npm - @syncello/auth - Versions diffs - 3.3.1 → 3.4.1 - Mend

@syncello/auth 3.3.1 → 3.4.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (7) hide show

package/dist/index.cjs CHANGED Viewed

@@ -1341,11 +1341,12 @@ var import_drizzle_orm4 = require("drizzle-orm");
 // src/factory.ts
 function createAuth(config) {
-  const { db, schema, getEnv } = config;
+  const { db, schema, getEnv, emailBranding } = config;
   const getContext = (c) => ({
     db,
     schema,
-    env: getEnv(c)
+    env: getEnv(c),
+    emailBranding
   });
   return {
     db,
@@ -1927,11 +1928,15 @@ function generateEmailTemplate(options) {
     appName = "App",
     buttonBgColor = "#00fe9a",
     buttonTextColor = "#000004",
-    buttonFontWeight = 500
+    buttonFontWeight = 500,
+    buttonRadius = "6px",
+    logoUrl,
+    footerColor = "#1e1b4b"
   } = options;
   const safeButtonUrl = buttonUrl ? sanitizeEmailUrl(buttonUrl, appUrl) : "";
   const safeAppUrl = appUrl ? sanitizeEmailUrl(appUrl, appUrl) : "";
   const safeMarketingUrl = marketingUrl ? sanitizeEmailUrl(marketingUrl, appUrl) : "";
+  const safeLogoUrl = logoUrl ? sanitizeEmailUrl(logoUrl, appUrl) : `${safeAppUrl.replace(/\/$/, "")}/email-header-image.png`;
   return `
     <!DOCTYPE html>
     <html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" lang="en">
@@ -2071,7 +2076,7 @@ function generateEmailTemplate(options) {
                                   <td class="pad" style="padding-left:40px;padding-right:40px;width:100%;">
                                     <div class="alignment" align="center">
                                       <div class="fullWidth" style="max-width: 50%;">
-                                        <img src="${safeAppUrl}/email-header-image.png" style="display: block; height: auto; border: 0; width: 100%;" alt="${appName}" title="${appName}" height="auto">
+                                        <img src="${safeLogoUrl}" style="display: block; height: auto; border: 0; width: 100%;" alt="${appName}" title="${appName}" height="auto">
                                       </div>
                                     </div>
                                   </td>
@@ -2128,7 +2133,7 @@ function generateEmailTemplate(options) {
                                         <v:textbox inset="0px,0px,0px,0px">
                                           <center dir="false" style="color:${buttonTextColor};font-family:'Montserrat',Arial,sans-serif;font-size:16px;font-weight:${buttonFontWeight};">
                                       <![endif]-->
-                                      <a href="${safeButtonUrl}" style="background-color: ${buttonBgColor}; border: 0px solid transparent; border-radius: 6px; color: ${buttonTextColor}; display: inline-block; font-family: 'Montserrat', Arial, sans-serif; font-size: 16px; font-weight: ${buttonFontWeight}; mso-border-alt: none; padding: 10px 20px; text-align: center; text-decoration: none; text-transform: capitalize; word-break: keep-all;">
+                                      <a href="${safeButtonUrl}" style="background-color: ${buttonBgColor}; border: 0px solid transparent; border-radius: ${buttonRadius}; color: ${buttonTextColor}; display: inline-block; font-family: 'Montserrat', Arial, sans-serif; font-size: 16px; font-weight: ${buttonFontWeight}; mso-border-alt: none; padding: 10px 20px; text-align: center; text-decoration: none; text-transform: capitalize; word-break: keep-all;">
                                         ${buttonText}
                                       </a>
                                       <!--[if mso]>
@@ -2219,7 +2224,7 @@ function generateEmailTemplate(options) {
                 <tbody>
                   <tr>
                     <td>
-                      <table class="row-content stack" align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="mso-table-lspace: 0pt; mso-table-rspace: 0pt; background-color: #1e1b4b; color: #000000; max-width: 640px; width: 100%; margin: 0 auto;">
+                      <table class="row-content stack" align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="mso-table-lspace: 0pt; mso-table-rspace: 0pt; background-color: ${footerColor}; color: #000000; max-width: 640px; width: 100%; margin: 0 auto;">
                         <tbody>
                           <tr>
                             <td class="column column-1" width="100%" style="mso-table-lspace: 0pt; mso-table-rspace: 0pt; font-weight: 400; text-align: left; vertical-align: top; padding: 20px;">
@@ -2278,7 +2283,7 @@ function extractAppUrl(url) {
     return "https://your-domain.com";
   }
 }
-function generateVerificationEmail(data, appName = "Your App", configuredAppUrl = "") {
+function generateVerificationEmail(data, appName = "Your App", configuredAppUrl = "", branding) {
   const { email, verificationUrl, firstName } = data;
   const appUrl = configuredAppUrl;
   const safeUrl = sanitizeEmailUrl(verificationUrl, appUrl);
@@ -2288,12 +2293,10 @@ function generateVerificationEmail(data, appName = "Your App", configuredAppUrl
     body: `Please verify that your email address is <strong>${escapeHtml(email)}</strong>, and that you entered it when signing up for ${escapeHtml(appName)}.`,
     buttonText: "Verify Email",
     buttonUrl: safeUrl,
-    buttonBgColor: "#00fe9a",
-    buttonTextColor: "#000004",
-    buttonFontWeight: 500,
     welcomeMessage: safeFirstName ? `Hi ${safeFirstName}, Welcome to ${escapeHtml(appName)}!` : void 0,
     footerNote: "",
-    appUrl
+    appUrl,
+    ...branding
   });
   return {
     to: email,
@@ -2313,7 +2316,7 @@ If you didn't create an account with ${appName}, you can safely ignore this emai
     }
   };
 }
-function generatePasswordResetEmail(data, appName = "Your App", configuredAppUrl = "") {
+function generatePasswordResetEmail(data, appName = "Your App", configuredAppUrl = "", branding) {
   const { email, resetUrl } = data;
   const appUrl = configuredAppUrl;
   const safeUrl = sanitizeEmailUrl(resetUrl, appUrl);
@@ -2322,15 +2325,13 @@ function generatePasswordResetEmail(data, appName = "Your App", configuredAppUrl
     body: "We received a request to reset your password. Click the button below to create a new password.",
     buttonText: "Reset Password",
     buttonUrl: safeUrl,
-    buttonBgColor: "#00fe9a",
-    buttonTextColor: "#000004",
-    buttonFontWeight: 500,
     securityWarning: `
 			<strong>Link expires in 1 hour.</strong><br>
 			For security, this link can only be used once.
 		`,
     footerNote: "If you didn't request this change, no action is needed. Your password will remain unchanged.",
-    appUrl
+    appUrl,
+    ...branding
   });
   return {
     to: email,
@@ -2350,7 +2351,7 @@ If you didn't request a password reset, you can safely ignore this email.`,
     }
   };
 }
-function generateEmailChangeConfirmation(data, appName = "Your App", configuredAppUrl = "") {
+function generateEmailChangeConfirmation(data, appName = "Your App", configuredAppUrl = "", branding) {
   const { newEmail, confirmUrl } = data;
   const appUrl = configuredAppUrl;
   const safeUrl = sanitizeEmailUrl(confirmUrl, appUrl);
@@ -2359,15 +2360,13 @@ function generateEmailChangeConfirmation(data, appName = "Your App", configuredA
     body: `We received a request to change your ${escapeHtml(appName)} account email to this address. Click the button below to confirm this change.`,
     buttonText: "Confirm Email Change",
     buttonUrl: safeUrl,
-    buttonBgColor: "#00fe9a",
-    buttonTextColor: "#000004",
-    buttonFontWeight: 500,
     securityWarning: `
 			<strong>This link expires in 24 hours.</strong><br>
 			For security, this link can only be used once.
 		`,
     footerNote: "If you didn't request this change, you can safely ignore this email.",
-    appUrl
+    appUrl,
+    ...branding
   });
   return {
     to: newEmail,
@@ -2389,7 +2388,7 @@ If you didn't request this change, you can safely ignore this email.`,
     }
   };
 }
-function generateEmailChangeNotification(data, appName = "Your App", configuredAppUrl = "") {
+function generateEmailChangeNotification(data, appName = "Your App", configuredAppUrl = "", branding) {
   const { oldEmail, newEmail, cancelUrl } = data;
   const appUrl = configuredAppUrl;
   const safeUrl = sanitizeEmailUrl(cancelUrl, appUrl);
@@ -2399,15 +2398,13 @@ function generateEmailChangeNotification(data, appName = "Your App", configuredA
     body: `Someone requested to change your ${escapeHtml(appName)} account email to <strong>${safeNewEmail}</strong>.`,
     buttonText: "This Wasn't Me - Cancel Change",
     buttonUrl: safeUrl,
-    buttonBgColor: "#00fe9a",
-    buttonTextColor: "#000004",
-    buttonFontWeight: 500,
     securityWarning: `
 			If you made this request, no action is needed.<br>
 			Complete the change by clicking the link sent to your new email address.
 		`,
     footerNote: "If you didn't request this change, click the button above to cancel it.",
-    appUrl
+    appUrl,
+    ...branding
   });
   return {
     to: oldEmail,
@@ -2427,7 +2424,7 @@ ${safeUrl}`,
     }
   };
 }
-function generate2faCodeEmail(data, appName = "Your App", appUrl = "") {
+function generate2faCodeEmail(data, appName = "Your App", appUrl = "", branding) {
   const { email, firstName, code } = data;
   const safeFirstName = firstName ? escapeHtml(firstName) : "there";
   const html = generateEmailTemplate({
@@ -2442,7 +2439,8 @@ function generate2faCodeEmail(data, appName = "Your App", appUrl = "") {
     buttonText: "",
     buttonUrl: "",
     footerNote: "",
-    appUrl
+    appUrl,
+    ...branding
   });
   return {
     to: email,
@@ -2462,7 +2460,7 @@ If you didn't request this code, you can safely ignore this email.
     tags: { type: "2fa_code" }
   };
 }
-function generate2faEnabledEmail(data, appName = "Your App", appUrl = "") {
+function generate2faEnabledEmail(data, appName = "Your App", appUrl = "", branding) {
   const { email, firstName, method } = data;
   const safeFirstName = firstName ? escapeHtml(firstName) : "there";
   const methodName = method === "totp" ? "an authenticator app" : "email codes";
@@ -2476,7 +2474,8 @@ function generate2faEnabledEmail(data, appName = "Your App", appUrl = "") {
     buttonText: "",
     buttonUrl: "",
     footerNote: "",
-    appUrl
+    appUrl,
+    ...branding
   });
   return {
     to: email,
@@ -2492,7 +2491,7 @@ If you didn't make this change, please contact support immediately and reset you
     tags: { type: "2fa_enabled" }
   };
 }
-function generate2faDisabledEmail(data, appName = "Your App", appUrl = "") {
+function generate2faDisabledEmail(data, appName = "Your App", appUrl = "", branding) {
   const { email, firstName } = data;
   const safeFirstName = firstName ? escapeHtml(firstName) : "there";
   const html = generateEmailTemplate({
@@ -2504,10 +2503,9 @@ function generate2faDisabledEmail(data, appName = "Your App", appUrl = "") {
 		`,
     buttonText: "Reset Password",
     buttonUrl: appUrl ? `${appUrl}/forgot-password` : "",
-    buttonBgColor: "#ef4444",
-    buttonTextColor: "#ffffff",
     footerNote: "",
-    appUrl
+    appUrl,
+    ...branding
   });
   return {
     to: email,
@@ -2697,6 +2695,7 @@ function createEmailAdapter(env) {
 var EmailService = class {
   adapter;
   env;
+  branding;
   get fromAddress() {
     if (this.env.EMAIL_FROM) {
       return this.env.EMAIL_FROM;
@@ -2710,9 +2709,10 @@ var EmailService = class {
     }
     return `${appName} <hello@${domain}>`;
   }
-  constructor(env, adapter) {
+  constructor(env, adapter, branding) {
     this.env = env;
     this.adapter = adapter ?? createEmailAdapter(env);
+    this.branding = branding;
   }
   /**
    * Check if email address has bounced or complained
@@ -2764,7 +2764,8 @@ var EmailService = class {
       const template = generateVerificationEmail(
         data,
         this.env.APP_NAME ?? "Your App",
-        this.env.APP_URL ?? ""
+        this.env.APP_URL ?? "",
+        this.branding
       );
       const recipient = this.getRecipientEmail(data.email, "verification");
       logger_default.info("Sending verification email", {
@@ -2824,7 +2825,8 @@ var EmailService = class {
       const template = generatePasswordResetEmail(
         data,
         this.env.APP_NAME ?? "Your App",
-        this.env.APP_URL ?? ""
+        this.env.APP_URL ?? "",
+        this.branding
       );
       const recipient = this.getRecipientEmail(data.email, "password_reset");
       logger_default.info("Sending password reset email", {
@@ -2884,7 +2886,8 @@ var EmailService = class {
       const template = generateEmailChangeConfirmation(
         data,
         this.env.APP_NAME ?? "Your App",
-        this.env.APP_URL ?? ""
+        this.env.APP_URL ?? "",
+        this.branding
       );
       const recipient = this.getRecipientEmail(data.newEmail, "email_change_confirmation");
       logger_default.info("Sending email change confirmation", {
@@ -2944,7 +2947,8 @@ var EmailService = class {
       const template = generateEmailChangeNotification(
         data,
         this.env.APP_NAME ?? "Your App",
-        this.env.APP_URL ?? ""
+        this.env.APP_URL ?? "",
+        this.branding
       );
       const recipient = this.getRecipientEmail(data.oldEmail, "email_change_notification");
       logger_default.info("Sending email change notification", {
@@ -3001,7 +3005,8 @@ var EmailService = class {
       const template = generate2faCodeEmail(
         data,
         this.env.APP_NAME ?? "Your App",
-        this.env.APP_URL ?? ""
+        this.env.APP_URL ?? "",
+        this.branding
       );
       const recipient = this.getRecipientEmail(data.email, "2fa_code");
       logger_default.info("Sending 2FA code email", {
@@ -3058,7 +3063,8 @@ var EmailService = class {
       const template = generate2faEnabledEmail(
         data,
         this.env.APP_NAME ?? "Your App",
-        this.env.APP_URL ?? ""
+        this.env.APP_URL ?? "",
+        this.branding
       );
       const recipient = this.getRecipientEmail(data.email, "2fa_enabled");
       logger_default.info("Sending 2FA enabled email", {
@@ -3116,7 +3122,8 @@ var EmailService = class {
       const template = generate2faDisabledEmail(
         data,
         this.env.APP_NAME ?? "Your App",
-        this.env.APP_URL ?? ""
+        this.env.APP_URL ?? "",
+        this.branding
       );
       const recipient = this.getRecipientEmail(data.email, "2fa_disabled");
       logger_default.info("Sending 2FA disabled email", {
@@ -3448,7 +3455,7 @@ var signupRoute = (0, import_zod_openapi2.createRoute)({
 });
 var signupHandler = async (c) => {
   const { email, password, name, turnstileToken, oauthToken } = c.req.valid("json");
-  const { db: database, schema } = getAuthContext(c);
+  const { db: database, schema, emailBranding } = getAuthContext(c);
   const env = c.env;
   if (oauthToken) {
     const stored = await env.OAUTH_STATES.get(`oauth:signup:${oauthToken}`);
@@ -3548,7 +3555,7 @@ var signupHandler = async (c) => {
     expiresAt,
     createdAt: Date.now()
   });
-  const emailService = new EmailService(env);
+  const emailService = new EmailService(env, void 0, emailBranding);
   const verificationUrl = `${env.APP_URL}/verify-email?token=${emailToken}`;
   await emailService.sendVerificationEmail(
     {
@@ -4032,7 +4039,7 @@ var forgotPasswordRoute = (0, import_zod_openapi7.createRoute)({
 });
 var forgotPasswordHandler = async (c) => {
   const { email, turnstileToken } = c.req.valid("json");
-  const { db: database, schema } = getAuthContext(c);
+  const { db: database, schema, emailBranding } = getAuthContext(c);
   const env = c.env;
   const turnstileValid = await verifyTurnstileToken(
     turnstileToken,
@@ -4051,7 +4058,7 @@ var forgotPasswordHandler = async (c) => {
   if (!resetResult) {
     return c.json({ success: true });
   }
-  const emailService = new EmailService(env);
+  const emailService = new EmailService(env, void 0, emailBranding);
   const resetUrl = `${env.APP_URL}/reset-password?token=${resetResult.token}`;
   await emailService.sendPasswordResetEmail(
     {
@@ -4102,7 +4109,7 @@ var resetPasswordRoute = (0, import_zod_openapi8.createRoute)({
 });
 var resetPasswordHandler = async (c) => {
   const { token, password, turnstileToken } = c.req.valid("json");
-  const database = c.get("db");
+  const { db: database, schema } = getAuthContext(c);
   const env = c.env;
   const turnstileValid = await verifyTurnstileToken(
     turnstileToken,
@@ -4117,7 +4124,18 @@ var resetPasswordHandler = async (c) => {
   if (!passwordValidation.valid) {
     return problems.badRequest(c, passwordValidation.error || "Invalid password");
   }
-  const result = await resetPassword(database, token, password, env.PASSWORD_PEPPER_V1, "v1");
+  const result = await resetPassword(
+    database,
+    {
+      users: schema.users,
+      passwordResetTokens: schema.passwordResetTokens,
+      sessions: schema.sessions
+    },
+    token,
+    password,
+    env.PASSWORD_PEPPER_V1,
+    "v1"
+  );
   if (!result.success) {
     return problems.badRequest(c, result.error || "Invalid or expired reset token");
   }
@@ -4299,7 +4317,7 @@ var changeEmailHandler = async (c) => {
   const userId = c.get("userId");
   if (!userId) return problems.unauthorized(c, "Not authenticated");
   const { password, newEmail } = c.req.valid("json");
-  const { db: database, schema } = getAuthContext(c);
+  const { db: database, schema, emailBranding } = getAuthContext(c);
   const env = c.env;
   const appUrl = env.APP_URL || "http://localhost:5173";
   const result = await requestEmailChange({
@@ -4316,7 +4334,7 @@ var changeEmailHandler = async (c) => {
     }
     return problems.badRequest(c, result.error || "Failed to request email change");
   }
-  const emailService = new EmailService(env);
+  const emailService = new EmailService(env, void 0, emailBranding);
   const confirmUrl = `${appUrl}/confirm-email-change?token=${result.confirmToken}`;
   const confirmResult = await emailService.sendEmailChangeConfirmation(
     { newEmail, confirmUrl },
@@ -4621,7 +4639,7 @@ var resendVerificationRoute = (0, import_zod_openapi21.createRoute)({
 });
 var resendVerificationHandler = async (c) => {
   const userId = c.get("userId");
-  const { db, schema } = getAuthContext(c);
+  const { db, schema, emailBranding } = getAuthContext(c);
   const env = c.env;
   const [user] = await db.select({
     id: schema.users.id,
@@ -4646,7 +4664,7 @@ var resendVerificationHandler = async (c) => {
     expiresAt,
     createdAt: Date.now()
   });
-  const emailService = new EmailService(env);
+  const emailService = new EmailService(env, void 0, emailBranding);
   const verificationUrl = `${env.APP_URL}/verify-email?token=${emailToken}`;
   await emailService.sendVerificationEmail(
     {
@@ -4934,7 +4952,7 @@ var totpVerifyHandler = async (c) => {
   const userId = c.get("userId");
   if (!userId) return problems.unauthorized(c);
   const { code } = c.req.valid("json");
-  const { db, schema, env } = getAuthContext(c);
+  const { db, schema, env, emailBranding } = getAuthContext(c);
   const secret = await env.OAUTH_STATES.get(`totp_setup:${userId}`);
   if (!secret) {
     return problems.badRequest(c, "Setup expired. Please start again.");
@@ -4978,7 +4996,7 @@ var totpVerifyHandler = async (c) => {
     backupCodes = codes.map(formatBackupCode);
   }
   if (user) {
-    const emailService = new EmailService(env);
+    const emailService = new EmailService(env, void 0, emailBranding);
     const firstName = user.name?.split(" ")[0] || null;
     await emailService.send2faEnabledEmail(
       { email: user.email, firstName, method: "totp" },
@@ -5026,7 +5044,7 @@ var totpDisableHandler = async (c) => {
     return problems.unauthorized(c);
   }
   const { code, method } = c.req.valid("json");
-  const { db, schema, env } = getAuthContext(c);
+  const { db, schema, env, emailBranding } = getAuthContext(c);
   const verification = await verifyAny2faCode(db, env, userId, code, method, {
     user2faMethods: schema.user2faMethods,
     userBackupCodes: schema.userBackupCodes
@@ -5043,7 +5061,7 @@ var totpDisableHandler = async (c) => {
     await invalidateAllUserSessions(db, { sessions: schema.sessions, users: schema.users }, userId);
     const [user] = await db.select({ email: schema.users.email, name: schema.users.name }).from(schema.users).where((0, import_drizzle_orm23.eq)(schema.users.id, userId)).limit(1);
     if (user) {
-      const emailService = new EmailService(env);
+      const emailService = new EmailService(env, void 0, emailBranding);
       const firstName = user.name?.split(" ")[0] || null;
       await emailService.send2faDisabledEmail({ email: user.email, firstName }, db, schema.users);
     }
@@ -5089,7 +5107,7 @@ var emailSetupRoute = (0, import_zod_openapi28.createRoute)({
 var emailSetupHandler = async (c) => {
   const userId = c.get("userId");
   if (!userId) return problems.unauthorized(c);
-  const { db, schema, env } = getAuthContext(c);
+  const { db, schema, env, emailBranding } = getAuthContext(c);
   const existing = await db.select({ id: schema.user2faMethods.id }).from(schema.user2faMethods).where((0, import_drizzle_orm24.and)((0, import_drizzle_orm24.eq)(schema.user2faMethods.userId, userId), (0, import_drizzle_orm24.eq)(schema.user2faMethods.method, "email"))).limit(1);
   if (existing.length > 0) {
     return problems.badRequest(c, "Email 2FA already enabled");
@@ -5099,7 +5117,7 @@ var emailSetupHandler = async (c) => {
   const code = generateEmailOtp();
   const codeHash = await hashToken(code);
   await env.OAUTH_STATES.put(`email_2fa_setup:${userId}`, codeHash, { expirationTtl: 300 });
-  const emailService = new EmailService(env);
+  const emailService = new EmailService(env, void 0, emailBranding);
   const firstName = user.name?.split(" ")[0] || null;
   await emailService.send2faCodeEmail({ email: user.email, firstName, code }, db, schema.users);
   logSecurityEvent("2fa_email_setup_initiated", "low", { userId });
@@ -5140,7 +5158,7 @@ var emailVerifyHandler = async (c) => {
   const userId = c.get("userId");
   if (!userId) return problems.unauthorized(c);
   const { code } = c.req.valid("json");
-  const { db, schema, env } = getAuthContext(c);
+  const { db, schema, env, emailBranding } = getAuthContext(c);
   const storedHash = await env.OAUTH_STATES.get(`email_2fa_setup:${userId}`);
   if (!storedHash) {
     return problems.badRequest(c, "Code expired. Please request a new one.");
@@ -5178,7 +5196,7 @@ var emailVerifyHandler = async (c) => {
     backupCodes = codes.map(formatBackupCode);
   }
   if (user) {
-    const emailService = new EmailService(env);
+    const emailService = new EmailService(env, void 0, emailBranding);
     const firstName = user.name?.split(" ")[0] || null;
     await emailService.send2faEnabledEmail(
       { email: user.email, firstName, method: "email" },
@@ -5221,7 +5239,7 @@ var emailSendCodeRoute = (0, import_zod_openapi30.createRoute)({
 var emailSendCodeHandler = async (c) => {
   const userId = c.get("userId");
   if (!userId) return problems.unauthorized(c);
-  const { db, schema, env } = getAuthContext(c);
+  const { db, schema, env, emailBranding } = getAuthContext(c);
   const [emailMethod] = await db.select().from(schema.user2faMethods).where((0, import_drizzle_orm26.and)((0, import_drizzle_orm26.eq)(schema.user2faMethods.userId, userId), (0, import_drizzle_orm26.eq)(schema.user2faMethods.method, "email"))).limit(1);
   if (!emailMethod) {
     return problems.badRequest(c, "Email 2FA not enabled");
@@ -5233,7 +5251,7 @@ var emailSendCodeHandler = async (c) => {
   await env.OAUTH_STATES.put(`email_2fa_challenge:${userId}`, codeHash, {
     expirationTtl: 300
   });
-  const emailService = new EmailService(env);
+  const emailService = new EmailService(env, void 0, emailBranding);
   const firstName = user.name?.split(" ")[0] || null;
   const emailResult = await emailService.send2faCodeEmail(
     { email: user.email, firstName, code },
@@ -5286,7 +5304,7 @@ var emailDisableHandler = async (c) => {
     return problems.unauthorized(c);
   }
   const { code, method } = c.req.valid("json");
-  const { db, schema, env } = getAuthContext(c);
+  const { db, schema, env, emailBranding } = getAuthContext(c);
   const verification = await verifyAny2faCode(db, env, userId, code, method, {
     user2faMethods: schema.user2faMethods,
     userBackupCodes: schema.userBackupCodes
@@ -5303,7 +5321,7 @@ var emailDisableHandler = async (c) => {
     await invalidateAllUserSessions(db, { sessions: schema.sessions, users: schema.users }, userId);
     const [user] = await db.select({ email: schema.users.email, name: schema.users.name }).from(schema.users).where((0, import_drizzle_orm27.eq)(schema.users.id, userId)).limit(1);
     if (user) {
-      const emailService = new EmailService(env);
+      const emailService = new EmailService(env, void 0, emailBranding);
       const firstName = user.name?.split(" ")[0] || null;
       await emailService.send2faDisabledEmail({ email: user.email, firstName }, db, schema.users);
     }
@@ -5600,7 +5618,7 @@ var challengeResendRoute = (0, import_zod_openapi35.createRoute)({
   }
 });
 var challengeResendHandler = async (c) => {
-  const { db, schema } = getAuthContext(c);
+  const { db, schema, emailBranding } = getAuthContext(c);
   const cookieName = getChallengeCookieName(c.env);
   const challengeToken = (0, import_cookie4.getCookie)(c, cookieName);
   if (!challengeToken) {
@@ -5624,7 +5642,7 @@ var challengeResendHandler = async (c) => {
   await c.env.OAUTH_STATES.put(`email_2fa_challenge:${payload.userId}`, codeHash, {
     expirationTtl: 300
   });
-  const emailService = new EmailService(c.env);
+  const emailService = new EmailService(c.env, void 0, emailBranding);
   const firstName = user.name?.split(" ")[0] || null;
   await emailService.send2faCodeEmail({ email: user.email, firstName, code }, db, schema.users);
   logger_default.info("Email 2FA code resent", { userId: payload.userId });