@masheev/better-auth 0.0.0-stage → 1.7.5

package/dist/plugins/email-otp/index.mjs

@@ -0,0 +1,145 @@
+import { getDate } from "../../utils/date.mjs";
+import { generateRandomString } from "../../crypto/random.mjs";
+import { PACKAGE_VERSION } from "../../version.mjs";
+import { EMAIL_OTP_ERROR_CODES } from "./error-codes.mjs";
+import { getEndpointResponse } from "../../utils/plugin-helper.mjs";
+import { toOTPIdentifier } from "./utils.mjs";
+import { storeOTP } from "./otp-token.mjs";
+import { changeEmailEmailOTP, checkVerificationOTP, createVerificationOTP, forgetPasswordEmailOTP, getVerificationOTP, requestEmailChangeEmailOTP, requestPasswordResetEmailOTP, resetPasswordEmailOTP, sendVerificationOTP, signInEmailOTP, verifyEmailOTP } from "./routes.mjs";
+import { createAuthMiddleware } from "@better-auth/core/api";
+//#region src/plugins/email-otp/index.ts
+const defaultOTPGenerator = (options) => generateRandomString(options.otpLength ?? 6, "0-9");
+const emailOTP = (options) => {
+	const opts = {
+		expiresIn: 300,
+		generateOTP: () => defaultOTPGenerator(options),
+		storeOTP: "plain",
+		...options
+	};
+	const sendVerificationOTPAction = sendVerificationOTP(opts);
+	return {
+		id: "email-otp",
+		version: PACKAGE_VERSION,
+		init(ctx) {
+			if (!opts.overrideDefaultEmailVerification) return;
+			return { options: { emailVerification: { async sendVerificationEmail(data, request) {
+				await ctx.runInBackgroundOrAwait(sendVerificationOTPAction({
+					context: ctx,
+					request,
+					body: {
+						email: data.user.email,
+						type: "email-verification"
+					},
+					ctx
+				}));
+			} } } };
+		},
+		endpoints: {
+			sendVerificationOTP: sendVerificationOTPAction,
+			createVerificationOTP: createVerificationOTP(opts),
+			getVerificationOTP: getVerificationOTP(opts),
+			checkVerificationOTP: checkVerificationOTP(opts),
+			verifyEmailOTP: verifyEmailOTP(opts),
+			signInEmailOTP: signInEmailOTP(opts),
+			requestPasswordResetEmailOTP: requestPasswordResetEmailOTP(opts),
+			forgetPasswordEmailOTP: forgetPasswordEmailOTP(opts),
+			resetPasswordEmailOTP: resetPasswordEmailOTP(opts),
+			requestEmailChangeEmailOTP: requestEmailChangeEmailOTP(opts),
+			changeEmailEmailOTP: changeEmailEmailOTP(opts)
+		},
+		hooks: { after: [{
+			matcher(context) {
+				return !!(context.path?.startsWith("/sign-up") && opts.sendVerificationOnSignUp && !opts.overrideDefaultEmailVerification);
+			},
+			handler: createAuthMiddleware(async (ctx) => {
+				const email = (await getEndpointResponse(ctx))?.user.email;
+				if (email) {
+					const otp = opts.generateOTP({
+						email,
+						type: "email-verification"
+					}, ctx) || defaultOTPGenerator(opts);
+					const storedOTP = await storeOTP(ctx, opts, otp);
+					await ctx.context.internalAdapter.createVerificationValue({
+						value: `${storedOTP}:0`,
+						identifier: toOTPIdentifier("email-verification", email),
+						expiresAt: getDate(opts.expiresIn, "sec")
+					});
+					await ctx.context.runInBackgroundOrAwait(options.sendVerificationOTP({
+						email,
+						otp,
+						type: "email-verification"
+					}, ctx));
+				}
+			})
+		}] },
+		rateLimit: [
+			{
+				pathMatcher(path) {
+					return path === "/email-otp/send-verification-otp";
+				},
+				window: opts.rateLimit?.window || 60,
+				max: opts.rateLimit?.max || 3
+			},
+			{
+				pathMatcher(path) {
+					return path === "/email-otp/check-verification-otp";
+				},
+				window: opts.rateLimit?.window || 60,
+				max: opts.rateLimit?.max || 3
+			},
+			{
+				pathMatcher(path) {
+					return path === "/email-otp/verify-email";
+				},
+				window: opts.rateLimit?.window || 60,
+				max: opts.rateLimit?.max || 3
+			},
+			{
+				pathMatcher(path) {
+					return path === "/sign-in/email-otp";
+				},
+				window: opts.rateLimit?.window || 60,
+				max: opts.rateLimit?.max || 3
+			},
+			{
+				pathMatcher(path) {
+					return path === "/email-otp/request-password-reset";
+				},
+				window: opts.rateLimit?.window || 60,
+				max: opts.rateLimit?.max || 3
+			},
+			{
+				pathMatcher(path) {
+					return path === "/email-otp/reset-password";
+				},
+				window: opts.rateLimit?.window || 60,
+				max: opts.rateLimit?.max || 3
+			},
+			{
+				pathMatcher(path) {
+					return path === "/forget-password/email-otp";
+				},
+				window: opts.rateLimit?.window || 60,
+				max: opts.rateLimit?.max || 3
+			},
+			{
+				pathMatcher(path) {
+					return path === "/email-otp/request-email-change";
+				},
+				window: opts.rateLimit?.window || 60,
+				max: opts.rateLimit?.max || 3
+			},
+			{
+				pathMatcher(path) {
+					return path === "/email-otp/change-email";
+				},
+				window: opts.rateLimit?.window || 60,
+				max: opts.rateLimit?.max || 3
+			}
+		],
+		options,
+		$ERROR_CODES: EMAIL_OTP_ERROR_CODES
+	};
+};
+//#endregion
+export { emailOTP };

package/dist/plugins/email-otp/otp-token.mjs

@@ -0,0 +1,55 @@
+import { getDate } from "../../utils/date.mjs";
+import { constantTimeEqual } from "../../crypto/buffer.mjs";
+import { symmetricDecrypt, symmetricEncrypt } from "../../crypto/index.mjs";
+import { defaultKeyHasher, splitAtLastColon } from "./utils.mjs";
+//#region src/plugins/email-otp/otp-token.ts
+async function storeOTP(ctx, opts, otp) {
+	if (opts.storeOTP === "encrypted") return await symmetricEncrypt({
+		key: ctx.context.secretConfig,
+		data: otp
+	});
+	if (opts.storeOTP === "hashed") return await defaultKeyHasher(otp);
+	if (typeof opts.storeOTP === "object" && "hash" in opts.storeOTP) return await opts.storeOTP.hash(otp);
+	if (typeof opts.storeOTP === "object" && "encrypt" in opts.storeOTP) return await opts.storeOTP.encrypt(otp);
+	return otp;
+}
+async function verifyStoredOTP(ctx, opts, storedOtp, otp) {
+	if (opts.storeOTP === "encrypted") return constantTimeEqual(await symmetricDecrypt({
+		key: ctx.context.secretConfig,
+		data: storedOtp
+	}), otp);
+	if (opts.storeOTP === "hashed") return constantTimeEqual(await defaultKeyHasher(otp), storedOtp);
+	if (typeof opts.storeOTP === "object" && "hash" in opts.storeOTP) return constantTimeEqual(await opts.storeOTP.hash(otp), storedOtp);
+	if (typeof opts.storeOTP === "object" && "decrypt" in opts.storeOTP) return constantTimeEqual(await opts.storeOTP.decrypt(storedOtp), otp);
+	return constantTimeEqual(otp, storedOtp);
+}
+/**
+* Retrieves the plain-text OTP from a stored value.
+* Returns `null` if the OTP is hashed and cannot be recovered.
+*/
+async function retrieveOTP(ctx, opts, storedOtp) {
+	if (opts.storeOTP === "plain" || opts.storeOTP === void 0) return storedOtp;
+	if (opts.storeOTP === "encrypted") return await symmetricDecrypt({
+		key: ctx.context.secretConfig,
+		data: storedOtp
+	});
+	if (typeof opts.storeOTP === "object" && "decrypt" in opts.storeOTP) return await opts.storeOTP.decrypt(storedOtp);
+	return null;
+}
+/**
+* Tries to reuse an existing unexpired OTP.
+* Returns the plain-text OTP if reusable, `null` otherwise.
+*/
+async function tryReuseOTP(ctx, opts, identifier) {
+	const existing = await ctx.context.internalAdapter.findVerificationValue(identifier);
+	if (!existing || existing.expiresAt < /* @__PURE__ */ new Date()) return null;
+	const [storedOtpValue, attempts] = splitAtLastColon(existing.value);
+	const allowedAttempts = opts.allowedAttempts || 3;
+	if (attempts && parseInt(attempts) >= allowedAttempts) return null;
+	const plainOtp = await retrieveOTP(ctx, opts, storedOtpValue);
+	if (!plainOtp) return null;
+	await ctx.context.internalAdapter.updateVerificationByIdentifier(identifier, { expiresAt: getDate(opts.expiresIn, "sec") });
+	return plainOtp;
+}
+//#endregion
+export { storeOTP, tryReuseOTP, verifyStoredOTP };