@protobase/server 0.66.7 → 0.66.9

package/dist/better-auth/auth-mail/auth-emails.d.ts

@@ -1,5 +1,6 @@
 import "./account-exists-email.js";
 import "./change-email-code-email.js";
+import "./confirmation-code-email.js";
 import "./invitation-email.js";
 import "./no-account-email.js";
 import "./password-changed-email.js";

package/dist/better-auth/auth-mail/auth-emails.js

@@ -1,5 +1,6 @@
 import { accountExistsEmail } from "./account-exists-email.js";
 import { changeEmailCodeEmail } from "./change-email-code-email.js";
+import { confirmationCodeEmail } from "./confirmation-code-email.js";
 import { invitationEmail } from "./invitation-email.js";
 import { noAccountEmail } from "./no-account-email.js";
 import { passwordChangedEmail } from "./password-changed-email.js";
@@ -8,4 +9,4 @@ import { signInCodeEmail } from "./sign-in-code-email.js";
 import { signUpCodeEmail } from "./sign-up-code-email.js";
 import { staffSignInEmail } from "./staff-sign-in-email.js";
 import { twoFactorCodeEmail } from "./two-factor-code-email.js";
-export { accountExistsEmail, changeEmailCodeEmail, invitationEmail, noAccountEmail, passwordChangedEmail, resetPasswordEmail, signInCodeEmail, signUpCodeEmail, staffSignInEmail, twoFactorCodeEmail };
+export { accountExistsEmail, changeEmailCodeEmail, confirmationCodeEmail, invitationEmail, noAccountEmail, passwordChangedEmail, resetPasswordEmail, signInCodeEmail, signUpCodeEmail, staffSignInEmail, twoFactorCodeEmail };

package/dist/better-auth/auth-mail/confirmation-code-email.d.ts

@@ -0,0 +1 @@
+import "../../index.js";

package/dist/better-auth/auth-mail/confirmation-code-email.js

@@ -0,0 +1,32 @@
+import { defineEmail } from "../../mail/define-email.js";
+import { EmailCode, EmailLayout, EmailNote } from "../../mail/email-layout.js";
+import { Text } from "react-email";
+import { jsx, jsxs } from "react/jsx-runtime";
+//#region src/better-auth/auth-mail/confirmation-code-email.tsx
+const ConfirmationCodeEmail = ({ app, code, lifetime }) => /* @__PURE__ */ jsxs(EmailLayout, {
+	app,
+	preview: `Your code to confirm it's you in ${app.name}`,
+	heading: "Confirm it's you",
+	children: [
+		/* @__PURE__ */ jsxs(Text, { children: [
+			"You are signed in to ",
+			app.name,
+			" and asked to confirm it's you. Use this code there:"
+		] }),
+		/* @__PURE__ */ jsx(EmailCode, { code }),
+		/* @__PURE__ */ jsxs(Text, { children: [
+			"It works for ",
+			lifetime,
+			", once, and only where you asked for it. It does not sign you in."
+		] }),
+		/* @__PURE__ */ jsx(EmailNote, { children: "If you did not ask for it, someone may be signed in to your account: sign out of your other devices on your account page." })
+	]
+});
+/** The email with a code that confirms it's them inside a signed-in session, for an account without a passkey or a second step. */
+const confirmationCodeEmail = defineEmail({
+	name: "confirmation-code",
+	subject: ({ app, code }) => `${code} confirms it's you in ${app.name}`,
+	component: ConfirmationCodeEmail
+});
+//#endregion
+export { confirmationCodeEmail };

package/dist/better-auth/auth-settings.d.ts

@@ -146,6 +146,7 @@ export declare const buildAppAuth: (settings: AuthSettings, input: AppAuthInput)
     };
   };
   session: {
+    freshAge: number;
     fields: {
       expiresAt: string;
       createdAt: string;
@@ -2570,6 +2571,14 @@ export declare const buildAppAuth: (settings: AuthSettings, input: AppAuthInput)
         handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>;
       }[];
     };
+  } | {
+    id: "protobase-recent-confirmation";
+    hooks: {
+      before: {
+        matcher: (context: import("better-auth").HookEndpointContext) => boolean;
+        handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>;
+      }[];
+    };
   } | {
     id: "email-otp";
     version: string;
@@ -3110,6 +3119,69 @@ export declare const buildAppAuth: (settings: AuthSettings, input: AppAuthInput)
         handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>;
       }[];
     };
+  } | {
+    id: "protobase-confirmation-code";
+    endpoints: {
+      sendConfirmationCode: import("better-call").StrictEndpoint<string, {
+        method: "POST";
+        use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+          session: {
+            session: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            };
+            user: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            };
+          };
+        }>>[];
+      }, {
+        status: boolean;
+      }>;
+      verifyConfirmationCode: import("better-call").StrictEndpoint<string, {
+        method: "POST";
+        use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+          session: {
+            session: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            };
+            user: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            };
+          };
+        }>>[];
+        body: import("zod").ZodObject<{
+          code: import("zod").ZodString;
+        }, import("zod/v4/core").$strip>;
+      }, {
+        status: boolean;
+      }>;
+    };
   } | {
     id: "protobase-sign-up";
     endpoints: {

package/dist/better-auth/confirmation-code-plugin.d.ts

@@ -0,0 +1,9 @@
+import "./auth-mail/send-auth-email.js";
+import "zod";
+//#region src/better-auth/confirmation-code-plugin.d.ts
+/** The endpoints of the emailed confirmation code, as Better Auth's `ctx.path` names them. */
+export declare const confirmationCodePaths: {
+  send: string;
+  verify: string;
+};
+//#endregion

package/dist/better-auth/confirmation-code-plugin.js

@@ -0,0 +1,95 @@
+import { sendAuthEmail } from "./auth-mail/send-auth-email.js";
+import { codeLifetime } from "./sign-in-mail.js";
+import { saveStrongSignIn } from "./strong-sign-ins.js";
+import { checkConfirmationCode, dropConfirmationCode, newConfirmationCode, saveConfirmationCode } from "./confirmation-codes.js";
+import * as z$1 from "zod";
+import { APIError, createAuthEndpoint, sessionMiddleware } from "better-auth/api";
+//#region src/better-auth/confirmation-code-plugin.ts
+/** The endpoints of the emailed confirmation code, as Better Auth's `ctx.path` names them. */
+const confirmationCodePaths = {
+	send: "/account/confirmation-code/send",
+	verify: "/account/confirmation-code/verify"
+};
+const notOffered = {
+	code: "CONFIRMATION_CODE_NOT_OFFERED",
+	message: "Confirm it's you with your passkey or your second step instead."
+};
+const refusals = {
+	wrong: {
+		status: "BAD_REQUEST",
+		code: "INVALID_CODE",
+		message: "The code is not right."
+	},
+	"too-many": {
+		status: "FORBIDDEN",
+		code: "TOO_MANY_ATTEMPTS",
+		message: "Too many wrong codes. Ask for a new one."
+	},
+	expired: {
+		status: "BAD_REQUEST",
+		code: "OTP_EXPIRED",
+		message: "The code has expired. Ask for a new one."
+	}
+};
+const isOffered = async (context, { user }) => !user.twoFactorEnabled && await context.adapter.count({
+	model: "passkey",
+	where: [{
+		field: "userId",
+		value: user.id
+	}]
+}) === 0;
+/**
+* An emailed code that confirms it's them inside a session someone is signed in with, for an account without a passkey
+* or a second step, which has nothing stronger to confirm with: a right code notes a strong sign-in for that session
+* (`saveStrongSignIn`), as a passkey or a second step does. The code is its own kind, never a sign-in code; it belongs
+* to the session and user that asked for it, a new one ends the one before, and it stops working after a few wrong
+* ones (`confirmationCodeTries`). When the email cannot be sent, the request fails and no code is kept. The endpoints
+* read the session cookie only, so an MCP client or an app's token cannot ask for one; staff sessions are refused by
+* the staff plugin.
+*/
+const confirmationCodePlugin = (mail) => ({
+	id: "protobase-confirmation-code",
+	endpoints: {
+		/** `POST /account/confirmation-code/send`: emails the signed-in person a new confirmation code. */
+		sendConfirmationCode: createAuthEndpoint(confirmationCodePaths.send, {
+			method: "POST",
+			use: [sessionMiddleware]
+		}, async (ctx) => {
+			const signed = ctx.context.session;
+			if (!await isOffered(ctx.context, signed)) throw new APIError("FORBIDDEN", notOffered);
+			const holder = {
+				userId: signed.user.id,
+				sessionId: signed.session.id
+			};
+			await dropConfirmationCode(ctx.context.internalAdapter, holder.sessionId);
+			const code = newConfirmationCode();
+			await sendAuthEmail(mail, "confirmationCodeEmail", signed.user.email, {
+				code,
+				lifetime: codeLifetime
+			}, ctx.context.baseURL);
+			await saveConfirmationCode(ctx.context.internalAdapter, holder, code);
+			return ctx.json({ status: true });
+		}),
+		/** `POST /account/confirmation-code/verify` with `{ code }`: confirms the session with the code it was emailed. */
+		verifyConfirmationCode: createAuthEndpoint(confirmationCodePaths.verify, {
+			method: "POST",
+			use: [sessionMiddleware],
+			body: z$1.object({ code: z$1.string() })
+		}, async (ctx) => {
+			const signed = ctx.context.session;
+			if (!await isOffered(ctx.context, signed)) throw new APIError("FORBIDDEN", notOffered);
+			const checked = await checkConfirmationCode(ctx.context.internalAdapter, {
+				userId: signed.user.id,
+				sessionId: signed.session.id
+			}, ctx.body.code.trim());
+			if (checked !== "confirmed") {
+				const { status, ...refusal } = refusals[checked];
+				throw new APIError(status, refusal);
+			}
+			await saveStrongSignIn(ctx.context.internalAdapter, signed.session);
+			return ctx.json({ status: true });
+		})
+	}
+});
+//#endregion
+export { confirmationCodePaths, confirmationCodePlugin };

package/dist/better-auth/confirmation-codes.js

@@ -0,0 +1,54 @@
+import { emailCodeMinutes } from "@protobase/schema/internal";
+import { createHash, timingSafeEqual } from "node:crypto";
+import { generateRandomString } from "better-auth/crypto";
+const identifierOf = (sessionId) => `protobase-confirmation-code-${sessionId}`;
+const hashOf = (code) => createHash("sha256").update(code).digest("hex");
+const sameHash = (a, b) => a.length === b.length && timingSafeEqual(Buffer.from(a), Buffer.from(b));
+/** Ends the session's confirmation code, if it has one, so only a newer one works. */
+const dropConfirmationCode = (internal, sessionId) => internal.deleteVerificationByIdentifier(identifierOf(sessionId));
+/** A new six-digit code, as the email shows it. */
+const newConfirmationCode = () => generateRandomString(6, "0-9");
+/** Keeps `code` as the session's confirmation code for `emailCodeMinutes`, in place of any earlier one. */
+const saveConfirmationCode = async (internal, holder, code, now = /* @__PURE__ */ new Date()) => {
+	const identifier = identifierOf(holder.sessionId);
+	await internal.deleteVerificationByIdentifier(identifier);
+	const value = {
+		userId: holder.userId,
+		hash: hashOf(code),
+		wrong: 0
+	};
+	await internal.createVerificationValue({
+		identifier,
+		value: JSON.stringify(value),
+		expiresAt: new Date(now.getTime() + emailCodeMinutes * 6e4)
+	});
+};
+/**
+* Checks `code` against the session's confirmation code: a code of another session or user is none. A right code is
+* used up; a wrong one counts, and the code stops working at `confirmationCodeTries` wrong ones.
+*/
+const checkConfirmationCode = async (internal, holder, code, now = /* @__PURE__ */ new Date()) => {
+	const identifier = identifierOf(holder.sessionId);
+	const found = await internal.findVerificationValue(identifier);
+	if (!found || new Date(found.expiresAt) <= now) return "expired";
+	const stored = JSON.parse(found.value);
+	if (stored.userId !== holder.userId) return "expired";
+	if (sameHash(stored.hash, hashOf(code))) {
+		await internal.deleteVerificationByIdentifier(identifier);
+		return "confirmed";
+	}
+	await internal.deleteVerificationByIdentifier(identifier);
+	const wrong = stored.wrong + 1;
+	if (wrong >= 3) return "too-many";
+	await internal.createVerificationValue({
+		identifier,
+		value: JSON.stringify({
+			...stored,
+			wrong
+		}),
+		expiresAt: new Date(found.expiresAt)
+	});
+	return "wrong";
+};
+//#endregion
+export { checkConfirmationCode, dropConfirmationCode, newConfirmationCode, saveConfirmationCode };

package/dist/better-auth/create-auth.d.ts

@@ -22,6 +22,7 @@ import { SsoOptions } from "./saml-sign-in.js";
 import { samlPlugin } from "./saml-plugin.js";
 import { signUpPaths } from "./sign-up/sign-up-plugin.js";
 import { PasswordHash } from "./password-hashes.js";
+import { confirmationCodePaths } from "./confirmation-code-plugin.js";
 import { BetterAuthOptions } from "better-auth";
 import { JwtOptions } from "better-auth/plugins";
 //#region src/better-auth/create-auth.d.ts
@@ -278,6 +279,7 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
     };
   };
   session: {
+    freshAge: number;
     fields: {
       expiresAt: string;
       createdAt: string;
@@ -2702,6 +2704,14 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
         handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>;
       }[];
     };
+  } | {
+    id: "protobase-recent-confirmation";
+    hooks: {
+      before: {
+        matcher: (context: import("better-auth").HookEndpointContext) => boolean;
+        handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>;
+      }[];
+    };
   } | {
     id: "email-otp";
     version: string;
@@ -2914,10 +2924,7 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
           email: string;
           emailVerified: boolean;
           name: string;
-          image? /**
-           * The secrets the app had before `secret`, newest first, such as `PROTOBASE_PREVIOUS_SECRETS`: what they encrypted
-           * still decrypts, so the signing keys keep signing after the secret changes. Default none.
-           */ : string | null | undefined;
+          image?: string | null | undefined;
         } & Record<string, any>;
       } | {
         status: boolean;
@@ -3102,11 +3109,7 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
               email: string;
               emailVerified: boolean;
               name: string;
-              image? /**
-               * Refuses a new password that appears in a known data breach, by Have I Been Pwned's password list: at sign-up, from
-               * an invitation, and when a password is set, changed, reset or given by an admin. Only the first five characters of
-               * the password's SHA-1 hash leave the server. While the list cannot be reached, setting a password fails. Default off.
-               */ : string | null | undefined;
+              image?: string | null | undefined;
             };
           };
         }>>[];
@@ -3249,6 +3252,69 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
         handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>;
       }[];
     };
+  } | {
+    id: "protobase-confirmation-code";
+    endpoints: {
+      sendConfirmationCode: import("better-call").StrictEndpoint<string, {
+        method: "POST";
+        use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+          session: {
+            session: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            };
+            user: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            };
+          };
+        }>>[];
+      }, {
+        status: boolean;
+      }>;
+      verifyConfirmationCode: import("better-call").StrictEndpoint<string, {
+        method: "POST";
+        use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+          session: {
+            session: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            };
+            user: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            };
+          };
+        }>>[];
+        body: import("zod").ZodObject<{
+          code: import("zod").ZodString;
+        }, import("zod/v4/core").$strip>;
+      }, {
+        status: boolean;
+      }>;
+    };
   } | {
     id: "protobase-sign-up";
     endpoints: {
@@ -4124,9 +4190,7 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
               expiresAt: Date;
               token: string;
               ipAddress?: string | null | undefined;
-              userAgent?
-              /** The OAuth provider for MCP clients, when on: the endpoint's resource (its URL) and path, and the scope its tokens carry. */
-              /** The OAuth provider for MCP clients, when on: the endpoint's resource (its URL) and path, and the scope its tokens carry. */ : string | null | undefined;
+              userAgent?: string | null | undefined;
             };
             user: Record<string, any> & {
               id: string;
@@ -5134,7 +5198,7 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
         member: import("better-auth/plugins").Member & Record<string, any>;
       }) => Promise<void | {
         data: {
-          name? /** Runs after a user is created, by any route: `createUser`, an admin, or a social sign-up. Default none. */ : string;
+          name?: string;
           slug?: string;
           logo?: string | null;
           metadata?: Record<string, any>;
@@ -8940,6 +9004,14 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
         window: number;
         max: number;
       };
+      [confirmationCodePaths.send]: {
+        window: number;
+        max: number;
+      };
+      [confirmationCodePaths.verify]: {
+        window: number;
+        max: number;
+      };
       '/sign-in/email': {
         window: number;
         max: number;

package/dist/better-auth/create-auth.js

@@ -50,6 +50,8 @@ import { confirmedOnCreate, confirmedOnUpdate, emailConfirmedField } from "./ema
 import { rehashPasswordsPlugin, verifyAcceptedHash } from "./password-hashes.js";
 import { staffSignInPlugin } from "./staff-plugin.js";
 import { strongSignInsPlugin } from "./strong-sign-ins.js";
+import { recentConfirmationPlugin } from "./recent-confirmation.js";
+import { confirmationCodePaths, confirmationCodePlugin } from "./confirmation-code-plugin.js";
 import { tokenClaims } from "./token-claims.js";
 import { twoFactorAfterPasswordOrCode } from "./two-factor-challenge.js";
 import { metadataField, userFieldsNamed, userModel, userTable, withUserColumns } from "./user-table.js";
@@ -191,7 +193,10 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 			...Object.keys(userFields).length > 0 && { additionalFields: userFields },
 			...deleteUser
 		},
-		session: coreNames.session,
+		session: {
+			...coreNames.session,
+			freshAge: 0
+		},
 		verification: coreNames.verification,
 		account: {
 			...coreNames.account,
@@ -219,7 +224,12 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 				origins: appOrigins(options.baseURL, origins)
 			}),
 			strongSignInsPlugin(),
-			...mail ? [emailOTP(emailCodeOptions(mail)), noAccountMailPlugin(mail)] : [],
+			recentConfirmationPlugin(),
+			...mail ? [
+				emailOTP(emailCodeOptions(mail)),
+				noAccountMailPlugin(mail),
+				confirmationCodePlugin(mail)
+			] : [],
 			...mail && signUpRole ? [signUpPlugin({
 				role: signUpRole,
 				mail,
@@ -343,6 +353,14 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 				[signUpPaths.create]: {
 					window: 60,
 					max: options.signInPerMinute ?? 5
+				},
+				[confirmationCodePaths.send]: {
+					window: 60,
+					max: 5
+				},
+				[confirmationCodePaths.verify]: {
+					window: 60,
+					max: 5
 				}
 			}
 		},

package/dist/better-auth/recent-confirmation.js

@@ -0,0 +1,58 @@
+import { isStaffSession } from "./staff-checks.js";
+import { strongSignInAt } from "./strong-sign-ins.js";
+import { confirmationMinutes } from "@protobase/schema/internal";
+import { APIError, createAuthMiddleware, getSessionFromCtx } from "better-auth/api";
+//#region src/better-auth/recent-confirmation.ts
+/** How long after signing in a session counts as recent without confirming: Better Auth's own default fresh age, a day. */
+const recentSessionSeconds = 86400;
+/** The refusal of an account change the session has to confirm first, which the account page answers by asking in place. */
+const confirmationRequired = {
+	code: "STRONG_SIGN_IN_REQUIRED",
+	message: `Confirm it's you first: this change needs a passkey, a second step or an emailed code in the last ${confirmationMinutes} minutes.`
+};
+const passkeyPaths = ["/passkey/generate-register-options", "/passkey/verify-registration"];
+const guardedPaths = [
+	...passkeyPaths,
+	"/unlink-account",
+	"/delete-user"
+];
+const asksToConfirm = async (context, path, body, { user }) => {
+	if (path === "/delete-user") return !body?.password;
+	if (!passkeyPaths.includes(path)) return true;
+	if (user.twoFactorEnabled) return true;
+	return await context.adapter.count({
+		model: "passkey",
+		where: [{
+			field: "userId",
+			value: user.id
+		}]
+	}) > 0;
+};
+/** Whether the session signed in within a day, or confirmed it's them within `confirmationMinutes`. */
+const isRecentlyConfirmed = async (context, session, now = /* @__PURE__ */ new Date()) => {
+	if (now.getTime() - new Date(session.createdAt).getTime() < 864e5) return true;
+	const at = await strongSignInAt(context.internalAdapter, session.id, now);
+	return at !== void 0 && now.getTime() - at.getTime() <= confirmationMinutes * 6e4;
+};
+/**
+* Replaces Better Auth's fresh-session check, which `createAuth` turns off (`freshAge: 0`), and which could only be met
+* by signing out and in again. A session of any age adds a first passkey, and lists its devices. Adding another passkey
+* to an account with a passkey or a second step, unlinking a sign-in provider and deleting the account without a
+* password ask a session older than a day to confirm it's them in place first (`strongSignInsPlugin` notes it), else
+* `403 STRONG_SIGN_IN_REQUIRED`. Staff sessions are left to the staff plugin, which refuses these changes.
+*/
+const recentConfirmationPlugin = () => ({
+	id: "protobase-recent-confirmation",
+	hooks: { before: [{
+		matcher: (context) => context.path !== void 0 && guardedPaths.includes(context.path),
+		handler: createAuthMiddleware(async (ctx) => {
+			const signedIn = await getSessionFromCtx(ctx);
+			if (!signedIn || isStaffSession(signedIn.session)) return;
+			if (!await asksToConfirm(ctx.context, ctx.path, ctx.body, signedIn)) return;
+			if (await isRecentlyConfirmed(ctx.context, signedIn.session)) return;
+			throw new APIError("FORBIDDEN", confirmationRequired);
+		})
+	}] }
+});
+//#endregion
+export { confirmationRequired, isRecentlyConfirmed, recentConfirmationPlugin, recentSessionSeconds };

package/dist/better-auth/staff-checks.js

@@ -55,6 +55,8 @@ const accountChanges = [
 	"/passkey/verify-registration",
 	"/passkey/update-passkey",
 	"/passkey/delete-passkey",
+	"/account/confirmation-code/send",
+	"/account/confirmation-code/verify",
 	"/invitation/accept",
 	"/organization/leave",
 	"/organization/transfer-ownership",

package/dist/better-auth/strong-sign-ins.js

@@ -12,7 +12,7 @@ const twoFactorPaths = [
 */
 const strongSignInPaths = ["/passkey/verify-authentication", ...twoFactorPaths];
 const identifierOf = (sessionId) => `protobase-strong-sign-in-${sessionId}`;
-/** Notes that the session proved a passkey or a second step now; the note ends with the session. */
+/** Notes that the session proved a passkey, a second step or an emailed confirmation code now; the note ends with the session. */
 const saveStrongSignIn = async (internal, session, now = /* @__PURE__ */ new Date()) => {
 	const identifier = identifierOf(session.id);
 	await internal.deleteVerificationByIdentifier(identifier);
@@ -22,7 +22,7 @@ const saveStrongSignIn = async (internal, session, now = /* @__PURE__ */ new Dat
 		expiresAt: session.expiresAt
 	});
 };
-/** When the session last proved a passkey or a second step, if it did and its note has not expired. */
+/** When the session last proved a passkey, a second step or an emailed confirmation code, if it did and its note has not expired. */
 const strongSignInAt = async (internal, sessionId, now = /* @__PURE__ */ new Date()) => {
 	const found = await internal.findVerificationValue(identifierOf(sessionId));
 	if (!found || new Date(found.expiresAt) <= now) return void 0;

package/dist/package.js

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.66.7";
+var version = "0.66.9";
 //#endregion
 export { version };

package/dist/reveal-service.js

@@ -17,7 +17,7 @@ const revealedValue = (deps, model, field, record) => {
 	});
 };
 /** The refusal of a reveal that needs a strong sign-in more recent than the caller's, which the app answers by asking them to confirm it's them. */
-const strongSignInRequired = (minutes) => new HttpProblem(403, "strong-sign-in-required", "Forbidden", `Confirm it's you with a passkey or a second step: this needs one in the last ${minutes} minutes.`, { minutes });
+const strongSignInRequired = (minutes) => new HttpProblem(403, "strong-sign-in-required", "Forbidden", `Confirm it's you with a passkey, a second step or an emailed code: this needs one in the last ${minutes} minutes.`, { minutes });
 const requireStrongSignIn = async (session, minutes, now = /* @__PURE__ */ new Date()) => {
 	const at = session.signIn && !session.signIn.staff && !session.client ? await session.signIn.strongAt?.() : void 0;
 	if (at && now.getTime() - at.getTime() <= minutes * 6e4) return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.66.7",
+  "version": "0.66.9",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -43,9 +43,9 @@
     "@better-auth/sso": "^1.7.12",
     "@livekit/protocol": "1.53.1",
     "@modelcontextprotocol/server": "^2.3.1",
-    "@protobase/layout": "0.66.7",
-    "@protobase/query": "0.66.7",
-    "@protobase/schema": "0.66.7",
+    "@protobase/layout": "0.66.9",
+    "@protobase/query": "0.66.9",
+    "@protobase/schema": "0.66.9",
     "@react-email/render": "^2.1.0",
     "@react-pdf/primitives": "^4.4.0",
     "@react-pdf/renderer": "^4.9.0",