@factiii/auth 0.5.3 → 0.5.5

package/dist/index.mjs

@@ -1,4 +1,5 @@
 import {
+  __require,
   biometricVerifySchema,
   changePasswordSchema,
   checkPasswordResetSchema,
@@ -17,11 +18,266 @@ import {
   twoFaResetVerifySchema,
   twoFaVerifySchema,
   verifyEmailSchema
-} from "./chunk-EHI4P63M.mjs";
+} from "./chunk-KUYH4DBN.mjs";
 
 // src/middleware/authGuard.ts
 import { TRPCError } from "@trpc/server";
 
+// src/adapters/prismaAdapter.ts
+function createPrismaAdapter(prisma) {
+  const db = prisma;
+  return {
+    user: {
+      async findByEmailInsensitive(email) {
+        return db.user.findFirst({
+          where: { email: { equals: email, mode: "insensitive" } }
+        });
+      },
+      async findByUsernameInsensitive(username) {
+        return db.user.findFirst({
+          where: { username: { equals: username, mode: "insensitive" } }
+        });
+      },
+      async findByEmailOrUsernameInsensitive(identifier) {
+        return db.user.findFirst({
+          where: {
+            OR: [
+              { email: { equals: identifier, mode: "insensitive" } },
+              { username: { equals: identifier, mode: "insensitive" } }
+            ]
+          }
+        });
+      },
+      async findByEmailOrOAuthId(email, oauthId) {
+        return db.user.findFirst({
+          where: {
+            OR: [
+              { email: { equals: email, mode: "insensitive" } },
+              { oauthId: { equals: oauthId } }
+            ]
+          }
+        });
+      },
+      async findById(id) {
+        return db.user.findUnique({ where: { id } });
+      },
+      async findActiveById(id) {
+        return db.user.findUnique({
+          where: { id, status: "ACTIVE" }
+        });
+      },
+      async create(data) {
+        return db.user.create({ data });
+      },
+      async update(id, data) {
+        return db.user.update({ where: { id }, data });
+      }
+    },
+    session: {
+      async findById(id) {
+        const session = await db.session.findUnique({
+          where: { id },
+          select: {
+            id: true,
+            userId: true,
+            socketId: true,
+            twoFaSecret: true,
+            browserName: true,
+            issuedAt: true,
+            lastUsed: true,
+            revokedAt: true,
+            deviceId: true,
+            user: { select: { status: true, verifiedHumanAt: true } }
+          }
+        });
+        return session;
+      },
+      async create(data) {
+        return db.session.create({ data });
+      },
+      async update(id, data) {
+        return db.session.update({ where: { id }, data });
+      },
+      async updateLastUsed(id) {
+        const session = await db.session.update({
+          where: { id },
+          data: { lastUsed: /* @__PURE__ */ new Date() },
+          select: {
+            id: true,
+            userId: true,
+            socketId: true,
+            twoFaSecret: true,
+            browserName: true,
+            issuedAt: true,
+            lastUsed: true,
+            revokedAt: true,
+            deviceId: true,
+            user: { select: { verifiedHumanAt: true } }
+          }
+        });
+        return session;
+      },
+      async revoke(id) {
+        await db.session.update({
+          where: { id },
+          data: { revokedAt: /* @__PURE__ */ new Date() }
+        });
+      },
+      async findActiveByUserId(userId, excludeSessionId) {
+        return db.session.findMany({
+          where: {
+            userId,
+            revokedAt: null,
+            ...excludeSessionId ? { NOT: { id: excludeSessionId } } : {}
+          },
+          select: { id: true, socketId: true, userId: true }
+        });
+      },
+      async revokeAllByUserId(userId, excludeSessionId) {
+        await db.session.updateMany({
+          where: {
+            userId,
+            revokedAt: null,
+            ...excludeSessionId ? { NOT: { id: excludeSessionId } } : {}
+          },
+          data: { revokedAt: /* @__PURE__ */ new Date() }
+        });
+      },
+      async findTwoFaSecretsByUserId(userId) {
+        return db.session.findMany({
+          where: { userId, twoFaSecret: { not: null } },
+          select: { twoFaSecret: true }
+        });
+      },
+      async clearTwoFaSecrets(userId, excludeSessionId) {
+        await db.session.updateMany({
+          where: {
+            userId,
+            ...excludeSessionId ? { NOT: { id: excludeSessionId } } : {}
+          },
+          data: { twoFaSecret: null }
+        });
+      },
+      async findByIdWithDevice(id, userId) {
+        const session = await db.session.findUnique({
+          where: { id, userId },
+          select: {
+            twoFaSecret: true,
+            deviceId: true,
+            device: { select: { pushToken: true } }
+          }
+        });
+        return session;
+      },
+      async revokeByDevicePushToken(userId, pushToken, excludeSessionId) {
+        await db.session.updateMany({
+          where: {
+            userId,
+            id: { not: excludeSessionId },
+            revokedAt: null,
+            device: { pushToken }
+          },
+          data: { revokedAt: /* @__PURE__ */ new Date() }
+        });
+      },
+      async clearDeviceId(userId, deviceId) {
+        await db.session.updateMany({
+          where: { userId, deviceId },
+          data: { deviceId: null }
+        });
+      }
+    },
+    otp: {
+      async findValidByUserAndCode(userId, code) {
+        return db.oTP.findFirst({
+          where: { userId, code, expiresAt: { gte: /* @__PURE__ */ new Date() } }
+        });
+      },
+      async create(data) {
+        return db.oTP.create({ data });
+      },
+      async delete(id) {
+        await db.oTP.delete({ where: { id } });
+      }
+    },
+    passwordReset: {
+      async findById(id) {
+        return db.passwordReset.findUnique({
+          where: { id },
+          select: { id: true, createdAt: true, userId: true }
+        });
+      },
+      async create(userId) {
+        return db.passwordReset.create({
+          data: { userId }
+        });
+      },
+      async delete(id) {
+        await db.passwordReset.delete({ where: { id } });
+      },
+      async deleteAllByUserId(userId) {
+        await db.passwordReset.deleteMany({ where: { userId } });
+      }
+    },
+    device: {
+      async findByTokenSessionAndUser(pushToken, sessionId, userId) {
+        return db.device.findFirst({
+          where: {
+            pushToken,
+            sessions: { some: { id: sessionId } },
+            users: { some: { id: userId } }
+          },
+          select: { id: true }
+        });
+      },
+      async upsertByPushToken(pushToken, sessionId, userId) {
+        await db.device.upsert({
+          where: { pushToken },
+          create: {
+            pushToken,
+            sessions: { connect: { id: sessionId } },
+            users: { connect: { id: userId } }
+          },
+          update: {
+            sessions: { connect: { id: sessionId } },
+            users: { connect: { id: userId } }
+          }
+        });
+      },
+      async findByUserAndToken(userId, pushToken) {
+        return db.device.findFirst({
+          where: { users: { some: { id: userId } }, pushToken },
+          select: { id: true }
+        });
+      },
+      async disconnectUser(deviceId, userId) {
+        await db.device.update({
+          where: { id: deviceId },
+          data: { users: { disconnect: { id: userId } } }
+        });
+      },
+      async hasRemainingUsers(deviceId) {
+        const result = await db.device.findUnique({
+          where: { id: deviceId },
+          select: { users: { select: { id: true }, take: 1 } }
+        });
+        return (result?.users.length ?? 0) > 0;
+      },
+      async delete(id) {
+        await db.device.delete({ where: { id } });
+      }
+    },
+    admin: {
+      async findByUserId(userId) {
+        return db.admin.findFirst({
+          where: { userId },
+          select: { ip: true }
+        });
+      }
+    }
+  };
+}
+
 // src/adapters/email.ts
 function createNoopEmailAdapter() {
   return {
@@ -75,6 +331,294 @@ function createConsoleEmailAdapter() {
   };
 }
 
+// src/adapters/drizzleAdapter.ts
+function createDrizzleAdapter(db, tables) {
+  const {
+    eq,
+    and,
+    or,
+    isNull,
+    isNotNull,
+    gte,
+    ne,
+    sql
+  } = __require("drizzle-orm");
+  const { users, sessions, otps, passwordResets, devices, admins } = tables;
+  return {
+    user: {
+      async findByEmailInsensitive(email) {
+        const rows = await db.select().from(users).where(sql`lower(${users.email}) = lower(${email})`).limit(1);
+        return rows[0] ?? null;
+      },
+      async findByUsernameInsensitive(username) {
+        const rows = await db.select().from(users).where(sql`lower(${users.username}) = lower(${username})`).limit(1);
+        return rows[0] ?? null;
+      },
+      async findByEmailOrUsernameInsensitive(identifier) {
+        const rows = await db.select().from(users).where(
+          or(
+            sql`lower(${users.email}) = lower(${identifier})`,
+            sql`lower(${users.username}) = lower(${identifier})`
+          )
+        ).limit(1);
+        return rows[0] ?? null;
+      },
+      async findByEmailOrOAuthId(email, oauthId) {
+        const rows = await db.select().from(users).where(
+          or(
+            sql`lower(${users.email}) = lower(${email})`,
+            eq(users.oauthId, oauthId)
+          )
+        ).limit(1);
+        return rows[0] ?? null;
+      },
+      async findById(id) {
+        const rows = await db.select().from(users).where(eq(users.id, id)).limit(1);
+        return rows[0] ?? null;
+      },
+      async findActiveById(id) {
+        const rows = await db.select().from(users).where(and(eq(users.id, id), eq(users.status, "ACTIVE"))).limit(1);
+        return rows[0] ?? null;
+      },
+      async create(data) {
+        const rows = await db.insert(users).values(data).returning();
+        return rows[0];
+      },
+      async update(id, data) {
+        const rows = await db.update(users).set(data).where(eq(users.id, id)).returning();
+        return rows[0];
+      }
+    },
+    session: {
+      async findById(id) {
+        const rows = await db.select({
+          id: sessions.id,
+          userId: sessions.userId,
+          socketId: sessions.socketId,
+          twoFaSecret: sessions.twoFaSecret,
+          browserName: sessions.browserName,
+          issuedAt: sessions.issuedAt,
+          lastUsed: sessions.lastUsed,
+          revokedAt: sessions.revokedAt,
+          deviceId: sessions.deviceId,
+          user: {
+            status: users.status,
+            verifiedHumanAt: users.verifiedHumanAt
+          }
+        }).from(sessions).innerJoin(users, eq(sessions.userId, users.id)).where(eq(sessions.id, id)).limit(1);
+        return rows[0] ?? null;
+      },
+      async create(data) {
+        const rows = await db.insert(sessions).values(data).returning();
+        return rows[0];
+      },
+      async update(id, data) {
+        const rows = await db.update(sessions).set(data).where(eq(sessions.id, id)).returning();
+        return rows[0];
+      },
+      async updateLastUsed(id) {
+        await db.update(sessions).set({ lastUsed: /* @__PURE__ */ new Date() }).where(eq(sessions.id, id));
+        const rows = await db.select({
+          id: sessions.id,
+          userId: sessions.userId,
+          socketId: sessions.socketId,
+          twoFaSecret: sessions.twoFaSecret,
+          browserName: sessions.browserName,
+          issuedAt: sessions.issuedAt,
+          lastUsed: sessions.lastUsed,
+          revokedAt: sessions.revokedAt,
+          deviceId: sessions.deviceId,
+          user: {
+            verifiedHumanAt: users.verifiedHumanAt
+          }
+        }).from(sessions).innerJoin(users, eq(sessions.userId, users.id)).where(eq(sessions.id, id)).limit(1);
+        return rows[0];
+      },
+      async revoke(id) {
+        await db.update(sessions).set({ revokedAt: /* @__PURE__ */ new Date() }).where(eq(sessions.id, id));
+      },
+      async findActiveByUserId(userId, excludeSessionId) {
+        const conditions = [eq(sessions.userId, userId), isNull(sessions.revokedAt)];
+        if (excludeSessionId !== void 0) {
+          conditions.push(ne(sessions.id, excludeSessionId));
+        }
+        const activeRows = await db.select({
+          id: sessions.id,
+          socketId: sessions.socketId,
+          userId: sessions.userId
+        }).from(sessions).where(and(...conditions));
+        return activeRows;
+      },
+      async revokeAllByUserId(userId, excludeSessionId) {
+        const conditions = [eq(sessions.userId, userId), isNull(sessions.revokedAt)];
+        if (excludeSessionId !== void 0) {
+          conditions.push(ne(sessions.id, excludeSessionId));
+        }
+        await db.update(sessions).set({ revokedAt: /* @__PURE__ */ new Date() }).where(and(...conditions));
+      },
+      async findTwoFaSecretsByUserId(userId) {
+        const secretRows = await db.select({ twoFaSecret: sessions.twoFaSecret }).from(sessions).where(and(eq(sessions.userId, userId), isNotNull(sessions.twoFaSecret)));
+        return secretRows;
+      },
+      async clearTwoFaSecrets(userId, excludeSessionId) {
+        const conditions = [eq(sessions.userId, userId)];
+        if (excludeSessionId !== void 0) {
+          conditions.push(ne(sessions.id, excludeSessionId));
+        }
+        await db.update(sessions).set({ twoFaSecret: null }).where(and(...conditions));
+      },
+      async findByIdWithDevice(id, userId) {
+        const rows = await db.select({
+          twoFaSecret: sessions.twoFaSecret,
+          deviceId: sessions.deviceId,
+          device: {
+            pushToken: devices.pushToken
+          }
+        }).from(sessions).leftJoin(devices, eq(sessions.deviceId, devices.id)).where(and(eq(sessions.id, id), eq(sessions.userId, userId))).limit(1);
+        if (!rows[0]) return null;
+        const row = rows[0];
+        const device = row.device;
+        return {
+          twoFaSecret: row.twoFaSecret,
+          deviceId: row.deviceId,
+          device: device?.pushToken ? { pushToken: device.pushToken } : null
+        };
+      },
+      async revokeByDevicePushToken(userId, pushToken, excludeSessionId) {
+        const deviceRows = await db.select({ id: devices.id }).from(devices).where(eq(devices.pushToken, pushToken)).limit(1);
+        if (!deviceRows[0]) return;
+        await db.update(sessions).set({ revokedAt: /* @__PURE__ */ new Date() }).where(
+          and(
+            eq(sessions.userId, userId),
+            ne(sessions.id, excludeSessionId),
+            isNull(sessions.revokedAt),
+            eq(sessions.deviceId, deviceRows[0].id)
+          )
+        );
+      },
+      async clearDeviceId(userId, deviceId) {
+        await db.update(sessions).set({ deviceId: null }).where(and(eq(sessions.userId, userId), eq(sessions.deviceId, deviceId)));
+      }
+    },
+    otp: {
+      async findValidByUserAndCode(userId, code) {
+        const rows = await db.select().from(otps).where(
+          and(eq(otps.userId, userId), eq(otps.code, code), gte(otps.expiresAt, /* @__PURE__ */ new Date()))
+        ).limit(1);
+        return rows[0] ?? null;
+      },
+      async create(data) {
+        const rows = await db.insert(otps).values(data).returning();
+        return rows[0];
+      },
+      async delete(id) {
+        await db.delete(otps).where(eq(otps.id, id));
+      }
+    },
+    passwordReset: {
+      async findById(id) {
+        const rows = await db.select({
+          id: passwordResets.id,
+          createdAt: passwordResets.createdAt,
+          userId: passwordResets.userId
+        }).from(passwordResets).where(eq(passwordResets.id, id)).limit(1);
+        return rows[0] ?? null;
+      },
+      async create(userId) {
+        const rows = await db.insert(passwordResets).values({ userId }).returning();
+        return rows[0];
+      },
+      async delete(id) {
+        await db.delete(passwordResets).where(eq(passwordResets.id, id));
+      },
+      async deleteAllByUserId(userId) {
+        await db.delete(passwordResets).where(eq(passwordResets.userId, userId));
+      }
+    },
+    device: {
+      async findByTokenSessionAndUser(pushToken, sessionId, userId) {
+        const rows = await db.select({ id: devices.id }).from(devices).where(eq(devices.pushToken, pushToken)).limit(1);
+        if (!rows[0]) return null;
+        if (tables.devicesToSessions && tables.devicesToUsers) {
+          const sessionLink = await db.select().from(tables.devicesToSessions).where(
+            and(
+              eq(tables.devicesToSessions.deviceId, rows[0].id),
+              eq(tables.devicesToSessions.sessionId, sessionId)
+            )
+          ).limit(1);
+          const userLink = await db.select().from(tables.devicesToUsers).where(
+            and(
+              eq(tables.devicesToUsers.deviceId, rows[0].id),
+              eq(tables.devicesToUsers.userId, userId)
+            )
+          ).limit(1);
+          if (!sessionLink[0] || !userLink[0]) return null;
+        }
+        return { id: rows[0].id };
+      },
+      async upsertByPushToken(pushToken, sessionId, userId) {
+        const existing = await db.select({ id: devices.id }).from(devices).where(eq(devices.pushToken, pushToken)).limit(1);
+        let deviceId;
+        if (existing[0]) {
+          deviceId = existing[0].id;
+        } else {
+          const insertedRows = await db.insert(devices).values({ pushToken }).returning({ id: devices.id });
+          deviceId = insertedRows[0].id;
+        }
+        if (tables.devicesToSessions) {
+          await db.insert(tables.devicesToSessions).values({ deviceId, sessionId }).onConflictDoNothing();
+        }
+        if (tables.devicesToUsers) {
+          await db.insert(tables.devicesToUsers).values({ deviceId, userId }).onConflictDoNothing();
+        }
+        await db.update(sessions).set({ deviceId }).where(eq(sessions.id, sessionId));
+      },
+      async findByUserAndToken(userId, pushToken) {
+        if (tables.devicesToUsers) {
+          const joinRows = await db.select({ id: devices.id }).from(devices).innerJoin(
+            tables.devicesToUsers,
+            eq(devices.id, tables.devicesToUsers.deviceId)
+          ).where(
+            and(
+              eq(devices.pushToken, pushToken),
+              eq(tables.devicesToUsers.userId, userId)
+            )
+          ).limit(1);
+          return joinRows[0] ? { id: joinRows[0].id } : null;
+        }
+        const rows = await db.select({ id: devices.id }).from(devices).where(eq(devices.pushToken, pushToken)).limit(1);
+        return rows[0] ? { id: rows[0].id } : null;
+      },
+      async disconnectUser(deviceId, userId) {
+        if (tables.devicesToUsers) {
+          await db.delete(tables.devicesToUsers).where(
+            and(
+              eq(tables.devicesToUsers.deviceId, deviceId),
+              eq(tables.devicesToUsers.userId, userId)
+            )
+          );
+        }
+      },
+      async hasRemainingUsers(deviceId) {
+        if (tables.devicesToUsers) {
+          const remainingRows = await db.select({ userId: tables.devicesToUsers.userId }).from(tables.devicesToUsers).where(eq(tables.devicesToUsers.deviceId, deviceId)).limit(1);
+          return remainingRows.length > 0;
+        }
+        return false;
+      },
+      async delete(id) {
+        await db.delete(devices).where(eq(devices.id, id));
+      }
+    },
+    admin: {
+      async findByUserId(userId) {
+        const rows = await db.select({ ip: admins.ip }).from(admins).where(eq(admins.userId, userId)).limit(1);
+        return rows[0] ?? null;
+      }
+    }
+  };
+}
+
 // src/utilities/config.ts
 var defaultTokenSettings = {
   jwtExpiry: 30 * 24 * 60 * 60,
@@ -105,9 +649,16 @@ var defaultFeatures = {
   otpLogin: true
 };
 function createAuthConfig(config) {
+  if (!config.database && !config.prisma) {
+    throw new Error(
+      "@factiii/auth: Provide either a `database` adapter or a `prisma` client in config."
+    );
+  }
+  const database = config.database ?? createPrismaAdapter(config.prisma);
   const emailService = config.emailService ?? createNoopEmailAdapter();
   return {
     ...config,
+    database,
     features: { ...defaultFeatures, ...config.features },
     tokenSettings: { ...defaultTokenSettings, ...config.tokenSettings },
     cookieSettings: { ...defaultCookieSettings, ...config.cookieSettings },
@@ -225,6 +776,7 @@ function isTokenInvalidError(error) {
 function createAuthGuard(config, t) {
   const storageKeys = config.storageKeys ?? defaultStorageKeys;
   const cookieSettings = { ...defaultCookieSettings, ...config.cookieSettings };
+  const database = config.database ?? createPrismaAdapter(config.prisma);
   const revokeSession = async (ctx, sessionId, description, errorStack, path) => {
     clearAuthCookie(ctx.res, cookieSettings, storageKeys);
     if (config.hooks?.logError) {
@@ -261,15 +813,9 @@ ${errorStack}` : null,
     }
     if (sessionId) {
       try {
-        await config.prisma.session.update({
-          where: { id: sessionId },
-          data: { revokedAt: /* @__PURE__ */ new Date() }
-        });
+        await database.session.revoke(sessionId);
         if (config.hooks?.onSessionRevoked) {
-          const session = await config.prisma.session.findUnique({
-            where: { id: sessionId },
-            select: { id: true, userId: true, socketId: true }
-          });
+          const session = await database.session.findById(sessionId);
           if (session) {
             await config.hooks.onSessionRevoked(session.userId, session.socketId, description);
           }
@@ -294,23 +840,7 @@ ${errorStack}` : null,
           secret: config.secrets.jwt,
           ignoreExpiration: meta?.ignoreExpiration ?? false
         });
-        const session = await config.prisma.session.findUnique({
-          where: {
-            id: decodedToken.id
-          },
-          select: {
-            userId: true,
-            user: {
-              select: {
-                status: true,
-                verifiedHumanAt: true
-              }
-            },
-            revokedAt: true,
-            socketId: true,
-            id: true
-          }
-        });
+        const session = await database.session.findById(decodedToken.id);
         if (!session) {
           await revokeSession(
             ctx,
@@ -364,10 +894,7 @@ ${errorStack}` : null,
           });
         }
         if (meta?.adminRequired) {
-          const admin = await config.prisma.admin.findFirst({
-            where: { userId: session.userId },
-            select: { ip: true }
-          });
+          const admin = await database.admin.findByUserId(session.userId);
           if (!admin || admin.ip !== ctx.ip) {
             await revokeSession(
               ctx,
@@ -557,6 +1084,36 @@ function validatePasswordStrength(password, minLength = 6) {
   return { valid: true };
 }
 
+// src/utilities/session.ts
+async function createSessionWithToken(config, params) {
+  const { userId, browserName, socketId, deviceId, extraSessionData } = params;
+  const session = await config.database.session.create({
+    userId,
+    browserName,
+    socketId,
+    ...deviceId != null ? { deviceId } : {},
+    ...extraSessionData
+  });
+  const user = await config.database.user.findById(userId);
+  const accessToken = createAuthToken(
+    {
+      id: session.id,
+      userId: session.userId,
+      verifiedHumanAt: user?.verifiedHumanAt ?? null
+    },
+    {
+      secret: config.secrets.jwt,
+      expiresIn: config.tokenSettings.jwtExpiry
+    }
+  );
+  return { accessToken, sessionId: session.id };
+}
+async function createSessionWithTokenAndCookie(config, params, res) {
+  const result = await createSessionWithToken(config, params);
+  setAuthCookie(res, result.accessToken, config.cookieSettings, config.storageKeys);
+  return result;
+}
+
 // src/utilities/totp.ts
 import crypto from "crypto";
 import { TOTP } from "totp-generator";
@@ -622,19 +1179,14 @@ var BaseProcedureFactory = class {
       if (this.config.hooks?.beforeRegister) {
         await this.config.hooks.beforeRegister(typedInput);
       }
-      const usernameCheck = await this.config.prisma.user.findFirst({
-        where: { username: { equals: username, mode: "insensitive" } }
-      });
+      const usernameCheck = await this.config.database.user.findByUsernameInsensitive(username);
       if (usernameCheck) {
         throw new TRPCError2({
           code: "CONFLICT",
           message: "An account already exists with that username."
         });
       }
-      const emailCheck = await this.config.prisma.user.findFirst({
-        where: { email: { equals: email, mode: "insensitive" } },
-        select: { id: true }
-      });
+      const emailCheck = await this.config.database.user.findByEmailInsensitive(email);
       if (emailCheck) {
         throw new TRPCError2({
           code: "CONFLICT",
@@ -642,30 +1194,25 @@ var BaseProcedureFactory = class {
         });
       }
       const hashedPassword = await hashPassword(password);
-      const user = await this.config.prisma.user.create({
-        data: {
-          username,
-          email,
-          password: hashedPassword,
-          status: "ACTIVE",
-          tag: this.config.features.biometric ? "BOT" : "HUMAN",
-          twoFaEnabled: false,
-          emailVerificationStatus: "UNVERIFIED",
-          verifiedHumanAt: null
-        }
+      const user = await this.config.database.user.create({
+        username,
+        email,
+        password: hashedPassword,
+        status: "ACTIVE",
+        tag: this.config.features.biometric ? "BOT" : "HUMAN",
+        twoFaEnabled: false,
+        emailVerificationStatus: "UNVERIFIED",
+        verifiedHumanAt: null
       });
       if (this.config.hooks?.onUserCreated) {
         await this.config.hooks.onUserCreated(user.id, typedInput);
       }
       const extraSessionData = this.config.hooks?.getSessionData ? await this.config.hooks.getSessionData(typedInput) : {};
-      const session = await this.config.prisma.session.create({
-        data: {
-          userId: user.id,
-          browserName: detectBrowser(userAgent),
-          socketId: null,
-          ...extraSessionData
-        },
-        select: { id: true, userId: true }
+      const session = await this.config.database.session.create({
+        userId: user.id,
+        browserName: detectBrowser(userAgent),
+        socketId: null,
+        ...extraSessionData
       });
       if (this.config.hooks?.onSessionCreated) {
         await this.config.hooks.onSessionCreated(session.id, typedInput);
@@ -703,24 +1250,7 @@ var BaseProcedureFactory = class {
       if (this.config.hooks?.beforeLogin) {
         await this.config.hooks.beforeLogin(typedInput);
       }
-      const user = await this.config.prisma.user.findFirst({
-        where: {
-          OR: [
-            { email: { equals: username, mode: "insensitive" } },
-            { username: { equals: username, mode: "insensitive" } }
-          ]
-        },
-        select: {
-          id: true,
-          status: true,
-          password: true,
-          twoFaEnabled: true,
-          email: true,
-          username: true,
-          oauthProvider: true,
-          verifiedHumanAt: true
-        }
-      });
+      const user = await this.config.database.user.findByEmailOrUsernameInsensitive(username);
       if (!user) {
         throw new TRPCError2({
           code: "FORBIDDEN",
@@ -761,10 +1291,7 @@ var BaseProcedureFactory = class {
           };
         }
         let validCode = false;
-        const secrets = await this.config.prisma.session.findMany({
-          where: { userId: user.id, twoFaSecret: { not: null } },
-          select: { twoFaSecret: true }
-        });
+        const secrets = await this.config.database.session.findTwoFaSecretsByUserId(user.id);
         for (const s of secrets) {
           if (s.twoFaSecret && await verifyTotp(code, cleanBase32String(s.twoFaSecret))) {
             validCode = true;
@@ -772,14 +1299,13 @@ var BaseProcedureFactory = class {
           }
         }
         if (!validCode) {
-          const checkOTP = await this.config.prisma.oTP.findFirst({
-            where: { userId: user.id, code: Number(code), expiresAt: { gte: /* @__PURE__ */ new Date() } }
-          });
+          const checkOTP = await this.config.database.otp.findValidByUserAndCode(
+            user.id,
+            Number(code)
+          );
           if (checkOTP) {
             validCode = true;
-            await this.config.prisma.oTP.delete({
-              where: { id: checkOTP.id }
-            });
+            await this.config.database.otp.delete(checkOTP.id);
           }
         }
         if (!validCode) {
@@ -790,24 +1316,11 @@ var BaseProcedureFactory = class {
         }
       }
       const extraSessionData = this.config.hooks?.getSessionData ? await this.config.hooks.getSessionData(typedInput) : {};
-      const session = await this.config.prisma.session.create({
-        data: {
-          userId: user.id,
-          browserName: detectBrowser(userAgent),
-          socketId: null,
-          ...extraSessionData
-        },
-        select: {
-          id: true,
-          userId: true,
-          socketId: true,
-          browserName: true,
-          issuedAt: true,
-          lastUsed: true,
-          revokedAt: true,
-          deviceId: true,
-          twoFaSecret: true
-        }
+      const session = await this.config.database.session.create({
+        userId: user.id,
+        browserName: detectBrowser(userAgent),
+        socketId: null,
+        ...extraSessionData
       });
       if (this.config.hooks?.onUserLogin) {
         await this.config.hooks.onUserLogin(user.id, session.id);
@@ -838,15 +1351,9 @@ var BaseProcedureFactory = class {
     return this.authProcedure.meta({ ignoreExpiration: true }).mutation(async ({ ctx }) => {
       const { userId, sessionId } = ctx;
       if (sessionId) {
-        await this.config.prisma.session.update({
-          where: { id: sessionId },
-          data: { revokedAt: /* @__PURE__ */ new Date() }
-        });
+        await this.config.database.session.revoke(sessionId);
         if (userId) {
-          await this.config.prisma.user.update({
-            where: { id: userId },
-            data: { isActive: false }
-          });
+          await this.config.database.user.update(userId, { isActive: false });
         }
         if (this.config.hooks?.afterLogout) {
           await this.config.hooks.afterLogout(userId, sessionId, ctx.socketId);
@@ -858,15 +1365,7 @@ var BaseProcedureFactory = class {
   }
   refresh() {
     return this.authProcedure.query(async ({ ctx }) => {
-      const session = await this.config.prisma.session.update({
-        where: { id: ctx.sessionId },
-        data: { lastUsed: /* @__PURE__ */ new Date() },
-        select: {
-          id: true,
-          userId: true,
-          user: { select: { verifiedHumanAt: true } }
-        }
-      });
+      const session = await this.config.database.session.updateLastUsed(ctx.sessionId);
       if (this.config.hooks?.onRefresh) {
         this.config.hooks.onRefresh(session.userId).catch(() => {
         });
@@ -891,22 +1390,14 @@ var BaseProcedureFactory = class {
     return this.authProcedure.input(endAllSessionsSchema).mutation(async ({ ctx, input }) => {
       const { skipCurrentSession } = input;
       const { userId, sessionId } = ctx;
-      const sessionsToRevoke = await this.config.prisma.session.findMany({
-        where: {
-          userId,
-          revokedAt: null,
-          ...skipCurrentSession ? { NOT: { id: sessionId } } : {}
-        },
-        select: { socketId: true, id: true, userId: true }
-      });
-      await this.config.prisma.session.updateMany({
-        where: {
-          userId,
-          revokedAt: null,
-          ...skipCurrentSession ? { NOT: { id: sessionId } } : {}
-        },
-        data: { revokedAt: /* @__PURE__ */ new Date() }
-      });
+      const sessionsToRevoke = await this.config.database.session.findActiveByUserId(
+        userId,
+        skipCurrentSession ? sessionId : void 0
+      );
+      await this.config.database.session.revokeAllByUserId(
+        userId,
+        skipCurrentSession ? sessionId : void 0
+      );
       for (const session of sessionsToRevoke) {
         if (this.config.hooks?.onSessionRevoked) {
           await this.config.hooks.onSessionRevoked(
@@ -917,10 +1408,7 @@ var BaseProcedureFactory = class {
         }
       }
       if (!skipCurrentSession) {
-        await this.config.prisma.user.update({
-          where: { id: userId },
-          data: { isActive: false }
-        });
+        await this.config.database.user.update(userId, { isActive: false });
       }
       return { success: true, revokedCount: sessionsToRevoke.length };
     });
@@ -935,10 +1423,7 @@ var BaseProcedureFactory = class {
           message: "New password cannot be the same as current password"
         });
       }
-      const user = await this.config.prisma.user.findUnique({
-        where: { id: userId },
-        select: { password: true }
-      });
+      const user = await this.config.database.user.findById(userId);
       if (!user) {
         throw new TRPCError2({ code: "NOT_FOUND", message: "User not found" });
       }
@@ -956,14 +1441,8 @@ var BaseProcedureFactory = class {
         });
       }
       const hashedPassword = await hashPassword(newPassword);
-      await this.config.prisma.user.update({
-        where: { id: userId },
-        data: { password: hashedPassword }
-      });
-      await this.config.prisma.session.updateMany({
-        where: { userId, revokedAt: null, NOT: { id: sessionId } },
-        data: { revokedAt: /* @__PURE__ */ new Date() }
-      });
+      await this.config.database.user.update(userId, { password: hashedPassword });
+      await this.config.database.session.revokeAllByUserId(userId, sessionId);
       if (this.config.hooks?.onPasswordChanged) {
         await this.config.hooks.onPasswordChanged(userId);
       }
@@ -976,11 +1455,8 @@ var BaseProcedureFactory = class {
   sendPasswordResetEmail() {
     return this.procedure.input(requestPasswordResetSchema).mutation(async ({ input }) => {
       const { email } = input;
-      const user = await this.config.prisma.user.findFirst({
-        where: { email: { equals: email, mode: "insensitive" }, status: "ACTIVE" },
-        select: { id: true, password: true, email: true }
-      });
-      if (!user) {
+      const user = await this.config.database.user.findByEmailInsensitive(email);
+      if (!user || user.status !== "ACTIVE") {
         return { message: "If an account exists with that email, a reset link has been sent." };
       }
       if (!user.password) {
@@ -989,10 +1465,8 @@ var BaseProcedureFactory = class {
           message: "This account uses social login. Please use that method."
         });
       }
-      await this.config.prisma.passwordReset.deleteMany({ where: { userId: user.id } });
-      const passwordReset = await this.config.prisma.passwordReset.create({
-        data: { userId: user.id }
-      });
+      await this.config.database.passwordReset.deleteAllByUserId(user.id);
+      const passwordReset = await this.config.database.passwordReset.create(user.id);
       if (this.config.emailService) {
         await this.config.emailService.sendPasswordResetEmail(user.email, String(passwordReset.id));
       }
@@ -1002,15 +1476,12 @@ var BaseProcedureFactory = class {
   checkPasswordReset() {
     return this.procedure.input(checkPasswordResetSchema).query(async ({ input }) => {
       const { token } = input;
-      const passwordReset = await this.config.prisma.passwordReset.findUnique({
-        where: { id: token },
-        select: { id: true, createdAt: true, userId: true }
-      });
+      const passwordReset = await this.config.database.passwordReset.findById(token);
       if (!passwordReset) {
         throw new TRPCError2({ code: "NOT_FOUND", message: "Invalid reset token." });
       }
       if (passwordReset.createdAt.getTime() + this.config.tokenSettings.passwordResetExpiryMs < Date.now()) {
-        await this.config.prisma.passwordReset.delete({ where: { id: token } });
+        await this.config.database.passwordReset.delete(token);
         throw new TRPCError2({ code: "FORBIDDEN", message: "Reset token expired." });
       }
       return { valid: true };
@@ -1019,31 +1490,23 @@ var BaseProcedureFactory = class {
   resetPassword() {
     return this.procedure.input(resetPasswordSchema).mutation(async ({ input }) => {
       const { token, password } = input;
-      const passwordReset = await this.config.prisma.passwordReset.findFirst({
-        where: { id: token },
-        select: { id: true, createdAt: true, userId: true }
-      });
+      const passwordReset = await this.config.database.passwordReset.findById(token);
       if (!passwordReset) {
         throw new TRPCError2({ code: "NOT_FOUND", message: "Invalid reset token." });
       }
       if (passwordReset.createdAt.getTime() + this.config.tokenSettings.passwordResetExpiryMs < Date.now()) {
-        await this.config.prisma.passwordReset.delete({ where: { id: token } });
+        await this.config.database.passwordReset.delete(token);
         throw new TRPCError2({ code: "FORBIDDEN", message: "Reset token expired." });
       }
       const hashedPassword = await hashPassword(password);
-      await this.config.prisma.user.update({
-        where: { id: passwordReset.userId },
-        data: { password: hashedPassword }
-      });
-      await this.config.prisma.passwordReset.delete({ where: { id: token } });
-      const sessionsToRevoke = await this.config.prisma.session.findMany({
-        where: { userId: passwordReset.userId, revokedAt: null },
-        select: { id: true, socketId: true, userId: true }
-      });
-      await this.config.prisma.session.updateMany({
-        where: { userId: passwordReset.userId, revokedAt: null },
-        data: { revokedAt: /* @__PURE__ */ new Date() }
+      await this.config.database.user.update(passwordReset.userId, {
+        password: hashedPassword
       });
+      await this.config.database.passwordReset.delete(token);
+      const sessionsToRevoke = await this.config.database.session.findActiveByUserId(
+        passwordReset.userId
+      );
+      await this.config.database.session.revokeAllByUserId(passwordReset.userId);
       for (const session of sessionsToRevoke) {
         if (this.config.hooks?.onSessionRevoked) {
           await this.config.hooks.onSessionRevoked(
@@ -1080,9 +1543,9 @@ var BiometricProcedureFactory = class {
     return this.authProcedure.input(biometricVerifySchema).mutation(async ({ ctx }) => {
       this.checkConfig();
       const { userId } = ctx;
-      await this.config.prisma.user.update({
-        where: { id: userId },
-        data: { verifiedHumanAt: /* @__PURE__ */ new Date(), tag: "HUMAN" }
+      await this.config.database.user.update(userId, {
+        verifiedHumanAt: /* @__PURE__ */ new Date(),
+        tag: "HUMAN"
       });
       if (this.config.hooks?.onBiometricVerified) {
         await this.config.hooks.onBiometricVerified(userId);
@@ -1094,10 +1557,7 @@ var BiometricProcedureFactory = class {
     return this.authProcedure.query(async ({ ctx }) => {
       this.checkConfig();
       const { userId } = ctx;
-      const user = await this.config.prisma.user.findUnique({
-        where: { id: userId },
-        select: { verifiedHumanAt: true }
-      });
+      const user = await this.config.database.user.findById(userId);
       if (!user) {
         throw new TRPCError3({ code: "NOT_FOUND", message: "User not found" });
       }
@@ -1144,10 +1604,7 @@ var EmailVerificationProcedureFactory = class {
     return this.authProcedure.mutation(async ({ ctx }) => {
       this.checkConfig();
       const { userId } = ctx;
-      const user = await this.config.prisma.user.findUnique({
-        where: { id: userId, status: "ACTIVE" },
-        select: { id: true, email: true, emailVerificationStatus: true }
-      });
+      const user = await this.config.database.user.findActiveById(userId);
       if (!user) {
         throw new TRPCError4({ code: "NOT_FOUND", message: "User not found" });
       }
@@ -1155,9 +1612,9 @@ var EmailVerificationProcedureFactory = class {
         return { message: "Email is already verified", emailSent: false };
       }
       const otp = randomUUID();
-      await this.config.prisma.user.update({
-        where: { id: userId },
-        data: { emailVerificationStatus: "PENDING", otpForEmailVerification: otp }
+      await this.config.database.user.update(userId, {
+        emailVerificationStatus: "PENDING",
+        otpForEmailVerification: otp
       });
       if (this.config.emailService) {
         try {
@@ -1175,10 +1632,7 @@ var EmailVerificationProcedureFactory = class {
       this.checkConfig();
       const { userId } = ctx;
       const { code } = input;
-      const user = await this.config.prisma.user.findUnique({
-        where: { id: userId, status: "ACTIVE" },
-        select: { id: true, emailVerificationStatus: true, otpForEmailVerification: true }
-      });
+      const user = await this.config.database.user.findActiveById(userId);
       if (!user) {
         throw new TRPCError4({ code: "NOT_FOUND", message: "User not found" });
       }
@@ -1188,9 +1642,9 @@ var EmailVerificationProcedureFactory = class {
       if (code !== user.otpForEmailVerification) {
         throw new TRPCError4({ code: "BAD_REQUEST", message: "Invalid verification code" });
       }
-      await this.config.prisma.user.update({
-        where: { id: userId },
-        data: { emailVerificationStatus: "VERIFIED", otpForEmailVerification: null }
+      await this.config.database.user.update(userId, {
+        emailVerificationStatus: "VERIFIED",
+        otpForEmailVerification: null
       });
       if (this.config.hooks?.onEmailVerified) {
         await this.config.hooks.onEmailVerified(userId);
@@ -1202,10 +1656,7 @@ var EmailVerificationProcedureFactory = class {
     return this.authProcedure.query(async ({ ctx }) => {
       this.checkConfig();
       const { userId } = ctx;
-      const user = await this.config.prisma.user.findUnique({
-        where: { id: userId },
-        select: { emailVerificationStatus: true, email: true }
-      });
+      const user = await this.config.database.user.findById(userId);
       if (!user) {
         throw new TRPCError4({ code: "NOT_FOUND", message: "User not found" });
       }
@@ -1259,23 +1710,7 @@ var OAuthLoginProcedureFactory = class {
           message: "Email not provided by OAuth provider"
         });
       }
-      let user = await this.config.prisma.user.findFirst({
-        where: {
-          OR: [{ email: { equals: email, mode: "insensitive" } }, { oauthId: { equals: oauthId } }]
-        },
-        select: {
-          id: true,
-          status: true,
-          email: true,
-          username: true,
-          password: true,
-          oauthProvider: true,
-          oauthId: true,
-          twoFaEnabled: true,
-          verifiedHumanAt: true,
-          emailVerificationStatus: true
-        }
-      });
+      let user = await this.config.database.user.findByEmailOrOAuthId(email, oauthId);
       if (user?.oauthProvider && user.oauthProvider !== provider) {
         throw new TRPCError5({
           code: "BAD_REQUEST",
@@ -1290,19 +1725,17 @@ var OAuthLoginProcedureFactory = class {
       }
       if (!user) {
         const generateUsername = this.config.generateUsername ?? (() => `user_${Date.now()}`);
-        user = await this.config.prisma.user.create({
-          data: {
-            username: generateUsername(),
-            email,
-            password: null,
-            emailVerificationStatus: "VERIFIED",
-            oauthProvider: provider,
-            oauthId,
-            status: "ACTIVE",
-            tag: this.config.features.biometric ? "BOT" : "HUMAN",
-            twoFaEnabled: false,
-            verifiedHumanAt: null
-          }
+        user = await this.config.database.user.create({
+          username: generateUsername(),
+          email,
+          password: null,
+          emailVerificationStatus: "VERIFIED",
+          oauthProvider: provider,
+          oauthId,
+          status: "ACTIVE",
+          tag: this.config.features.biometric ? "BOT" : "HUMAN",
+          twoFaEnabled: false,
+          verifiedHumanAt: null
         });
         if (this.config.hooks?.onUserCreated) {
           await this.config.hooks.onUserCreated(user.id, typedInput);
@@ -1318,24 +1751,11 @@ var OAuthLoginProcedureFactory = class {
         throw new TRPCError5({ code: "FORBIDDEN", message: "Your account has been banned." });
       }
       const extraSessionData = this.config.hooks?.getSessionData ? await this.config.hooks.getSessionData(typedInput) : {};
-      const session = await this.config.prisma.session.create({
-        data: {
-          userId: user.id,
-          browserName: detectBrowser(userAgent),
-          socketId: null,
-          ...extraSessionData
-        },
-        select: {
-          id: true,
-          userId: true,
-          socketId: true,
-          browserName: true,
-          issuedAt: true,
-          lastUsed: true,
-          revokedAt: true,
-          deviceId: true,
-          twoFaSecret: true
-        }
+      const session = await this.config.database.session.create({
+        userId: user.id,
+        browserName: detectBrowser(userAgent),
+        socketId: null,
+        ...extraSessionData
       });
       if (this.config.hooks?.onUserLogin) {
         await this.config.hooks.onUserLogin(user.id, session.id);
@@ -1392,10 +1812,7 @@ var TwoFaProcedureFactory = class {
     return this.authProcedure.mutation(async ({ ctx }) => {
       this.checkConfig();
       const { userId, sessionId } = ctx;
-      const user = await this.config.prisma.user.findFirst({
-        where: { id: userId },
-        select: { twoFaEnabled: true, oauthProvider: true, password: true }
-      });
+      const user = await this.config.database.user.findById(userId);
       if (!user) {
         throw new TRPCError6({ code: "NOT_FOUND", message: "User not found." });
       }
@@ -1409,10 +1826,7 @@ var TwoFaProcedureFactory = class {
         throw new TRPCError6({ code: "BAD_REQUEST", message: "2FA already enabled." });
       }
       if (this.config.features.twoFaRequiresDevice !== false) {
-        const checkSession = await this.config.prisma.session.findFirst({
-          where: { userId, id: sessionId },
-          select: { deviceId: true }
-        });
+        const checkSession = await this.config.database.session.findById(sessionId);
         if (!checkSession?.deviceId) {
           throw new TRPCError6({
             code: "BAD_REQUEST",
@@ -1420,23 +1834,11 @@ var TwoFaProcedureFactory = class {
           });
         }
       }
-      await this.config.prisma.session.updateMany({
-        where: { userId, revokedAt: null, NOT: { id: sessionId } },
-        data: { revokedAt: /* @__PURE__ */ new Date() }
-      });
-      await this.config.prisma.session.updateMany({
-        where: { userId, NOT: { id: sessionId } },
-        data: { twoFaSecret: null }
-      });
+      await this.config.database.session.revokeAllByUserId(userId, sessionId);
+      await this.config.database.session.clearTwoFaSecrets(userId, sessionId);
       const secret = generateTotpSecret();
-      await this.config.prisma.user.update({
-        where: { id: userId },
-        data: { twoFaEnabled: true }
-      });
-      await this.config.prisma.session.update({
-        where: { id: sessionId },
-        data: { twoFaSecret: secret }
-      });
+      await this.config.database.user.update(userId, { twoFaEnabled: true });
+      await this.config.database.session.update(sessionId, { twoFaSecret: secret });
       if (this.config.hooks?.onTwoFaStatusChanged) {
         await this.config.hooks.onTwoFaStatusChanged(userId, true);
       }
@@ -1448,10 +1850,7 @@ var TwoFaProcedureFactory = class {
       this.checkConfig();
       const { userId, sessionId } = ctx;
       const { password } = input;
-      const user = await this.config.prisma.user.findFirst({
-        where: { id: userId },
-        select: { password: true, status: true, oauthProvider: true }
-      });
+      const user = await this.config.database.user.findById(userId);
       if (!user) {
         throw new TRPCError6({ code: "NOT_FOUND", message: "User not found." });
       }
@@ -1474,14 +1873,8 @@ var TwoFaProcedureFactory = class {
       if (!isMatch) {
         throw new TRPCError6({ code: "FORBIDDEN", message: "Incorrect password." });
       }
-      await this.config.prisma.user.update({
-        where: { id: userId },
-        data: { twoFaEnabled: false }
-      });
-      await this.config.prisma.session.update({
-        where: { id: sessionId },
-        data: { twoFaSecret: null }
-      });
+      await this.config.database.user.update(userId, { twoFaEnabled: false });
+      await this.config.database.session.update(sessionId, { twoFaSecret: null });
       if (this.config.hooks?.onTwoFaStatusChanged) {
         await this.config.hooks.onTwoFaStatusChanged(userId, false);
       }
@@ -1493,10 +1886,7 @@ var TwoFaProcedureFactory = class {
       this.checkConfig();
       const { userId, sessionId } = ctx;
       const { pushCode } = input;
-      const user = await this.config.prisma.user.findFirst({
-        where: { id: userId },
-        select: { twoFaEnabled: true, oauthProvider: true }
-      });
+      const user = await this.config.database.user.findById(userId);
       if (user?.oauthProvider) {
         throw new TRPCError6({
           code: "FORBIDDEN",
@@ -1506,10 +1896,7 @@ var TwoFaProcedureFactory = class {
       if (!user?.twoFaEnabled) {
         throw new TRPCError6({ code: "BAD_REQUEST", message: "2FA not enabled." });
       }
-      const session = await this.config.prisma.session.findUnique({
-        where: { id: sessionId, userId },
-        select: { twoFaSecret: true, device: { select: { pushToken: true } } }
-      });
+      const session = await this.config.database.session.findByIdWithDevice(sessionId, userId);
       if (!session?.device) {
         throw new TRPCError6({ code: "BAD_REQUEST", message: "Invalid request" });
       }
@@ -1521,10 +1908,7 @@ var TwoFaProcedureFactory = class {
         return { secret: session.twoFaSecret };
       }
       const secret = generateTotpSecret();
-      await this.config.prisma.session.update({
-        where: { id: sessionId },
-        data: { twoFaSecret: secret }
-      });
+      await this.config.database.session.update(sessionId, { twoFaSecret: secret });
       return { secret };
     });
   }
@@ -1532,11 +1916,8 @@ var TwoFaProcedureFactory = class {
     return this.procedure.input(twoFaResetSchema).mutation(async ({ input }) => {
       this.checkConfig();
       const { username, password } = input;
-      const user = await this.config.prisma.user.findFirst({
-        where: { username: { equals: username, mode: "insensitive" }, twoFaEnabled: true },
-        select: { id: true, password: true, email: true }
-      });
-      if (!user) {
+      const user = await this.config.database.user.findByUsernameInsensitive(username);
+      if (!user || !user.twoFaEnabled) {
         throw new TRPCError6({ code: "UNAUTHORIZED", message: "Invalid credentials." });
       }
       if (!user.password) {
@@ -1551,9 +1932,7 @@ var TwoFaProcedureFactory = class {
       }
       const otp = generateOtp();
       const expiresAt = new Date(Date.now() + this.config.tokenSettings.otpValidityMs);
-      await this.config.prisma.oTP.create({
-        data: { userId: user.id, code: otp, expiresAt }
-      });
+      await this.config.database.otp.create({ userId: user.id, code: otp, expiresAt });
       if (this.config.emailService) {
         await this.config.emailService.sendOTPEmail(user.email, otp);
       }
@@ -1564,30 +1943,17 @@ var TwoFaProcedureFactory = class {
     return this.procedure.input(twoFaResetVerifySchema).mutation(async ({ input }) => {
       this.checkConfig();
       const { code, username } = input;
-      const user = await this.config.prisma.user.findFirst({
-        where: { username: { equals: username, mode: "insensitive" } },
-        select: { id: true }
-      });
+      const user = await this.config.database.user.findByUsernameInsensitive(username);
       if (!user) {
         throw new TRPCError6({ code: "NOT_FOUND", message: "User not found" });
       }
-      const otp = await this.config.prisma.oTP.findFirst({
-        where: { userId: user.id, code, expiresAt: { gte: /* @__PURE__ */ new Date() } }
-      });
+      const otp = await this.config.database.otp.findValidByUserAndCode(user.id, code);
       if (!otp) {
         throw new TRPCError6({ code: "FORBIDDEN", message: "Invalid or expired OTP" });
       }
-      await this.config.prisma.oTP.delete({
-        where: { id: otp.id }
-      });
-      await this.config.prisma.user.update({
-        where: { id: user.id },
-        data: { twoFaEnabled: false }
-      });
-      await this.config.prisma.session.updateMany({
-        where: { userId: user.id },
-        data: { twoFaSecret: null }
-      });
+      await this.config.database.otp.delete(otp.id);
+      await this.config.database.user.update(user.id, { twoFaEnabled: false });
+      await this.config.database.session.clearTwoFaSecrets(user.id);
       return { success: true, message: "2FA has been reset." };
     });
   }
@@ -1596,36 +1962,14 @@ var TwoFaProcedureFactory = class {
       this.checkConfig();
       const { userId, sessionId } = ctx;
       const { pushToken } = input;
-      await this.config.prisma.session.updateMany({
-        where: {
-          userId,
-          id: { not: sessionId },
-          revokedAt: null,
-          device: { pushToken }
-        },
-        data: { revokedAt: /* @__PURE__ */ new Date() }
-      });
-      const checkDevice = await this.config.prisma.device.findFirst({
-        where: {
-          pushToken,
-          sessions: { some: { id: sessionId } },
-          users: { some: { id: userId } }
-        },
-        select: { id: true }
-      });
+      await this.config.database.session.revokeByDevicePushToken(userId, pushToken, sessionId);
+      const checkDevice = await this.config.database.device.findByTokenSessionAndUser(
+        pushToken,
+        sessionId,
+        userId
+      );
       if (!checkDevice) {
-        await this.config.prisma.device.upsert({
-          where: { pushToken },
-          create: {
-            pushToken,
-            sessions: { connect: { id: sessionId } },
-            users: { connect: { id: userId } }
-          },
-          update: {
-            sessions: { connect: { id: sessionId } },
-            users: { connect: { id: userId } }
-          }
-        });
+        await this.config.database.device.upsertByPushToken(pushToken, sessionId, userId);
       }
       return { registered: true };
     });
@@ -1635,30 +1979,13 @@ var TwoFaProcedureFactory = class {
       this.checkConfig();
       const { userId } = ctx;
       const { pushToken } = input;
-      const device = await this.config.prisma.device.findFirst({
-        where: {
-          users: { some: { id: userId } },
-          pushToken
-        },
-        select: { id: true }
-      });
+      const device = await this.config.database.device.findByUserAndToken(userId, pushToken);
       if (device) {
-        await this.config.prisma.session.updateMany({
-          where: { userId, deviceId: device.id },
-          data: { deviceId: null }
-        });
-        await this.config.prisma.device.update({
-          where: { id: device.id },
-          data: { users: { disconnect: { id: userId } } }
-        });
-        const remainingUsers = await this.config.prisma.device.findUnique({
-          where: { id: device.id },
-          select: { users: { select: { id: true }, take: 1 } }
-        });
-        if (!remainingUsers?.users.length) {
-          await this.config.prisma.device.delete({
-            where: { id: device.id }
-          });
+        await this.config.database.session.clearDeviceId(userId, device.id);
+        await this.config.database.device.disconnectUser(device.id, userId);
+        const hasUsers = await this.config.database.device.hasRemainingUsers(device.id);
+        if (!hasUsers) {
+          await this.config.database.device.delete(device.id);
         }
       }
       return { deregistered: true };
@@ -1670,13 +1997,15 @@ var TwoFaProcedureFactory = class {
 import { initTRPC } from "@trpc/server";
 import SuperJSON from "superjson";
 import { ZodError } from "zod";
+function hasStringProp(obj, key) {
+  return typeof obj === "object" && obj !== null && key in obj && typeof obj[key] === "string";
+}
 function isPrismaConnectionError(error) {
   if (!error || typeof error !== "object") {
     return false;
   }
-  const errorCode = error.code;
-  if (errorCode && typeof errorCode === "string") {
-    const codeMatch = errorCode.match(/^P(\d+)$/);
+  if (hasStringProp(error, "code")) {
+    const codeMatch = error.code.match(/^P(\d+)$/);
     if (codeMatch) {
       const codeNum = parseInt(codeMatch[1], 10);
       if (codeNum >= 1e3 && codeNum <= 1003) {
@@ -1686,14 +2015,13 @@ function isPrismaConnectionError(error) {
   }
   const constructorName = error.constructor?.name || "";
   if (constructorName.includes("Prisma")) {
-    const errorMessage = error.message?.toLowerCase() || "";
+    const errorMessage = hasStringProp(error, "message") ? error.message.toLowerCase() : "";
     if (errorMessage.includes("can't reach database") || errorMessage.includes("authentication failed") || errorMessage.includes("database server") || errorMessage.includes("timeout") || errorMessage.includes("connection")) {
       return true;
     }
   }
-  const cause = error.cause;
-  if (cause) {
-    return isPrismaConnectionError(cause);
+  if ("cause" in error) {
+    return isPrismaConnectionError(error.cause);
   }
   return false;
 }
@@ -1739,8 +2067,9 @@ function createBaseProcedure(t, authGuard) {
 }
 function getClientIp(req) {
   const forwarded = req.headers["x-forwarded-for"];
-  if (forwarded) {
-    return forwarded.split(",")[0]?.trim();
+  const forwardedStr = Array.isArray(forwarded) ? forwarded[0] : forwarded;
+  if (forwardedStr) {
+    return forwardedStr.split(",")[0]?.trim();
   }
   return req.socket.remoteAddress || void 0;
 }
@@ -1758,7 +2087,7 @@ var AuthRouterFactory = class {
   constructor(userConfig) {
     this.userConfig = userConfig;
     this.config = createAuthConfig(this.userConfig);
-    this.schemas = createSchemas(this.config.schemaExtensions);
+    this.schemas = createSchemas(this.userConfig.schemaExtensions);
     this.t = createTrpcBuilder(this.config);
     this.authGuard = createAuthGuard(this.config, this.t);
     this.procedure = createBaseProcedure(this.t, this.authGuard);
@@ -1815,8 +2144,12 @@ export {
   createAuthRouter,
   createAuthToken,
   createConsoleEmailAdapter,
+  createDrizzleAdapter,
   createNoopEmailAdapter,
   createOAuthVerifier,
+  createPrismaAdapter,
+  createSessionWithToken,
+  createSessionWithTokenAndCookie,
   decodeToken,
   defaultAuthConfig,
   defaultCookieSettings,