@flaredev/cli 0.1.2 → 0.2.0

package/templates/app/lib/auth-config.ts

@@ -0,0 +1,33 @@
+/**
+ * How people sign in to this app. `flare create` wrote the choices you made; change
+ * them here any time. Every method's tables already exist, so switching one on or off
+ * needs no migration, and a method that's off is refused by the API, not just hidden.
+ *
+ * Email and password sign-in is always available.
+ */
+export const authConfig = {
+  /** A sign-in link by email. */
+  magicLink: true,
+  /** A 6-digit sign-in code by email. */
+  emailOtp: true,
+  /** Face ID, Touch ID, Windows Hello or a security key. */
+  passkeys: true,
+  twoFactor: {
+    /** Codes from an authenticator app (TOTP), with backup codes. */
+    authenticator: true,
+    /** Codes by email as the second step. */
+    email: true,
+  },
+  /**
+   * Social sign-in. Each provider also needs its credentials (see .dev.vars.example);
+   * without them its button stays hidden.
+   */
+  social: [] as SocialProvider[],
+  /** Refuse password sign-in until the email address is verified. */
+  requireEmailVerification: false,
+};
+
+export type SocialProvider = "google" | "github" | "apple" | "microsoft";
+
+/** Whether any second factor can be set up. */
+export const twoFactorAvailable = authConfig.twoFactor.authenticator || authConfig.twoFactor.email;

package/templates/app/lib/auth-emails.ts

@@ -0,0 +1,94 @@
+import { eq } from "drizzle-orm";
+import { getDb } from "@/db";
+import { user } from "@/db/auth-schema";
+import { sendTransactionalEmail } from "./mail";
+
+/**
+ * Every email the sign-in flows send. Change the wording here; the layout comes from
+ * lib/mail.ts. Without RESEND_API_KEY these print to the console, links and codes included.
+ */
+
+const ignore = "If you didn't ask for this, you can ignore this email.";
+
+/** Accounts with two-factor sign-in never get a one-step email sign-in (it would skip the second factor). */
+async function usesTwoFactor(email: string): Promise<boolean> {
+  const row = await getDb().select({ on: user.twoFactorEnabled }).from(user).where(eq(user.email, email.toLowerCase())).get();
+  return Boolean(row?.on);
+}
+
+async function sendTwoFactorNotice(email: string) {
+  await sendTransactionalEmail({
+    to: email,
+    subject: "Sign in with your password or a passkey",
+    heading: "Email sign-in is off for your account",
+    paragraphs: [
+      "Someone asked to sign in to your account by email. Your account uses two-factor authentication, so we don't send sign-in links or codes.",
+      "Sign in with your password and second factor, or with a passkey.",
+    ],
+    footer: ignore,
+  });
+}
+
+export async function sendMagicLink({ email, url }: { email: string; url: string }) {
+  if (await usesTwoFactor(email)) return sendTwoFactorNotice(email);
+  await sendTransactionalEmail({
+    to: email,
+    subject: "Your sign-in link",
+    heading: "Sign in",
+    paragraphs: ["Use this link to sign in. It works once and expires in 5 minutes."],
+    action: { label: "Sign in", url },
+    footer: ignore,
+    preheader: "Your sign-in link",
+  });
+}
+
+export async function sendEmailCode({ email, otp, type }: { email: string; otp: string; type: "sign-in" | "email-verification" | "forget-password" | "change-email" }) {
+  if (type === "sign-in" && (await usesTwoFactor(email))) return sendTwoFactorNotice(email);
+  const purpose = {
+    "sign-in": ["Your sign-in code", "Enter this code to sign in."],
+    "email-verification": ["Verify your email", "Enter this code to verify your email address."],
+    "forget-password": ["Reset your password", "Enter this code to choose a new password."],
+    "change-email": ["Confirm your new email", "Enter this code to confirm your new email address."],
+  }[type];
+  await sendTransactionalEmail({
+    to: email,
+    subject: `${purpose[0]}: ${otp}`,
+    heading: otp,
+    paragraphs: [purpose[1], "It expires in 5 minutes."],
+    footer: ignore,
+    preheader: purpose[0],
+  });
+}
+
+export async function sendTwoFactorCode({ user, otp }: { user: { email: string }; otp: string }) {
+  await sendTransactionalEmail({
+    to: user.email,
+    subject: `Your verification code: ${otp}`,
+    heading: otp,
+    paragraphs: ["Enter this code to finish signing in. It expires in 5 minutes."],
+    footer: "If you didn't just sign in, change your password: someone else knows it.",
+    preheader: "Your verification code",
+  });
+}
+
+export async function sendPasswordReset({ user, url }: { user: { email: string }; url: string }) {
+  await sendTransactionalEmail({
+    to: user.email,
+    subject: "Reset your password",
+    heading: "Reset your password",
+    paragraphs: ["Use this link to choose a new password. It expires in 1 hour."],
+    action: { label: "Choose a new password", url },
+    footer: ignore,
+  });
+}
+
+export async function sendVerificationEmail({ user, url }: { user: { email: string }; url: string }) {
+  await sendTransactionalEmail({
+    to: user.email,
+    subject: "Verify your email",
+    heading: "Verify your email",
+    paragraphs: ["Confirm this is your email address."],
+    action: { label: "Verify email", url },
+    footer: ignore,
+  });
+}

package/templates/app/lib/auth.ts

@@ -1,13 +1,55 @@
 import { env, waitUntil } from "cloudflare:workers";
-import { betterAuth } from "better-auth";
+import { passkey } from "@better-auth/passkey";
 import { drizzleAdapter } from "@better-auth/drizzle-adapter";
+import { betterAuth } from "better-auth";
+import { APIError, createAuthMiddleware } from "better-auth/api";
 import { nextCookies } from "better-auth/next-js";
 import { admin } from "better-auth/plugins/admin";
+import { emailOTP } from "better-auth/plugins/email-otp";
+import { magicLink } from "better-auth/plugins/magic-link";
+import { twoFactor } from "better-auth/plugins/two-factor";
 import { hashPassword, verifyPassword } from "@flaredev/core";
 import { getDb, schema } from "@/db";
+import { authConfig, type SocialProvider } from "./auth-config";
+import { sendEmailCode, sendMagicLink, sendPasswordReset, sendTwoFactorCode, sendVerificationEmail } from "./auth-emails";
+
+const vars = env as unknown as Record<string, string | undefined>;
 
 /** Optional: set when serving from a custom domain (e.g. https://example.com). */
-const configuredURL = (env as { BETTER_AUTH_URL?: string }).BETTER_AUTH_URL;
+const configuredURL = vars.BETTER_AUTH_URL;
+
+/** A provider's credentials from the environment, when both are set. */
+function credentials(prefix: string) {
+  const clientId = vars[`${prefix}_CLIENT_ID`];
+  const clientSecret = vars[`${prefix}_CLIENT_SECRET`];
+  return clientId && clientSecret ? { clientId, clientSecret } : undefined;
+}
+
+const providerSettings: Record<SocialProvider, Record<string, string> | undefined> = {
+  google: credentials("GOOGLE"),
+  github: credentials("GITHUB"),
+  // Apple's client secret is a JWT you generate from your key (see the auth guide).
+  apple: credentials("APPLE") && { ...credentials("APPLE")!, ...(vars.APPLE_APP_BUNDLE_ID ? { appBundleIdentifier: vars.APPLE_APP_BUNDLE_ID } : {}) },
+  // "common" accepts personal and work accounts; set a tenant id to allow only your organisation.
+  microsoft: credentials("MICROSOFT") && { ...credentials("MICROSOFT")!, tenantId: vars.MICROSOFT_TENANT_ID || "common" },
+};
+
+/** Social providers switched on in lib/auth-config.ts that also have credentials. */
+const socialProviders = Object.fromEntries(
+  authConfig.social.flatMap((provider) => (providerSettings[provider] ? [[provider, providerSettings[provider]]] : [])),
+);
+
+/** Endpoints of methods switched off in lib/auth-config.ts: refused, not just hidden. */
+function disabledPath(path: string): boolean {
+  if (!authConfig.magicLink && (path === "/sign-in/magic-link" || path === "/magic-link/verify")) return true;
+  if (!authConfig.emailOtp && (path.startsWith("/email-otp/") || path === "/sign-in/email-otp" || path === "/forget-password/email-otp")) return true;
+  if (!authConfig.passkeys && path.startsWith("/passkey/")) return true;
+  const { authenticator, email } = authConfig.twoFactor;
+  if (!authenticator && !email && path.startsWith("/two-factor/")) return true;
+  if (!authenticator && (path === "/two-factor/get-totp-uri" || path === "/two-factor/verify-totp")) return true;
+  if (!email && (path === "/two-factor/send-otp" || path === "/two-factor/verify-otp")) return true;
+  return false;
+}
 
 export const auth = betterAuth({
   appName: "__APP_NAME__",
@@ -18,20 +60,53 @@ export const auth = betterAuth({
   baseURL: configuredURL || {
     allowedHosts: ["localhost:*", "127.0.0.1:*", "*.trycloudflare.com", "__APP_NAME__.*.workers.dev"],
   },
+  // Sign in with Apple posts back from Apple's own origin.
+  trustedOrigins: authConfig.social.includes("apple") ? ["https://appleid.apple.com"] : [],
   database: drizzleAdapter(getDb(), { provider: "sqlite", schema }),
-  socialProviders: __SOCIAL_PROVIDERS__,
+  socialProviders,
+  account: {
+    // Signing in with Google as ada@example.com joins Ada's existing account (the provider has verified the address).
+    accountLinking: { enabled: true, trustedProviders: ["google", "github", "apple", "microsoft"] },
+  },
   emailAndPassword: {
     enabled: true,
+    requireEmailVerification: authConfig.requireEmailVerification,
     // PBKDF2 via WebCrypto: the default scrypt exceeds Workers CPU limits.
     password: { hash: hashPassword, verify: verifyPassword },
+    sendResetPassword: ({ user, url }) => sendPasswordReset({ user, url }),
+    resetPasswordTokenExpiresIn: 60 * 60,
+    // A password reset signs every other device out.
+    revokeSessionsOnPasswordReset: true,
+  },
+  emailVerification: {
+    sendVerificationEmail: ({ user, url }) => sendVerificationEmail({ user, url }),
+    sendOnSignUp: true,
+    autoSignInAfterVerification: true,
   },
   advanced: {
     // Let emails and other deferred work finish after the response is sent.
     backgroundTasks: { handler: waitUntil },
   },
+  hooks: {
+    before: createAuthMiddleware(async (ctx) => {
+      if (disabledPath(ctx.path)) throw new APIError("NOT_FOUND", { message: "This sign-in method isn't enabled." });
+    }),
+  },
   plugins: [
     // Adds user.role (default "user") and admin APIs. The /admin area allows ADMIN_ROLES (lib/admin.ts).
     admin({ defaultRole: "user", adminRoles: ["admin"] }),
+    magicLink({ sendMagicLink: ({ email, url }) => sendMagicLink({ email, url }), expiresIn: 5 * 60, disableSignUp: false }),
+    emailOTP({ sendVerificationOTP: (data) => sendEmailCode(data), otpLength: 6, expiresIn: 5 * 60, allowedAttempts: 5 }),
+    twoFactor({
+      issuer: "__APP_NAME__",
+      otpOptions: { sendOTP: ({ user, otp }) => sendTwoFactorCode({ user, otp }), allowedAttempts: 5 },
+      // With only email codes switched on there's no authenticator app to confirm first.
+      skipVerificationOnEnable: !authConfig.twoFactor.authenticator,
+      // People who signed up with a social account have no password to confirm with;
+      // accounts that do have one must still give it.
+      allowPasswordless: true,
+    }),
+    passkey({ rpName: "__APP_NAME__" }),
     // Must stay last: lets server actions set auth cookies.
     nextCookies(),
   ],
@@ -39,7 +114,7 @@ export const auth = betterAuth({
 
 export type Session = typeof auth.$Infer.Session;
 
-/** OAuth providers with credentials configured, e.g. ["github"]. */
-export function enabledSocialProviders(): string[] {
-  return Object.keys(auth.options.socialProviders ?? {});
+/** OAuth providers switched on and configured, e.g. ["github"], for the sign-in buttons. */
+export function enabledSocialProviders(): SocialProvider[] {
+  return Object.keys(socialProviders) as SocialProvider[];
 }

package/templates/app/lib/site.ts

@@ -0,0 +1,47 @@
+import type { ThemeName } from "./theme";
+
+/**
+ * What the site says about itself: the home page, the sign-in screens' side panels and
+ * the page titles read from here. Edit freely.
+ */
+export const site = {
+  name: "__APP_NAME__",
+  tagline: "The fastest way to run your business",
+  description: "__APP_NAME__ keeps your team, your customers and your data in one place, and it's live on the edge in every region.",
+  /**
+   * The look of the whole app: sign-in screens, dashboard, admin and home page.
+   * One of: default, coral, amber, sky, mono, emerald. FLARE_THEME (shell or .env)
+   * overrides it when the app is built or run with `flare dev`.
+   */
+  theme: "__THEME__" as ThemeName,
+  /** The small pill above the home page headline; set to null to hide it. */
+  announcement: { label: "New", text: "Passkeys and two-factor sign-in are here", href: "/sign-up" } as { label: string; text: string; href: string } | null,
+  /** The home page's feature grid (icon names from lucide.dev). */
+  features: [
+    { icon: "zap", title: "Fast everywhere", description: "Served from the edge in every region, so pages load in milliseconds wherever your customers are." },
+    { icon: "shield-check", title: "Secure by default", description: "Passkeys, two-factor sign-in, roles and rate limits, switched on from day one." },
+    { icon: "layout-dashboard", title: "One place for your data", description: "Every record your team keeps, with search, filters and an admin built in." },
+    { icon: "users", title: "Built for teams", description: "Invite your team, give each person the right access, and see who changed what." },
+    { icon: "plug", title: "Connects to your tools", description: "A documented API for every record, ready for your scripts and integrations." },
+    { icon: "credit-card", title: "Billing when you need it", description: "Plans, checkout and invoices through Stripe, without building a billing system." },
+  ],
+  /** Placeholder names for the logo strip: replace them with your customers (or remove the strip). */
+  customers: ["Acme", "Globex", "Initech", "Vandelay", "Northwind", "Brightline"],
+  /** Shown beside the sign-up form. */
+  highlights: [
+    "Set up in minutes, with nothing to install",
+    "Secure sign-in with passkeys and two-factor",
+    "Your data stays yours: export it any time",
+  ],
+  /** Shown on the sign-in screen of themes with a quote panel. */
+  testimonial: {
+    quote: "We moved our whole workflow over in an afternoon. The team hasn't looked back.",
+    author: "Alex Rivera",
+    role: "Head of Operations",
+  },
+  links: {
+    terms: "/terms",
+    privacy: "/privacy",
+    support: "mailto:support@example.com",
+  },
+};

package/templates/app/lib/theme.ts

@@ -0,0 +1,79 @@
+import { site } from "./site";
+
+/**
+ * The six looks every Flare app ships with. The active one sets `data-theme` on <html>;
+ * app/globals.css maps it to colours, radius and type, and the auth screens pick the
+ * layout below.
+ */
+export const THEMES = {
+  default: {
+    label: "Default",
+    description: "Calm and centred, indigo accents.",
+    auth: "centered",
+    social: "after",
+    socialStyle: "full",
+    signIn: (name: string) => ({ title: `Sign in to ${name}` }),
+    signUp: (name: string) => ({ title: `Create your ${name} account` }),
+  },
+  coral: {
+    label: "Coral",
+    description: "Warm and rounded, a card floating over the page.",
+    auth: "modal",
+    social: "after",
+    socialStyle: "icon",
+    signIn: () => ({ title: "Log in or sign up" }),
+    signUp: () => ({ title: "Create your account" }),
+  },
+  amber: {
+    label: "Amber",
+    description: "Plain and direct, a boxed form with pill buttons.",
+    auth: "boxed",
+    social: "after",
+    socialStyle: "full",
+    signIn: () => ({ title: "Sign in" }),
+    signUp: () => ({ title: "Create account" }),
+  },
+  sky: {
+    label: "Sky",
+    description: "Crisp blue, a bold heading with social sign-in first.",
+    auth: "banner",
+    social: "before",
+    socialStyle: "full",
+    signIn: (name: string) => ({ title: `Log in to ${name}` }),
+    signUp: (name: string) => ({ title: `Get started with ${name}` }),
+  },
+  mono: {
+    label: "Mono",
+    description: "Black and white on a fine grid, a showcase beside the form.",
+    auth: "showcase",
+    social: "after",
+    socialStyle: "full",
+    signIn: (name: string) => ({ title: `Log in to your ${name} account` }),
+    signUp: (name: string) => ({ title: `Create your ${name} account` }),
+  },
+  emerald: {
+    label: "Emerald",
+    description: "Fresh green, the form beside a customer quote.",
+    auth: "quote",
+    social: "before",
+    socialStyle: "full",
+    signIn: () => ({ title: "Welcome back", subtitle: "Sign in to your account" }),
+    signUp: () => ({ title: "Get started", subtitle: "Create a new account" }),
+  },
+} as const;
+
+export type ThemeName = keyof typeof THEMES;
+export type AuthLayout = (typeof THEMES)[ThemeName]["auth"];
+
+/** Set from FLARE_THEME by vite.config.ts when the app is built or run. */
+declare const __FLARE_THEME__: string;
+
+export function isThemeName(value: unknown): value is ThemeName {
+  return typeof value === "string" && value in THEMES;
+}
+
+/** The theme in use: FLARE_THEME if it names one, else lib/site.ts. */
+export const activeTheme: ThemeName = isThemeName(__FLARE_THEME__) ? __FLARE_THEME__ : isThemeName(site.theme) ? site.theme : "default";
+
+export const theme = THEMES[activeTheme];
+export const authLayout: AuthLayout = theme.auth;

package/templates/app/migrations/0000_init.sql

@@ -16,6 +16,23 @@ CREATE TABLE `account` (
 );
 --> statement-breakpoint
 CREATE INDEX `account_userId_idx` ON `account` (`user_id`);--> statement-breakpoint
+CREATE TABLE `passkey` (
+	`id` text PRIMARY KEY NOT NULL,
+	`name` text,
+	`public_key` text NOT NULL,
+	`user_id` text NOT NULL,
+	`credential_id` text NOT NULL,
+	`counter` integer NOT NULL,
+	`device_type` text NOT NULL,
+	`backed_up` integer NOT NULL,
+	`transports` text,
+	`created_at` integer,
+	`aaguid` text,
+	FOREIGN KEY (`user_id`) REFERENCES `user`(`id`) ON UPDATE no action ON DELETE cascade
+);
+--> statement-breakpoint
+CREATE INDEX `passkey_userId_idx` ON `passkey` (`user_id`);--> statement-breakpoint
+CREATE INDEX `passkey_credentialID_idx` ON `passkey` (`credential_id`);--> statement-breakpoint
 CREATE TABLE `session` (
 	`id` text PRIMARY KEY NOT NULL,
 	`expires_at` integer NOT NULL,
@@ -31,6 +48,19 @@ CREATE TABLE `session` (
 --> statement-breakpoint
 CREATE UNIQUE INDEX `session_token_unique` ON `session` (`token`);--> statement-breakpoint
 CREATE INDEX `session_userId_idx` ON `session` (`user_id`);--> statement-breakpoint
+CREATE TABLE `two_factor` (
+	`id` text PRIMARY KEY NOT NULL,
+	`secret` text NOT NULL,
+	`backup_codes` text NOT NULL,
+	`user_id` text NOT NULL,
+	`verified` integer DEFAULT true,
+	`failed_verification_count` integer DEFAULT 0,
+	`locked_until` integer,
+	FOREIGN KEY (`user_id`) REFERENCES `user`(`id`) ON UPDATE no action ON DELETE cascade
+);
+--> statement-breakpoint
+CREATE INDEX `twoFactor_secret_idx` ON `two_factor` (`secret`);--> statement-breakpoint
+CREATE INDEX `twoFactor_userId_idx` ON `two_factor` (`user_id`);--> statement-breakpoint
 CREATE TABLE `user` (
 	`id` text PRIMARY KEY NOT NULL,
 	`name` text NOT NULL,
@@ -42,7 +72,8 @@ CREATE TABLE `user` (
 	`role` text,
 	`banned` integer DEFAULT false,
 	`ban_reason` text,
-	`ban_expires` integer
+	`ban_expires` integer,
+	`two_factor_enabled` integer DEFAULT false
 );
 --> statement-breakpoint
 CREATE UNIQUE INDEX `user_email_unique` ON `user` (`email`);--> statement-breakpoint

package/templates/app/migrations/meta/0000_snapshot.json

@@ -1,7 +1,7 @@
 {
   "version": "6",
   "dialect": "sqlite",
-  "id": "0d286de4-e9a3-4fb7-a0d3-e3fa1f8ac57f",
+  "id": "79194ad1-2287-43f7-8f37-64fded59352b",
   "prevId": "00000000-0000-0000-0000-000000000000",
   "tables": {
     "account": {
@@ -128,6 +128,122 @@
       "uniqueConstraints": {},
       "checkConstraints": {}
     },
+    "passkey": {
+      "name": "passkey",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "public_key": {
+          "name": "public_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "credential_id": {
+          "name": "credential_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "counter": {
+          "name": "counter",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "device_type": {
+          "name": "device_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "backed_up": {
+          "name": "backed_up",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "transports": {
+          "name": "transports",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "aaguid": {
+          "name": "aaguid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        }
+      },
+      "indexes": {
+        "passkey_userId_idx": {
+          "name": "passkey_userId_idx",
+          "columns": [
+            "user_id"
+          ],
+          "isUnique": false
+        },
+        "passkey_credentialID_idx": {
+          "name": "passkey_credentialID_idx",
+          "columns": [
+            "credential_id"
+          ],
+          "isUnique": false
+        }
+      },
+      "foreignKeys": {
+        "passkey_user_id_user_id_fk": {
+          "name": "passkey_user_id_user_id_fk",
+          "tableFrom": "passkey",
+          "tableTo": "user",
+          "columnsFrom": [
+            "user_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "checkConstraints": {}
+    },
     "session": {
       "name": "session",
       "columns": {
@@ -231,6 +347,96 @@
       "uniqueConstraints": {},
       "checkConstraints": {}
     },
+    "two_factor": {
+      "name": "two_factor",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "secret": {
+          "name": "secret",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "backup_codes": {
+          "name": "backup_codes",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "verified": {
+          "name": "verified",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false,
+          "default": true
+        },
+        "failed_verification_count": {
+          "name": "failed_verification_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false,
+          "default": 0
+        },
+        "locked_until": {
+          "name": "locked_until",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        }
+      },
+      "indexes": {
+        "twoFactor_secret_idx": {
+          "name": "twoFactor_secret_idx",
+          "columns": [
+            "secret"
+          ],
+          "isUnique": false
+        },
+        "twoFactor_userId_idx": {
+          "name": "twoFactor_userId_idx",
+          "columns": [
+            "user_id"
+          ],
+          "isUnique": false
+        }
+      },
+      "foreignKeys": {
+        "two_factor_user_id_user_id_fk": {
+          "name": "two_factor_user_id_user_id_fk",
+          "tableFrom": "two_factor",
+          "tableTo": "user",
+          "columnsFrom": [
+            "user_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "checkConstraints": {}
+    },
     "user": {
       "name": "user",
       "columns": {
@@ -314,6 +520,14 @@
           "primaryKey": false,
           "notNull": false,
           "autoincrement": false
+        },
+        "two_factor_enabled": {
+          "name": "two_factor_enabled",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false,
+          "default": false
         }
       },
       "indexes": {

package/templates/app/migrations/meta/_journal.json

@@ -5,7 +5,7 @@
     {
       "idx": 0,
       "version": "6",
-      "when": 1789674564602,
+      "when": 1790089765410,
       "tag": "0000_init",
       "breakpoints": true
     }