@connextar/house 0.11.0 → 0.13.0

package/dist/auth/index.d.ts

@@ -1,2 +1,4 @@
-export { TWO_FACTOR_BLOCKED_MESSAGE, TWO_FACTOR_BLOCKED_PATHS, isTwoFactorBlockedPath, shouldBlockForTwoFactor, totpSecretFromUri, type TwoFactorBlockedPath, type TwoFactorLookup, } from "./two-factor-policy.js";
+export { TWO_FACTOR_BLOCKED_MESSAGE, TWO_FACTOR_BLOCKED_PATHS, isTwoFactorBlockedPath, magicLinkRefusalRetired, shouldBlockForTwoFactor, totpSecretFromUri, type AuthContextLike, type TwoFactorBlockedPath, type TwoFactorLookup, } from "./two-factor-policy.js";
+export { DEFAULT_CODE_SCREEN_PATH, DEFAULT_NEXT_PARAM, SECOND_FACTOR_CHALLENGE_ROUTES, SECOND_FACTOR_EVERYWHERE_ID, type SecondFactorChallengeRoute, } from "./second-factor-routes.js";
+export { magicLinkConfirmHref, magicLinkVerifyHref, safeNextPath, secondFactorNext } from "./second-factor-next.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,wBAAwB,EACxB,sBAAsB,EACtB,uBAAuB,EACvB,iBAAiB,EACjB,KAAK,oBAAoB,EACzB,KAAK,eAAe,GACrB,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,wBAAwB,EACxB,sBAAsB,EACtB,uBAAuB,EACvB,uBAAuB,EACvB,iBAAiB,EACjB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,eAAe,GACrB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EAClB,8BAA8B,EAC9B,2BAA2B,EAC3B,KAAK,0BAA0B,GAChC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC"}

package/dist/auth/index.js

@@ -1,2 +1,4 @@
-export { TWO_FACTOR_BLOCKED_MESSAGE, TWO_FACTOR_BLOCKED_PATHS, isTwoFactorBlockedPath, shouldBlockForTwoFactor, totpSecretFromUri, } from "./two-factor-policy.js";
+export { TWO_FACTOR_BLOCKED_MESSAGE, TWO_FACTOR_BLOCKED_PATHS, isTwoFactorBlockedPath, magicLinkRefusalRetired, shouldBlockForTwoFactor, totpSecretFromUri, } from "./two-factor-policy.js";
+export { DEFAULT_CODE_SCREEN_PATH, DEFAULT_NEXT_PARAM, SECOND_FACTOR_CHALLENGE_ROUTES, SECOND_FACTOR_EVERYWHERE_ID, } from "./second-factor-routes.js";
+export { magicLinkConfirmHref, magicLinkVerifyHref, safeNextPath, secondFactorNext } from "./second-factor-next.js";
 //# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,wBAAwB,EACxB,sBAAsB,EACtB,uBAAuB,EACvB,iBAAiB,GAGlB,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,wBAAwB,EACxB,sBAAsB,EACtB,uBAAuB,EACvB,uBAAuB,EACvB,iBAAiB,GAIlB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EAClB,8BAA8B,EAC9B,2BAA2B,GAE5B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC"}

package/dist/auth/second-factor-index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * `@connextar/house/auth/second-factor` — the server half: a Better Auth plugin. Kept off `@connextar/house/auth`
+ * so that entry point stays free of any Better Auth import and safe for client components.
+ */
+export { findTwoFactorSignInHook, secondFactorEverywhere, type SecondFactorEverywhereOptions, } from "./second-factor.js";
+export { DEFAULT_CODE_SCREEN_PATH, DEFAULT_NEXT_PARAM, SECOND_FACTOR_CHALLENGE_ROUTES, SECOND_FACTOR_EVERYWHERE_ID, type SecondFactorChallengeRoute, } from "./second-factor-routes.js";
+//# sourceMappingURL=second-factor-index.d.ts.map

package/dist/auth/second-factor-index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"second-factor-index.d.ts","sourceRoot":"","sources":["../../src/auth/second-factor-index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,KAAK,6BAA6B,GACnC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EAClB,8BAA8B,EAC9B,2BAA2B,EAC3B,KAAK,0BAA0B,GAChC,MAAM,2BAA2B,CAAC"}

package/dist/auth/second-factor-index.js

@@ -0,0 +1,7 @@
+/**
+ * `@connextar/house/auth/second-factor` — the server half: a Better Auth plugin. Kept off `@connextar/house/auth`
+ * so that entry point stays free of any Better Auth import and safe for client components.
+ */
+export { findTwoFactorSignInHook, secondFactorEverywhere, } from "./second-factor.js";
+export { DEFAULT_CODE_SCREEN_PATH, DEFAULT_NEXT_PARAM, SECOND_FACTOR_CHALLENGE_ROUTES, SECOND_FACTOR_EVERYWHERE_ID, } from "./second-factor-routes.js";
+//# sourceMappingURL=second-factor-index.js.map

package/dist/auth/second-factor-index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"second-factor-index.js","sourceRoot":"","sources":["../../src/auth/second-factor-index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EACL,uBAAuB,EACvB,sBAAsB,GAEvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EAClB,8BAA8B,EAC9B,2BAA2B,GAE5B,MAAM,2BAA2B,CAAC"}

package/dist/auth/second-factor-next.d.ts

@@ -0,0 +1,39 @@
+/**
+ * `candidate` if it is a same-site path, otherwise `fallback`. The result always starts with a single `/`, so it is
+ * safe to hand straight to `router.replace()` or `redirect()`.
+ */
+export declare function safeNextPath(candidate: string | null | undefined, fallback?: string): string;
+/**
+ * The code screen's `next`, made safe. Pass the page's search params (a `URLSearchParams`, Next's
+ * `ReadonlyURLSearchParams`, or a raw `?a=b` string); read it once the code — or a backup code — has been accepted:
+ *
+ * ```ts
+ * const { error } = await authClient.twoFactor.verifyTotp({ code, trustDevice });
+ * if (!error) router.replace(secondFactorNext(useSearchParams()));
+ * ```
+ */
+export declare function secondFactorNext(search: string | {
+    get(name: string): string | null;
+} | null | undefined, options?: {
+    param?: string;
+    fallback?: string;
+}): string;
+/**
+ * The same-site path of `location` (absolute or relative) on `origin`, or null when it points anywhere else.
+ * Used by the server to turn a sign-in route's `callbackURL` into the code screen's `next`.
+ */
+export declare function sameSitePath(location: string | null | undefined, origin: string): string | null;
+/**
+ * The code screen's URL on `origin`, carrying `next` when it is worth carrying: a safe same-site path that is not
+ * the site root (the default anyway) and not the code screen itself (which would loop).
+ */
+export declare function codeScreenUrl(origin: string, codeScreenPath: string, next: string | null, param?: string): string;
+export declare function magicLinkConfirmHref(verifyUrl: string, confirmPath: string): string;
+/**
+ * The verify URL to send the "Continue" button to, or null when the page was opened without a token. `verifyPath`
+ * is the app's own route, e.g. `/api/auth/magic-link/verify`.
+ */
+export declare function magicLinkVerifyHref(search: string | {
+    get(name: string): string | null;
+}, verifyPath: string): string | null;
+//# sourceMappingURL=second-factor-next.d.ts.map

package/dist/auth/second-factor-next.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"second-factor-next.d.ts","sourceRoot":"","sources":["../../src/auth/second-factor-next.ts"],"names":[],"mappings":"AAcA;;;GAGG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,QAAQ,SAAM,GAAG,MAAM,CAezF;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,GAAG;IAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,EACxE,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GAClD,MAAM,CAMR;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAa/F;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,MAAM,EACtB,IAAI,EAAE,MAAM,GAAG,IAAI,EACnB,KAAK,GAAE,MAA2B,GACjC,MAAM,CAIR;AAkBD,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAQnF;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,GAAG;IAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;CAAE,EACrD,UAAU,EAAE,MAAM,GACjB,MAAM,GAAG,IAAI,CAaf"}

package/dist/auth/second-factor-next.js

@@ -0,0 +1,131 @@
+import { DEFAULT_NEXT_PARAM } from "./second-factor-routes.js";
+/**
+ * Where to send someone once their second factor checks out — and, as importantly, where not to.
+ *
+ * The code screen is reached by a redirect that carries the page the person was originally heading for as `?next=`.
+ * Anything in a URL is attacker-controlled, so `next` is only ever honoured as a path on this site: never another
+ * origin, never a protocol-relative `//host`, never a backslash (browsers read `/\host` as `//host`), never a
+ * `javascript:` URL, never control characters. Anything else falls back.
+ */
+const PROBE_ORIGIN = "http://next.invalid";
+const MAX_NEXT_LENGTH = 2048;
+/**
+ * `candidate` if it is a same-site path, otherwise `fallback`. The result always starts with a single `/`, so it is
+ * safe to hand straight to `router.replace()` or `redirect()`.
+ */
+export function safeNextPath(candidate, fallback = "/") {
+    if (typeof candidate !== "string" || candidate.length === 0 || candidate.length > MAX_NEXT_LENGTH)
+        return fallback;
+    if (!candidate.startsWith("/") || candidate.startsWith("//"))
+        return fallback;
+    // Backslashes and control characters are normalised away by browsers in ways that turn `/\evil.com` into
+    // `//evil.com`; nothing legitimate needs them in a path we generated.
+    // eslint-disable-next-line no-control-regex
+    if (/[\\\u0000-\u001f\u007f]/.test(candidate))
+        return fallback;
+    let url;
+    try {
+        url = new URL(candidate, PROBE_ORIGIN);
+    }
+    catch {
+        return fallback;
+    }
+    if (url.origin !== PROBE_ORIGIN)
+        return fallback;
+    return `${url.pathname}${url.search}${url.hash}`;
+}
+/**
+ * The code screen's `next`, made safe. Pass the page's search params (a `URLSearchParams`, Next's
+ * `ReadonlyURLSearchParams`, or a raw `?a=b` string); read it once the code — or a backup code — has been accepted:
+ *
+ * ```ts
+ * const { error } = await authClient.twoFactor.verifyTotp({ code, trustDevice });
+ * if (!error) router.replace(secondFactorNext(useSearchParams()));
+ * ```
+ */
+export function secondFactorNext(search, options = {}) {
+    const param = options.param ?? DEFAULT_NEXT_PARAM;
+    const fallback = options.fallback ?? "/";
+    if (!search)
+        return fallback;
+    const params = typeof search === "string" ? new URLSearchParams(search) : search;
+    return safeNextPath(params.get(param), fallback);
+}
+/**
+ * The same-site path of `location` (absolute or relative) on `origin`, or null when it points anywhere else.
+ * Used by the server to turn a sign-in route's `callbackURL` into the code screen's `next`.
+ */
+export function sameSitePath(location, origin) {
+    if (!location)
+        return null;
+    let url;
+    let base;
+    try {
+        base = new URL(origin);
+        url = new URL(location, base);
+    }
+    catch {
+        return null;
+    }
+    if (url.origin !== base.origin)
+        return null;
+    const path = safeNextPath(`${url.pathname}${url.search}${url.hash}`, "");
+    return path === "" ? null : path;
+}
+/**
+ * The code screen's URL on `origin`, carrying `next` when it is worth carrying: a safe same-site path that is not
+ * the site root (the default anyway) and not the code screen itself (which would loop).
+ */
+export function codeScreenUrl(origin, codeScreenPath, next, param = DEFAULT_NEXT_PARAM) {
+    const url = new URL(codeScreenPath, origin);
+    if (next && next !== "/" && new URL(next, origin).pathname !== url.pathname)
+        url.searchParams.set(param, next);
+    return url.toString();
+}
+/**
+ * Email link scanners (Microsoft Defender Safe Links, Mimecast, Proofpoint…) open links before the person does.
+ * A magic link is single-use, so the scanner spends it: without two-factor the scanner is handed a session it
+ * throws away, with two-factor it is handed the pending code state — and either way the person's own click then
+ * finds the link used.
+ *
+ * The mitigation is a confirm step: email a link to a page of the app that shows a "Continue signing in" button,
+ * and only that button goes to Better Auth's verify URL. Scanners fetch; they do not press buttons.
+ *
+ * `magicLinkConfirmHref()` turns the verify URL Better Auth gives `sendMagicLink` into that page's URL, carrying
+ * only the token and the redirect targets; `magicLinkVerifyHref()` rebuilds the verify URL on the page, from the
+ * app's own fixed verify path — never from a URL taken off the query string, which would be an open redirect. The
+ * verify endpoint still origin-checks the redirect targets itself.
+ */
+const MAGIC_LINK_PARAMS = ["token", "callbackURL", "newUserCallbackURL", "errorCallbackURL"];
+export function magicLinkConfirmHref(verifyUrl, confirmPath) {
+    const source = new URL(verifyUrl);
+    const target = new URL(confirmPath, source.origin);
+    for (const name of MAGIC_LINK_PARAMS) {
+        const value = source.searchParams.get(name);
+        if (value !== null)
+            target.searchParams.set(name, value);
+    }
+    return target.toString();
+}
+/**
+ * The verify URL to send the "Continue" button to, or null when the page was opened without a token. `verifyPath`
+ * is the app's own route, e.g. `/api/auth/magic-link/verify`.
+ */
+export function magicLinkVerifyHref(search, verifyPath) {
+    const params = typeof search === "string" ? new URLSearchParams(search) : search;
+    const token = params.get("token");
+    if (!token)
+        return null;
+    const out = new URLSearchParams();
+    for (const name of MAGIC_LINK_PARAMS) {
+        const value = name === "token" ? token : params.get(name);
+        if (value === null)
+            continue;
+        // Redirect targets must be same-site paths here; Better Auth resolves them against its own base URL.
+        if (name !== "token" && safeNextPath(value, "") === "")
+            continue;
+        out.set(name, value);
+    }
+    return `${safeNextPath(verifyPath)}?${out.toString()}`;
+}
+//# sourceMappingURL=second-factor-next.js.map

package/dist/auth/second-factor-next.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"second-factor-next.js","sourceRoot":"","sources":["../../src/auth/second-factor-next.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAE/D;;;;;;;GAOG;AAEH,MAAM,YAAY,GAAG,qBAAqB,CAAC;AAC3C,MAAM,eAAe,GAAG,IAAI,CAAC;AAE7B;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,SAAoC,EAAE,QAAQ,GAAG,GAAG;IAC/E,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,MAAM,GAAG,eAAe;QAAE,OAAO,QAAQ,CAAC;IACnH,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC9E,yGAAyG;IACzG,sEAAsE;IACtE,4CAA4C;IAC5C,IAAI,yBAAyB,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC/D,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,YAAY;QAAE,OAAO,QAAQ,CAAC;IACjD,OAAO,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;AACnD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAwE,EACxE,UAAiD,EAAE;IAEnD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,kBAAkB,CAAC;IAClD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,GAAG,CAAC;IACzC,IAAI,CAAC,MAAM;QAAE,OAAO,QAAQ,CAAC;IAC7B,MAAM,MAAM,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACjF,OAAO,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,CAAC;AACnD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,QAAmC,EAAE,MAAc;IAC9E,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,GAAQ,CAAC;IACb,IAAI,IAAS,CAAC;IACd,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QACvB,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC5C,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACzE,OAAO,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACnC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,MAAc,EACd,cAAsB,EACtB,IAAmB,EACnB,QAAgB,kBAAkB;IAElC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;IAC5C,IAAI,IAAI,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC/G,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,iBAAiB,GAAG,CAAC,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,kBAAkB,CAAU,CAAC;AAEtG,MAAM,UAAU,oBAAoB,CAAC,SAAiB,EAAE,WAAmB;IACzE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACnD,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,KAAK,KAAK,IAAI;YAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAqD,EACrD,UAAkB;IAElB,MAAM,MAAM,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACjF,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,GAAG,GAAG,IAAI,eAAe,EAAE,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1D,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QAC7B,qGAAqG;QACrG,IAAI,IAAI,KAAK,OAAO,IAAI,YAAY,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE;YAAE,SAAS;QACjE,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,GAAG,YAAY,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC;AACzD,CAAC"}

package/dist/auth/second-factor-routes.d.ts

@@ -0,0 +1,29 @@
+/**
+ * The vocabulary shared by the server plugin (`@connextar/house/auth/second-factor`) and the pure helpers in
+ * `@connextar/house/auth`. Kept free of any Better Auth import so a client component or a before-hook can read it
+ * without pulling the server in.
+ */
+/** The Better Auth plugin id of `secondFactorEverywhere()`. */
+export declare const SECOND_FACTOR_EVERYWHERE_ID = "second-factor-everywhere";
+/**
+ * Every route that hands out a session without a password, and so without Better Auth's two-factor check — the
+ * ones `secondFactorEverywhere()` can put the code screen behind.
+ *
+ * - `/magic-link/verify` — the link in the email.
+ * - `/callback/:id` — Google, Microsoft, Apple and every other built-in social provider's OAuth callback.
+ * - `/oauth2/callback/:providerId` — the generic-OAuth plugin's callback.
+ * - `/sign-in/social` — only when called with an `idToken` (native Google/Apple sign-in); the redirect flow makes no
+ *   session here, so there is nothing to challenge.
+ * - `/one-tap/callback` — Google One Tap.
+ * - `/sign-in/email-otp` — the email-OTP plugin's sign-in.
+ *
+ * Passkeys (`/passkey/verify-authentication`) are deliberately absent and cannot be added: a passkey is possession
+ * of a device and phishing-resistant, at least as strong as password + code, so it stays a single step.
+ */
+export declare const SECOND_FACTOR_CHALLENGE_ROUTES: readonly ["/magic-link/verify", "/callback/:id", "/oauth2/callback/:providerId", "/sign-in/social", "/one-tap/callback", "/sign-in/email-otp"];
+export type SecondFactorChallengeRoute = (typeof SECOND_FACTOR_CHALLENGE_ROUTES)[number];
+/** Where the code screen lives unless an app says otherwise — the path every house app already uses. */
+export declare const DEFAULT_CODE_SCREEN_PATH = "/auth/two-factor";
+/** The query parameter that carries "where to go once the code checks out". */
+export declare const DEFAULT_NEXT_PARAM = "next";
+//# sourceMappingURL=second-factor-routes.d.ts.map

package/dist/auth/second-factor-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"second-factor-routes.d.ts","sourceRoot":"","sources":["../../src/auth/second-factor-routes.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,+DAA+D;AAC/D,eAAO,MAAM,2BAA2B,6BAA6B,CAAC;AAEtE;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,8BAA8B,gJAOjC,CAAC;AAEX,MAAM,MAAM,0BAA0B,GAAG,CAAC,OAAO,8BAA8B,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzF,wGAAwG;AACxG,eAAO,MAAM,wBAAwB,qBAAqB,CAAC;AAE3D,+EAA+E;AAC/E,eAAO,MAAM,kBAAkB,SAAS,CAAC"}

package/dist/auth/second-factor-routes.js

@@ -0,0 +1,35 @@
+/**
+ * The vocabulary shared by the server plugin (`@connextar/house/auth/second-factor`) and the pure helpers in
+ * `@connextar/house/auth`. Kept free of any Better Auth import so a client component or a before-hook can read it
+ * without pulling the server in.
+ */
+/** The Better Auth plugin id of `secondFactorEverywhere()`. */
+export const SECOND_FACTOR_EVERYWHERE_ID = "second-factor-everywhere";
+/**
+ * Every route that hands out a session without a password, and so without Better Auth's two-factor check — the
+ * ones `secondFactorEverywhere()` can put the code screen behind.
+ *
+ * - `/magic-link/verify` — the link in the email.
+ * - `/callback/:id` — Google, Microsoft, Apple and every other built-in social provider's OAuth callback.
+ * - `/oauth2/callback/:providerId` — the generic-OAuth plugin's callback.
+ * - `/sign-in/social` — only when called with an `idToken` (native Google/Apple sign-in); the redirect flow makes no
+ *   session here, so there is nothing to challenge.
+ * - `/one-tap/callback` — Google One Tap.
+ * - `/sign-in/email-otp` — the email-OTP plugin's sign-in.
+ *
+ * Passkeys (`/passkey/verify-authentication`) are deliberately absent and cannot be added: a passkey is possession
+ * of a device and phishing-resistant, at least as strong as password + code, so it stays a single step.
+ */
+export const SECOND_FACTOR_CHALLENGE_ROUTES = [
+    "/magic-link/verify",
+    "/callback/:id",
+    "/oauth2/callback/:providerId",
+    "/sign-in/social",
+    "/one-tap/callback",
+    "/sign-in/email-otp",
+];
+/** Where the code screen lives unless an app says otherwise — the path every house app already uses. */
+export const DEFAULT_CODE_SCREEN_PATH = "/auth/two-factor";
+/** The query parameter that carries "where to go once the code checks out". */
+export const DEFAULT_NEXT_PARAM = "next";
+//# sourceMappingURL=second-factor-routes.js.map

package/dist/auth/second-factor-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"second-factor-routes.js","sourceRoot":"","sources":["../../src/auth/second-factor-routes.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,+DAA+D;AAC/D,MAAM,CAAC,MAAM,2BAA2B,GAAG,0BAA0B,CAAC;AAEtE;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC5C,oBAAoB;IACpB,eAAe;IACf,8BAA8B;IAC9B,iBAAiB;IACjB,mBAAmB;IACnB,oBAAoB;CACZ,CAAC;AAIX,wGAAwG;AACxG,MAAM,CAAC,MAAM,wBAAwB,GAAG,kBAAkB,CAAC;AAE3D,+EAA+E;AAC/E,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC"}

package/dist/auth/second-factor.d.ts

@@ -0,0 +1,117 @@
+import type { BetterAuthPlugin } from "better-auth";
+import { type SecondFactorChallengeRoute } from "./second-factor-routes.js";
+/**
+ * The second factor after a magic link and after a social sign-in — every sign-in path consistent.
+ *
+ * Better Auth's `twoFactor` plugin swaps the session for a pending "enter your code" state only on the password
+ * routes (`/sign-in/email`, `/sign-in/username`, `/sign-in/phone-number`). A magic link (`/magic-link/verify`) and a
+ * social callback (`/callback/:id`) hand out a full session with no code. This plugin runs **the two-factor plugin's
+ * own after-hook** on those routes too, so an account with two-factor on gets exactly what a password sign-in gets:
+ *
+ * - no session survives — the one the route just made is deleted and its cookies expired;
+ * - the pending state is Better Auth's own (its signed `two_factor` cookie and verification row), so
+ *   `/two-factor/verify-totp`, `/two-factor/verify-backup-code` and `/two-factor/verify-otp` finish the sign-in
+ *   unchanged — trust-this-device, attempt limits, account lockout and all;
+ * - a device with a valid trust cookie skips the code, by the plugin's own rule, and has the cookie rotated;
+ * - a browser redirect (the link, the OAuth callback) is sent to the app's code screen instead of `callbackURL`, with
+ *   the original destination carried as a same-site `?next=` — anything off-site is dropped;
+ * - a JSON caller (magic-link verify without a `callbackURL`, `/sign-in/social` with an `idToken`) gets the plugin's
+ *   own `{ twoFactorRedirect: true }`, which `twoFactorClient`'s `onTwoFactorRedirect` already handles.
+ *
+ * Nothing about Better Auth's pending state is copied here — no cookie names, no signing, no verification
+ * identifiers — so a Better Auth upgrade that changes them changes them here too. What this relies on is that the
+ * two-factor plugin exposes its after-hook, that the hook reads `ctx.context.newSession`, and that it answers
+ * `{ twoFactorRedirect: true }` when it takes the session away; `second-factor.test.ts` pins each of those against
+ * the installed Better Auth, and `init` refuses to start if the hook cannot be found.
+ *
+ * Passkeys are untouched: a passkey is possession of a device and phishing-resistant, so it stays one step.
+ *
+ * **Order**: list it after `twoFactor()` and before `nextCookies()`. It composes with an app's own
+ * `second-factor-session` plugin unchanged: the session a magic link or social callback creates is deleted before the
+ * response leaves, and the session that counts is created by `/two-factor/verify-totp` (or the backup-code route),
+ * which those plugins already record as second-factor-proven.
+ */
+export interface SecondFactorEverywhereOptions {
+    /**
+     * Turn the challenge off for this app (`false`) while keeping the plugin listed. With it off, `magicLinkRefusalRetired()`
+     * answers false again, so an app still using the old magic-link refusal gets it back. Default `true`.
+     */
+    enabled?: boolean;
+    /** The app's code screen, a path on the app's origin. Default `/auth/two-factor`. */
+    codeScreenPath?: string;
+    /** The query parameter that carries the original destination to the code screen. Default `next`. */
+    nextParam?: string;
+    /**
+     * The origin the code screen (and every acceptable `next`) lives on. Default: the origin of Better Auth's
+     * `baseURL`, which is the app itself whenever auth is mounted under the app (`/api/auth`).
+     */
+    appOrigin?: string;
+    /** Which routes get the challenge. Default: all of {@link SECOND_FACTOR_CHALLENGE_ROUTES}. */
+    routes?: readonly SecondFactorChallengeRoute[];
+    /**
+     * Which OAuth providers get the challenge on the social routes (`/callback/:id`, `/oauth2/callback/:providerId`,
+     * `/sign-in/social`, `/one-tap/callback` counts as `google`). Default `"all"`.
+     */
+    providers?: "all" | readonly string[];
+}
+/** The slice of the endpoint context an after-hook is handed that this reads. */
+interface AfterHookInput {
+    path?: string;
+    params?: Record<string, string | undefined> | null;
+    body?: unknown;
+    context: {
+        baseURL: string;
+        returned?: unknown;
+        responseHeaders?: Headers | null;
+        newSession?: {
+            user?: {
+                twoFactorEnabled?: boolean | null;
+            } | null;
+        } | null;
+        options: {
+            plugins?: readonly BetterAuthPlugin[] | null;
+        };
+    };
+}
+interface HookResult {
+    response?: unknown;
+    headers?: Headers | null;
+}
+type RawHook = {
+    matcher: (context: AfterHookInput) => boolean;
+    handler: (context: AfterHookInput) => Promise<HookResult | undefined>;
+};
+/**
+ * The two-factor plugin's own after-hook: the one that matches a password sign-in. Exported for the pinning tests.
+ * Returns null when the plugin is missing, or no longer exposes a hook this way.
+ */
+export declare function findTwoFactorSignInHook(plugins: readonly BetterAuthPlugin[] | null | undefined): RawHook | null;
+export declare function secondFactorEverywhere(options?: SecondFactorEverywhereOptions): {
+    id: "second-factor-everywhere";
+    options: {
+        enabled: boolean;
+        codeScreenPath: string;
+        nextParam: string;
+        /**
+         * The origin the code screen (and every acceptable `next`) lives on. Default: the origin of Better Auth's
+         * `baseURL`, which is the app itself whenever auth is mounted under the app (`/api/auth`).
+         */
+        appOrigin?: string;
+        /** Which routes get the challenge. Default: all of {@link SECOND_FACTOR_CHALLENGE_ROUTES}. */
+        routes?: readonly SecondFactorChallengeRoute[];
+        /**
+         * Which OAuth providers get the challenge on the social routes (`/callback/:id`, `/oauth2/callback/:providerId`,
+         * `/sign-in/social`, `/one-tap/callback` counts as `google`). Default `"all"`.
+         */
+        providers?: "all" | readonly string[];
+    };
+    init(ctx: import("better-auth").AuthContext): void;
+    hooks: {
+        after: {
+            matcher: (context: import("better-auth").HookEndpointContext) => boolean;
+            handler: import("better-auth/api").AuthMiddleware;
+        }[];
+    };
+};
+export {};
+//# sourceMappingURL=second-factor.d.ts.map

package/dist/auth/second-factor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"second-factor.d.ts","sourceRoot":"","sources":["../../src/auth/second-factor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAIpD,OAAO,EAKL,KAAK,0BAA0B,EAChC,MAAM,2BAA2B,CAAC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,WAAW,6BAA6B;IAC5C;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,qFAAqF;IACrF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,oGAAoG;IACpG,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8FAA8F;IAC9F,MAAM,CAAC,EAAE,SAAS,0BAA0B,EAAE,CAAC;IAC/C;;;OAGG;IACH,SAAS,CAAC,EAAE,KAAK,GAAG,SAAS,MAAM,EAAE,CAAC;CACvC;AAKD,iFAAiF;AACjF,UAAU,cAAc;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC;IACnD,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,EAAE;QACP,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,eAAe,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;QACjC,UAAU,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE;gBAAE,gBAAgB,CAAC,EAAE,OAAO,GAAG,IAAI,CAAA;aAAE,GAAG,IAAI,CAAA;SAAE,GAAG,IAAI,CAAC;QAC5E,OAAO,EAAE;YAAE,OAAO,CAAC,EAAE,SAAS,gBAAgB,EAAE,GAAG,IAAI,CAAA;SAAE,CAAC;KAC3D,CAAC;CACH;AAED,UAAU,UAAU;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;CAC1B;AAED,KAAK,OAAO,GAAG;IACb,OAAO,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC;IAC9C,OAAO,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;CACvE,CAAC;AAEF;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,SAAS,gBAAgB,EAAE,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,GAAG,IAAI,CAY/G;AA8CD,wBAAgB,sBAAsB,CAAC,OAAO,GAAE,6BAAkC;;;;;;QAvGhF;;;WAGG;oBACS,MAAM;QAClB,8FAA8F;iBACrF,SAAS,0BAA0B,EAAE;QAC9C;;;WAGG;oBACS,KAAK,GAAG,SAAS,MAAM,EAAE;;;;;;;;;EAiKtC"}

package/dist/auth/second-factor.js

@@ -0,0 +1,127 @@
+import { APIError, isAPIError } from "better-auth/api";
+import { codeScreenUrl, sameSitePath } from "./second-factor-next.js";
+import { DEFAULT_CODE_SCREEN_PATH, DEFAULT_NEXT_PARAM, SECOND_FACTOR_CHALLENGE_ROUTES, SECOND_FACTOR_EVERYWHERE_ID, } from "./second-factor-routes.js";
+/**
+ * The two-factor plugin's own after-hook: the one that matches a password sign-in. Exported for the pinning tests.
+ * Returns null when the plugin is missing, or no longer exposes a hook this way.
+ */
+export function findTwoFactorSignInHook(plugins) {
+    const plugin = plugins?.find((p) => p.id === "two-factor");
+    const hooks = (plugin?.hooks?.after ?? []);
+    const probe = { path: "/sign-in/email" };
+    for (const hook of hooks) {
+        try {
+            if (typeof hook.handler === "function" && hook.matcher(probe))
+                return hook;
+        }
+        catch {
+            // A matcher that needs more than a path is not the one we are looking for.
+        }
+    }
+    return null;
+}
+/** The provider a social route is completing, or null on routes that have none. */
+function providerOf(input) {
+    switch (input.path) {
+        case "/callback/:id":
+            return input.params?.id ?? null;
+        case "/oauth2/callback/:providerId":
+            return input.params?.providerId ?? null;
+        case "/sign-in/social": {
+            const provider = input.body?.provider;
+            return typeof provider === "string" ? provider : null;
+        }
+        case "/one-tap/callback":
+            return "google";
+        default:
+            return null;
+    }
+}
+function jsonBody(response) {
+    // `ctx.json()` answers the plain object inside hooks, and a `{ _flag: "json", body }` wrapper when the caller
+    // asked for a Response; accept either.
+    if (response && typeof response === "object" && response._flag === "json") {
+        return response.body;
+    }
+    return response;
+}
+function isTwoFactorRedirect(response) {
+    const body = jsonBody(response);
+    return !!body && typeof body === "object" && body.twoFactorRedirect === true;
+}
+function redirectLocation(input) {
+    const returned = input.context.returned;
+    if (!isAPIError(returned))
+        return null;
+    const status = returned.statusCode;
+    if (status === undefined || status < 300 || status >= 400)
+        return null;
+    return (input.context.responseHeaders?.get("location") ??
+        returned.headers?.get?.("location") ??
+        null);
+}
+export function secondFactorEverywhere(options = {}) {
+    const enabled = options.enabled !== false;
+    const routes = new Set(options.routes ?? SECOND_FACTOR_CHALLENGE_ROUTES);
+    const providers = options.providers ?? "all";
+    const codeScreenPath = options.codeScreenPath ?? DEFAULT_CODE_SCREEN_PATH;
+    const nextParam = options.nextParam ?? DEFAULT_NEXT_PARAM;
+    if (!codeScreenPath.startsWith("/") || codeScreenPath.startsWith("//")) {
+        throw new Error(`[second-factor-everywhere] codeScreenPath must be a path on the app, got "${codeScreenPath}".`);
+    }
+    function applies(input) {
+        if (!enabled || !input.path || !routes.has(input.path))
+            return false;
+        const provider = providerOf(input);
+        if (provider === null || providers === "all")
+            return true;
+        return providers.includes(provider);
+    }
+    async function handler(input) {
+        // Only a sign-in that actually made a session for a two-factor account is ours. Account linking, errors, the
+        // redirect leg of `/sign-in/social` and accounts without two-factor all fall through untouched.
+        if (!input.context.newSession?.user?.twoFactorEnabled)
+            return {};
+        const twoFactorHook = findTwoFactorSignInHook(input.context.options.plugins);
+        // `init` already refused to start without it; if it has gone missing since, fail closed rather than let the
+        // session through — the response is lost, and with it the session cookie.
+        if (!twoFactorHook)
+            throw new Error("[second-factor-everywhere] Better Auth's two-factor plugin hook is missing.");
+        const location = redirectLocation(input);
+        const result = (await twoFactorHook.handler(input)) ?? {};
+        // Trusted device: the plugin let the session stand and rotated the trust cookie. Keep both, change nothing else.
+        if (result.response === undefined || !isTwoFactorRedirect(result.response))
+            return result;
+        // A JSON caller gets exactly what a password sign-in gets.
+        if (location === null)
+            return result;
+        const origin = options.appOrigin ?? new URL(input.context.baseURL).origin;
+        const target = codeScreenUrl(origin, codeScreenPath, sameSitePath(location, origin), nextParam);
+        const headers = new Headers(result.headers ?? undefined);
+        headers.set("location", target);
+        return { response: new APIError("FOUND", undefined, { location: target }), headers };
+    }
+    return {
+        id: SECOND_FACTOR_EVERYWHERE_ID,
+        options: { ...options, enabled, codeScreenPath, nextParam },
+        init(ctx) {
+            if (!enabled)
+                return;
+            const plugins = ctx.options.plugins ?? [];
+            if (!findTwoFactorSignInHook(plugins)) {
+                throw new Error("[second-factor-everywhere] needs Better Auth's twoFactor() plugin, listed in `plugins`, exposing its " +
+                    "password sign-in after-hook. Either it is missing, or this Better Auth version changed how it enforces the " +
+                    "second factor — check @connextar/house's supported Better Auth range.");
+            }
+            const ownIndex = plugins.findIndex((p) => p.id === SECOND_FACTOR_EVERYWHERE_ID);
+            const nextCookiesIndex = plugins.findIndex((p) => p.id === "next-cookies");
+            if (nextCookiesIndex !== -1 && nextCookiesIndex < ownIndex) {
+                ctx.logger.warn("[second-factor-everywhere] is listed after nextCookies(); list it before, so the cookies it sets reach Next.");
+            }
+        },
+        hooks: {
+            after: [{ matcher: applies, handler }],
+        },
+    };
+}
+//# sourceMappingURL=second-factor.js.map

package/dist/auth/second-factor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"second-factor.js","sourceRoot":"","sources":["../../src/auth/second-factor.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAEvD,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EAClB,8BAA8B,EAC9B,2BAA2B,GAE5B,MAAM,2BAA2B,CAAC;AAoFnC;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAuD;IAC7F,MAAM,MAAM,GAAG,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,YAAY,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,CAAyB,CAAC;IACnE,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,gBAAgB,EAAoB,CAAC;IAC3D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,UAAU,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC7E,CAAC;QAAC,MAAM,CAAC;YACP,2EAA2E;QAC7E,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,mFAAmF;AACnF,SAAS,UAAU,CAAC,KAAqB;IACvC,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,eAAe;YAClB,OAAO,KAAK,CAAC,MAAM,EAAE,EAAE,IAAI,IAAI,CAAC;QAClC,KAAK,8BAA8B;YACjC,OAAO,KAAK,CAAC,MAAM,EAAE,UAAU,IAAI,IAAI,CAAC;QAC1C,KAAK,iBAAiB,CAAC,CAAC,CAAC;YACvB,MAAM,QAAQ,GAAI,KAAK,CAAC,IAA2C,EAAE,QAAQ,CAAC;YAC9E,OAAO,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;QACxD,CAAC;QACD,KAAK,mBAAmB;YACtB,OAAO,QAAQ,CAAC;QAClB;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,QAAiB;IACjC,8GAA8G;IAC9G,uCAAuC;IACvC,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAK,QAAgC,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;QACnG,OAAQ,QAA+B,CAAC,IAAI,CAAC;IAC/C,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAiB;IAC5C,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAChC,OAAO,CAAC,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAK,IAAwC,CAAC,iBAAiB,KAAK,IAAI,CAAC;AACpH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAqB;IAC7C,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;IACxC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,MAAM,GAAI,QAAoC,CAAC,UAAU,CAAC;IAChE,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IACvE,OAAO,CACL,KAAK,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,UAAU,CAAC;QAC7C,QAAyC,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC;QACrE,IAAI,CACL,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,UAAyC,EAAE;IAChF,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,KAAK,KAAK,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAS,OAAO,CAAC,MAAM,IAAI,8BAA8B,CAAC,CAAC;IACjF,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC7C,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,wBAAwB,CAAC;IAC1E,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAE1D,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,6EAA6E,cAAc,IAAI,CAAC,CAAC;IACnH,CAAC;IAED,SAAS,OAAO,CAAC,KAAqB;QACpC,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QACrE,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,QAAQ,KAAK,IAAI,IAAI,SAAS,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QAC1D,OAAO,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,UAAU,OAAO,CAAC,KAAqB;QAC1C,6GAA6G;QAC7G,gGAAgG;QAChG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE,gBAAgB;YAAE,OAAO,EAAE,CAAC;QAEjE,MAAM,aAAa,GAAG,uBAAuB,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC7E,4GAA4G;QAC5G,0EAA0E;QAC1E,IAAI,CAAC,aAAa;YAAE,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;QAEnH,MAAM,QAAQ,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,CAAC,MAAM,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QAE1D,iHAAiH;QACjH,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,QAAQ,CAAC;YAAE,OAAO,MAAM,CAAC;QAE1F,2DAA2D;QAC3D,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,MAAM,CAAC;QAErC,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;QAC1E,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,EAAE,cAAc,EAAE,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,SAAS,CAAC,CAAC;QAChG,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,SAAS,CAAC,CAAC;QACzD,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAChC,OAAO,EAAE,QAAQ,EAAE,IAAI,QAAQ,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC;IACvF,CAAC;IAED,OAAO;QACL,EAAE,EAAE,2BAA2B;QAC/B,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE;QAC3D,IAAI,CAAC,GAAG;YACN,IAAI,CAAC,OAAO;gBAAE,OAAO;YACrB,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;YAC1C,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,EAAE,CAAC;gBACtC,MAAM,IAAI,KAAK,CACb,uGAAuG;oBACrG,6GAA6G;oBAC7G,uEAAuE,CAC1E,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,2BAA2B,CAAC,CAAC;YAChF,MAAM,gBAAgB,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,cAAc,CAAC,CAAC;YAC3E,IAAI,gBAAgB,KAAK,CAAC,CAAC,IAAI,gBAAgB,GAAG,QAAQ,EAAE,CAAC;gBAC3D,GAAG,CAAC,MAAM,CAAC,IAAI,CACb,8GAA8G,CAC/G,CAAC;YACJ,CAAC;QACH,CAAC;QACD,KAAK,EAAE;YACL,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAA0B,CAAC;SAC/D;KACyB,CAAC;AAC/B,CAAC"}

package/dist/auth/two-factor-policy.d.ts

@@ -18,6 +18,12 @@
  * This lives in the package rather than in each app because it is a security
  * decision that has to be the same everywhere, and because getting it wrong is
  * silent: two-factor keeps *looking* enabled while doing nothing.
+ *
+ * **Superseded by `secondFactorEverywhere()`** (`@connextar/house/auth/second-factor`),
+ * which instead puts the code screen after a magic link *and* after a social
+ * sign-in, so neither needs refusing. Pass the hook's `ctx.context` to
+ * {@link shouldBlockForTwoFactor} and the refusal retires itself while that plugin
+ * is live — see {@link magicLinkRefusalRetired}.
  */
 export declare const TWO_FACTOR_BLOCKED_PATHS: readonly ["/sign-in/magic-link"];
 export type TwoFactorBlockedPath = (typeof TWO_FACTOR_BLOCKED_PATHS)[number];
@@ -37,7 +43,30 @@ export type TwoFactorLookup = (email: string) => Promise<boolean>;
  * answering "does this account exist, and does it have two-factor on?" for
  * anyone with an email address and a spare minute.
  */
-export declare function shouldBlockForTwoFactor(path: string, email: string | undefined | null, lookup: TwoFactorLookup): Promise<boolean>;
+export declare function shouldBlockForTwoFactor(path: string, email: string | undefined | null, lookup: TwoFactorLookup, 
+/**
+ * The hook's `ctx.context`. Passing it retires the refusal once `secondFactorEverywhere()` is installed and
+ * challenging magic links — see {@link magicLinkRefusalRetired}.
+ */
+authContext?: AuthContextLike | null): Promise<boolean>;
+/** The slice of Better Auth's `ctx.context` (or `auth.options`) this reads. */
+export interface AuthContextLike {
+    options?: {
+        plugins?: readonly unknown[] | null;
+    } | null;
+    plugins?: readonly unknown[] | null;
+}
+/**
+ * True when refusing magic links for two-factor accounts is no longer needed, because
+ * `secondFactorEverywhere()` from `@connextar/house/auth/second-factor` is installed, enabled, and puts the code
+ * screen behind `/magic-link/verify`.
+ *
+ * This is how an app retires its old before-hook refusal *safely*: the refusal steps aside exactly while its
+ * replacement is live, and comes back on its own if the replacement is ever switched off (`enabled: false`) or
+ * removed — so turning the challenge off can never quietly reopen the magic-link hole. Pass `ctx.context` from a
+ * hook, or `auth.options`.
+ */
+export declare function magicLinkRefusalRetired(authContext: AuthContextLike): boolean;
 /**
  * Pull the shared secret out of an `otpauth://` URI, for the "can't scan it?"
  * manual-entry path during enrolment.

package/dist/auth/two-factor-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"two-factor-policy.d.ts","sourceRoot":"","sources":["../../src/auth/two-factor-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,eAAO,MAAM,wBAAwB,kCAAmC,CAAC;AAEzE,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE7E,eAAO,MAAM,0BAA0B,QAEa,CAAC;AAErD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE5D;AAED,wFAAwF;AACxF,MAAM,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAElE;;;;;;;;;;;GAWG;AACH,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,EAChC,MAAM,EAAE,eAAe,GACtB,OAAO,CAAC,OAAO,CAAC,CAGlB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAIhE"}
+{"version":3,"file":"two-factor-policy.d.ts","sourceRoot":"","sources":["../../src/auth/two-factor-policy.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,eAAO,MAAM,wBAAwB,kCAAmC,CAAC;AAEzE,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE7E,eAAO,MAAM,0BAA0B,QAEa,CAAC;AAErD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE5D;AAED,wFAAwF;AACxF,MAAM,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAElE;;;;;;;;;;;GAWG;AACH,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,EAChC,MAAM,EAAE,eAAe;AACvB;;;GAGG;AACH,WAAW,CAAC,EAAE,eAAe,GAAG,IAAI,GACnC,OAAO,CAAC,OAAO,CAAC,CAIlB;AAED,+EAA+E;AAC/E,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IACzD,OAAO,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,IAAI,CAAC;CACrC;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,eAAe,GAAG,OAAO,CAU7E;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAIhE"}