendSMS(options, config) {
 }
 //#endregion
 //#region src/index.ts
+async function getRequestLocation() {
+	try {
+		return (await getCurrentAuthContext()).context.location;
+	} catch {
+		return;
+	}
+}
 const dash = (options) => {
 	const processedBulkOperationContexts = /* @__PURE__ */ new WeakSet();
 	const opts = resolveDashOptions(options);
@@ -8005,6 +8237,7 @@ const dash = (options) => {
 		options: opts,
 		version: PLUGIN_VERSION,
 		init(ctx) {
+			instrumentSocialProviders(ctx.socialProviders);
 			const organizationPlugin = ctx.getPlugin("organization");
 			if (organizationPlugin) {
 				const instrumentOrganizationHooks = (organizationPluginOptions) => {
@@ -8012,85 +8245,85 @@ const dash = (options) => {
 					const afterCreateOrganization = organizationHooks.afterCreateOrganization;
 					organizationHooks.afterCreateOrganization = async (...args) => {
 						const [{ organization, user }] = args;
-						trackOrganizationCreated(organization, getOrganizationTriggerInfo(user));
+						trackOrganizationCreated(organization, getOrganizationTriggerInfo(user), await getRequestLocation());
 						if (afterCreateOrganization) return afterCreateOrganization(...args);
 					};
 					const afterUpdateOrganization = organizationHooks.afterUpdateOrganization;
 					organizationHooks.afterUpdateOrganization = async (...args) => {
 						const [{ organization, user }] = args;
-						if (organization) trackOrganizationUpdated(organization, getOrganizationTriggerInfo(user));
+						if (organization) trackOrganizationUpdated(organization, getOrganizationTriggerInfo(user), await getRequestLocation());
 						if (afterUpdateOrganization) return afterUpdateOrganization(...args);
 					};
 					const afterAddMember = organizationHooks.afterAddMember;
 					organizationHooks.afterAddMember = async (...args) => {
 						const [{ organization, member, user }] = args;
-						trackOrganizationMemberAdded(organization, member, user, getOrganizationTriggerInfo(user));
+						trackOrganizationMemberAdded(organization, member, user, getOrganizationTriggerInfo(user), await getRequestLocation());
 						if (afterAddMember) return afterAddMember(...args);
 					};
 					const afterRemoveMember = organizationHooks.afterRemoveMember;
 					organizationHooks.afterRemoveMember = async (...args) => {
 						const [{ organization, member, user }] = args;
-						trackOrganizationMemberRemoved(organization, member, user, getOrganizationTriggerInfo(user));
+						trackOrganizationMemberRemoved(organization, member, user, getOrganizationTriggerInfo(user), await getRequestLocation());
 						if (afterRemoveMember) return afterRemoveMember(...args);
 					};
 					const afterUpdateMemberRole = organizationHooks.afterUpdateMemberRole;
 					organizationHooks.afterUpdateMemberRole = async (...args) => {
 						const [{ organization, member, user, previousRole }] = args;
-						trackOrganizationMemberRoleUpdated(organization, member, user, previousRole, getOrganizationTriggerInfo(user));
+						trackOrganizationMemberRoleUpdated(organization, member, user, previousRole, getOrganizationTriggerInfo(user), await getRequestLocation());
 						if (afterUpdateMemberRole) return afterUpdateMemberRole(...args);
 					};
 					const afterCreateInvitation = organizationHooks.afterCreateInvitation;
 					organizationHooks.afterCreateInvitation = async (...args) => {
 						const [{ organization, invitation, inviter }] = args;
-						trackOrganizationMemberInvited(organization, invitation, inviter, getOrganizationTriggerInfo(inviter));
+						trackOrganizationMemberInvited(organization, invitation, inviter, getOrganizationTriggerInfo(inviter), await getRequestLocation());
 						if (afterCreateInvitation) return afterCreateInvitation(...args);
 					};
 					const afterAcceptInvitation = organizationHooks.afterAcceptInvitation;
 					organizationHooks.afterAcceptInvitation = async (...args) => {
 						const [{ organization, invitation, member, user }] = args;
-						trackOrganizationMemberInviteAccepted(organization, invitation, member, user, getOrganizationTriggerInfo(user));
+						trackOrganizationMemberInviteAccepted(organization, invitation, member, user, getOrganizationTriggerInfo(user), await getRequestLocation());
 						if (afterAcceptInvitation) return afterAcceptInvitation(...args);
 					};
 					const afterRejectInvitation = organizationHooks.afterRejectInvitation;
 					organizationHooks.afterRejectInvitation = async (...args) => {
 						const [{ organization, invitation, user }] = args;
-						trackOrganizationMemberInviteRejected(organization, invitation, user, getOrganizationTriggerInfo(user));
+						trackOrganizationMemberInviteRejected(organization, invitation, user, getOrganizationTriggerInfo(user), await getRequestLocation());
 						if (afterRejectInvitation) return afterRejectInvitation(...args);
 					};
 					const afterCancelInvitation = organizationHooks.afterCancelInvitation;
 					organizationHooks.afterCancelInvitation = async (...args) => {
 						const [{ organization, invitation, cancelledBy }] = args;
-						trackOrganizationMemberInviteCanceled(organization, invitation, cancelledBy, getOrganizationTriggerInfo(cancelledBy));
+						trackOrganizationMemberInviteCanceled(organization, invitation, cancelledBy, getOrganizationTriggerInfo(cancelledBy), await getRequestLocation());
 						if (afterCancelInvitation) return afterCancelInvitation(...args);
 					};
 					const afterCreateTeam = organizationHooks.afterCreateTeam;
 					organizationHooks.afterCreateTeam = async (...args) => {
 						const [{ organization, team, user }] = args;
-						trackOrganizationTeamCreated(organization, team, getOrganizationTriggerInfo(user));
+						trackOrganizationTeamCreated(organization, team, getOrganizationTriggerInfo(user), await getRequestLocation());
 						if (afterCreateTeam) return afterCreateTeam(...args);
 					};
 					const afterUpdateTeam = organizationHooks.afterUpdateTeam;
 					organizationHooks.afterUpdateTeam = async (...args) => {
 						const [{ organization, team, user }] = args;
-						if (team) trackOrganizationTeamUpdated(organization, team, getOrganizationTriggerInfo(user));
+						if (team) trackOrganizationTeamUpdated(organization, team, getOrganizationTriggerInfo(user), await getRequestLocation());
 						if (afterUpdateTeam) return afterUpdateTeam(...args);
 					};
 					const afterDeleteTeam = organizationHooks.afterDeleteTeam;
 					organizationHooks.afterDeleteTeam = async (...args) => {
 						const [{ organization, team, user }] = args;
-						trackOrganizationTeamDeleted(organization, team, getOrganizationTriggerInfo(user));
+						trackOrganizationTeamDeleted(organization, team, getOrganizationTriggerInfo(user), await getRequestLocation());
 						if (afterDeleteTeam) return afterDeleteTeam(...args);
 					};
 					const afterAddTeamMember = organizationHooks.afterAddTeamMember;
 					organizationHooks.afterAddTeamMember = async (...args) => {
 						const [{ organization, team, user, teamMember }] = args;
-						trackOrganizationTeamMemberAdded(organization, team, user, teamMember, getOrganizationTriggerInfo(user));
+						trackOrganizationTeamMemberAdded(organization, team, user, teamMember, getOrganizationTriggerInfo(user), await getRequestLocation());
 						if (afterAddTeamMember) return afterAddTeamMember(...args);
 					};
 					const afterRemoveTeamMember = organizationHooks.afterRemoveTeamMember;
 					organizationHooks.afterRemoveTeamMember = async (...args) => {
 						const [{ organization, team, user, teamMember }] = args;
-						trackOrganizationTeamMemberRemoved(organization, team, user, teamMember, getOrganizationTriggerInfo(user));
+						trackOrganizationTeamMemberRemoved(organization, team, user, teamMember, getOrganizationTriggerInfo(user), await getRequestLocation());
 						if (afterRemoveTeamMember) return afterRemoveTeamMember(...args);
 					};
 				};
@@ -8270,8 +8503,15 @@ const dash = (options) => {
 			before: [{
 				matcher: (ctx) => {
 					if (ctx.request?.method !== "GET") return true;
-					const path = new URL(ctx.request.url).pathname;
-					return matchesAnyRoute(path, [routes.SIGN_IN_SOCIAL_CALLBACK, routes.SIGN_IN_OAUTH_CALLBACK]);
+					return matchesAnyRoute(ctx.path, [
+						routes.SIGN_IN_SOCIAL_CALLBACK,
+						routes.SIGN_IN_OAUTH_CALLBACK,
+						routes.DASH_IMPERSONATE_USER,
+						routes.VERIFY_EMAIL,
+						routes.MAGIC_LINK_VERIFY,
+						routes.DASH_ACCEPT_INVITATION,
+						routes.DASH_COMPLETE_INVITATION_SOCIAL
+					]);
 				},
 				handler: createIdentificationMiddleware($kv)
 			}],
@@ -8279,16 +8519,20 @@ const dash = (options) => {
 				matcher: (ctx) => {
 					if (ctx.request?.method !== "GET") return true;
 					const path = new URL(ctx.request.url).pathname;
-					return matchesAnyRoute(path, [routes.SIGN_IN_SOCIAL_CALLBACK, routes.SIGN_IN_OAUTH_CALLBACK]);
+					return matchesAnyRoute(path, [
+						routes.SIGN_IN_SOCIAL_CALLBACK,
+						routes.SIGN_IN_OAUTH_CALLBACK,
+						routes.DASH_IMPERSONATE_USER
+					]);
 				},
 				handler: createAuthMiddleware(async (_ctx) => {
 					const ctx = _ctx;
 					const trigger = getTriggerInfo(ctx, ctx.context.session?.user.id ?? "unknown");
-					if (matchesAnyRoute(ctx.path, [routes.SEND_VERIFICATION_EMAIL]) && ctx.context.session && !(ctx.context.returned instanceof Error)) trackEmailVerificationSent(ctx.context.session.session, ctx.context.session.user, trigger, ctx);
+					if (matchesAnyRoute(ctx.path, [routes.SEND_VERIFICATION_EMAIL]) && ctx.context.session && !(ctx.context.returned instanceof Error)) trackEmailVerificationSent(ctx.context.session.session, ctx.context.session.user, trigger, ctx.context.location);
 					const body = ctx.body;
-					if (matchesAnyRoute(ctx.path, [routes.SIGN_IN_EMAIL, routes.SIGN_IN_EMAIL_OTP]) && ctx.context.returned instanceof Error && body?.email) trackEmailSignInAttempt(ctx, trigger);
-					if (matchesAnyRoute(ctx.path, [routes.SIGN_IN_SOCIAL]) && ctx.context.returned instanceof Error && ctx.body.provider && ctx.body.idToken) trackSocialSignInAttempt(ctx, trigger);
-					if (matchesAnyRoute(ctx.path, [routes.SIGN_IN_SOCIAL_CALLBACK]) && ctx.request?.method === "GET" && ctx.context.returned instanceof Error && !ctx.context.newSession) trackSocialSignInRedirectionAttempt(ctx, trigger);
+					if (matchesAnyRoute(ctx.path, [routes.SIGN_IN_EMAIL, routes.SIGN_IN_EMAIL_OTP]) && ctx.context.returned instanceof Error && body?.email) trackEmailSignInAttempt(ctx, trigger, ctx.context.location);
+					if (matchesAnyRoute(ctx.path, [routes.SIGN_IN_SOCIAL]) && ctx.context.returned instanceof Error && ctx.body.provider && ctx.body.idToken) trackSocialSignInAttempt(ctx, trigger, ctx.context.location);
+					if (matchesAnyRoute(ctx.path, [routes.SIGN_IN_SOCIAL_CALLBACK]) && ctx.request?.method === "GET" && ctx.context.returned instanceof Error && !ctx.context.newSession) trackSocialSignInRedirectionAttempt(ctx, trigger, ctx.context.location);
 					const headerRequestId = ctx.request?.headers.get("X-Request-Id");
 					if (headerRequestId) ctx.setCookie(IDENTIFICATION_COOKIE_NAME, headerRequestId, {
 						maxAge: 600,
@@ -8383,6 +8627,7 @@ const dash = (options) => {
 			dashSendManyVerificationEmails: sendManyVerificationEmails(settings),
 			dashSendResetPasswordEmail: sendResetPasswordEmail(settings),
 			dashEnableTwoFactor: enableTwoFactor(settings),
+			dashCompleteTwoFactorSetup: completeTwoFactorSetup(settings),
 			dashViewTwoFactorTotpUri: viewTwoFactorTotpUri(settings),
 			dashViewBackupCodes: viewBackupCodes(settings),
 			dashDisableTwoFactor: disableTwoFactor(settings),