@hammadj/better-auth 1.5.0-beta.10

package/dist/plugins/siwe/types.d.mts

@@ -0,0 +1,44 @@
+//#region src/plugins/siwe/types.d.ts
+interface CacaoHeader {
+  t: "caip122";
+}
+interface CacaoPayload {
+  domain: string;
+  aud: string;
+  nonce: string;
+  iss: string;
+  version?: string | undefined;
+  iat?: string | undefined;
+  nbf?: string | undefined;
+  exp?: string | undefined;
+  statement?: string | undefined;
+  requestId?: string | undefined;
+  resources?: string[] | undefined;
+  type?: string | undefined;
+}
+interface Cacao {
+  h: CacaoHeader;
+  p: CacaoPayload;
+  s: {
+    t: "eip191" | "eip1271";
+    s: string;
+    m?: string | undefined;
+  };
+}
+interface SIWEVerifyMessageArgs {
+  message: string;
+  signature: string;
+  address: string;
+  chainId: number;
+  cacao?: Cacao | undefined;
+}
+interface ENSLookupArgs {
+  walletAddress: string;
+}
+interface ENSLookupResult {
+  name: string;
+  avatar: string;
+}
+//#endregion
+export { ENSLookupArgs, ENSLookupResult, SIWEVerifyMessageArgs };
+//# sourceMappingURL=types.d.mts.map

package/dist/plugins/two-factor/backup-codes/index.d.mts

@@ -0,0 +1,91 @@
+//#region src/plugins/two-factor/backup-codes/index.d.ts
+interface BackupCodeOptions {
+  /**
+   * The amount of backup codes to generate
+   *
+   * @default 10
+   */
+  amount?: number | undefined;
+  /**
+   * The length of the backup codes
+   *
+   * @default 10
+   */
+  length?: number | undefined;
+  /**
+   * An optional custom function to generate backup codes
+   */
+  customBackupCodesGenerate?: (() => string[]) | undefined;
+  /**
+   * How to store the backup codes in the database, whether encrypted or plain.
+   */
+  storeBackupCodes?: ("plain" | "encrypted" | {
+    encrypt: (token: string) => Promise<string>;
+    decrypt: (token: string) => Promise<string>;
+  }) | undefined;
+}
+declare function generateBackupCodes(secret: string, options?: BackupCodeOptions | undefined): Promise<{
+  backupCodes: string[];
+  encryptedBackupCodes: string;
+}>;
+declare function verifyBackupCode(data: {
+  backupCodes: string;
+  code: string;
+}, key: string, options?: BackupCodeOptions | undefined): Promise<{
+  status: any;
+  updated: any;
+}>;
+declare function getBackupCodes(backupCodes: string, key: string, options?: BackupCodeOptions | undefined): Promise<any>;
+declare const backupCode2fa: (opts: BackupCodeOptions) => {
+  id: string;
+  endpoints: {
+    /**
+     * ### Endpoint
+     *
+     * POST `/two-factor/verify-backup-code`
+     *
+     * ### API Methods
+     *
+     * **server:**
+     * `auth.api.verifyBackupCode`
+     *
+     * **client:**
+     * `authClient.twoFactor.verifyBackupCode`
+     *
+     * @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/2fa#api-method-two-factor-verify-backup-code)
+     */
+    verifyBackupCode: any;
+    /**
+     * ### Endpoint
+     *
+     * POST `/two-factor/generate-backup-codes`
+     *
+     * ### API Methods
+     *
+     * **server:**
+     * `auth.api.generateBackupCodes`
+     *
+     * **client:**
+     * `authClient.twoFactor.generateBackupCodes`
+     *
+     * @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/2fa#api-method-two-factor-generate-backup-codes)
+     */
+    generateBackupCodes: any;
+    /**
+     * ### Endpoint
+     *
+     * POST `/two-factor/view-backup-codes`
+     *
+     * ### API Methods
+     *
+     * **server:**
+     * `auth.api.viewBackupCodes`
+     *
+     * @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/2fa#api-method-two-factor-view-backup-codes)
+     */
+    viewBackupCodes: any;
+  };
+};
+//#endregion
+export { BackupCodeOptions, backupCode2fa, generateBackupCodes, getBackupCodes, verifyBackupCode };
+//# sourceMappingURL=index.d.mts.map

package/dist/plugins/two-factor/backup-codes/index.mjs

@@ -0,0 +1,277 @@
+import { generateRandomString } from "../../../crypto/random.mjs";
+import { symmetricDecrypt, symmetricEncrypt } from "../../../crypto/index.mjs";
+import { parseUserOutput } from "../../../db/schema.mjs";
+import { sessionMiddleware } from "../../../api/routes/session.mjs";
+import "../../../api/index.mjs";
+import { TWO_FACTOR_ERROR_CODES } from "../error-code.mjs";
+import { verifyTwoFactor } from "../verify-two-factor.mjs";
+import { APIError } from "@better-auth/core/error";
+import { safeJSONParse } from "@better-auth/core/utils/json";
+import { createAuthEndpoint } from "@better-auth/core/api";
+import * as z from "zod";
+
+//#region src/plugins/two-factor/backup-codes/index.ts
+function generateBackupCodesFn(options) {
+	return Array.from({ length: options?.amount ?? 10 }).fill(null).map(() => generateRandomString(options?.length ?? 10, "a-z", "0-9", "A-Z")).map((code) => `${code.slice(0, 5)}-${code.slice(5)}`);
+}
+async function generateBackupCodes(secret, options) {
+	const backupCodes = options?.customBackupCodesGenerate ? options.customBackupCodesGenerate() : generateBackupCodesFn(options);
+	if (options?.storeBackupCodes === "encrypted") return {
+		backupCodes,
+		encryptedBackupCodes: await symmetricEncrypt({
+			data: JSON.stringify(backupCodes),
+			key: secret
+		})
+	};
+	if (typeof options?.storeBackupCodes === "object" && "encrypt" in options?.storeBackupCodes) return {
+		backupCodes,
+		encryptedBackupCodes: await options?.storeBackupCodes.encrypt(JSON.stringify(backupCodes))
+	};
+	return {
+		backupCodes,
+		encryptedBackupCodes: JSON.stringify(backupCodes)
+	};
+}
+async function verifyBackupCode(data, key, options) {
+	const codes = await getBackupCodes(data.backupCodes, key, options);
+	if (!codes) return {
+		status: false,
+		updated: null
+	};
+	return {
+		status: codes.includes(data.code),
+		updated: codes.filter((code) => code !== data.code)
+	};
+}
+async function getBackupCodes(backupCodes, key, options) {
+	if (options?.storeBackupCodes === "encrypted") return safeJSONParse(await symmetricDecrypt({
+		key,
+		data: backupCodes
+	}));
+	if (typeof options?.storeBackupCodes === "object" && "decrypt" in options?.storeBackupCodes) return safeJSONParse(await options?.storeBackupCodes.decrypt(backupCodes));
+	return safeJSONParse(backupCodes);
+}
+const verifyBackupCodeBodySchema = z.object({
+	code: z.string().meta({ description: `A backup code to verify. Eg: "123456"` }),
+	disableSession: z.boolean().meta({ description: "If true, the session cookie will not be set." }).optional(),
+	trustDevice: z.boolean().meta({ description: "If true, the device will be trusted for 30 days. It'll be refreshed on every sign in request within this time. Eg: true" }).optional()
+});
+const viewBackupCodesBodySchema = z.object({ userId: z.coerce.string().meta({ description: `The user ID to view all backup codes. Eg: "user-id"` }) });
+const generateBackupCodesBodySchema = z.object({ password: z.string().meta({ description: "The users password." }) });
+const backupCode2fa = (opts) => {
+	const twoFactorTable = "twoFactor";
+	return {
+		id: "backup_code",
+		endpoints: {
+			verifyBackupCode: createAuthEndpoint("/two-factor/verify-backup-code", {
+				method: "POST",
+				body: verifyBackupCodeBodySchema,
+				metadata: { openapi: {
+					description: "Verify a backup code for two-factor authentication",
+					responses: { "200": {
+						description: "Backup code verified successfully",
+						content: { "application/json": { schema: {
+							type: "object",
+							properties: {
+								user: {
+									type: "object",
+									properties: {
+										id: {
+											type: "string",
+											description: "Unique identifier of the user"
+										},
+										email: {
+											type: "string",
+											format: "email",
+											nullable: true,
+											description: "User's email address"
+										},
+										emailVerified: {
+											type: "boolean",
+											nullable: true,
+											description: "Whether the email is verified"
+										},
+										name: {
+											type: "string",
+											nullable: true,
+											description: "User's name"
+										},
+										image: {
+											type: "string",
+											format: "uri",
+											nullable: true,
+											description: "User's profile image URL"
+										},
+										twoFactorEnabled: {
+											type: "boolean",
+											description: "Whether two-factor authentication is enabled for the user"
+										},
+										createdAt: {
+											type: "string",
+											format: "date-time",
+											description: "Timestamp when the user was created"
+										},
+										updatedAt: {
+											type: "string",
+											format: "date-time",
+											description: "Timestamp when the user was last updated"
+										}
+									},
+									required: [
+										"id",
+										"twoFactorEnabled",
+										"createdAt",
+										"updatedAt"
+									],
+									description: "The authenticated user object with two-factor details"
+								},
+								session: {
+									type: "object",
+									properties: {
+										token: {
+											type: "string",
+											description: "Session token"
+										},
+										userId: {
+											type: "string",
+											description: "ID of the user associated with the session"
+										},
+										createdAt: {
+											type: "string",
+											format: "date-time",
+											description: "Timestamp when the session was created"
+										},
+										expiresAt: {
+											type: "string",
+											format: "date-time",
+											description: "Timestamp when the session expires"
+										}
+									},
+									required: [
+										"token",
+										"userId",
+										"createdAt",
+										"expiresAt"
+									],
+									description: "The current session object, included unless disableSession is true"
+								}
+							},
+							required: ["user", "session"]
+						} } }
+					} }
+				} }
+			}, async (ctx) => {
+				const { session, valid } = await verifyTwoFactor(ctx);
+				const user = session.user;
+				const twoFactor = await ctx.context.adapter.findOne({
+					model: twoFactorTable,
+					where: [{
+						field: "userId",
+						value: user.id
+					}]
+				});
+				if (!twoFactor) throw APIError.from("BAD_REQUEST", TWO_FACTOR_ERROR_CODES.BACKUP_CODES_NOT_ENABLED);
+				const validate = await verifyBackupCode({
+					backupCodes: twoFactor.backupCodes,
+					code: ctx.body.code
+				}, ctx.context.secret, opts);
+				if (!validate.status) throw APIError.from("UNAUTHORIZED", TWO_FACTOR_ERROR_CODES.INVALID_BACKUP_CODE);
+				const updatedBackupCodes = await symmetricEncrypt({
+					key: ctx.context.secret,
+					data: JSON.stringify(validate.updated)
+				});
+				if (!await ctx.context.adapter.update({
+					model: twoFactorTable,
+					update: { backupCodes: updatedBackupCodes },
+					where: [{
+						field: "id",
+						value: twoFactor.id
+					}, {
+						field: "backupCodes",
+						value: twoFactor.backupCodes
+					}]
+				})) throw APIError.fromStatus("CONFLICT", { message: "Failed to verify backup code. Please try again." });
+				if (!ctx.body.disableSession) return valid(ctx);
+				return ctx.json({
+					token: session.session?.token,
+					user: parseUserOutput(ctx.context.options, session.user)
+				});
+			}),
+			generateBackupCodes: createAuthEndpoint("/two-factor/generate-backup-codes", {
+				method: "POST",
+				body: generateBackupCodesBodySchema,
+				use: [sessionMiddleware],
+				metadata: { openapi: {
+					description: "Generate new backup codes for two-factor authentication",
+					responses: { "200": {
+						description: "Backup codes generated successfully",
+						content: { "application/json": { schema: {
+							type: "object",
+							properties: {
+								status: {
+									type: "boolean",
+									description: "Indicates if the backup codes were generated successfully",
+									enum: [true]
+								},
+								backupCodes: {
+									type: "array",
+									items: { type: "string" },
+									description: "Array of generated backup codes in plain text"
+								}
+							},
+							required: ["status", "backupCodes"]
+						} } }
+					} }
+				} }
+			}, async (ctx) => {
+				const user = ctx.context.session.user;
+				if (!user.twoFactorEnabled) throw APIError.from("BAD_REQUEST", TWO_FACTOR_ERROR_CODES.TWO_FACTOR_NOT_ENABLED);
+				await ctx.context.password.checkPassword(user.id, ctx);
+				const twoFactor = await ctx.context.adapter.findOne({
+					model: twoFactorTable,
+					where: [{
+						field: "userId",
+						value: user.id
+					}]
+				});
+				if (!twoFactor) throw APIError.from("BAD_REQUEST", TWO_FACTOR_ERROR_CODES.TWO_FACTOR_NOT_ENABLED);
+				const backupCodes = await generateBackupCodes(ctx.context.secret, opts);
+				await ctx.context.adapter.update({
+					model: twoFactorTable,
+					update: { backupCodes: backupCodes.encryptedBackupCodes },
+					where: [{
+						field: "id",
+						value: twoFactor.id
+					}]
+				});
+				return ctx.json({
+					status: true,
+					backupCodes: backupCodes.backupCodes
+				});
+			}),
+			viewBackupCodes: createAuthEndpoint({
+				method: "POST",
+				body: viewBackupCodesBodySchema
+			}, async (ctx) => {
+				const twoFactor = await ctx.context.adapter.findOne({
+					model: twoFactorTable,
+					where: [{
+						field: "userId",
+						value: ctx.body.userId
+					}]
+				});
+				if (!twoFactor) throw APIError.from("BAD_REQUEST", TWO_FACTOR_ERROR_CODES.BACKUP_CODES_NOT_ENABLED);
+				const decryptedBackupCodes = await getBackupCodes(twoFactor.backupCodes, ctx.context.secret, opts);
+				if (!decryptedBackupCodes) throw APIError.from("BAD_REQUEST", TWO_FACTOR_ERROR_CODES.INVALID_BACKUP_CODE);
+				return ctx.json({
+					status: true,
+					backupCodes: decryptedBackupCodes
+				});
+			})
+		}
+	};
+};
+
+//#endregion
+export { backupCode2fa, generateBackupCodes };
+//# sourceMappingURL=index.mjs.map

package/dist/plugins/two-factor/backup-codes/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../src/plugins/two-factor/backup-codes/index.ts"],"sourcesContent":["import { createAuthEndpoint } from \"@better-auth/core/api\";\nimport { APIError } from \"@better-auth/core/error\";\nimport { safeJSONParse } from \"@better-auth/core/utils/json\";\nimport * as z from \"zod\";\nimport { sessionMiddleware } from \"../../../api\";\nimport { symmetricDecrypt, symmetricEncrypt } from \"../../../crypto\";\nimport { generateRandomString } from \"../../../crypto/random\";\nimport { parseUserOutput } from \"../../../db/schema\";\nimport { TWO_FACTOR_ERROR_CODES } from \"../error-code\";\nimport type {\n\tTwoFactorProvider,\n\tTwoFactorTable,\n\tUserWithTwoFactor,\n} from \"../types\";\nimport { verifyTwoFactor } from \"../verify-two-factor\";\n\nexport interface BackupCodeOptions {\n\t/**\n\t * The amount of backup codes to generate\n\t *\n\t * @default 10\n\t */\n\tamount?: number | undefined;\n\t/**\n\t * The length of the backup codes\n\t *\n\t * @default 10\n\t */\n\tlength?: number | undefined;\n\t/**\n\t * An optional custom function to generate backup codes\n\t */\n\tcustomBackupCodesGenerate?: (() => string[]) | undefined;\n\t/**\n\t * How to store the backup codes in the database, whether encrypted or plain.\n\t */\n\tstoreBackupCodes?:\n\t\t| (\n\t\t\t\t| \"plain\"\n\t\t\t\t| \"encrypted\"\n\t\t\t\t| {\n\t\t\t\t\t\tencrypt: (token: string) => Promise<string>;\n\t\t\t\t\t\tdecrypt: (token: string) => Promise<string>;\n\t\t\t\t  }\n\t\t  )\n\t\t| undefined;\n}\n\nfunction generateBackupCodesFn(options?: BackupCodeOptions | undefined) {\n\treturn Array.from({ length: options?.amount ?? 10 })\n\t\t.fill(null)\n\t\t.map(() => generateRandomString(options?.length ?? 10, \"a-z\", \"0-9\", \"A-Z\"))\n\t\t.map((code) => `${code.slice(0, 5)}-${code.slice(5)}`);\n}\n\nexport async function generateBackupCodes(\n\tsecret: string,\n\toptions?: BackupCodeOptions | undefined,\n) {\n\tconst backupCodes = options?.customBackupCodesGenerate\n\t\t? options.customBackupCodesGenerate()\n\t\t: generateBackupCodesFn(options);\n\tif (options?.storeBackupCodes === \"encrypted\") {\n\t\tconst encCodes = await symmetricEncrypt({\n\t\t\tdata: JSON.stringify(backupCodes),\n\t\t\tkey: secret,\n\t\t});\n\t\treturn {\n\t\t\tbackupCodes,\n\t\t\tencryptedBackupCodes: encCodes,\n\t\t};\n\t}\n\tif (\n\t\ttypeof options?.storeBackupCodes === \"object\" &&\n\t\t\"encrypt\" in options?.storeBackupCodes\n\t) {\n\t\treturn {\n\t\t\tbackupCodes,\n\t\t\tencryptedBackupCodes: await options?.storeBackupCodes.encrypt(\n\t\t\t\tJSON.stringify(backupCodes),\n\t\t\t),\n\t\t};\n\t}\n\treturn {\n\t\tbackupCodes,\n\t\tencryptedBackupCodes: JSON.stringify(backupCodes),\n\t};\n}\n\nexport async function verifyBackupCode(\n\tdata: {\n\t\tbackupCodes: string;\n\t\tcode: string;\n\t},\n\tkey: string,\n\toptions?: BackupCodeOptions | undefined,\n) {\n\tconst codes = await getBackupCodes(data.backupCodes, key, options);\n\tif (!codes) {\n\t\treturn {\n\t\t\tstatus: false,\n\t\t\tupdated: null,\n\t\t};\n\t}\n\treturn {\n\t\tstatus: codes.includes(data.code),\n\t\tupdated: codes.filter((code) => code !== data.code),\n\t};\n}\n\nexport async function getBackupCodes(\n\tbackupCodes: string,\n\tkey: string,\n\toptions?: BackupCodeOptions | undefined,\n) {\n\tif (options?.storeBackupCodes === \"encrypted\") {\n\t\tconst decrypted = await symmetricDecrypt({ key, data: backupCodes });\n\t\treturn safeJSONParse<string[]>(decrypted);\n\t}\n\tif (\n\t\ttypeof options?.storeBackupCodes === \"object\" &&\n\t\t\"decrypt\" in options?.storeBackupCodes\n\t) {\n\t\tconst decrypted = await options?.storeBackupCodes.decrypt(backupCodes);\n\t\treturn safeJSONParse<string[]>(decrypted);\n\t}\n\n\treturn safeJSONParse<string[]>(backupCodes);\n}\n\nconst verifyBackupCodeBodySchema = z.object({\n\tcode: z.string().meta({\n\t\tdescription: `A backup code to verify. Eg: \"123456\"`,\n\t}),\n\t/**\n\t * Disable setting the session cookie\n\t */\n\tdisableSession: z\n\t\t.boolean()\n\t\t.meta({\n\t\t\tdescription: \"If true, the session cookie will not be set.\",\n\t\t})\n\t\t.optional(),\n\t/**\n\t * if true, the device will be trusted\n\t * for 30 days. It'll be refreshed on\n\t * every sign in request within this time.\n\t */\n\ttrustDevice: z\n\t\t.boolean()\n\t\t.meta({\n\t\t\tdescription:\n\t\t\t\t\"If true, the device will be trusted for 30 days. It'll be refreshed on every sign in request within this time. Eg: true\",\n\t\t})\n\t\t.optional(),\n});\n\nconst viewBackupCodesBodySchema = z.object({\n\tuserId: z.coerce.string().meta({\n\t\tdescription: `The user ID to view all backup codes. Eg: \"user-id\"`,\n\t}),\n});\n\nconst generateBackupCodesBodySchema = z.object({\n\tpassword: z.string().meta({\n\t\tdescription: \"The users password.\",\n\t}),\n});\n\nexport const backupCode2fa = (opts: BackupCodeOptions) => {\n\tconst twoFactorTable = \"twoFactor\";\n\n\treturn {\n\t\tid: \"backup_code\",\n\t\tendpoints: {\n\t\t\t/**\n\t\t\t * ### Endpoint\n\t\t\t *\n\t\t\t * POST `/two-factor/verify-backup-code`\n\t\t\t *\n\t\t\t * ### API Methods\n\t\t\t *\n\t\t\t * **server:**\n\t\t\t * `auth.api.verifyBackupCode`\n\t\t\t *\n\t\t\t * **client:**\n\t\t\t * `authClient.twoFactor.verifyBackupCode`\n\t\t\t *\n\t\t\t * @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/2fa#api-method-two-factor-verify-backup-code)\n\t\t\t */\n\t\t\tverifyBackupCode: createAuthEndpoint(\n\t\t\t\t\"/two-factor/verify-backup-code\",\n\n\t\t\t\t{\n\t\t\t\t\tmethod: \"POST\",\n\t\t\t\t\tbody: verifyBackupCodeBodySchema,\n\t\t\t\t\tmetadata: {\n\t\t\t\t\t\topenapi: {\n\t\t\t\t\t\t\tdescription: \"Verify a backup code for two-factor authentication\",\n\t\t\t\t\t\t\tresponses: {\n\t\t\t\t\t\t\t\t\"200\": {\n\t\t\t\t\t\t\t\t\tdescription: \"Backup code verified successfully\",\n\t\t\t\t\t\t\t\t\tcontent: {\n\t\t\t\t\t\t\t\t\t\t\"application/json\": {\n\t\t\t\t\t\t\t\t\t\t\tschema: {\n\t\t\t\t\t\t\t\t\t\t\t\ttype: \"object\",\n\t\t\t\t\t\t\t\t\t\t\t\tproperties: {\n\t\t\t\t\t\t\t\t\t\t\t\t\tuser: {\n\t\t\t\t\t\t\t\t\t\t\t\t\t\ttype: \"object\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t\tproperties: {\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\tid: {\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\tdescription: \"Unique identifier of the user\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\temail: {\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\tformat: \"email\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\tnullable: true,\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\tdescription: \"User's email address\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\temailVerified: {\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\ttype: \"boolean\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\tnullable: true,\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\tdescription: \"Whether the email is verified\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\tname: {\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\tnullable: true,\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\tdescription: \"User's name\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\timage: {\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\tformat: \"uri\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\tnullable: true,\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\tdescription: \"User's profile image URL\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\ttwoFactorEnabled: {\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\ttype: \"boolean\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\tdescription:\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"Whether two-factor authentication is enabled for the user\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\tcreatedAt: {\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\tformat: \"date-time\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\tdescription:\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"Timestamp when the user was created\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\tupdatedAt: {\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\tformat: \"date-time\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\tdescription:\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"Timestamp when the user was last updated\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\t\t\t\t\trequired: [\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"id\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"twoFactorEnabled\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"createdAt\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"updatedAt\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t],\n\t\t\t\t\t\t\t\t\t\t\t\t\t\tdescription:\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"The authenticated user object with two-factor details\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\t\t\t\tsession: {\n\t\t\t\t\t\t\t\t\t\t\t\t\t\ttype: \"object\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t\tproperties: {\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\ttoken: {\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\tdescription: \"Session token\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\tuserId: {\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\tdescription:\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"ID of the user associated with the session\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\tcreatedAt: {\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\tformat: \"date-time\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\tdescription:\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"Timestamp when the session was created\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\texpiresAt: {\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\tformat: \"date-time\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\tdescription:\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"Timestamp when the session expires\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\t\t\t\t\trequired: [\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"token\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"userId\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"createdAt\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"expiresAt\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t],\n\t\t\t\t\t\t\t\t\t\t\t\t\t\tdescription:\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"The current session object, included unless disableSession is true\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\t\t\trequired: [\"user\", \"session\"],\n\t\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t},\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t\tasync (ctx) => {\n\t\t\t\t\tconst { session, valid } = await verifyTwoFactor(ctx);\n\t\t\t\t\tconst user = session.user as UserWithTwoFactor;\n\t\t\t\t\tconst twoFactor = await ctx.context.adapter.findOne<TwoFactorTable>({\n\t\t\t\t\t\tmodel: twoFactorTable,\n\t\t\t\t\t\twhere: [\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\tfield: \"userId\",\n\t\t\t\t\t\t\t\tvalue: user.id,\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t],\n\t\t\t\t\t});\n\t\t\t\t\tif (!twoFactor) {\n\t\t\t\t\t\tthrow APIError.from(\n\t\t\t\t\t\t\t\"BAD_REQUEST\",\n\t\t\t\t\t\t\tTWO_FACTOR_ERROR_CODES.BACKUP_CODES_NOT_ENABLED,\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\t\t\t\t\tconst validate = await verifyBackupCode(\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\tbackupCodes: twoFactor.backupCodes,\n\t\t\t\t\t\t\tcode: ctx.body.code,\n\t\t\t\t\t\t},\n\t\t\t\t\t\tctx.context.secret,\n\t\t\t\t\t\topts,\n\t\t\t\t\t);\n\t\t\t\t\tif (!validate.status) {\n\t\t\t\t\t\tthrow APIError.from(\n\t\t\t\t\t\t\t\"UNAUTHORIZED\",\n\t\t\t\t\t\t\tTWO_FACTOR_ERROR_CODES.INVALID_BACKUP_CODE,\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\t\t\t\t\tconst updatedBackupCodes = await symmetricEncrypt({\n\t\t\t\t\t\tkey: ctx.context.secret,\n\t\t\t\t\t\tdata: JSON.stringify(validate.updated),\n\t\t\t\t\t});\n\n\t\t\t\t\tconst updated = await ctx.context.adapter.update({\n\t\t\t\t\t\tmodel: twoFactorTable,\n\t\t\t\t\t\tupdate: {\n\t\t\t\t\t\t\tbackupCodes: updatedBackupCodes,\n\t\t\t\t\t\t},\n\t\t\t\t\t\twhere: [\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\tfield: \"id\",\n\t\t\t\t\t\t\t\tvalue: twoFactor.id,\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\tfield: \"backupCodes\",\n\t\t\t\t\t\t\t\tvalue: twoFactor.backupCodes,\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t],\n\t\t\t\t\t});\n\t\t\t\t\tif (!updated) {\n\t\t\t\t\t\tthrow APIError.fromStatus(\"CONFLICT\", {\n\t\t\t\t\t\t\tmessage: \"Failed to verify backup code. Please try again.\",\n\t\t\t\t\t\t});\n\t\t\t\t\t}\n\n\t\t\t\t\tif (!ctx.body.disableSession) {\n\t\t\t\t\t\treturn valid(ctx);\n\t\t\t\t\t}\n\t\t\t\t\treturn ctx.json({\n\t\t\t\t\t\ttoken: session.session?.token,\n\t\t\t\t\t\tuser: parseUserOutput(ctx.context.options, session.user),\n\t\t\t\t\t});\n\t\t\t\t},\n\t\t\t),\n\t\t\t/**\n\t\t\t * ### Endpoint\n\t\t\t *\n\t\t\t * POST `/two-factor/generate-backup-codes`\n\t\t\t *\n\t\t\t * ### API Methods\n\t\t\t *\n\t\t\t * **server:**\n\t\t\t * `auth.api.generateBackupCodes`\n\t\t\t *\n\t\t\t * **client:**\n\t\t\t * `authClient.twoFactor.generateBackupCodes`\n\t\t\t *\n\t\t\t * @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/2fa#api-method-two-factor-generate-backup-codes)\n\t\t\t */\n\t\t\tgenerateBackupCodes: createAuthEndpoint(\n\t\t\t\t\"/two-factor/generate-backup-codes\",\n\t\t\t\t{\n\t\t\t\t\tmethod: \"POST\",\n\t\t\t\t\tbody: generateBackupCodesBodySchema,\n\t\t\t\t\tuse: [sessionMiddleware],\n\t\t\t\t\tmetadata: {\n\t\t\t\t\t\topenapi: {\n\t\t\t\t\t\t\tdescription:\n\t\t\t\t\t\t\t\t\"Generate new backup codes for two-factor authentication\",\n\t\t\t\t\t\t\tresponses: {\n\t\t\t\t\t\t\t\t\"200\": {\n\t\t\t\t\t\t\t\t\tdescription: \"Backup codes generated successfully\",\n\t\t\t\t\t\t\t\t\tcontent: {\n\t\t\t\t\t\t\t\t\t\t\"application/json\": {\n\t\t\t\t\t\t\t\t\t\t\tschema: {\n\t\t\t\t\t\t\t\t\t\t\t\ttype: \"object\",\n\t\t\t\t\t\t\t\t\t\t\t\tproperties: {\n\t\t\t\t\t\t\t\t\t\t\t\t\tstatus: {\n\t\t\t\t\t\t\t\t\t\t\t\t\t\ttype: \"boolean\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t\tdescription:\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"Indicates if the backup codes were generated successfully\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t\tenum: [true],\n\t\t\t\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\t\t\t\tbackupCodes: {\n\t\t\t\t\t\t\t\t\t\t\t\t\t\ttype: \"array\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t\titems: { type: \"string\" },\n\t\t\t\t\t\t\t\t\t\t\t\t\t\tdescription:\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"Array of generated backup codes in plain text\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\t\t\trequired: [\"status\", \"backupCodes\"],\n\t\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t},\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t\tasync (ctx) => {\n\t\t\t\t\tconst user = ctx.context.session.user as UserWithTwoFactor;\n\t\t\t\t\tif (!user.twoFactorEnabled) {\n\t\t\t\t\t\tthrow APIError.from(\n\t\t\t\t\t\t\t\"BAD_REQUEST\",\n\t\t\t\t\t\t\tTWO_FACTOR_ERROR_CODES.TWO_FACTOR_NOT_ENABLED,\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\t\t\t\t\tawait ctx.context.password.checkPassword(user.id, ctx);\n\n\t\t\t\t\t// First, find the twoFactor record to get its id\n\t\t\t\t\tconst twoFactor = await ctx.context.adapter.findOne<TwoFactorTable>({\n\t\t\t\t\t\tmodel: twoFactorTable,\n\t\t\t\t\t\twhere: [\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\tfield: \"userId\",\n\t\t\t\t\t\t\t\tvalue: user.id,\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t],\n\t\t\t\t\t});\n\n\t\t\t\t\tif (!twoFactor) {\n\t\t\t\t\t\tthrow APIError.from(\n\t\t\t\t\t\t\t\"BAD_REQUEST\",\n\t\t\t\t\t\t\tTWO_FACTOR_ERROR_CODES.TWO_FACTOR_NOT_ENABLED,\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\n\t\t\t\t\tconst backupCodes = await generateBackupCodes(\n\t\t\t\t\t\tctx.context.secret,\n\t\t\t\t\t\topts,\n\t\t\t\t\t);\n\n\t\t\t\t\t// Use the id to update the record\n\t\t\t\t\tawait ctx.context.adapter.update({\n\t\t\t\t\t\tmodel: twoFactorTable,\n\t\t\t\t\t\tupdate: {\n\t\t\t\t\t\t\tbackupCodes: backupCodes.encryptedBackupCodes,\n\t\t\t\t\t\t},\n\t\t\t\t\t\twhere: [\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\tfield: \"id\",\n\t\t\t\t\t\t\t\tvalue: twoFactor.id,\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t],\n\t\t\t\t\t});\n\t\t\t\t\treturn ctx.json({\n\t\t\t\t\t\tstatus: true,\n\t\t\t\t\t\tbackupCodes: backupCodes.backupCodes,\n\t\t\t\t\t});\n\t\t\t\t},\n\t\t\t),\n\t\t\t/**\n\t\t\t * ### Endpoint\n\t\t\t *\n\t\t\t * POST `/two-factor/view-backup-codes`\n\t\t\t *\n\t\t\t * ### API Methods\n\t\t\t *\n\t\t\t * **server:**\n\t\t\t * `auth.api.viewBackupCodes`\n\t\t\t *\n\t\t\t * @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/2fa#api-method-two-factor-view-backup-codes)\n\t\t\t */\n\t\t\tviewBackupCodes: createAuthEndpoint(\n\t\t\t\t{\n\t\t\t\t\tmethod: \"POST\",\n\t\t\t\t\tbody: viewBackupCodesBodySchema,\n\t\t\t\t},\n\t\t\t\tasync (ctx) => {\n\t\t\t\t\tconst twoFactor = await ctx.context.adapter.findOne<TwoFactorTable>({\n\t\t\t\t\t\tmodel: twoFactorTable,\n\t\t\t\t\t\twhere: [\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\tfield: \"userId\",\n\t\t\t\t\t\t\t\tvalue: ctx.body.userId,\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t],\n\t\t\t\t\t});\n\t\t\t\t\tif (!twoFactor) {\n\t\t\t\t\t\tthrow APIError.from(\n\t\t\t\t\t\t\t\"BAD_REQUEST\",\n\t\t\t\t\t\t\tTWO_FACTOR_ERROR_CODES.BACKUP_CODES_NOT_ENABLED,\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\t\t\t\t\tconst decryptedBackupCodes = await getBackupCodes(\n\t\t\t\t\t\ttwoFactor.backupCodes,\n\t\t\t\t\t\tctx.context.secret,\n\t\t\t\t\t\topts,\n\t\t\t\t\t);\n\n\t\t\t\t\tif (!decryptedBackupCodes) {\n\t\t\t\t\t\tthrow APIError.from(\n\t\t\t\t\t\t\t\"BAD_REQUEST\",\n\t\t\t\t\t\t\tTWO_FACTOR_ERROR_CODES.INVALID_BACKUP_CODE,\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\t\t\t\t\treturn ctx.json({\n\t\t\t\t\t\tstatus: true,\n\t\t\t\t\t\tbackupCodes: decryptedBackupCodes,\n\t\t\t\t\t});\n\t\t\t\t},\n\t\t\t),\n\t\t},\n\t} satisfies TwoFactorProvider;\n};\n"],"mappings":";;;;;;;;;;;;;AAgDA,SAAS,sBAAsB,SAAyC;AACvE,QAAO,MAAM,KAAK,EAAE,QAAQ,SAAS,UAAU,IAAI,CAAC,CAClD,KAAK,KAAK,CACV,UAAU,qBAAqB,SAAS,UAAU,IAAI,OAAO,OAAO,MAAM,CAAC,CAC3E,KAAK,SAAS,GAAG,KAAK,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK,MAAM,EAAE,GAAG;;AAGxD,eAAsB,oBACrB,QACA,SACC;CACD,MAAM,cAAc,SAAS,4BAC1B,QAAQ,2BAA2B,GACnC,sBAAsB,QAAQ;AACjC,KAAI,SAAS,qBAAqB,YAKjC,QAAO;EACN;EACA,sBANgB,MAAM,iBAAiB;GACvC,MAAM,KAAK,UAAU,YAAY;GACjC,KAAK;GACL,CAAC;EAID;AAEF,KACC,OAAO,SAAS,qBAAqB,YACrC,aAAa,SAAS,iBAEtB,QAAO;EACN;EACA,sBAAsB,MAAM,SAAS,iBAAiB,QACrD,KAAK,UAAU,YAAY,CAC3B;EACD;AAEF,QAAO;EACN;EACA,sBAAsB,KAAK,UAAU,YAAY;EACjD;;AAGF,eAAsB,iBACrB,MAIA,KACA,SACC;CACD,MAAM,QAAQ,MAAM,eAAe,KAAK,aAAa,KAAK,QAAQ;AAClE,KAAI,CAAC,MACJ,QAAO;EACN,QAAQ;EACR,SAAS;EACT;AAEF,QAAO;EACN,QAAQ,MAAM,SAAS,KAAK,KAAK;EACjC,SAAS,MAAM,QAAQ,SAAS,SAAS,KAAK,KAAK;EACnD;;AAGF,eAAsB,eACrB,aACA,KACA,SACC;AACD,KAAI,SAAS,qBAAqB,YAEjC,QAAO,cADW,MAAM,iBAAiB;EAAE;EAAK,MAAM;EAAa,CAAC,CAC3B;AAE1C,KACC,OAAO,SAAS,qBAAqB,YACrC,aAAa,SAAS,iBAGtB,QAAO,cADW,MAAM,SAAS,iBAAiB,QAAQ,YAAY,CAC7B;AAG1C,QAAO,cAAwB,YAAY;;AAG5C,MAAM,6BAA6B,EAAE,OAAO;CAC3C,MAAM,EAAE,QAAQ,CAAC,KAAK,EACrB,aAAa,yCACb,CAAC;CAIF,gBAAgB,EACd,SAAS,CACT,KAAK,EACL,aAAa,gDACb,CAAC,CACD,UAAU;CAMZ,aAAa,EACX,SAAS,CACT,KAAK,EACL,aACC,2HACD,CAAC,CACD,UAAU;CACZ,CAAC;AAEF,MAAM,4BAA4B,EAAE,OAAO,EAC1C,QAAQ,EAAE,OAAO,QAAQ,CAAC,KAAK,EAC9B,aAAa,uDACb,CAAC,EACF,CAAC;AAEF,MAAM,gCAAgC,EAAE,OAAO,EAC9C,UAAU,EAAE,QAAQ,CAAC,KAAK,EACzB,aAAa,uBACb,CAAC,EACF,CAAC;AAEF,MAAa,iBAAiB,SAA4B;CACzD,MAAM,iBAAiB;AAEvB,QAAO;EACN,IAAI;EACJ,WAAW;GAgBV,kBAAkB,mBACjB,kCAEA;IACC,QAAQ;IACR,MAAM;IACN,UAAU,EACT,SAAS;KACR,aAAa;KACb,WAAW,EACV,OAAO;MACN,aAAa;MACb,SAAS,EACR,oBAAoB,EACnB,QAAQ;OACP,MAAM;OACN,YAAY;QACX,MAAM;SACL,MAAM;SACN,YAAY;UACX,IAAI;WACH,MAAM;WACN,aAAa;WACb;UACD,OAAO;WACN,MAAM;WACN,QAAQ;WACR,UAAU;WACV,aAAa;WACb;UACD,eAAe;WACd,MAAM;WACN,UAAU;WACV,aAAa;WACb;UACD,MAAM;WACL,MAAM;WACN,UAAU;WACV,aAAa;WACb;UACD,OAAO;WACN,MAAM;WACN,QAAQ;WACR,UAAU;WACV,aAAa;WACb;UACD,kBAAkB;WACjB,MAAM;WACN,aACC;WACD;UACD,WAAW;WACV,MAAM;WACN,QAAQ;WACR,aACC;WACD;UACD,WAAW;WACV,MAAM;WACN,QAAQ;WACR,aACC;WACD;UACD;SACD,UAAU;UACT;UACA;UACA;UACA;UACA;SACD,aACC;SACD;QACD,SAAS;SACR,MAAM;SACN,YAAY;UACX,OAAO;WACN,MAAM;WACN,aAAa;WACb;UACD,QAAQ;WACP,MAAM;WACN,aACC;WACD;UACD,WAAW;WACV,MAAM;WACN,QAAQ;WACR,aACC;WACD;UACD,WAAW;WACV,MAAM;WACN,QAAQ;WACR,aACC;WACD;UACD;SACD,UAAU;UACT;UACA;UACA;UACA;UACA;SACD,aACC;SACD;QACD;OACD,UAAU,CAAC,QAAQ,UAAU;OAC7B,EACD,EACD;MACD,EACD;KACD,EACD;IACD,EACD,OAAO,QAAQ;IACd,MAAM,EAAE,SAAS,UAAU,MAAM,gBAAgB,IAAI;IACrD,MAAM,OAAO,QAAQ;IACrB,MAAM,YAAY,MAAM,IAAI,QAAQ,QAAQ,QAAwB;KACnE,OAAO;KACP,OAAO,CACN;MACC,OAAO;MACP,OAAO,KAAK;MACZ,CACD;KACD,CAAC;AACF,QAAI,CAAC,UACJ,OAAM,SAAS,KACd,eACA,uBAAuB,yBACvB;IAEF,MAAM,WAAW,MAAM,iBACtB;KACC,aAAa,UAAU;KACvB,MAAM,IAAI,KAAK;KACf,EACD,IAAI,QAAQ,QACZ,KACA;AACD,QAAI,CAAC,SAAS,OACb,OAAM,SAAS,KACd,gBACA,uBAAuB,oBACvB;IAEF,MAAM,qBAAqB,MAAM,iBAAiB;KACjD,KAAK,IAAI,QAAQ;KACjB,MAAM,KAAK,UAAU,SAAS,QAAQ;KACtC,CAAC;AAkBF,QAAI,CAhBY,MAAM,IAAI,QAAQ,QAAQ,OAAO;KAChD,OAAO;KACP,QAAQ,EACP,aAAa,oBACb;KACD,OAAO,CACN;MACC,OAAO;MACP,OAAO,UAAU;MACjB,EACD;MACC,OAAO;MACP,OAAO,UAAU;MACjB,CACD;KACD,CAAC,CAED,OAAM,SAAS,WAAW,YAAY,EACrC,SAAS,mDACT,CAAC;AAGH,QAAI,CAAC,IAAI,KAAK,eACb,QAAO,MAAM,IAAI;AAElB,WAAO,IAAI,KAAK;KACf,OAAO,QAAQ,SAAS;KACxB,MAAM,gBAAgB,IAAI,QAAQ,SAAS,QAAQ,KAAK;KACxD,CAAC;KAEH;GAgBD,qBAAqB,mBACpB,qCACA;IACC,QAAQ;IACR,MAAM;IACN,KAAK,CAAC,kBAAkB;IACxB,UAAU,EACT,SAAS;KACR,aACC;KACD,WAAW,EACV,OAAO;MACN,aAAa;MACb,SAAS,EACR,oBAAoB,EACnB,QAAQ;OACP,MAAM;OACN,YAAY;QACX,QAAQ;SACP,MAAM;SACN,aACC;SACD,MAAM,CAAC,KAAK;SACZ;QACD,aAAa;SACZ,MAAM;SACN,OAAO,EAAE,MAAM,UAAU;SACzB,aACC;SACD;QACD;OACD,UAAU,CAAC,UAAU,cAAc;OACnC,EACD,EACD;MACD,EACD;KACD,EACD;IACD,EACD,OAAO,QAAQ;IACd,MAAM,OAAO,IAAI,QAAQ,QAAQ;AACjC,QAAI,CAAC,KAAK,iBACT,OAAM,SAAS,KACd,eACA,uBAAuB,uBACvB;AAEF,UAAM,IAAI,QAAQ,SAAS,cAAc,KAAK,IAAI,IAAI;IAGtD,MAAM,YAAY,MAAM,IAAI,QAAQ,QAAQ,QAAwB;KACnE,OAAO;KACP,OAAO,CACN;MACC,OAAO;MACP,OAAO,KAAK;MACZ,CACD;KACD,CAAC;AAEF,QAAI,CAAC,UACJ,OAAM,SAAS,KACd,eACA,uBAAuB,uBACvB;IAGF,MAAM,cAAc,MAAM,oBACzB,IAAI,QAAQ,QACZ,KACA;AAGD,UAAM,IAAI,QAAQ,QAAQ,OAAO;KAChC,OAAO;KACP,QAAQ,EACP,aAAa,YAAY,sBACzB;KACD,OAAO,CACN;MACC,OAAO;MACP,OAAO,UAAU;MACjB,CACD;KACD,CAAC;AACF,WAAO,IAAI,KAAK;KACf,QAAQ;KACR,aAAa,YAAY;KACzB,CAAC;KAEH;GAaD,iBAAiB,mBAChB;IACC,QAAQ;IACR,MAAM;IACN,EACD,OAAO,QAAQ;IACd,MAAM,YAAY,MAAM,IAAI,QAAQ,QAAQ,QAAwB;KACnE,OAAO;KACP,OAAO,CACN;MACC,OAAO;MACP,OAAO,IAAI,KAAK;MAChB,CACD;KACD,CAAC;AACF,QAAI,CAAC,UACJ,OAAM,SAAS,KACd,eACA,uBAAuB,yBACvB;IAEF,MAAM,uBAAuB,MAAM,eAClC,UAAU,aACV,IAAI,QAAQ,QACZ,KACA;AAED,QAAI,CAAC,qBACJ,OAAM,SAAS,KACd,eACA,uBAAuB,oBACvB;AAEF,WAAO,IAAI,KAAK;KACf,QAAQ;KACR,aAAa;KACb,CAAC;KAEH;GACD;EACD"}

package/dist/plugins/two-factor/client.d.mts

@@ -0,0 +1,17 @@
+import { TWO_FACTOR_ERROR_CODES } from "./error-code.mjs";
+import { BackupCodeOptions, backupCode2fa, generateBackupCodes, getBackupCodes, verifyBackupCode } from "./backup-codes/index.mjs";
+import { TOTPOptions, totp2fa } from "./totp/index.mjs";
+import { TwoFactorOptions, TwoFactorProvider, TwoFactorTable, UserWithTwoFactor } from "./types.mjs";
+import { OTPOptions, otp2fa } from "./otp/index.mjs";
+
+//#region src/plugins/two-factor/client.d.ts
+declare const twoFactorClient: (options?: {
+  /**
+   * a redirect function to call if a user needs to verify
+   * their two factor
+   */
+  onTwoFactorRedirect?: () => void | Promise<void>;
+} | undefined) => BetterAuthClientPlugin;
+//#endregion
+export { twoFactorClient };
+//# sourceMappingURL=client.d.mts.map

package/dist/plugins/two-factor/client.mjs

@@ -0,0 +1,37 @@
+import { TWO_FACTOR_ERROR_CODES } from "./error-code.mjs";
+
+//#region src/plugins/two-factor/client.ts
+const twoFactorClient = (options) => {
+	return {
+		id: "two-factor",
+		$InferServerPlugin: {},
+		atomListeners: [{
+			matcher: (path) => path.startsWith("/two-factor/"),
+			signal: "$sessionSignal"
+		}],
+		pathMethods: {
+			"/two-factor/disable": "POST",
+			"/two-factor/enable": "POST",
+			"/two-factor/send-otp": "POST",
+			"/two-factor/generate-backup-codes": "POST",
+			"/two-factor/get-totp-uri": "POST",
+			"/two-factor/verify-totp": "POST",
+			"/two-factor/verify-otp": "POST",
+			"/two-factor/verify-backup-code": "POST"
+		},
+		fetchPlugins: [{
+			id: "two-factor",
+			name: "two-factor",
+			hooks: { async onSuccess(context) {
+				if (context.data?.twoFactorRedirect) {
+					if (options?.onTwoFactorRedirect) await options.onTwoFactorRedirect();
+				}
+			} }
+		}],
+		$ERROR_CODES: TWO_FACTOR_ERROR_CODES
+	};
+};
+
+//#endregion
+export { twoFactorClient };
+//# sourceMappingURL=client.mjs.map

package/dist/plugins/two-factor/client.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.mjs","names":[],"sources":["../../../src/plugins/two-factor/client.ts"],"sourcesContent":["import type { BetterAuthClientPlugin } from \"@better-auth/core\";\nimport type { twoFactor as twoFa } from \".\";\nimport { TWO_FACTOR_ERROR_CODES } from \"./error-code\";\n\nexport * from \"./error-code\";\n\nexport const twoFactorClient = (\n\toptions?:\n\t\t| {\n\t\t\t\t/**\n\t\t\t\t * a redirect function to call if a user needs to verify\n\t\t\t\t * their two factor\n\t\t\t\t */\n\t\t\t\tonTwoFactorRedirect?: () => void | Promise<void>;\n\t\t  }\n\t\t| undefined,\n) => {\n\treturn {\n\t\tid: \"two-factor\",\n\t\t$InferServerPlugin: {} as ReturnType<typeof twoFa>,\n\t\tatomListeners: [\n\t\t\t{\n\t\t\t\tmatcher: (path) => path.startsWith(\"/two-factor/\"),\n\t\t\t\tsignal: \"$sessionSignal\",\n\t\t\t},\n\t\t],\n\t\tpathMethods: {\n\t\t\t\"/two-factor/disable\": \"POST\",\n\t\t\t\"/two-factor/enable\": \"POST\",\n\t\t\t\"/two-factor/send-otp\": \"POST\",\n\t\t\t\"/two-factor/generate-backup-codes\": \"POST\",\n\t\t\t\"/two-factor/get-totp-uri\": \"POST\",\n\t\t\t\"/two-factor/verify-totp\": \"POST\",\n\t\t\t\"/two-factor/verify-otp\": \"POST\",\n\t\t\t\"/two-factor/verify-backup-code\": \"POST\",\n\t\t},\n\t\tfetchPlugins: [\n\t\t\t{\n\t\t\t\tid: \"two-factor\",\n\t\t\t\tname: \"two-factor\",\n\t\t\t\thooks: {\n\t\t\t\t\tasync onSuccess(context) {\n\t\t\t\t\t\tif (context.data?.twoFactorRedirect) {\n\t\t\t\t\t\t\tif (options?.onTwoFactorRedirect) {\n\t\t\t\t\t\t\t\tawait options.onTwoFactorRedirect();\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t},\n\t\t],\n\t\t$ERROR_CODES: TWO_FACTOR_ERROR_CODES,\n\t} satisfies BetterAuthClientPlugin;\n};\n\nexport type * from \"./backup-codes\";\nexport type * from \"./otp\";\nexport type * from \"./totp\";\nexport type * from \"./types\";\n"],"mappings":";;;AAMA,MAAa,mBACZ,YASI;AACJ,QAAO;EACN,IAAI;EACJ,oBAAoB,EAAE;EACtB,eAAe,CACd;GACC,UAAU,SAAS,KAAK,WAAW,eAAe;GAClD,QAAQ;GACR,CACD;EACD,aAAa;GACZ,uBAAuB;GACvB,sBAAsB;GACtB,wBAAwB;GACxB,qCAAqC;GACrC,4BAA4B;GAC5B,2BAA2B;GAC3B,0BAA0B;GAC1B,kCAAkC;GAClC;EACD,cAAc,CACb;GACC,IAAI;GACJ,MAAM;GACN,OAAO,EACN,MAAM,UAAU,SAAS;AACxB,QAAI,QAAQ,MAAM,mBACjB;SAAI,SAAS,oBACZ,OAAM,QAAQ,qBAAqB;;MAItC;GACD,CACD;EACD,cAAc;EACd"}

package/dist/plugins/two-factor/constant.mjs

@@ -0,0 +1,8 @@
+//#region src/plugins/two-factor/constant.ts
+const TWO_FACTOR_COOKIE_NAME = "two_factor";
+const TRUST_DEVICE_COOKIE_NAME = "trust_device";
+const TRUST_DEVICE_COOKIE_MAX_AGE = 720 * 60 * 60;
+
+//#endregion
+export { TRUST_DEVICE_COOKIE_MAX_AGE, TRUST_DEVICE_COOKIE_NAME, TWO_FACTOR_COOKIE_NAME };
+//# sourceMappingURL=constant.mjs.map

package/dist/plugins/two-factor/constant.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"constant.mjs","names":[],"sources":["../../../src/plugins/two-factor/constant.ts"],"sourcesContent":["export const TWO_FACTOR_COOKIE_NAME = \"two_factor\";\nexport const TRUST_DEVICE_COOKIE_NAME = \"trust_device\";\nexport const TRUST_DEVICE_COOKIE_MAX_AGE = 30 * 24 * 60 * 60; // 30 days\n"],"mappings":";AAAA,MAAa,yBAAyB;AACtC,MAAa,2BAA2B;AACxC,MAAa,8BAA8B,MAAU,KAAK"}

package/dist/plugins/two-factor/error-code.d.mts

@@ -0,0 +1,5 @@
+//#region src/plugins/two-factor/error-code.d.ts
+declare const TWO_FACTOR_ERROR_CODES: any;
+//#endregion
+export { TWO_FACTOR_ERROR_CODES };
+//# sourceMappingURL=error-code.d.mts.map

package/dist/plugins/two-factor/error-code.mjs

@@ -0,0 +1,18 @@
+import { defineErrorCodes } from "@better-auth/core/utils/error-codes";
+
+//#region src/plugins/two-factor/error-code.ts
+const TWO_FACTOR_ERROR_CODES = defineErrorCodes({
+	OTP_NOT_ENABLED: "OTP not enabled",
+	OTP_HAS_EXPIRED: "OTP has expired",
+	TOTP_NOT_ENABLED: "TOTP not enabled",
+	TWO_FACTOR_NOT_ENABLED: "Two factor isn't enabled",
+	BACKUP_CODES_NOT_ENABLED: "Backup codes aren't enabled",
+	INVALID_BACKUP_CODE: "Invalid backup code",
+	INVALID_CODE: "Invalid code",
+	TOO_MANY_ATTEMPTS_REQUEST_NEW_CODE: "Too many attempts. Please request a new code.",
+	INVALID_TWO_FACTOR_COOKIE: "Invalid two factor cookie"
+});
+
+//#endregion
+export { TWO_FACTOR_ERROR_CODES };
+//# sourceMappingURL=error-code.mjs.map

package/dist/plugins/two-factor/error-code.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-code.mjs","names":[],"sources":["../../../src/plugins/two-factor/error-code.ts"],"sourcesContent":["import { defineErrorCodes } from \"@better-auth/core/utils/error-codes\";\n\nexport const TWO_FACTOR_ERROR_CODES = defineErrorCodes({\n\tOTP_NOT_ENABLED: \"OTP not enabled\",\n\tOTP_HAS_EXPIRED: \"OTP has expired\",\n\tTOTP_NOT_ENABLED: \"TOTP not enabled\",\n\tTWO_FACTOR_NOT_ENABLED: \"Two factor isn't enabled\",\n\tBACKUP_CODES_NOT_ENABLED: \"Backup codes aren't enabled\",\n\tINVALID_BACKUP_CODE: \"Invalid backup code\",\n\tINVALID_CODE: \"Invalid code\",\n\tTOO_MANY_ATTEMPTS_REQUEST_NEW_CODE:\n\t\t\"Too many attempts. Please request a new code.\",\n\tINVALID_TWO_FACTOR_COOKIE: \"Invalid two factor cookie\",\n});\n"],"mappings":";;;AAEA,MAAa,yBAAyB,iBAAiB;CACtD,iBAAiB;CACjB,iBAAiB;CACjB,kBAAkB;CAClB,wBAAwB;CACxB,0BAA0B;CAC1B,qBAAqB;CACrB,cAAc;CACd,oCACC;CACD,2BAA2B;CAC3B,CAAC"}

package/dist/plugins/two-factor/index.d.mts

@@ -0,0 +1,19 @@
+import { TWO_FACTOR_ERROR_CODES } from "./error-code.mjs";
+import { BackupCodeOptions, backupCode2fa, generateBackupCodes, getBackupCodes, verifyBackupCode } from "./backup-codes/index.mjs";
+import { TOTPOptions, totp2fa } from "./totp/index.mjs";
+import { TwoFactorOptions, TwoFactorProvider, TwoFactorTable, UserWithTwoFactor } from "./types.mjs";
+import { OTPOptions, otp2fa } from "./otp/index.mjs";
+import { twoFactorClient } from "./client.mjs";
+
+//#region src/plugins/two-factor/index.d.ts
+declare module "@better-auth/core" {
+  interface BetterAuthPluginRegistry<AuthOptions, Options> {
+    "two-factor": {
+      creator: typeof twoFactor;
+    };
+  }
+}
+declare const twoFactor: <O extends TwoFactorOptions>(options?: O) => BetterAuthPlugin;
+//#endregion
+export { BackupCodeOptions, OTPOptions, TOTPOptions, TWO_FACTOR_ERROR_CODES, TwoFactorOptions, TwoFactorProvider, TwoFactorTable, UserWithTwoFactor, backupCode2fa, generateBackupCodes, getBackupCodes, otp2fa, totp2fa, twoFactor, twoFactorClient, verifyBackupCode };
+//# sourceMappingURL=index.d.mts.map