@sirketio/auth 0.0.1

package/dist/plugins/two-factor/otp/index.mjs

@@ -0,0 +1,199 @@
+import { parseUserOutput } from "../../../db/schema.mjs";
+import { constantTimeEqual } from "../../../crypto/buffer.mjs";
+import { generateRandomString } from "../../../crypto/random.mjs";
+import { symmetricDecrypt, symmetricEncrypt } from "../../../crypto/index.mjs";
+import { setSessionCookie } from "../../../cookies/index.mjs";
+import { TWO_FACTOR_ERROR_CODES } from "../error-code.mjs";
+import { verifyTwoFactor } from "../verify-two-factor.mjs";
+import { defaultKeyHasher } from "../utils.mjs";
+import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
+import { createAuthEndpoint } from "@better-auth/core/api";
+import * as z from "zod";
+
+//#region src/plugins/two-factor/otp/index.ts
+const verifyOTPBodySchema = z.object({
+	code: z.string().meta({ description: "The otp code to verify. Eg: \"012345\"" }),
+	trustDevice: z.boolean().optional().meta({ description: "If true, the device will be trusted for 30 days. It'll be refreshed on every sign in request within this time. Eg: true" })
+});
+const send2FaOTPBodySchema = z.object({ trustDevice: z.boolean().optional().meta({ description: "If true, the device will be trusted for 30 days. It'll be refreshed on every sign in request within this time. Eg: true" }) }).optional();
+/**
+* The otp adapter is created from the totp adapter.
+*/
+const otp2fa = (options) => {
+	const opts = {
+		storeOTP: "plain",
+		digits: 6,
+		...options,
+		period: (options?.period || 3) * 60 * 1e3
+	};
+	async function storeOTP(ctx, otp) {
+		if (opts.storeOTP === "hashed") return await defaultKeyHasher(otp);
+		if (typeof opts.storeOTP === "object" && "hash" in opts.storeOTP) return await opts.storeOTP.hash(otp);
+		if (typeof opts.storeOTP === "object" && "encrypt" in opts.storeOTP) return await opts.storeOTP.encrypt(otp);
+		if (opts.storeOTP === "encrypted") return await symmetricEncrypt({
+			key: ctx.context.secret,
+			data: otp
+		});
+		return otp;
+	}
+	async function decryptOrHashForComparison(ctx, storedOtp, userInput) {
+		if (opts.storeOTP === "hashed") return [storedOtp, await defaultKeyHasher(userInput)];
+		if (opts.storeOTP === "encrypted") return [await symmetricDecrypt({
+			key: ctx.context.secret,
+			data: storedOtp
+		}), userInput];
+		if (typeof opts.storeOTP === "object" && "encrypt" in opts.storeOTP) return [await opts.storeOTP.decrypt(storedOtp), userInput];
+		if (typeof opts.storeOTP === "object" && "hash" in opts.storeOTP) return [storedOtp, await opts.storeOTP.hash(userInput)];
+		return [storedOtp, userInput];
+	}
+	return {
+		id: "otp",
+		endpoints: {
+			sendTwoFactorOTP: createAuthEndpoint("/two-factor/send-otp", {
+				method: "POST",
+				body: send2FaOTPBodySchema,
+				metadata: { openapi: {
+					summary: "Send two factor OTP",
+					description: "Send two factor OTP to the user",
+					responses: { 200: {
+						description: "Successful response",
+						content: { "application/json": { schema: {
+							type: "object",
+							properties: { status: { type: "boolean" } }
+						} } }
+					} }
+				} }
+			}, async (ctx) => {
+				if (!options || !options.sendOTP) {
+					ctx.context.logger.error("send otp isn't configured. Please configure the send otp function on otp options.");
+					throw APIError.from("BAD_REQUEST", {
+						message: "otp isn't configured",
+						code: "OTP_NOT_CONFIGURED"
+					});
+				}
+				const { session, key } = await verifyTwoFactor(ctx);
+				const code = generateRandomString(opts.digits, "0-9");
+				const hashedCode = await storeOTP(ctx, code);
+				await ctx.context.internalAdapter.createVerificationValue({
+					value: `${hashedCode}:0`,
+					identifier: `2fa-otp-${key}`,
+					expiresAt: new Date(Date.now() + opts.period)
+				});
+				const sendOTPResult = options.sendOTP({
+					user: session.user,
+					otp: code
+				}, ctx);
+				if (sendOTPResult instanceof Promise) await ctx.context.runInBackgroundOrAwait(sendOTPResult.catch((e) => {
+					ctx.context.logger.error("Failed to send two-factor OTP", e);
+				}));
+				return ctx.json({ status: true });
+			}),
+			verifyTwoFactorOTP: createAuthEndpoint("/two-factor/verify-otp", {
+				method: "POST",
+				body: verifyOTPBodySchema,
+				metadata: { openapi: {
+					summary: "Verify two factor OTP",
+					description: "Verify two factor OTP",
+					responses: { "200": {
+						description: "Two-factor OTP verified successfully",
+						content: { "application/json": { schema: {
+							type: "object",
+							properties: {
+								token: {
+									type: "string",
+									description: "Session token for the authenticated session"
+								},
+								user: {
+									type: "object",
+									properties: {
+										id: {
+											type: "string",
+											description: "Unique identifier of the user"
+										},
+										email: {
+											type: "string",
+											format: "email",
+											nullable: true,
+											description: "User's email address"
+										},
+										emailVerified: {
+											type: "boolean",
+											nullable: true,
+											description: "Whether the email is verified"
+										},
+										name: {
+											type: "string",
+											nullable: true,
+											description: "User's name"
+										},
+										image: {
+											type: "string",
+											format: "uri",
+											nullable: true,
+											description: "User's profile image URL"
+										},
+										createdAt: {
+											type: "string",
+											format: "date-time",
+											description: "Timestamp when the user was created"
+										},
+										updatedAt: {
+											type: "string",
+											format: "date-time",
+											description: "Timestamp when the user was last updated"
+										}
+									},
+									required: [
+										"id",
+										"createdAt",
+										"updatedAt"
+									],
+									description: "The authenticated user object"
+								}
+							},
+							required: ["token", "user"]
+						} } }
+					} }
+				} }
+			}, async (ctx) => {
+				const { session, key, valid, invalid } = await verifyTwoFactor(ctx);
+				const toCheckOtp = await ctx.context.internalAdapter.findVerificationValue(`2fa-otp-${key}`);
+				const [otp, counter] = toCheckOtp?.value?.split(":") ?? [];
+				if (!toCheckOtp || toCheckOtp.expiresAt < /* @__PURE__ */ new Date()) {
+					if (toCheckOtp) await ctx.context.internalAdapter.deleteVerificationValue(toCheckOtp.id);
+					throw APIError.from("BAD_REQUEST", TWO_FACTOR_ERROR_CODES.OTP_HAS_EXPIRED);
+				}
+				const allowedAttempts = options?.allowedAttempts || 5;
+				if (parseInt(counter) >= allowedAttempts) {
+					await ctx.context.internalAdapter.deleteVerificationValue(toCheckOtp.id);
+					throw APIError.from("BAD_REQUEST", TWO_FACTOR_ERROR_CODES.TOO_MANY_ATTEMPTS_REQUEST_NEW_CODE);
+				}
+				const [storedValue, inputValue] = await decryptOrHashForComparison(ctx, otp, ctx.body.code);
+				if (constantTimeEqual(new TextEncoder().encode(storedValue), new TextEncoder().encode(inputValue))) {
+					if (!session.user.twoFactorEnabled) {
+						if (!session.session) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.FAILED_TO_CREATE_SESSION);
+						const updatedUser = await ctx.context.internalAdapter.updateUser(session.user.id, { twoFactorEnabled: true });
+						const newSession = await ctx.context.internalAdapter.createSession(session.user.id, false, session.session);
+						await ctx.context.internalAdapter.deleteSession(session.session.token);
+						await setSessionCookie(ctx, {
+							session: newSession,
+							user: updatedUser
+						});
+						return ctx.json({
+							token: newSession.token,
+							user: parseUserOutput(ctx.context.options, updatedUser)
+						});
+					}
+					return valid(ctx);
+				} else {
+					await ctx.context.internalAdapter.updateVerificationValue(toCheckOtp.id, { value: `${otp}:${(parseInt(counter, 10) || 0) + 1}` });
+					return invalid("INVALID_CODE");
+				}
+			})
+		}
+	};
+};
+
+//#endregion
+export { otp2fa };
+//# sourceMappingURL=index.mjs.map

package/dist/plugins/two-factor/otp/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../src/plugins/two-factor/otp/index.ts"],"sourcesContent":["import type { Awaitable, GenericEndpointContext } from \"@better-auth/core\";\nimport { createAuthEndpoint } from \"@better-auth/core/api\";\nimport { APIError, BASE_ERROR_CODES } from \"@better-auth/core/error\";\nimport * as z from \"zod\";\nimport { setSessionCookie } from \"../../../cookies\";\nimport {\n\tconstantTimeEqual,\n\tgenerateRandomString,\n\tsymmetricDecrypt,\n\tsymmetricEncrypt,\n} from \"../../../crypto\";\nimport { parseUserOutput } from \"../../../db/schema\";\nimport { TWO_FACTOR_ERROR_CODES } from \"../error-code\";\nimport type { TwoFactorProvider, UserWithTwoFactor } from \"../types\";\nimport { defaultKeyHasher } from \"../utils\";\nimport { verifyTwoFactor } from \"../verify-two-factor\";\n\nexport interface OTPOptions {\n\t/**\n\t * How long the opt will be valid for in\n\t * minutes\n\t *\n\t * @default \"3 mins\"\n\t */\n\tperiod?: number | undefined;\n\t/**\n\t * Number of digits for the OTP code\n\t *\n\t * @default 6\n\t */\n\tdigits?: number | undefined;\n\t/**\n\t * Send the otp to the user\n\t *\n\t * @param user - The user to send the otp to\n\t * @param otp - The otp to send\n\t * @param request - The request object\n\t * @returns void | Promise<void>\n\t */\n\tsendOTP?:\n\t\t| ((\n\t\t\t\t/**\n\t\t\t\t * The user to send the otp to\n\t\t\t\t * @type UserWithTwoFactor\n\t\t\t\t * @default UserWithTwoFactors\n\t\t\t\t */\n\t\t\t\tdata: {\n\t\t\t\t\tuser: UserWithTwoFactor;\n\t\t\t\t\totp: string;\n\t\t\t\t},\n\t\t\t\t/**\n\t\t\t\t * The request object\n\t\t\t\t */\n\t\t\t\tctx?: GenericEndpointContext,\n\t\t  ) => Awaitable<void>)\n\t\t| undefined;\n\t/**\n\t * The number of allowed attempts for the OTP\n\t *\n\t * @default 5\n\t */\n\tallowedAttempts?: number | undefined;\n\tstoreOTP?:\n\t\t| (\n\t\t\t\t| \"plain\"\n\t\t\t\t| \"encrypted\"\n\t\t\t\t| \"hashed\"\n\t\t\t\t| { hash: (token: string) => Promise<string> }\n\t\t\t\t| {\n\t\t\t\t\t\tencrypt: (token: string) => Promise<string>;\n\t\t\t\t\t\tdecrypt: (token: string) => Promise<string>;\n\t\t\t\t  }\n\t\t  )\n\t\t| undefined;\n}\n\nconst verifyOTPBodySchema = z.object({\n\tcode: z.string().meta({\n\t\tdescription: 'The otp code to verify. Eg: \"012345\"',\n\t}),\n\t/**\n\t * if true, the device will be trusted\n\t * for 30 days. It'll be refreshed on\n\t * every sign in request within this time.\n\t */\n\ttrustDevice: z.boolean().optional().meta({\n\t\tdescription:\n\t\t\t\"If true, the device will be trusted for 30 days. It'll be refreshed on every sign in request within this time. Eg: true\",\n\t}),\n});\n\nconst send2FaOTPBodySchema = z\n\t.object({\n\t\t/**\n\t\t * if true, the device will be trusted\n\t\t * for 30 days. It'll be refreshed on\n\t\t * every sign in request within this time.\n\t\t */\n\t\ttrustDevice: z.boolean().optional().meta({\n\t\t\tdescription:\n\t\t\t\t\"If true, the device will be trusted for 30 days. It'll be refreshed on every sign in request within this time. Eg: true\",\n\t\t}),\n\t})\n\t.optional();\n\n/**\n * The otp adapter is created from the totp adapter.\n */\nexport const otp2fa = (options?: OTPOptions | undefined) => {\n\tconst opts = {\n\t\tstoreOTP: \"plain\",\n\t\tdigits: 6,\n\t\t...options,\n\t\tperiod: (options?.period || 3) * 60 * 1000,\n\t};\n\n\tasync function storeOTP(ctx: GenericEndpointContext, otp: string) {\n\t\tif (opts.storeOTP === \"hashed\") {\n\t\t\treturn await defaultKeyHasher(otp);\n\t\t}\n\t\tif (typeof opts.storeOTP === \"object\" && \"hash\" in opts.storeOTP) {\n\t\t\treturn await opts.storeOTP.hash(otp);\n\t\t}\n\t\tif (typeof opts.storeOTP === \"object\" && \"encrypt\" in opts.storeOTP) {\n\t\t\treturn await opts.storeOTP.encrypt(otp);\n\t\t}\n\t\tif (opts.storeOTP === \"encrypted\") {\n\t\t\treturn await symmetricEncrypt({\n\t\t\t\tkey: ctx.context.secret,\n\t\t\t\tdata: otp,\n\t\t\t});\n\t\t}\n\t\treturn otp;\n\t}\n\n\tasync function decryptOrHashForComparison(\n\t\tctx: GenericEndpointContext,\n\t\tstoredOtp: string,\n\t\tuserInput: string,\n\t): Promise<[string, string]> {\n\t\tif (opts.storeOTP === \"hashed\") {\n\t\t\t// For hashed storage: hash the user input and compare with stored hash\n\t\t\treturn [storedOtp, await defaultKeyHasher(userInput)];\n\t\t}\n\t\tif (opts.storeOTP === \"encrypted\") {\n\t\t\t// For encrypted storage: decrypt stored value and compare with plain input\n\t\t\tconst decrypted = await symmetricDecrypt({\n\t\t\t\tkey: ctx.context.secret,\n\t\t\t\tdata: storedOtp,\n\t\t\t});\n\t\t\treturn [decrypted, userInput];\n\t\t}\n\t\tif (typeof opts.storeOTP === \"object\" && \"encrypt\" in opts.storeOTP) {\n\t\t\tconst decrypted = await opts.storeOTP.decrypt(storedOtp);\n\t\t\treturn [decrypted, userInput];\n\t\t}\n\t\tif (typeof opts.storeOTP === \"object\" && \"hash\" in opts.storeOTP) {\n\t\t\t// For custom hash: hash the user input and compare with stored hash\n\t\t\treturn [storedOtp, await opts.storeOTP.hash(userInput)];\n\t\t}\n\t\t// Plain storage: compare directly\n\t\treturn [storedOtp, userInput];\n\t}\n\n\t/**\n\t * Generate OTP and send it to the user.\n\t */\n\tconst send2FaOTP = createAuthEndpoint(\n\t\t\"/two-factor/send-otp\",\n\t\t{\n\t\t\tmethod: \"POST\",\n\t\t\tbody: send2FaOTPBodySchema,\n\t\t\tmetadata: {\n\t\t\t\topenapi: {\n\t\t\t\t\tsummary: \"Send two factor OTP\",\n\t\t\t\t\tdescription: \"Send two factor OTP to the user\",\n\t\t\t\t\tresponses: {\n\t\t\t\t\t\t200: {\n\t\t\t\t\t\t\tdescription: \"Successful response\",\n\t\t\t\t\t\t\tcontent: {\n\t\t\t\t\t\t\t\t\"application/json\": {\n\t\t\t\t\t\t\t\t\tschema: {\n\t\t\t\t\t\t\t\t\t\ttype: \"object\",\n\t\t\t\t\t\t\t\t\t\tproperties: {\n\t\t\t\t\t\t\t\t\t\t\tstatus: {\n\t\t\t\t\t\t\t\t\t\t\t\ttype: \"boolean\",\n\t\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t},\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t},\n\t\t},\n\t\tasync (ctx) => {\n\t\t\tif (!options || !options.sendOTP) {\n\t\t\t\tctx.context.logger.error(\n\t\t\t\t\t\"send otp isn't configured. Please configure the send otp function on otp options.\",\n\t\t\t\t);\n\t\t\t\tthrow APIError.from(\"BAD_REQUEST\", {\n\t\t\t\t\tmessage: \"otp isn't configured\",\n\t\t\t\t\tcode: \"OTP_NOT_CONFIGURED\",\n\t\t\t\t});\n\t\t\t}\n\t\t\tconst { session, key } = await verifyTwoFactor(ctx);\n\t\t\tconst code = generateRandomString(opts.digits, \"0-9\");\n\t\t\tconst hashedCode = await storeOTP(ctx, code);\n\t\t\tawait ctx.context.internalAdapter.createVerificationValue({\n\t\t\t\tvalue: `${hashedCode}:0`,\n\t\t\t\tidentifier: `2fa-otp-${key}`,\n\t\t\t\texpiresAt: new Date(Date.now() + opts.period),\n\t\t\t});\n\t\t\tconst sendOTPResult = options.sendOTP(\n\t\t\t\t{ user: session.user as UserWithTwoFactor, otp: code },\n\t\t\t\tctx,\n\t\t\t);\n\t\t\tif (sendOTPResult instanceof Promise) {\n\t\t\t\tawait ctx.context.runInBackgroundOrAwait(\n\t\t\t\t\tsendOTPResult.catch((e: unknown) => {\n\t\t\t\t\t\tctx.context.logger.error(\"Failed to send two-factor OTP\", e);\n\t\t\t\t\t}),\n\t\t\t\t);\n\t\t\t}\n\t\t\treturn ctx.json({ status: true });\n\t\t},\n\t);\n\n\tconst verifyOTP = createAuthEndpoint(\n\t\t\"/two-factor/verify-otp\",\n\t\t{\n\t\t\tmethod: \"POST\",\n\t\t\tbody: verifyOTPBodySchema,\n\t\t\tmetadata: {\n\t\t\t\topenapi: {\n\t\t\t\t\tsummary: \"Verify two factor OTP\",\n\t\t\t\t\tdescription: \"Verify two factor OTP\",\n\t\t\t\t\tresponses: {\n\t\t\t\t\t\t\"200\": {\n\t\t\t\t\t\t\tdescription: \"Two-factor OTP verified successfully\",\n\t\t\t\t\t\t\tcontent: {\n\t\t\t\t\t\t\t\t\"application/json\": {\n\t\t\t\t\t\t\t\t\tschema: {\n\t\t\t\t\t\t\t\t\t\ttype: \"object\",\n\t\t\t\t\t\t\t\t\t\tproperties: {\n\t\t\t\t\t\t\t\t\t\t\ttoken: {\n\t\t\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\t\t\tdescription:\n\t\t\t\t\t\t\t\t\t\t\t\t\t\"Session token for the authenticated session\",\n\t\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\t\tuser: {\n\t\t\t\t\t\t\t\t\t\t\t\ttype: \"object\",\n\t\t\t\t\t\t\t\t\t\t\t\tproperties: {\n\t\t\t\t\t\t\t\t\t\t\t\t\tid: {\n\t\t\t\t\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t\tdescription: \"Unique identifier of the user\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\t\t\t\temail: {\n\t\t\t\t\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t\tformat: \"email\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t\tnullable: true,\n\t\t\t\t\t\t\t\t\t\t\t\t\t\tdescription: \"User's email address\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\t\t\t\temailVerified: {\n\t\t\t\t\t\t\t\t\t\t\t\t\t\ttype: \"boolean\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t\tnullable: true,\n\t\t\t\t\t\t\t\t\t\t\t\t\t\tdescription: \"Whether the email is verified\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\t\t\t\tname: {\n\t\t\t\t\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t\tnullable: true,\n\t\t\t\t\t\t\t\t\t\t\t\t\t\tdescription: \"User's name\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\t\t\t\timage: {\n\t\t\t\t\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t\tformat: \"uri\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t\tnullable: true,\n\t\t\t\t\t\t\t\t\t\t\t\t\t\tdescription: \"User's profile image URL\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\t\t\t\tcreatedAt: {\n\t\t\t\t\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t\tformat: \"date-time\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t\tdescription: \"Timestamp when the user was created\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\t\t\t\tupdatedAt: {\n\t\t\t\t\t\t\t\t\t\t\t\t\t\ttype: \"string\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t\tformat: \"date-time\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t\tdescription:\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"Timestamp when the user was last updated\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\t\t\trequired: [\"id\", \"createdAt\", \"updatedAt\"],\n\t\t\t\t\t\t\t\t\t\t\t\tdescription: \"The authenticated user object\",\n\t\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t\trequired: [\"token\", \"user\"],\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t},\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t},\n\t\t},\n\t\tasync (ctx) => {\n\t\t\tconst { session, key, valid, invalid } = await verifyTwoFactor(ctx);\n\t\t\tconst toCheckOtp =\n\t\t\t\tawait ctx.context.internalAdapter.findVerificationValue(\n\t\t\t\t\t`2fa-otp-${key}`,\n\t\t\t\t);\n\t\t\tconst [otp, counter] = toCheckOtp?.value?.split(\":\") ?? [];\n\t\t\tif (!toCheckOtp || toCheckOtp.expiresAt < new Date()) {\n\t\t\t\tif (toCheckOtp) {\n\t\t\t\t\tawait ctx.context.internalAdapter.deleteVerificationValue(\n\t\t\t\t\t\ttoCheckOtp.id,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tthrow APIError.from(\n\t\t\t\t\t\"BAD_REQUEST\",\n\t\t\t\t\tTWO_FACTOR_ERROR_CODES.OTP_HAS_EXPIRED,\n\t\t\t\t);\n\t\t\t}\n\t\t\tconst allowedAttempts = options?.allowedAttempts || 5;\n\t\t\tif (parseInt(counter!) >= allowedAttempts) {\n\t\t\t\tawait ctx.context.internalAdapter.deleteVerificationValue(\n\t\t\t\t\ttoCheckOtp.id,\n\t\t\t\t);\n\t\t\t\tthrow APIError.from(\n\t\t\t\t\t\"BAD_REQUEST\",\n\t\t\t\t\tTWO_FACTOR_ERROR_CODES.TOO_MANY_ATTEMPTS_REQUEST_NEW_CODE,\n\t\t\t\t);\n\t\t\t}\n\t\t\tconst [storedValue, inputValue] = await decryptOrHashForComparison(\n\t\t\t\tctx,\n\t\t\t\totp!,\n\t\t\t\tctx.body.code,\n\t\t\t);\n\t\t\tconst isCodeValid = constantTimeEqual(\n\t\t\t\tnew TextEncoder().encode(storedValue),\n\t\t\t\tnew TextEncoder().encode(inputValue),\n\t\t\t);\n\t\t\tif (isCodeValid) {\n\t\t\t\tif (!session.user.twoFactorEnabled) {\n\t\t\t\t\tif (!session.session) {\n\t\t\t\t\t\tthrow APIError.from(\n\t\t\t\t\t\t\t\"BAD_REQUEST\",\n\t\t\t\t\t\t\tBASE_ERROR_CODES.FAILED_TO_CREATE_SESSION,\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\t\t\t\t\tconst updatedUser = await ctx.context.internalAdapter.updateUser(\n\t\t\t\t\t\tsession.user.id,\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\ttwoFactorEnabled: true,\n\t\t\t\t\t\t},\n\t\t\t\t\t);\n\t\t\t\t\tconst newSession = await ctx.context.internalAdapter.createSession(\n\t\t\t\t\t\tsession.user.id,\n\t\t\t\t\t\tfalse,\n\t\t\t\t\t\tsession.session,\n\t\t\t\t\t);\n\t\t\t\t\tawait ctx.context.internalAdapter.deleteSession(\n\t\t\t\t\t\tsession.session.token,\n\t\t\t\t\t);\n\t\t\t\t\tawait setSessionCookie(ctx, {\n\t\t\t\t\t\tsession: newSession,\n\t\t\t\t\t\tuser: updatedUser,\n\t\t\t\t\t});\n\t\t\t\t\treturn ctx.json({\n\t\t\t\t\t\ttoken: newSession.token,\n\t\t\t\t\t\tuser: parseUserOutput(ctx.context.options, updatedUser),\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t\treturn valid(ctx);\n\t\t\t} else {\n\t\t\t\tawait ctx.context.internalAdapter.updateVerificationValue(\n\t\t\t\t\ttoCheckOtp.id,\n\t\t\t\t\t{\n\t\t\t\t\t\tvalue: `${otp}:${(parseInt(counter!, 10) || 0) + 1}`,\n\t\t\t\t\t},\n\t\t\t\t);\n\t\t\t\treturn invalid(\"INVALID_CODE\");\n\t\t\t}\n\t\t},\n\t);\n\n\treturn {\n\t\tid: \"otp\",\n\t\tendpoints: {\n\t\t\t/**\n\t\t\t * ### Endpoint\n\t\t\t *\n\t\t\t * POST `/two-factor/send-otp`\n\t\t\t *\n\t\t\t * ### API Methods\n\t\t\t *\n\t\t\t * **server:**\n\t\t\t * `auth.api.send2FaOTP`\n\t\t\t *\n\t\t\t * **client:**\n\t\t\t * `authClient.twoFactor.sendOtp`\n\t\t\t *\n\t\t\t * @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/2fa#api-method-two-factor-send-otp)\n\t\t\t */\n\t\t\tsendTwoFactorOTP: send2FaOTP,\n\t\t\t/**\n\t\t\t * ### Endpoint\n\t\t\t *\n\t\t\t * POST `/two-factor/verify-otp`\n\t\t\t *\n\t\t\t * ### API Methods\n\t\t\t *\n\t\t\t * **server:**\n\t\t\t * `auth.api.verifyOTP`\n\t\t\t *\n\t\t\t * **client:**\n\t\t\t * `authClient.twoFactor.verifyOtp`\n\t\t\t *\n\t\t\t * @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/2fa#api-method-two-factor-verify-otp)\n\t\t\t */\n\t\t\tverifyTwoFactorOTP: verifyOTP,\n\t\t},\n\t} satisfies TwoFactorProvider;\n};\n"],"mappings":";;;;;;;;;;;;;AA4EA,MAAM,sBAAsB,EAAE,OAAO;CACpC,MAAM,EAAE,QAAQ,CAAC,KAAK,EACrB,aAAa,0CACb,CAAC;CAMF,aAAa,EAAE,SAAS,CAAC,UAAU,CAAC,KAAK,EACxC,aACC,2HACD,CAAC;CACF,CAAC;AAEF,MAAM,uBAAuB,EAC3B,OAAO,EAMP,aAAa,EAAE,SAAS,CAAC,UAAU,CAAC,KAAK,EACxC,aACC,2HACD,CAAC,EACF,CAAC,CACD,UAAU;;;;AAKZ,MAAa,UAAU,YAAqC;CAC3D,MAAM,OAAO;EACZ,UAAU;EACV,QAAQ;EACR,GAAG;EACH,SAAS,SAAS,UAAU,KAAK,KAAK;EACtC;CAED,eAAe,SAAS,KAA6B,KAAa;AACjE,MAAI,KAAK,aAAa,SACrB,QAAO,MAAM,iBAAiB,IAAI;AAEnC,MAAI,OAAO,KAAK,aAAa,YAAY,UAAU,KAAK,SACvD,QAAO,MAAM,KAAK,SAAS,KAAK,IAAI;AAErC,MAAI,OAAO,KAAK,aAAa,YAAY,aAAa,KAAK,SAC1D,QAAO,MAAM,KAAK,SAAS,QAAQ,IAAI;AAExC,MAAI,KAAK,aAAa,YACrB,QAAO,MAAM,iBAAiB;GAC7B,KAAK,IAAI,QAAQ;GACjB,MAAM;GACN,CAAC;AAEH,SAAO;;CAGR,eAAe,2BACd,KACA,WACA,WAC4B;AAC5B,MAAI,KAAK,aAAa,SAErB,QAAO,CAAC,WAAW,MAAM,iBAAiB,UAAU,CAAC;AAEtD,MAAI,KAAK,aAAa,YAMrB,QAAO,CAJW,MAAM,iBAAiB;GACxC,KAAK,IAAI,QAAQ;GACjB,MAAM;GACN,CAAC,EACiB,UAAU;AAE9B,MAAI,OAAO,KAAK,aAAa,YAAY,aAAa,KAAK,SAE1D,QAAO,CADW,MAAM,KAAK,SAAS,QAAQ,UAAU,EACrC,UAAU;AAE9B,MAAI,OAAO,KAAK,aAAa,YAAY,UAAU,KAAK,SAEvD,QAAO,CAAC,WAAW,MAAM,KAAK,SAAS,KAAK,UAAU,CAAC;AAGxD,SAAO,CAAC,WAAW,UAAU;;AAiO9B,QAAO;EACN,IAAI;EACJ,WAAW;GAgBV,kBA7OiB,mBAClB,wBACA;IACC,QAAQ;IACR,MAAM;IACN,UAAU,EACT,SAAS;KACR,SAAS;KACT,aAAa;KACb,WAAW,EACV,KAAK;MACJ,aAAa;MACb,SAAS,EACR,oBAAoB,EACnB,QAAQ;OACP,MAAM;OACN,YAAY,EACX,QAAQ,EACP,MAAM,WACN,EACD;OACD,EACD,EACD;MACD,EACD;KACD,EACD;IACD,EACD,OAAO,QAAQ;AACd,QAAI,CAAC,WAAW,CAAC,QAAQ,SAAS;AACjC,SAAI,QAAQ,OAAO,MAClB,oFACA;AACD,WAAM,SAAS,KAAK,eAAe;MAClC,SAAS;MACT,MAAM;MACN,CAAC;;IAEH,MAAM,EAAE,SAAS,QAAQ,MAAM,gBAAgB,IAAI;IACnD,MAAM,OAAO,qBAAqB,KAAK,QAAQ,MAAM;IACrD,MAAM,aAAa,MAAM,SAAS,KAAK,KAAK;AAC5C,UAAM,IAAI,QAAQ,gBAAgB,wBAAwB;KACzD,OAAO,GAAG,WAAW;KACrB,YAAY,WAAW;KACvB,WAAW,IAAI,KAAK,KAAK,KAAK,GAAG,KAAK,OAAO;KAC7C,CAAC;IACF,MAAM,gBAAgB,QAAQ,QAC7B;KAAE,MAAM,QAAQ;KAA2B,KAAK;KAAM,EACtD,IACA;AACD,QAAI,yBAAyB,QAC5B,OAAM,IAAI,QAAQ,uBACjB,cAAc,OAAO,MAAe;AACnC,SAAI,QAAQ,OAAO,MAAM,iCAAiC,EAAE;MAC3D,CACF;AAEF,WAAO,IAAI,KAAK,EAAE,QAAQ,MAAM,CAAC;KAElC;GAiMC,oBA/LgB,mBACjB,0BACA;IACC,QAAQ;IACR,MAAM;IACN,UAAU,EACT,SAAS;KACR,SAAS;KACT,aAAa;KACb,WAAW,EACV,OAAO;MACN,aAAa;MACb,SAAS,EACR,oBAAoB,EACnB,QAAQ;OACP,MAAM;OACN,YAAY;QACX,OAAO;SACN,MAAM;SACN,aACC;SACD;QACD,MAAM;SACL,MAAM;SACN,YAAY;UACX,IAAI;WACH,MAAM;WACN,aAAa;WACb;UACD,OAAO;WACN,MAAM;WACN,QAAQ;WACR,UAAU;WACV,aAAa;WACb;UACD,eAAe;WACd,MAAM;WACN,UAAU;WACV,aAAa;WACb;UACD,MAAM;WACL,MAAM;WACN,UAAU;WACV,aAAa;WACb;UACD,OAAO;WACN,MAAM;WACN,QAAQ;WACR,UAAU;WACV,aAAa;WACb;UACD,WAAW;WACV,MAAM;WACN,QAAQ;WACR,aAAa;WACb;UACD,WAAW;WACV,MAAM;WACN,QAAQ;WACR,aACC;WACD;UACD;SACD,UAAU;UAAC;UAAM;UAAa;UAAY;SAC1C,aAAa;SACb;QACD;OACD,UAAU,CAAC,SAAS,OAAO;OAC3B,EACD,EACD;MACD,EACD;KACD,EACD;IACD,EACD,OAAO,QAAQ;IACd,MAAM,EAAE,SAAS,KAAK,OAAO,YAAY,MAAM,gBAAgB,IAAI;IACnE,MAAM,aACL,MAAM,IAAI,QAAQ,gBAAgB,sBACjC,WAAW,MACX;IACF,MAAM,CAAC,KAAK,WAAW,YAAY,OAAO,MAAM,IAAI,IAAI,EAAE;AAC1D,QAAI,CAAC,cAAc,WAAW,4BAAY,IAAI,MAAM,EAAE;AACrD,SAAI,WACH,OAAM,IAAI,QAAQ,gBAAgB,wBACjC,WAAW,GACX;AAEF,WAAM,SAAS,KACd,eACA,uBAAuB,gBACvB;;IAEF,MAAM,kBAAkB,SAAS,mBAAmB;AACpD,QAAI,SAAS,QAAS,IAAI,iBAAiB;AAC1C,WAAM,IAAI,QAAQ,gBAAgB,wBACjC,WAAW,GACX;AACD,WAAM,SAAS,KACd,eACA,uBAAuB,mCACvB;;IAEF,MAAM,CAAC,aAAa,cAAc,MAAM,2BACvC,KACA,KACA,IAAI,KAAK,KACT;AAKD,QAJoB,kBACnB,IAAI,aAAa,CAAC,OAAO,YAAY,EACrC,IAAI,aAAa,CAAC,OAAO,WAAW,CACpC,EACgB;AAChB,SAAI,CAAC,QAAQ,KAAK,kBAAkB;AACnC,UAAI,CAAC,QAAQ,QACZ,OAAM,SAAS,KACd,eACA,iBAAiB,yBACjB;MAEF,MAAM,cAAc,MAAM,IAAI,QAAQ,gBAAgB,WACrD,QAAQ,KAAK,IACb,EACC,kBAAkB,MAClB,CACD;MACD,MAAM,aAAa,MAAM,IAAI,QAAQ,gBAAgB,cACpD,QAAQ,KAAK,IACb,OACA,QAAQ,QACR;AACD,YAAM,IAAI,QAAQ,gBAAgB,cACjC,QAAQ,QAAQ,MAChB;AACD,YAAM,iBAAiB,KAAK;OAC3B,SAAS;OACT,MAAM;OACN,CAAC;AACF,aAAO,IAAI,KAAK;OACf,OAAO,WAAW;OAClB,MAAM,gBAAgB,IAAI,QAAQ,SAAS,YAAY;OACvD,CAAC;;AAEH,YAAO,MAAM,IAAI;WACX;AACN,WAAM,IAAI,QAAQ,gBAAgB,wBACjC,WAAW,IACX,EACC,OAAO,GAAG,IAAI,IAAI,SAAS,SAAU,GAAG,IAAI,KAAK,KACjD,CACD;AACD,YAAO,QAAQ,eAAe;;KAGhC;GAqCC;EACD"}

package/dist/plugins/two-factor/schema.d.mts

@@ -0,0 +1,41 @@
+//#region src/plugins/two-factor/schema.d.ts
+declare const schema: {
+  user: {
+    fields: {
+      twoFactorEnabled: {
+        type: "boolean";
+        required: false;
+        defaultValue: false;
+        input: false;
+      };
+    };
+  };
+  twoFactor: {
+    fields: {
+      secret: {
+        type: "string";
+        required: true;
+        returned: false;
+        index: true;
+      };
+      backupCodes: {
+        type: "string";
+        required: true;
+        returned: false;
+      };
+      userId: {
+        type: "string";
+        required: true;
+        returned: false;
+        references: {
+          model: string;
+          field: string;
+        };
+        index: true;
+      };
+    };
+  };
+};
+//#endregion
+export { schema };
+//# sourceMappingURL=schema.d.mts.map

package/dist/plugins/two-factor/schema.mjs

@@ -0,0 +1,36 @@
+//#region src/plugins/two-factor/schema.ts
+const schema = {
+	user: { fields: { twoFactorEnabled: {
+		type: "boolean",
+		required: false,
+		defaultValue: false,
+		input: false
+	} } },
+	twoFactor: { fields: {
+		secret: {
+			type: "string",
+			required: true,
+			returned: false,
+			index: true
+		},
+		backupCodes: {
+			type: "string",
+			required: true,
+			returned: false
+		},
+		userId: {
+			type: "string",
+			required: true,
+			returned: false,
+			references: {
+				model: "user",
+				field: "id"
+			},
+			index: true
+		}
+	} }
+};
+
+//#endregion
+export { schema };
+//# sourceMappingURL=schema.mjs.map

package/dist/plugins/two-factor/schema.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.mjs","names":[],"sources":["../../../src/plugins/two-factor/schema.ts"],"sourcesContent":["import type { BetterAuthPluginDBSchema } from \"@better-auth/core/db\";\n\nexport const schema = {\n\tuser: {\n\t\tfields: {\n\t\t\ttwoFactorEnabled: {\n\t\t\t\ttype: \"boolean\",\n\t\t\t\trequired: false,\n\t\t\t\tdefaultValue: false,\n\t\t\t\tinput: false,\n\t\t\t},\n\t\t},\n\t},\n\ttwoFactor: {\n\t\tfields: {\n\t\t\tsecret: {\n\t\t\t\ttype: \"string\",\n\t\t\t\trequired: true,\n\t\t\t\treturned: false,\n\t\t\t\tindex: true,\n\t\t\t},\n\t\t\tbackupCodes: {\n\t\t\t\ttype: \"string\",\n\t\t\t\trequired: true,\n\t\t\t\treturned: false,\n\t\t\t},\n\t\t\tuserId: {\n\t\t\t\ttype: \"string\",\n\t\t\t\trequired: true,\n\t\t\t\treturned: false,\n\t\t\t\treferences: {\n\t\t\t\t\tmodel: \"user\",\n\t\t\t\t\tfield: \"id\",\n\t\t\t\t},\n\t\t\t\tindex: true,\n\t\t\t},\n\t\t},\n\t},\n} satisfies BetterAuthPluginDBSchema;\n"],"mappings":";AAEA,MAAa,SAAS;CACrB,MAAM,EACL,QAAQ,EACP,kBAAkB;EACjB,MAAM;EACN,UAAU;EACV,cAAc;EACd,OAAO;EACP,EACD,EACD;CACD,WAAW,EACV,QAAQ;EACP,QAAQ;GACP,MAAM;GACN,UAAU;GACV,UAAU;GACV,OAAO;GACP;EACD,aAAa;GACZ,MAAM;GACN,UAAU;GACV,UAAU;GACV;EACD,QAAQ;GACP,MAAM;GACN,UAAU;GACV,UAAU;GACV,YAAY;IACX,OAAO;IACP,OAAO;IACP;GACD,OAAO;GACP;EACD,EACD;CACD"}

package/dist/plugins/two-factor/totp/index.d.mts

@@ -0,0 +1,210 @@
+import { BackupCodeOptions } from "../backup-codes/index.mjs";
+import { UserWithTwoFactor } from "../types.mjs";
+import * as better_call0 from "better-call";
+import * as z from "zod";
+
+//#region src/plugins/two-factor/totp/index.d.ts
+type TOTPOptions = {
+  /**
+   * Issuer
+   */
+  issuer?: string | undefined;
+  /**
+   * How many digits the otp to be
+   *
+   * @default 6
+   */
+  digits?: (6 | 8) | undefined;
+  /**
+   * Period for otp in seconds.
+   * @default 30
+   */
+  period?: number | undefined;
+  /**
+   * Backup codes configuration
+   */
+  backupCodes?: BackupCodeOptions | undefined;
+  /**
+   * Disable totp
+   */
+  disable?: boolean | undefined;
+};
+declare const totp2fa: (options?: TOTPOptions | undefined) => {
+  id: "totp";
+  endpoints: {
+    /**
+     * ### Endpoint
+     *
+     * POST `/totp/generate`
+     *
+     * ### API Methods
+     *
+     * **server:**
+     * `auth.api.generateTOTP`
+     *
+     * @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/2fa#totp)
+     */
+    generateTOTP: better_call0.StrictEndpoint<string, {
+      method: "POST";
+      body: z.ZodObject<{
+        secret: z.ZodString;
+      }, z.core.$strip>;
+      metadata: {
+        openapi: {
+          summary: string;
+          description: string;
+          responses: {
+            200: {
+              description: string;
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object";
+                    properties: {
+                      code: {
+                        type: string;
+                      };
+                    };
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+    }, {
+      code: string;
+    }>;
+    /**
+     * ### Endpoint
+     *
+     * POST `/two-factor/get-totp-uri`
+     *
+     * ### API Methods
+     *
+     * **server:**
+     * `auth.api.getTOTPURI`
+     *
+     * **client:**
+     * `authClient.twoFactor.getTotpUri`
+     *
+     * @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/2fa#getting-totp-uri)
+     */
+    getTOTPURI: better_call0.StrictEndpoint<"/two-factor/get-totp-uri", {
+      method: "POST";
+      use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+        session: {
+          session: Record<string, any> & {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            userId: string;
+            expiresAt: Date;
+            token: string;
+            ipAddress?: string | null | undefined;
+            userAgent?: string | null | undefined;
+          };
+          user: Record<string, any> & {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            email: string;
+            emailVerified: boolean;
+            name: string;
+            image?: string | null | undefined;
+          };
+        };
+      }>)[];
+      body: z.ZodObject<{
+        password: z.ZodString;
+      }, z.core.$strip>;
+      metadata: {
+        openapi: {
+          summary: string;
+          description: string;
+          responses: {
+            200: {
+              description: string;
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object";
+                    properties: {
+                      totpURI: {
+                        type: string;
+                      };
+                    };
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+    }, {
+      totpURI: string;
+    }>;
+    /**
+     * ### Endpoint
+     *
+     * POST `/two-factor/verify-totp`
+     *
+     * ### API Methods
+     *
+     * **server:**
+     * `auth.api.verifyTOTP`
+     *
+     * **client:**
+     * `authClient.twoFactor.verifyTotp`
+     *
+     * @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/2fa#verifying-totp)
+     */
+    verifyTOTP: better_call0.StrictEndpoint<"/two-factor/verify-totp", {
+      method: "POST";
+      body: z.ZodObject<{
+        code: z.ZodString;
+        trustDevice: z.ZodOptional<z.ZodBoolean>;
+      }, z.core.$strip>;
+      metadata: {
+        openapi: {
+          summary: string;
+          description: string;
+          responses: {
+            200: {
+              description: string;
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object";
+                    properties: {
+                      status: {
+                        type: string;
+                      };
+                    };
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+    }, {
+      token: string;
+      user: UserWithTwoFactor;
+    } | {
+      token: string;
+      user: Record<string, any> & {
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        email: string;
+        emailVerified: boolean;
+        name: string;
+        image?: string | null | undefined;
+      };
+    }>;
+  };
+};
+//#endregion
+export { TOTPOptions, totp2fa };
+//# sourceMappingURL=index.d.mts.map

package/dist/plugins/two-factor/totp/index.mjs

@@ -0,0 +1,157 @@
+import { symmetricDecrypt } from "../../../crypto/index.mjs";
+import { setSessionCookie } from "../../../cookies/index.mjs";
+import { sessionMiddleware } from "../../../api/routes/session.mjs";
+import "../../../api/index.mjs";
+import { TWO_FACTOR_ERROR_CODES } from "../error-code.mjs";
+import { verifyTwoFactor } from "../verify-two-factor.mjs";
+import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
+import { createAuthEndpoint } from "@better-auth/core/api";
+import * as z from "zod";
+import { createOTP } from "@better-auth/utils/otp";
+
+//#region src/plugins/two-factor/totp/index.ts
+const generateTOTPBodySchema = z.object({ secret: z.string().meta({ description: "The secret to generate the TOTP code" }) });
+const getTOTPURIBodySchema = z.object({ password: z.string().meta({ description: "User password" }) });
+const verifyTOTPBodySchema = z.object({
+	code: z.string().meta({ description: "The otp code to verify. Eg: \"012345\"" }),
+	trustDevice: z.boolean().meta({ description: "If true, the device will be trusted for 30 days. It'll be refreshed on every sign in request within this time. Eg: true" }).optional()
+});
+const totp2fa = (options) => {
+	const opts = {
+		...options,
+		digits: options?.digits || 6,
+		period: options?.period || 30
+	};
+	const twoFactorTable = "twoFactor";
+	return {
+		id: "totp",
+		endpoints: {
+			generateTOTP: createAuthEndpoint({
+				method: "POST",
+				body: generateTOTPBodySchema,
+				metadata: { openapi: {
+					summary: "Generate TOTP code",
+					description: "Use this endpoint to generate a TOTP code",
+					responses: { 200: {
+						description: "Successful response",
+						content: { "application/json": { schema: {
+							type: "object",
+							properties: { code: { type: "string" } }
+						} } }
+					} }
+				} }
+			}, async (ctx) => {
+				if (options?.disable) {
+					ctx.context.logger.error("totp isn't configured. please pass totp option on two factor plugin to enable totp");
+					throw APIError.from("BAD_REQUEST", {
+						message: "totp isn't configured",
+						code: "TOTP_NOT_CONFIGURED"
+					});
+				}
+				return { code: await createOTP(ctx.body.secret, {
+					period: opts.period,
+					digits: opts.digits
+				}).totp() };
+			}),
+			getTOTPURI: createAuthEndpoint("/two-factor/get-totp-uri", {
+				method: "POST",
+				use: [sessionMiddleware],
+				body: getTOTPURIBodySchema,
+				metadata: { openapi: {
+					summary: "Get TOTP URI",
+					description: "Use this endpoint to get the TOTP URI",
+					responses: { 200: {
+						description: "Successful response",
+						content: { "application/json": { schema: {
+							type: "object",
+							properties: { totpURI: { type: "string" } }
+						} } }
+					} }
+				} }
+			}, async (ctx) => {
+				if (options?.disable) {
+					ctx.context.logger.error("totp isn't configured. please pass totp option on two factor plugin to enable totp");
+					throw APIError.from("BAD_REQUEST", {
+						message: "totp isn't configured",
+						code: "TOTP_NOT_CONFIGURED"
+					});
+				}
+				const user = ctx.context.session.user;
+				const twoFactor = await ctx.context.adapter.findOne({
+					model: twoFactorTable,
+					where: [{
+						field: "userId",
+						value: user.id
+					}]
+				});
+				if (!twoFactor) throw APIError.from("BAD_REQUEST", TWO_FACTOR_ERROR_CODES.TOTP_NOT_ENABLED);
+				const secret = await symmetricDecrypt({
+					key: ctx.context.secret,
+					data: twoFactor.secret
+				});
+				await ctx.context.password.checkPassword(user.id, ctx);
+				return { totpURI: createOTP(secret, {
+					digits: opts.digits,
+					period: opts.period
+				}).url(options?.issuer || ctx.context.appName, user.email) };
+			}),
+			verifyTOTP: createAuthEndpoint("/two-factor/verify-totp", {
+				method: "POST",
+				body: verifyTOTPBodySchema,
+				metadata: { openapi: {
+					summary: "Verify two factor TOTP",
+					description: "Verify two factor TOTP",
+					responses: { 200: {
+						description: "Successful response",
+						content: { "application/json": { schema: {
+							type: "object",
+							properties: { status: { type: "boolean" } }
+						} } }
+					} }
+				} }
+			}, async (ctx) => {
+				if (options?.disable) {
+					ctx.context.logger.error("totp isn't configured. please pass totp option on two factor plugin to enable totp");
+					throw APIError.from("BAD_REQUEST", {
+						message: "totp isn't configured",
+						code: "TOTP_NOT_CONFIGURED"
+					});
+				}
+				const { session, valid, invalid } = await verifyTwoFactor(ctx);
+				const user = session.user;
+				const twoFactor = await ctx.context.adapter.findOne({
+					model: twoFactorTable,
+					where: [{
+						field: "userId",
+						value: user.id
+					}]
+				});
+				if (!twoFactor) throw APIError.from("BAD_REQUEST", TWO_FACTOR_ERROR_CODES.TOTP_NOT_ENABLED);
+				if (!await createOTP(await symmetricDecrypt({
+					key: ctx.context.secret,
+					data: twoFactor.secret
+				}), {
+					period: opts.period,
+					digits: opts.digits
+				}).verify(ctx.body.code)) return invalid("INVALID_CODE");
+				if (!user.twoFactorEnabled) {
+					if (!session.session) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.FAILED_TO_CREATE_SESSION);
+					const updatedUser = await ctx.context.internalAdapter.updateUser(user.id, { twoFactorEnabled: true });
+					const newSession = await ctx.context.internalAdapter.createSession(user.id, false, session.session).catch((e) => {
+						throw e;
+					});
+					await ctx.context.internalAdapter.deleteSession(session.session.token);
+					await setSessionCookie(ctx, {
+						session: newSession,
+						user: updatedUser
+					});
+				}
+				return valid(ctx);
+			})
+		}
+	};
+};
+
+//#endregion
+export { totp2fa };
+//# sourceMappingURL=index.mjs.map