@hammadj/better-auth 1.5.0-beta.9

package/dist/plugins/phone-number/client.d.mts

@@ -0,0 +1,8 @@
+import { PHONE_NUMBER_ERROR_CODES } from "./error-codes.mjs";
+import { PhoneNumberOptions, UserWithPhoneNumber } from "./types.mjs";
+
+//#region src/plugins/phone-number/client.d.ts
+declare const phoneNumberClient: () => BetterAuthClientPlugin;
+//#endregion
+export { phoneNumberClient };
+//# sourceMappingURL=client.d.mts.map

package/dist/plugins/phone-number/client.mjs

@@ -0,0 +1,20 @@
+import { PHONE_NUMBER_ERROR_CODES } from "./error-codes.mjs";
+
+//#region src/plugins/phone-number/client.ts
+const phoneNumberClient = () => {
+	return {
+		id: "phoneNumber",
+		$InferServerPlugin: {},
+		atomListeners: [{
+			matcher(path) {
+				return path === "/phone-number/update" || path === "/phone-number/verify" || path === "/sign-in/phone-number";
+			},
+			signal: "$sessionSignal"
+		}],
+		$ERROR_CODES: PHONE_NUMBER_ERROR_CODES
+	};
+};
+
+//#endregion
+export { phoneNumberClient };
+//# sourceMappingURL=client.mjs.map

package/dist/plugins/phone-number/client.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.mjs","names":[],"sources":["../../../src/plugins/phone-number/client.ts"],"sourcesContent":["import type { BetterAuthClientPlugin } from \"@better-auth/core\";\nimport type { phoneNumber } from \".\";\n\nimport { PHONE_NUMBER_ERROR_CODES } from \"./error-codes\";\n\nexport * from \"./error-codes\";\n\nexport const phoneNumberClient = () => {\n\treturn {\n\t\tid: \"phoneNumber\",\n\t\t$InferServerPlugin: {} as ReturnType<typeof phoneNumber>,\n\t\tatomListeners: [\n\t\t\t{\n\t\t\t\tmatcher(path) {\n\t\t\t\t\treturn (\n\t\t\t\t\t\tpath === \"/phone-number/update\" ||\n\t\t\t\t\t\tpath === \"/phone-number/verify\" ||\n\t\t\t\t\t\tpath === \"/sign-in/phone-number\"\n\t\t\t\t\t);\n\t\t\t\t},\n\t\t\t\tsignal: \"$sessionSignal\",\n\t\t\t},\n\t\t],\n\t\t$ERROR_CODES: PHONE_NUMBER_ERROR_CODES,\n\t} satisfies BetterAuthClientPlugin;\n};\n\nexport type * from \"./types\";\n"],"mappings":";;;AAOA,MAAa,0BAA0B;AACtC,QAAO;EACN,IAAI;EACJ,oBAAoB,EAAE;EACtB,eAAe,CACd;GACC,QAAQ,MAAM;AACb,WACC,SAAS,0BACT,SAAS,0BACT,SAAS;;GAGX,QAAQ;GACR,CACD;EACD,cAAc;EACd"}

package/dist/plugins/phone-number/error-codes.d.mts

@@ -0,0 +1,5 @@
+//#region src/plugins/phone-number/error-codes.d.ts
+declare const PHONE_NUMBER_ERROR_CODES: any;
+//#endregion
+export { PHONE_NUMBER_ERROR_CODES };
+//# sourceMappingURL=error-codes.d.mts.map

package/dist/plugins/phone-number/error-codes.mjs

@@ -0,0 +1,21 @@
+import { defineErrorCodes } from "@better-auth/core/utils/error-codes";
+
+//#region src/plugins/phone-number/error-codes.ts
+const PHONE_NUMBER_ERROR_CODES = defineErrorCodes({
+	INVALID_PHONE_NUMBER: "Invalid phone number",
+	PHONE_NUMBER_EXIST: "Phone number already exists",
+	PHONE_NUMBER_NOT_EXIST: "phone number isn't registered",
+	INVALID_PHONE_NUMBER_OR_PASSWORD: "Invalid phone number or password",
+	UNEXPECTED_ERROR: "Unexpected error",
+	OTP_NOT_FOUND: "OTP not found",
+	OTP_EXPIRED: "OTP expired",
+	INVALID_OTP: "Invalid OTP",
+	PHONE_NUMBER_NOT_VERIFIED: "Phone number not verified",
+	PHONE_NUMBER_CANNOT_BE_UPDATED: "Phone number cannot be updated",
+	SEND_OTP_NOT_IMPLEMENTED: "sendOTP not implemented",
+	TOO_MANY_ATTEMPTS: "Too many attempts"
+});
+
+//#endregion
+export { PHONE_NUMBER_ERROR_CODES };
+//# sourceMappingURL=error-codes.mjs.map

package/dist/plugins/phone-number/error-codes.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-codes.mjs","names":[],"sources":["../../../src/plugins/phone-number/error-codes.ts"],"sourcesContent":["import { defineErrorCodes } from \"@better-auth/core/utils/error-codes\";\n\nexport const PHONE_NUMBER_ERROR_CODES = defineErrorCodes({\n\tINVALID_PHONE_NUMBER: \"Invalid phone number\",\n\tPHONE_NUMBER_EXIST: \"Phone number already exists\",\n\tPHONE_NUMBER_NOT_EXIST: \"phone number isn't registered\",\n\tINVALID_PHONE_NUMBER_OR_PASSWORD: \"Invalid phone number or password\",\n\tUNEXPECTED_ERROR: \"Unexpected error\",\n\tOTP_NOT_FOUND: \"OTP not found\",\n\tOTP_EXPIRED: \"OTP expired\",\n\tINVALID_OTP: \"Invalid OTP\",\n\tPHONE_NUMBER_NOT_VERIFIED: \"Phone number not verified\",\n\tPHONE_NUMBER_CANNOT_BE_UPDATED: \"Phone number cannot be updated\",\n\tSEND_OTP_NOT_IMPLEMENTED: \"sendOTP not implemented\",\n\tTOO_MANY_ATTEMPTS: \"Too many attempts\",\n});\n"],"mappings":";;;AAEA,MAAa,2BAA2B,iBAAiB;CACxD,sBAAsB;CACtB,oBAAoB;CACpB,wBAAwB;CACxB,kCAAkC;CAClC,kBAAkB;CAClB,eAAe;CACf,aAAa;CACb,aAAa;CACb,2BAA2B;CAC3B,gCAAgC;CAChC,0BAA0B;CAC1B,mBAAmB;CACnB,CAAC"}

package/dist/plugins/phone-number/index.d.mts

@@ -0,0 +1,14 @@
+import { PhoneNumberOptions, UserWithPhoneNumber } from "./types.mjs";
+
+//#region src/plugins/phone-number/index.d.ts
+declare module "@better-auth/core" {
+  interface BetterAuthPluginRegistry<AuthOptions, Options> {
+    "phone-number": {
+      creator: typeof phoneNumber;
+    };
+  }
+}
+declare const phoneNumber: (options?: PhoneNumberOptions | undefined) => BetterAuthPlugin;
+//#endregion
+export { type PhoneNumberOptions, type UserWithPhoneNumber, phoneNumber };
+//# sourceMappingURL=index.d.mts.map

package/dist/plugins/phone-number/index.mjs

@@ -0,0 +1,49 @@
+import { mergeSchema } from "../../db/schema.mjs";
+import { PHONE_NUMBER_ERROR_CODES } from "./error-codes.mjs";
+import { requestPasswordResetPhoneNumber, resetPasswordPhoneNumber, sendPhoneNumberOTP, signInPhoneNumber, verifyPhoneNumber } from "./routes.mjs";
+import { schema } from "./schema.mjs";
+import { APIError } from "@better-auth/core/error";
+import { createAuthMiddleware } from "@better-auth/core/api";
+
+//#region src/plugins/phone-number/index.ts
+const phoneNumber = (options) => {
+	const opts = {
+		expiresIn: options?.expiresIn || 300,
+		otpLength: options?.otpLength || 6,
+		...options,
+		phoneNumber: "phoneNumber",
+		phoneNumberVerified: "phoneNumberVerified",
+		code: "code",
+		createdAt: "createdAt"
+	};
+	return {
+		id: "phone-number",
+		hooks: { before: [{
+			matcher: (ctx) => ctx.path === "/update-user" && "phoneNumber" in ctx.body,
+			handler: createAuthMiddleware(async (_ctx) => {
+				throw APIError.from("BAD_REQUEST", PHONE_NUMBER_ERROR_CODES.PHONE_NUMBER_CANNOT_BE_UPDATED);
+			})
+		}] },
+		endpoints: {
+			signInPhoneNumber: signInPhoneNumber(opts),
+			sendPhoneNumberOTP: sendPhoneNumberOTP(opts),
+			verifyPhoneNumber: verifyPhoneNumber(opts),
+			requestPasswordResetPhoneNumber: requestPasswordResetPhoneNumber(opts),
+			resetPasswordPhoneNumber: resetPasswordPhoneNumber(opts)
+		},
+		schema: mergeSchema(schema, options?.schema),
+		rateLimit: [{
+			pathMatcher(path) {
+				return path.startsWith("/phone-number");
+			},
+			window: 60 * 1e3,
+			max: 10
+		}],
+		options,
+		$ERROR_CODES: PHONE_NUMBER_ERROR_CODES
+	};
+};
+
+//#endregion
+export { phoneNumber };
+//# sourceMappingURL=index.mjs.map

package/dist/plugins/phone-number/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../src/plugins/phone-number/index.ts"],"sourcesContent":["import type { BetterAuthPlugin } from \"@better-auth/core\";\nimport { createAuthMiddleware } from \"@better-auth/core/api\";\nimport { APIError } from \"@better-auth/core/error\";\nimport { mergeSchema } from \"../../db/schema\";\nimport { PHONE_NUMBER_ERROR_CODES } from \"./error-codes\";\nimport type { RequiredPhoneNumberOptions } from \"./routes\";\nimport {\n\trequestPasswordResetPhoneNumber,\n\tresetPasswordPhoneNumber,\n\tsendPhoneNumberOTP,\n\tsignInPhoneNumber,\n\tverifyPhoneNumber,\n} from \"./routes\";\nimport { schema } from \"./schema\";\nimport type { PhoneNumberOptions, UserWithPhoneNumber } from \"./types\";\n\nexport type { PhoneNumberOptions, UserWithPhoneNumber };\n\ndeclare module \"@better-auth/core\" {\n\tinterface BetterAuthPluginRegistry<AuthOptions, Options> {\n\t\t\"phone-number\": {\n\t\t\tcreator: typeof phoneNumber;\n\t\t};\n\t}\n}\n\nexport const phoneNumber = (options?: PhoneNumberOptions | undefined) => {\n\tconst opts = {\n\t\texpiresIn: options?.expiresIn || 300,\n\t\totpLength: options?.otpLength || 6,\n\t\t...options,\n\t\tphoneNumber: \"phoneNumber\",\n\t\tphoneNumberVerified: \"phoneNumberVerified\",\n\t\tcode: \"code\",\n\t\tcreatedAt: \"createdAt\",\n\t};\n\n\treturn {\n\t\tid: \"phone-number\",\n\t\thooks: {\n\t\t\tbefore: [\n\t\t\t\t{\n\t\t\t\t\t// Stop any requests attempting to update the user's phone number\n\t\t\t\t\tmatcher: (ctx) =>\n\t\t\t\t\t\tctx.path === \"/update-user\" && \"phoneNumber\" in ctx.body,\n\t\t\t\t\thandler: createAuthMiddleware(async (_ctx) => {\n\t\t\t\t\t\tthrow APIError.from(\n\t\t\t\t\t\t\t\"BAD_REQUEST\",\n\t\t\t\t\t\t\tPHONE_NUMBER_ERROR_CODES.PHONE_NUMBER_CANNOT_BE_UPDATED,\n\t\t\t\t\t\t);\n\t\t\t\t\t}),\n\t\t\t\t},\n\t\t\t],\n\t\t},\n\t\tendpoints: {\n\t\t\tsignInPhoneNumber: signInPhoneNumber(opts as RequiredPhoneNumberOptions),\n\t\t\tsendPhoneNumberOTP: sendPhoneNumberOTP(\n\t\t\t\topts as RequiredPhoneNumberOptions,\n\t\t\t),\n\t\t\tverifyPhoneNumber: verifyPhoneNumber(opts as RequiredPhoneNumberOptions),\n\t\t\trequestPasswordResetPhoneNumber: requestPasswordResetPhoneNumber(\n\t\t\t\topts as RequiredPhoneNumberOptions,\n\t\t\t),\n\t\t\tresetPasswordPhoneNumber: resetPasswordPhoneNumber(\n\t\t\t\topts as RequiredPhoneNumberOptions,\n\t\t\t),\n\t\t},\n\t\tschema: mergeSchema(schema, options?.schema),\n\t\trateLimit: [\n\t\t\t{\n\t\t\t\tpathMatcher(path) {\n\t\t\t\t\treturn path.startsWith(\"/phone-number\");\n\t\t\t\t},\n\t\t\t\twindow: 60 * 1000,\n\t\t\t\tmax: 10,\n\t\t\t},\n\t\t],\n\t\toptions,\n\t\t$ERROR_CODES: PHONE_NUMBER_ERROR_CODES,\n\t} satisfies BetterAuthPlugin;\n};\n"],"mappings":";;;;;;;;AA0BA,MAAa,eAAe,YAA6C;CACxE,MAAM,OAAO;EACZ,WAAW,SAAS,aAAa;EACjC,WAAW,SAAS,aAAa;EACjC,GAAG;EACH,aAAa;EACb,qBAAqB;EACrB,MAAM;EACN,WAAW;EACX;AAED,QAAO;EACN,IAAI;EACJ,OAAO,EACN,QAAQ,CACP;GAEC,UAAU,QACT,IAAI,SAAS,kBAAkB,iBAAiB,IAAI;GACrD,SAAS,qBAAqB,OAAO,SAAS;AAC7C,UAAM,SAAS,KACd,eACA,yBAAyB,+BACzB;KACA;GACF,CACD,EACD;EACD,WAAW;GACV,mBAAmB,kBAAkB,KAAmC;GACxE,oBAAoB,mBACnB,KACA;GACD,mBAAmB,kBAAkB,KAAmC;GACxE,iCAAiC,gCAChC,KACA;GACD,0BAA0B,yBACzB,KACA;GACD;EACD,QAAQ,YAAY,QAAQ,SAAS,OAAO;EAC5C,WAAW,CACV;GACC,YAAY,MAAM;AACjB,WAAO,KAAK,WAAW,gBAAgB;;GAExC,QAAQ,KAAK;GACb,KAAK;GACL,CACD;EACD;EACA,cAAc;EACd"}

package/dist/plugins/phone-number/routes.mjs

@@ -0,0 +1,459 @@
+import { generateRandomString } from "../../crypto/random.mjs";
+import { parseUserOutput } from "../../db/schema.mjs";
+import { getDate } from "../../utils/date.mjs";
+import { setSessionCookie } from "../../cookies/index.mjs";
+import { getSessionFromCtx } from "../../api/routes/session.mjs";
+import "../../api/index.mjs";
+import { PHONE_NUMBER_ERROR_CODES } from "./error-codes.mjs";
+import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
+import { createAuthEndpoint } from "@better-auth/core/api";
+import * as z from "zod";
+
+//#region src/plugins/phone-number/routes.ts
+const signInPhoneNumberBodySchema = z.object({
+	phoneNumber: z.string().meta({ description: "Phone number to sign in. Eg: \"+1234567890\"" }),
+	password: z.string().meta({ description: "Password to use for sign in." }),
+	rememberMe: z.boolean().meta({ description: "Remember the session. Eg: true" }).optional()
+});
+/**
+* ### Endpoint
+*
+* POST `/sign-in/phone-number`
+*
+* ### API Methods
+*
+* **server:**
+* `auth.api.signInPhoneNumber`
+*
+* **client:**
+* `authClient.signIn.phoneNumber`
+*
+* @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/phone-number#api-method-sign-in-phone-number)
+*/
+const signInPhoneNumber = (opts) => createAuthEndpoint("/sign-in/phone-number", {
+	method: "POST",
+	body: signInPhoneNumberBodySchema,
+	metadata: { openapi: {
+		summary: "Sign in with phone number",
+		description: "Use this endpoint to sign in with phone number",
+		responses: {
+			200: {
+				description: "Success",
+				content: { "application/json": { schema: {
+					type: "object",
+					properties: {
+						user: { $ref: "#/components/schemas/User" },
+						session: { $ref: "#/components/schemas/Session" }
+					}
+				} } }
+			},
+			400: { description: "Invalid phone number or password" }
+		}
+	} }
+}, async (ctx) => {
+	const { password, phoneNumber } = ctx.body;
+	if (opts.phoneNumberValidator) {
+		if (!await opts.phoneNumberValidator(ctx.body.phoneNumber)) throw APIError.from("BAD_REQUEST", PHONE_NUMBER_ERROR_CODES.INVALID_PHONE_NUMBER);
+	}
+	const user = await ctx.context.adapter.findOne({
+		model: "user",
+		where: [{
+			field: "phoneNumber",
+			value: phoneNumber
+		}]
+	});
+	if (!user) throw APIError.from("UNAUTHORIZED", PHONE_NUMBER_ERROR_CODES.INVALID_PHONE_NUMBER_OR_PASSWORD);
+	if (opts.requireVerification) {
+		if (!user.phoneNumberVerified) {
+			const otp = generateOTP(opts.otpLength);
+			await ctx.context.internalAdapter.createVerificationValue({
+				value: otp,
+				identifier: phoneNumber,
+				expiresAt: getDate(opts.expiresIn, "sec")
+			});
+			if (opts.sendOTP) await ctx.context.runInBackgroundOrAwait(opts.sendOTP({
+				phoneNumber,
+				code: otp
+			}, ctx));
+			throw APIError.from("UNAUTHORIZED", PHONE_NUMBER_ERROR_CODES.PHONE_NUMBER_NOT_VERIFIED);
+		}
+	}
+	const credentialAccount = (await ctx.context.internalAdapter.findAccountByUserId(user.id)).find((a) => a.providerId === "credential");
+	if (!credentialAccount) {
+		ctx.context.logger.error("Credential account not found", { phoneNumber });
+		throw APIError.from("UNAUTHORIZED", PHONE_NUMBER_ERROR_CODES.INVALID_PHONE_NUMBER_OR_PASSWORD);
+	}
+	const currentPassword = credentialAccount?.password;
+	if (!currentPassword) {
+		ctx.context.logger.error("Password not found", { phoneNumber });
+		throw APIError.from("UNAUTHORIZED", PHONE_NUMBER_ERROR_CODES.UNEXPECTED_ERROR);
+	}
+	if (!await ctx.context.password.verify({
+		hash: currentPassword,
+		password
+	})) {
+		ctx.context.logger.error("Invalid password");
+		throw APIError.from("UNAUTHORIZED", PHONE_NUMBER_ERROR_CODES.INVALID_PHONE_NUMBER_OR_PASSWORD);
+	}
+	const session = await ctx.context.internalAdapter.createSession(user.id, ctx.body.rememberMe === false);
+	if (!session) {
+		ctx.context.logger.error("Failed to create session");
+		throw APIError.from("UNAUTHORIZED", BASE_ERROR_CODES.FAILED_TO_CREATE_SESSION);
+	}
+	await setSessionCookie(ctx, {
+		session,
+		user
+	}, ctx.body.rememberMe === false);
+	return ctx.json({
+		token: session.token,
+		user: parseUserOutput(ctx.context.options, user)
+	});
+});
+const sendPhoneNumberOTPBodySchema = z.object({ phoneNumber: z.string().meta({ description: "Phone number to send OTP. Eg: \"+1234567890\"" }) });
+/**
+* ### Endpoint
+*
+* POST `/phone-number/send-otp`
+*
+* ### API Methods
+*
+* **server:**
+* `auth.api.sendPhoneNumberOTP`
+*
+* **client:**
+* `authClient.phoneNumber.sendOtp`
+*
+* @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/phone-number#api-method-phone-number-send-otp)
+*/
+const sendPhoneNumberOTP = (opts) => createAuthEndpoint("/phone-number/send-otp", {
+	method: "POST",
+	body: sendPhoneNumberOTPBodySchema,
+	metadata: { openapi: {
+		summary: "Send OTP to phone number",
+		description: "Use this endpoint to send OTP to phone number",
+		responses: { 200: {
+			description: "Success",
+			content: { "application/json": { schema: {
+				type: "object",
+				properties: { message: { type: "string" } }
+			} } }
+		} }
+	} }
+}, async (ctx) => {
+	if (!opts?.sendOTP) {
+		ctx.context.logger.warn("sendOTP not implemented");
+		throw APIError.from("NOT_IMPLEMENTED", PHONE_NUMBER_ERROR_CODES.SEND_OTP_NOT_IMPLEMENTED);
+	}
+	if (opts.phoneNumberValidator) {
+		if (!await opts.phoneNumberValidator(ctx.body.phoneNumber)) throw APIError.from("BAD_REQUEST", PHONE_NUMBER_ERROR_CODES.INVALID_PHONE_NUMBER);
+	}
+	const code = generateOTP(opts.otpLength);
+	await ctx.context.internalAdapter.createVerificationValue({
+		value: `${code}:0`,
+		identifier: ctx.body.phoneNumber,
+		expiresAt: getDate(opts.expiresIn, "sec")
+	});
+	await ctx.context.runInBackgroundOrAwait(opts.sendOTP({
+		phoneNumber: ctx.body.phoneNumber,
+		code
+	}, ctx));
+	return ctx.json({ message: "code sent" });
+});
+const verifyPhoneNumberBodySchema = z.object({
+	phoneNumber: z.string().meta({ description: "Phone number to verify. Eg: \"+1234567890\"" }),
+	code: z.string().meta({ description: "OTP code. Eg: \"123456\"" }),
+	disableSession: z.boolean().meta({ description: "Disable session creation after verification. Eg: false" }).optional(),
+	updatePhoneNumber: z.boolean().meta({ description: "Check if there is a session and update the phone number. Eg: true" }).optional()
+});
+/**
+* ### Endpoint
+*
+* POST `/phone-number/verify`
+*
+* ### API Methods
+*
+* **server:**
+* `auth.api.verifyPhoneNumber`
+*
+* **client:**
+* `authClient.phoneNumber.verify`
+*
+* @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/phone-number#api-method-phone-number-verify)
+*/
+const verifyPhoneNumber = (opts) => createAuthEndpoint("/phone-number/verify", {
+	method: "POST",
+	body: verifyPhoneNumberBodySchema,
+	metadata: { openapi: {
+		summary: "Verify phone number",
+		description: "Use this endpoint to verify phone number",
+		responses: {
+			"200": {
+				description: "Phone number verified successfully",
+				content: { "application/json": { schema: {
+					type: "object",
+					properties: {
+						status: {
+							type: "boolean",
+							description: "Indicates if the verification was successful",
+							enum: [true]
+						},
+						token: {
+							type: "string",
+							nullable: true,
+							description: "Session token if session is created, null if disableSession is true or no session is created"
+						},
+						user: {
+							type: "object",
+							nullable: true,
+							properties: {
+								id: {
+									type: "string",
+									description: "Unique identifier of the user"
+								},
+								email: {
+									type: "string",
+									format: "email",
+									nullable: true,
+									description: "User's email address"
+								},
+								emailVerified: {
+									type: "boolean",
+									nullable: true,
+									description: "Whether the email is verified"
+								},
+								name: {
+									type: "string",
+									nullable: true,
+									description: "User's name"
+								},
+								image: {
+									type: "string",
+									format: "uri",
+									nullable: true,
+									description: "User's profile image URL"
+								},
+								phoneNumber: {
+									type: "string",
+									description: "User's phone number"
+								},
+								phoneNumberVerified: {
+									type: "boolean",
+									description: "Whether the phone number is verified"
+								},
+								createdAt: {
+									type: "string",
+									format: "date-time",
+									description: "Timestamp when the user was created"
+								},
+								updatedAt: {
+									type: "string",
+									format: "date-time",
+									description: "Timestamp when the user was last updated"
+								}
+							},
+							required: [
+								"id",
+								"phoneNumber",
+								"phoneNumberVerified",
+								"createdAt",
+								"updatedAt"
+							],
+							description: "User object with phone number details, null if no user is created or found"
+						}
+					},
+					required: ["status"]
+				} } }
+			},
+			400: { description: "Invalid OTP" }
+		}
+	} }
+}, async (ctx) => {
+	if (opts?.verifyOTP) {
+		if (!await opts.verifyOTP({
+			phoneNumber: ctx.body.phoneNumber,
+			code: ctx.body.code
+		}, ctx)) throw APIError.from("BAD_REQUEST", PHONE_NUMBER_ERROR_CODES.INVALID_OTP);
+		const otp = await ctx.context.internalAdapter.findVerificationValue(ctx.body.phoneNumber);
+		if (otp) await ctx.context.internalAdapter.deleteVerificationValue(otp.id);
+	} else {
+		const otp = await ctx.context.internalAdapter.findVerificationValue(ctx.body.phoneNumber);
+		if (!otp || otp.expiresAt < /* @__PURE__ */ new Date()) {
+			if (otp && otp.expiresAt < /* @__PURE__ */ new Date()) throw APIError.from("BAD_REQUEST", PHONE_NUMBER_ERROR_CODES.OTP_EXPIRED);
+			throw APIError.from("BAD_REQUEST", PHONE_NUMBER_ERROR_CODES.OTP_NOT_FOUND);
+		}
+		const [otpValue, attempts] = otp.value.split(":");
+		const allowedAttempts = opts?.allowedAttempts || 3;
+		if (attempts && parseInt(attempts) >= allowedAttempts) {
+			await ctx.context.internalAdapter.deleteVerificationValue(otp.id);
+			throw APIError.from("FORBIDDEN", PHONE_NUMBER_ERROR_CODES.TOO_MANY_ATTEMPTS);
+		}
+		if (otpValue !== ctx.body.code) {
+			await ctx.context.internalAdapter.updateVerificationValue(otp.id, { value: `${otpValue}:${parseInt(attempts || "0") + 1}` });
+			throw APIError.from("BAD_REQUEST", PHONE_NUMBER_ERROR_CODES.INVALID_OTP);
+		}
+		await ctx.context.internalAdapter.deleteVerificationValue(otp.id);
+	}
+	if (ctx.body.updatePhoneNumber) {
+		const session = await getSessionFromCtx(ctx);
+		if (!session) throw APIError.from("UNAUTHORIZED", BASE_ERROR_CODES.USER_NOT_FOUND);
+		if ((await ctx.context.adapter.findMany({
+			model: "user",
+			where: [{
+				field: "phoneNumber",
+				value: ctx.body.phoneNumber
+			}]
+		})).length) throw APIError.from("BAD_REQUEST", PHONE_NUMBER_ERROR_CODES.PHONE_NUMBER_EXIST);
+		const user = await ctx.context.internalAdapter.updateUser(session.user.id, {
+			[opts.phoneNumber]: ctx.body.phoneNumber,
+			[opts.phoneNumberVerified]: true
+		});
+		return ctx.json({
+			status: true,
+			token: session.session.token,
+			user: parseUserOutput(ctx.context.options, user)
+		});
+	}
+	let user = await ctx.context.adapter.findOne({
+		model: "user",
+		where: [{
+			value: ctx.body.phoneNumber,
+			field: opts.phoneNumber
+		}]
+	});
+	if (!user) {
+		if (opts?.signUpOnVerification) {
+			user = await ctx.context.internalAdapter.createUser({
+				email: opts.signUpOnVerification.getTempEmail(ctx.body.phoneNumber),
+				name: opts.signUpOnVerification.getTempName ? opts.signUpOnVerification.getTempName(ctx.body.phoneNumber) : ctx.body.phoneNumber,
+				[opts.phoneNumber]: ctx.body.phoneNumber,
+				[opts.phoneNumberVerified]: true
+			});
+			if (!user) throw APIError.from("INTERNAL_SERVER_ERROR", BASE_ERROR_CODES.FAILED_TO_CREATE_USER);
+		}
+	} else user = await ctx.context.internalAdapter.updateUser(user.id, { [opts.phoneNumberVerified]: true });
+	if (!user) throw APIError.from("INTERNAL_SERVER_ERROR", BASE_ERROR_CODES.FAILED_TO_UPDATE_USER);
+	await opts?.callbackOnVerification?.({
+		phoneNumber: ctx.body.phoneNumber,
+		user
+	}, ctx);
+	if (!ctx.body.disableSession) {
+		const session = await ctx.context.internalAdapter.createSession(user.id);
+		if (!session) throw APIError.from("INTERNAL_SERVER_ERROR", BASE_ERROR_CODES.FAILED_TO_CREATE_SESSION);
+		await setSessionCookie(ctx, {
+			session,
+			user
+		});
+		return ctx.json({
+			status: true,
+			token: session.token,
+			user: parseUserOutput(ctx.context.options, user)
+		});
+	}
+	return ctx.json({
+		status: true,
+		token: null,
+		user: parseUserOutput(ctx.context.options, user)
+	});
+});
+const requestPasswordResetPhoneNumberBodySchema = z.object({ phoneNumber: z.string() });
+const requestPasswordResetPhoneNumber = (opts) => createAuthEndpoint("/phone-number/request-password-reset", {
+	method: "POST",
+	body: requestPasswordResetPhoneNumberBodySchema,
+	metadata: { openapi: {
+		description: "Request OTP for password reset via phone number",
+		responses: { "200": {
+			description: "OTP sent successfully for password reset",
+			content: { "application/json": { schema: {
+				type: "object",
+				properties: { status: {
+					type: "boolean",
+					description: "Indicates if the OTP was sent successfully",
+					enum: [true]
+				} },
+				required: ["status"]
+			} } }
+		} }
+	} }
+}, async (ctx) => {
+	const user = await ctx.context.adapter.findOne({
+		model: "user",
+		where: [{
+			value: ctx.body.phoneNumber,
+			field: opts.phoneNumber
+		}]
+	});
+	const code = generateOTP(opts.otpLength);
+	await ctx.context.internalAdapter.createVerificationValue({
+		value: `${code}:0`,
+		identifier: `${ctx.body.phoneNumber}-request-password-reset`,
+		expiresAt: getDate(opts.expiresIn, "sec")
+	});
+	if (!user) return ctx.json({ status: true });
+	if (opts.sendPasswordResetOTP) await ctx.context.runInBackgroundOrAwait(opts.sendPasswordResetOTP({
+		phoneNumber: ctx.body.phoneNumber,
+		code
+	}, ctx));
+	return ctx.json({ status: true });
+});
+const resetPasswordPhoneNumberBodySchema = z.object({
+	otp: z.string().meta({ description: "The one time password to reset the password. Eg: \"123456\"" }),
+	phoneNumber: z.string().meta({ description: "The phone number to the account which intends to reset the password for. Eg: \"+1234567890\"" }),
+	newPassword: z.string().meta({ description: `The new password. Eg: "new-and-secure-password"` })
+});
+const resetPasswordPhoneNumber = (opts) => createAuthEndpoint("/phone-number/reset-password", {
+	method: "POST",
+	body: resetPasswordPhoneNumberBodySchema,
+	metadata: { openapi: {
+		description: "Reset password using phone number OTP",
+		responses: { "200": {
+			description: "Password reset successfully",
+			content: { "application/json": { schema: {
+				type: "object",
+				properties: { status: {
+					type: "boolean",
+					description: "Indicates if the password was reset successfully",
+					enum: [true]
+				} },
+				required: ["status"]
+			} } }
+		} }
+	} }
+}, async (ctx) => {
+	const verification = await ctx.context.internalAdapter.findVerificationValue(`${ctx.body.phoneNumber}-request-password-reset`);
+	if (!verification) throw APIError.from("BAD_REQUEST", PHONE_NUMBER_ERROR_CODES.OTP_NOT_FOUND);
+	if (verification.expiresAt < /* @__PURE__ */ new Date()) throw APIError.from("BAD_REQUEST", PHONE_NUMBER_ERROR_CODES.OTP_EXPIRED);
+	const [otpValue, attempts] = verification.value.split(":");
+	const allowedAttempts = opts?.allowedAttempts || 3;
+	if (attempts && parseInt(attempts) >= allowedAttempts) {
+		await ctx.context.internalAdapter.deleteVerificationValue(verification.id);
+		throw APIError.from("FORBIDDEN", PHONE_NUMBER_ERROR_CODES.TOO_MANY_ATTEMPTS);
+	}
+	if (ctx.body.otp !== otpValue) {
+		await ctx.context.internalAdapter.updateVerificationValue(verification.id, { value: `${otpValue}:${parseInt(attempts || "0") + 1}` });
+		throw APIError.from("BAD_REQUEST", PHONE_NUMBER_ERROR_CODES.INVALID_OTP);
+	}
+	const user = await ctx.context.adapter.findOne({
+		model: "user",
+		where: [{
+			field: "phoneNumber",
+			value: ctx.body.phoneNumber
+		}]
+	});
+	if (!user) throw APIError.from("BAD_REQUEST", PHONE_NUMBER_ERROR_CODES.UNEXPECTED_ERROR);
+	const minLength = ctx.context.password.config.minPasswordLength;
+	const maxLength = ctx.context.password.config.maxPasswordLength;
+	if (ctx.body.newPassword.length < minLength) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.PASSWORD_TOO_SHORT);
+	if (ctx.body.newPassword.length > maxLength) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.PASSWORD_TOO_LONG);
+	const hashedPassword = await ctx.context.password.hash(ctx.body.newPassword);
+	await ctx.context.internalAdapter.updatePassword(user.id, hashedPassword);
+	await ctx.context.internalAdapter.deleteVerificationValue(verification.id);
+	if (ctx.context.options.emailAndPassword?.revokeSessionsOnPasswordReset) await ctx.context.internalAdapter.deleteSessions(user.id);
+	return ctx.json({ status: true });
+});
+function generateOTP(size) {
+	return generateRandomString(size, "0-9");
+}
+
+//#endregion
+export { requestPasswordResetPhoneNumber, resetPasswordPhoneNumber, sendPhoneNumberOTP, signInPhoneNumber, verifyPhoneNumber };
+//# sourceMappingURL=routes.mjs.map