better-auth 0.4.7 → 0.4.8

package/dist/adapters/drizzle.d.ts

@@ -1,4 +1,4 @@
-import { A as Adapter } from '../index-BLNnHUb3.js';
+import { A as Adapter } from '../index-CPq0wKn7.js';
 import 'zod';
 import 'kysely';
 import '../types-IzAbV4nB.js';

package/dist/adapters/drizzle.js

@@ -13,7 +13,7 @@ var getAuthTables = (options) => {
             ...acc[key]?.fields,
             ...value.fields
           },
-          tableName: key
+          tableName: value.tableName || key
         };
       }
       return acc;

package/dist/adapters/mongodb.d.ts

@@ -1,5 +1,5 @@
 import { Db } from 'mongodb';
-import { W as Where } from '../index-BLNnHUb3.js';
+import { W as Where } from '../index-CPq0wKn7.js';
 import 'zod';
 import 'kysely';
 import '../types-IzAbV4nB.js';

package/dist/adapters/prisma.d.ts

@@ -1,4 +1,4 @@
-import { A as Adapter } from '../index-BLNnHUb3.js';
+import { A as Adapter } from '../index-CPq0wKn7.js';
 import 'zod';
 import 'kysely';
 import '../types-IzAbV4nB.js';

package/dist/api.d.ts

@@ -1,4 +1,4 @@
-export { e as AuthEndpoint, f as AuthMiddleware, v as callbackOAuth, T as changePassword, d as createAuthEndpoint, c as createAuthMiddleware, M as createEmailVerificationToken, $ as csrfMiddleware, V as deleteUser, Y as error, J as forgetPassword, K as forgetPasswordCallback, X as getCSRFToken, r as getEndpoints, w as getSession, x as getSessionFromCtx, z as listSessions, Z as ok, o as optionsMiddleware, L as resetPassword, C as revokeSession, D as revokeSessions, s as router, N as sendVerificationEmail, y as sessionMiddleware, U as setPassword, u as signInEmail, t as signInOAuth, E as signOut, _ as signUpEmail, Q as updateUser, O as verifyEmail } from './index-BLNnHUb3.js';
+export { e as AuthEndpoint, f as AuthMiddleware, v as callbackOAuth, T as changePassword, d as createAuthEndpoint, c as createAuthMiddleware, M as createEmailVerificationToken, $ as csrfMiddleware, V as deleteUser, Y as error, J as forgetPassword, K as forgetPasswordCallback, X as getCSRFToken, r as getEndpoints, w as getSession, x as getSessionFromCtx, z as listSessions, Z as ok, o as optionsMiddleware, L as resetPassword, C as revokeSession, D as revokeSessions, s as router, N as sendVerificationEmail, y as sessionMiddleware, U as setPassword, u as signInEmail, t as signInOAuth, E as signOut, _ as signUpEmail, Q as updateUser, O as verifyEmail } from './index-CPq0wKn7.js';
 import './helper-DPDj8Nix.js';
 import 'zod';
 export { APIError } from 'better-call';

package/dist/cli.js

@@ -384,7 +384,7 @@ var getAuthTables = (options) => {
             ...acc[key]?.fields,
             ...value.fields
           },
-          tableName: key
+          tableName: value.tableName || key
         };
       }
       return acc;
@@ -1143,7 +1143,7 @@ async function generatePrismaSchema({
         }
         if (attr.references) {
           builder.model(tableName).field(
-            `${attr.references.model.toLowerCase()}s`,
+            `${attr.references.model.toLowerCase()}`,
             capitalizeFirstLetter(attr.references.model)
           ).attribute(
             `relation(fields: [${field}], references: [${attr.references.field}], onDelete: Cascade)`

package/dist/client/plugins.d.ts

@@ -2,10 +2,10 @@ import * as nanostores from 'nanostores';
 import { A as AccessControl, S as StatementsPrimitive, R as Role } from '../statement-CfnyN34h.js';
 import * as _better_fetch_fetch from '@better-fetch/fetch';
 import { BetterFetchOption } from '@better-fetch/fetch';
-import { o as organization, j as Organization, M as Member, I as Invitation, u as username, m as magicLink, d as phoneNumber, e as anonymous, i as admin } from '../index-xf_fyhlx.js';
-export { g as getPasskeyActions, c as passkeyClient, a as twoFactorClient } from '../index-xf_fyhlx.js';
+import { o as organization, j as Organization, M as Member, I as Invitation, u as username, m as magicLink, d as phoneNumber, e as anonymous, i as admin } from '../index-BL_Wucme.js';
+export { g as getPasskeyActions, c as passkeyClient, a as twoFactorClient } from '../index-BL_Wucme.js';
 import { P as Prettify } from '../helper-DPDj8Nix.js';
-import { F as FieldAttribute, B as BetterAuthOptions, b as BetterAuthPlugin } from '../index-BLNnHUb3.js';
+import { F as FieldAttribute, B as BetterAuthOptions, b as BetterAuthPlugin } from '../index-CPq0wKn7.js';
 import * as better_call from 'better-call';
 import { z } from 'zod';
 import { O as OAuth2Tokens, U as User } from '../types-IzAbV4nB.js';

package/dist/client/plugins.js

@@ -450,7 +450,8 @@ var twoFactorClient = (options = {
     pathMethods: {
       "/two-factor/disable": "POST",
       "/two-factor/enable": "POST",
-      "/two-factor/send-otp": "POST"
+      "/two-factor/send-otp": "POST",
+      "/two-factor/generate-backup-codes": "POST"
     },
     fetchPlugins: [
       {

package/dist/client.d.ts

@@ -6,7 +6,7 @@ import { BetterFetch, BetterFetchError, BetterFetchOption } from '@better-fetch/
 import { U as UnionToIntersection, P as Prettify, S as StripEmptyObjects } from './helper-DPDj8Nix.js';
 import { ClientOptions, InferClientAPI, InferActions, InferAdditionalFromClient, InferSessionFromClient, InferUserFromClient, BetterAuthClientPlugin, IsSignal } from './types.js';
 export { AtomListener, InferPluginsFromClient } from './types.js';
-import './index-BLNnHUb3.js';
+import './index-CPq0wKn7.js';
 import 'kysely';
 import './types-IzAbV4nB.js';
 import 'better-call';

package/dist/{index-xf_fyhlx.d.ts → index-BL_Wucme.d.ts}

@@ -5,7 +5,7 @@ import { P as Prettify } from './helper-DPDj8Nix.js';
 import { A as AccessControl, R as Role, S as StatementsPrimitive, g as defaultRoles } from './statement-CfnyN34h.js';
 import * as _better_fetch_fetch from '@better-fetch/fetch';
 import { BetterFetch, BetterFetchOption } from '@better-fetch/fetch';
-import { H as HookEndpointContext, g as AuthContext } from './index-BLNnHUb3.js';
+import { H as HookEndpointContext, g as AuthContext } from './index-CPq0wKn7.js';
 import * as nanostores from 'nanostores';
 import { atom } from 'nanostores';
 import * as _simplewebauthn_types from '@simplewebauthn/types';
@@ -2563,21 +2563,17 @@ interface TwoFactorOptions {
      * Backup code options
      */
     backupCodeOptions?: BackupCodeOptions;
+    /**
+     * Table name for two factor authentication.
+     * @default "userTwoFactor"
+     */
+    twoFactorTable?: string;
 }
 interface UserWithTwoFactor extends User {
     /**
      * If the user has enabled two factor authentication.
      */
     twoFactorEnabled: boolean;
-    /**
-     * The secret used to generate the TOTP or OTP.
-     */
-    twoFactorSecret: string;
-    /**
-     * List of backup codes separated by a
-     * comma
-     */
-    twoFactorBackupCodes: string;
 }
 
 declare const twoFactorClient: (options?: {
@@ -2599,6 +2595,7 @@ declare const twoFactorClient: (options?: {
         "/two-factor/disable": "POST";
         "/two-factor/enable": "POST";
         "/two-factor/send-otp": "POST";
+        "/two-factor/generate-backup-codes": "POST";
     };
     fetchPlugins: {
         id: string;
@@ -2755,10 +2752,13 @@ declare const twoFactor: (options?: TwoFactorOptions) => {
                 method: "POST";
                 body: z.ZodObject<{
                     code: z.ZodString;
+                    disableSession: z.ZodOptional<z.ZodBoolean>;
                 }, "strip", z.ZodTypeAny, {
                     code: string;
+                    disableSession?: boolean | undefined;
                 }, {
                     code: string;
+                    disableSession?: boolean | undefined;
                 }>;
                 use: better_call.Endpoint<better_call.Handler<string, {
                     body: z.ZodObject<{
@@ -2782,7 +2782,14 @@ declare const twoFactor: (options?: TwoFactorOptions) => {
                             headers: Record<string, string> | undefined;
                         };
                         body: {
-                            status: boolean;
+                            session: {
+                                id: string;
+                                userId: string;
+                                expiresAt: Date;
+                                ipAddress?: string | undefined;
+                                userAgent?: string | undefined;
+                            };
+                            user: UserWithTwoFactor;
                         };
                         _flag: "json";
                     }>;
@@ -2810,17 +2817,26 @@ declare const twoFactor: (options?: TwoFactorOptions) => {
             }>]>(...ctx: C): Promise<C extends [{
                 asResponse: true;
             }] ? Response : {
-                status: boolean;
+                user: UserWithTwoFactor;
+                session: {
+                    id: string;
+                    userId: string;
+                    expiresAt: Date;
+                    user: UserWithTwoFactor;
+                };
             }>;
             path: "/two-factor/verify-backup-code";
             options: {
                 method: "POST";
                 body: z.ZodObject<{
                     code: z.ZodString;
+                    disableSession: z.ZodOptional<z.ZodBoolean>;
                 }, "strip", z.ZodTypeAny, {
                     code: string;
+                    disableSession?: boolean | undefined;
                 }, {
                     code: string;
+                    disableSession?: boolean | undefined;
                 }>;
                 use: better_call.Endpoint<better_call.Handler<string, {
                     body: z.ZodObject<{
@@ -2844,7 +2860,14 @@ declare const twoFactor: (options?: TwoFactorOptions) => {
                             headers: Record<string, string> | undefined;
                         };
                         body: {
-                            status: boolean;
+                            session: {
+                                id: string;
+                                userId: string;
+                                expiresAt: Date;
+                                ipAddress?: string | undefined;
+                                userAgent?: string | undefined;
+                            };
+                            user: UserWithTwoFactor;
                         };
                         _flag: "json";
                     }>;
@@ -3010,7 +3033,14 @@ declare const twoFactor: (options?: TwoFactorOptions) => {
                             headers: Record<string, string> | undefined;
                         };
                         body: {
-                            status: boolean;
+                            session: {
+                                id: string;
+                                userId: string;
+                                expiresAt: Date;
+                                ipAddress?: string | undefined;
+                                userAgent?: string | undefined;
+                            };
+                            user: UserWithTwoFactor;
                         };
                         _flag: "json";
                     }>;
@@ -3065,7 +3095,14 @@ declare const twoFactor: (options?: TwoFactorOptions) => {
                             headers: Record<string, string> | undefined;
                         };
                         body: {
-                            status: boolean;
+                            session: {
+                                id: string;
+                                userId: string;
+                                expiresAt: Date;
+                                ipAddress?: string | undefined;
+                                userAgent?: string | undefined;
+                            };
+                            user: UserWithTwoFactor;
                         };
                         _flag: "json";
                     }>;
@@ -3126,7 +3163,14 @@ declare const twoFactor: (options?: TwoFactorOptions) => {
                             headers: Record<string, string> | undefined;
                         };
                         body: {
-                            status: boolean;
+                            session: {
+                                id: string;
+                                userId: string;
+                                expiresAt: Date;
+                                ipAddress?: string | undefined;
+                                userAgent?: string | undefined;
+                            };
+                            user: UserWithTwoFactor;
                         };
                         _flag: "json";
                     }>;
@@ -3154,7 +3198,14 @@ declare const twoFactor: (options?: TwoFactorOptions) => {
             }>]>(...ctx: C): Promise<C extends [{
                 asResponse: true;
             }] ? Response : {
-                status: boolean;
+                session: {
+                    id: string;
+                    userId: string;
+                    expiresAt: Date;
+                    ipAddress?: string | undefined;
+                    userAgent?: string | undefined;
+                };
+                user: UserWithTwoFactor;
             }>;
             path: "/two-factor/verify-otp";
             options: {
@@ -3188,7 +3239,14 @@ declare const twoFactor: (options?: TwoFactorOptions) => {
                             headers: Record<string, string> | undefined;
                         };
                         body: {
-                            status: boolean;
+                            session: {
+                                id: string;
+                                userId: string;
+                                expiresAt: Date;
+                                ipAddress?: string | undefined;
+                                userAgent?: string | undefined;
+                            };
+                            user: UserWithTwoFactor;
                         };
                         _flag: "json";
                     }>;
@@ -3362,7 +3420,14 @@ declare const twoFactor: (options?: TwoFactorOptions) => {
                             headers: Record<string, string> | undefined;
                         };
                         body: {
-                            status: boolean;
+                            session: {
+                                id: string;
+                                userId: string;
+                                expiresAt: Date;
+                                ipAddress?: string | undefined;
+                                userAgent?: string | undefined;
+                            };
+                            user: UserWithTwoFactor;
                         };
                         _flag: "json";
                     }>;
@@ -3390,7 +3455,14 @@ declare const twoFactor: (options?: TwoFactorOptions) => {
             }>]>(...ctx: C): Promise<C extends [{
                 asResponse: true;
             }] ? Response : {
-                status: boolean;
+                session: {
+                    id: string;
+                    userId: string;
+                    expiresAt: Date;
+                    ipAddress?: string | undefined;
+                    userAgent?: string | undefined;
+                };
+                user: UserWithTwoFactor;
             }>;
             path: "/two-factor/verify-totp";
             options: {
@@ -3427,7 +3499,14 @@ declare const twoFactor: (options?: TwoFactorOptions) => {
                             headers: Record<string, string> | undefined;
                         };
                         body: {
-                            status: boolean;
+                            session: {
+                                id: string;
+                                userId: string;
+                                expiresAt: Date;
+                                ipAddress?: string | undefined;
+                                userAgent?: string | undefined;
+                            };
+                            user: UserWithTwoFactor;
                         };
                         _flag: "json";
                     }>;
@@ -3474,15 +3553,29 @@ declare const twoFactor: (options?: TwoFactorOptions) => {
                     required: false;
                     defaultValue: boolean;
                 };
-                twoFactorSecret: {
+            };
+        };
+        twoFactor: {
+            tableName: string;
+            fields: {
+                secret: {
                     type: "string";
-                    required: false;
+                    required: true;
                     returned: false;
                 };
-                twoFactorBackupCodes: {
+                backupCodes: {
                     type: "string";
-                    required: false;
+                    required: true;
+                    returned: false;
+                };
+                userId: {
+                    type: "string";
+                    required: true;
                     returned: false;
+                    references: {
+                        model: string;
+                        field: string;
+                    };
                 };
             };
         };

package/dist/{index-BLNnHUb3.d.ts → index-CPq0wKn7.d.ts}

@@ -382,11 +382,12 @@ type InferFieldsFromOptions<Options extends BetterAuthOptions, Key extends "sess
 } ? Format extends "output" ? InferFieldsOutput<Field> : InferFieldsInput<Field> : {};
 
 type PluginSchema = {
-    [table: string]: {
+    [table in string]: {
         fields: {
             [field in string]: FieldAttribute;
         };
         disableMigration?: boolean;
+        tableName?: string;
     };
 };
 type BetterAuthPlugin = {

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export { a as Auth, a0 as betterAuth } from './index-BLNnHUb3.js';
+export { a as Auth, a0 as betterAuth } from './index-CPq0wKn7.js';
 import 'zod';
 import 'kysely';
 import './types-IzAbV4nB.js';

package/dist/index.js

@@ -2858,7 +2858,7 @@ var getAuthTables = (options) => {
             ...acc[key]?.fields,
             ...value.fields
           },
-          tableName: key
+          tableName: value.tableName || key
         };
       }
       return acc;

package/dist/next-js.d.ts

@@ -1,4 +1,4 @@
-import { a as Auth } from './index-BLNnHUb3.js';
+import { a as Auth } from './index-CPq0wKn7.js';
 import { U as User, S as Session } from './types-IzAbV4nB.js';
 import { NextRequest } from 'next/server';
 import 'zod';

package/dist/node.d.ts

@@ -1,5 +1,5 @@
 import * as http from 'http';
-import { a as Auth } from './index-BLNnHUb3.js';
+import { a as Auth } from './index-CPq0wKn7.js';
 import 'zod';
 import 'kysely';
 import './types-IzAbV4nB.js';

package/dist/plugins.d.ts

@@ -1,7 +1,7 @@
-export { A as AnonymousOptions, O as OrganizationOptions, b as Passkey, P as PasskeyOptions, U as UserWithPhoneNumber, f as UserWithRole, i as admin, h as adminMiddleware, e as anonymous, g as getPasskeyActions, m as magicLink, o as organization, p as passkey, c as passkeyClient, d as phoneNumber, t as twoFactor, a as twoFactorClient, u as username } from './index-xf_fyhlx.js';
+export { A as AnonymousOptions, O as OrganizationOptions, b as Passkey, P as PasskeyOptions, U as UserWithPhoneNumber, f as UserWithRole, i as admin, h as adminMiddleware, e as anonymous, g as getPasskeyActions, m as magicLink, o as organization, p as passkey, c as passkeyClient, d as phoneNumber, t as twoFactor, a as twoFactorClient, u as username } from './index-BL_Wucme.js';
 export { i as ac } from './index-DfAHOgpj.js';
-import { H as HookEndpointContext } from './index-BLNnHUb3.js';
-export { e as AuthEndpoint, f as AuthMiddleware, b as BetterAuthPlugin, P as PluginSchema, d as createAuthEndpoint, c as createAuthMiddleware, o as optionsMiddleware } from './index-BLNnHUb3.js';
+import { H as HookEndpointContext } from './index-CPq0wKn7.js';
+export { e as AuthEndpoint, f as AuthMiddleware, b as BetterAuthPlugin, P as PluginSchema, d as createAuthEndpoint, c as createAuthMiddleware, o as optionsMiddleware } from './index-CPq0wKn7.js';
 import './types-IzAbV4nB.js';
 import 'zod';
 import './helper-DPDj8Nix.js';

package/dist/plugins.js

@@ -4009,10 +4009,15 @@ var verifyTwoFactorMiddleware = createAuthMiddleware(
               return ctx.json({
                 status: true,
                 callbackURL: ctx.body.callbackURL,
-                redirect: true
+                redirect: true,
+                session,
+                user
               });
             }
-            return ctx.json({ status: true });
+            return ctx.json({
+              session,
+              user
+            });
           },
           invalid: async () => {
             throw new APIError17("UNAUTHORIZED", {
@@ -4054,15 +4059,15 @@ async function generateBackupCodes(secret, options) {
   };
 }
 async function verifyBackupCode(data, key) {
-  const codes = await getBackupCodes(data.user, key);
+  const codes = await getBackupCodes(data.backupCodes, key);
   if (!codes) {
     return false;
   }
   return codes.includes(data.code);
 }
-async function getBackupCodes(user, key) {
+async function getBackupCodes(backupCodes, key) {
   const secret = Buffer.from(
-    await symmetricDecrypt({ key, data: user.twoFactorBackupCodes })
+    await symmetricDecrypt({ key, data: backupCodes })
   ).toString("utf-8");
   const data = JSON.parse(secret);
   const result = z18.array(z18.string()).safeParse(data);
@@ -4071,7 +4076,7 @@ async function getBackupCodes(user, key) {
   }
   return null;
 }
-var backupCode2fa = (options) => {
+var backupCode2fa = (options, twoFactorTable) => {
   return {
     id: "backup_code",
     endpoints: {
@@ -4080,14 +4085,33 @@ var backupCode2fa = (options) => {
         {
           method: "POST",
           body: z18.object({
-            code: z18.string()
+            code: z18.string(),
+            /**
+             * Disable setting the session cookie
+             */
+            disableSession: z18.boolean().optional()
           }),
           use: [verifyTwoFactorMiddleware]
         },
         async (ctx) => {
+          const user = ctx.context.session.user;
+          const twoFactor2 = await ctx.context.adapter.findOne({
+            model: twoFactorTable,
+            where: [
+              {
+                field: "userId",
+                value: user.id
+              }
+            ]
+          });
+          if (!twoFactor2) {
+            throw new APIError18("BAD_REQUEST", {
+              message: "Backup codes aren't enabled"
+            });
+          }
           const validate = verifyBackupCode(
             {
-              user: ctx.context.session.user,
+              backupCodes: twoFactor2.backupCodes,
               code: ctx.body.code
             },
             ctx.context.secret
@@ -4097,7 +4121,13 @@ var backupCode2fa = (options) => {
               message: "Invalid backup code"
             });
           }
-          return ctx.json({ status: true });
+          if (!ctx.body.disableSession) {
+            await setSessionCookie(ctx, ctx.context.session.id);
+          }
+          return ctx.json({
+            user,
+            session: ctx.context.session
+          });
         }
       ),
       generateBackupCodes: createAuthEndpoint(
@@ -4107,19 +4137,24 @@ var backupCode2fa = (options) => {
           use: [sessionMiddleware]
         },
         async (ctx) => {
+          const user = ctx.context.session.user;
+          if (!user.twoFactorEnabled) {
+            throw new APIError18("BAD_REQUEST", {
+              message: "Two factor isn't enabled"
+            });
+          }
           const backupCodes = await generateBackupCodes(
             ctx.context.secret,
             options
           );
           await ctx.context.adapter.update({
-            model: "user",
+            model: twoFactorTable,
             update: {
-              twoFactorEnabled: true,
-              twoFactorBackupCodes: backupCodes.encryptedBackupCodes
+              backupCodes: backupCodes.encryptedBackupCodes
             },
             where: [
               {
-                field: "id",
+                field: "userId",
                 value: ctx.context.session.user.id
               }
             ]
@@ -4138,7 +4173,29 @@ var backupCode2fa = (options) => {
         },
         async (ctx) => {
           const user = ctx.context.session.user;
-          const backupCodes = getBackupCodes(user, ctx.context.secret);
+          const twoFactor2 = await ctx.context.adapter.findOne({
+            model: twoFactorTable,
+            where: [
+              {
+                field: "userId",
+                value: user.id
+              }
+            ]
+          });
+          if (!twoFactor2) {
+            throw new APIError18("BAD_REQUEST", {
+              message: "Backup codes aren't enabled"
+            });
+          }
+          const backupCodes = getBackupCodes(
+            twoFactor2.backupCodes,
+            ctx.context.secret
+          );
+          if (!backupCodes) {
+            throw new APIError18("BAD_REQUEST", {
+              message: "Backup codes aren't enabled"
+            });
+          }
           return ctx.json({
             status: true,
             backupCodes
@@ -4154,8 +4211,9 @@ import { APIError as APIError19 } from "better-call";
 import { TOTPController } from "oslo/otp";
 import { z as z19 } from "zod";
 import { TimeSpan as TimeSpan4 } from "oslo";
-var otp2fa = (options) => {
+var otp2fa = (options, twoFactorTable) => {
   const opts = {
+    ...options,
     period: new TimeSpan4(options?.period || 3, "m")
   };
   const totp = new TOTPController({
@@ -4178,7 +4236,21 @@ var otp2fa = (options) => {
         });
       }
       const user = ctx.context.session.user;
-      const code = await totp.generate(Buffer.from(user.twoFactorSecret));
+      const twoFactor2 = await ctx.context.adapter.findOne({
+        model: twoFactorTable,
+        where: [
+          {
+            field: "userId",
+            value: user.id
+          }
+        ]
+      });
+      if (!twoFactor2) {
+        throw new APIError19("BAD_REQUEST", {
+          message: "totp isn't enabled"
+        });
+      }
+      const code = await totp.generate(Buffer.from(twoFactor2.secret));
       await options.sendOTP(user, code);
       return ctx.json({ status: true });
     }
@@ -4199,7 +4271,21 @@ var otp2fa = (options) => {
           message: "two factor isn't enabled"
         });
       }
-      const toCheckOtp = await totp.generate(Buffer.from(user.twoFactorSecret));
+      const twoFactor2 = await ctx.context.adapter.findOne({
+        model: twoFactorTable,
+        where: [
+          {
+            field: "userId",
+            value: user.id
+          }
+        ]
+      });
+      if (!twoFactor2) {
+        throw new APIError19("BAD_REQUEST", {
+          message: "totp isn't enabled"
+        });
+      }
+      const toCheckOtp = await totp.generate(Buffer.from(twoFactor2.secret));
       if (toCheckOtp === ctx.body.code) {
         return ctx.context.valid();
       } else {
@@ -4221,8 +4307,9 @@ import { APIError as APIError20 } from "better-call";
 import { TimeSpan as TimeSpan5 } from "oslo";
 import { TOTPController as TOTPController2, createTOTPKeyURI } from "oslo/otp";
 import { z as z20 } from "zod";
-var totp2fa = (options) => {
+var totp2fa = (options, twoFactorTable) => {
   const opts = {
+    ...options,
     digits: 6,
     period: new TimeSpan5(options?.period || 30, "s")
   };
@@ -4241,9 +4328,23 @@ var totp2fa = (options) => {
           message: "totp isn't configured"
         });
       }
-      const session = ctx.context.session.user;
+      const user = ctx.context.session.user;
+      const twoFactor2 = await ctx.context.adapter.findOne({
+        model: twoFactorTable,
+        where: [
+          {
+            field: "userId",
+            value: user.id
+          }
+        ]
+      });
+      if (!twoFactor2) {
+        throw new APIError20("BAD_REQUEST", {
+          message: "totp isn't enabled"
+        });
+      }
       const totp = new TOTPController2(opts);
-      const code = await totp.generate(Buffer.from(session.twoFactorSecret));
+      const code = await totp.generate(Buffer.from(twoFactor2.secret));
       return { code };
     }
   );
@@ -4263,7 +4364,16 @@ var totp2fa = (options) => {
         });
       }
       const user = ctx.context.session.user;
-      if (!user.twoFactorSecret) {
+      const twoFactor2 = await ctx.context.adapter.findOne({
+        model: twoFactorTable,
+        where: [
+          {
+            field: "userId",
+            value: user.id
+          }
+        ]
+      });
+      if (!twoFactor2 || !user.twoFactorEnabled) {
         throw new APIError20("BAD_REQUEST", {
           message: "totp isn't enabled"
         });
@@ -4272,7 +4382,7 @@ var totp2fa = (options) => {
         totpURI: createTOTPKeyURI(
           options?.issuer || "BetterAuth",
           user.email,
-          Buffer.from(user.twoFactorSecret),
+          Buffer.from(twoFactor2.secret),
           opts
         )
       };
@@ -4297,10 +4407,25 @@ var totp2fa = (options) => {
           message: "totp isn't configured"
         });
       }
+      const user = ctx.context.session.user;
+      const twoFactor2 = await ctx.context.adapter.findOne({
+        model: twoFactorTable,
+        where: [
+          {
+            field: "userId",
+            value: user.id
+          }
+        ]
+      });
+      if (!twoFactor2 || !twoFactor2.enabled) {
+        throw new APIError20("BAD_REQUEST", {
+          message: "totp isn't enabled"
+        });
+      }
       const totp = new TOTPController2(opts);
       const decrypted = await symmetricDecrypt({
         key: ctx.context.secret,
-        data: ctx.context.session.user.twoFactorSecret
+        data: twoFactor2.secret
       });
       const secret = Buffer.from(decrypted);
       const status = await totp.verify(ctx.body.code, secret);
@@ -4357,7 +4482,8 @@ var twoFactorClient = (options = {
     pathMethods: {
       "/two-factor/disable": "POST",
       "/two-factor/enable": "POST",
-      "/two-factor/send-otp": "POST"
+      "/two-factor/send-otp": "POST",
+      "/two-factor/generate-backup-codes": "POST"
     },
     fetchPlugins: [
       {
@@ -4381,12 +4507,28 @@ var twoFactorClient = (options = {
 
 // src/plugins/two-factor/index.ts
 var twoFactor = (options) => {
-  const totp = totp2fa({
-    issuer: options?.issuer || "better-auth",
-    ...options?.totpOptions
-  });
-  const backupCode = backupCode2fa(options?.backupCodeOptions);
-  const otp = otp2fa(options?.otpOptions);
+  const opts = {
+    twoFactorTable: options?.twoFactorTable || "twoFactor"
+  };
+  const totp = totp2fa(
+    {
+      issuer: options?.issuer || "better-auth",
+      ...options?.totpOptions
+    },
+    opts.twoFactorTable
+  );
+  const backupCode = backupCode2fa(
+    {
+      ...options?.backupCodeOptions
+    },
+    opts.twoFactorTable
+  );
+  const otp = otp2fa(
+    {
+      ...options?.otpOptions
+    },
+    opts.twoFactorTable
+  );
   return {
     id: "two-factor",
     endpoints: {
@@ -4423,19 +4565,16 @@ var twoFactor = (options) => {
             ctx.context.secret,
             options?.backupCodeOptions
           );
-          await ctx.context.adapter.update({
-            model: "user",
-            update: {
-              twoFactorSecret: encryptedSecret,
-              twoFactorEnabled: true,
-              twoFactorBackupCodes: backupCodes.encryptedBackupCodes
-            },
-            where: [
-              {
-                field: "id",
-                value: user.id
-              }
-            ]
+          await ctx.context.internalAdapter.updateUser(user.id, {
+            twoFactorEnabled: true
+          });
+          const res = await ctx.context.adapter.create({
+            model: opts.twoFactorTable,
+            data: {
+              secret: encryptedSecret,
+              backupCodes: backupCodes.encryptedBackupCodes,
+              userId: user.id
+            }
           });
           return ctx.json({ status: true });
         }
@@ -4461,14 +4600,14 @@ var twoFactor = (options) => {
               message: "Invalid password"
             });
           }
-          await ctx.context.adapter.update({
-            model: "user",
-            update: {
-              twoFactorEnabled: false
-            },
+          await ctx.context.internalAdapter.updateUser(user.id, {
+            twoFactorEnabled: false
+          });
+          await ctx.context.adapter.delete({
+            model: opts.twoFactorTable,
             where: [
               {
-                field: "id",
+                field: "userId",
                 value: user.id
               }
             ]
@@ -4567,16 +4706,30 @@ var twoFactor = (options) => {
             type: "boolean",
             required: false,
             defaultValue: false
-          },
-          twoFactorSecret: {
+          }
+        }
+      },
+      twoFactor: {
+        tableName: opts.twoFactorTable,
+        fields: {
+          secret: {
             type: "string",
-            required: false,
+            required: true,
             returned: false
           },
-          twoFactorBackupCodes: {
+          backupCodes: {
             type: "string",
-            required: false,
+            required: true,
             returned: false
+          },
+          userId: {
+            type: "string",
+            required: true,
+            returned: false,
+            references: {
+              model: "user",
+              field: "id"
+            }
           }
         }
       }

package/dist/react.d.ts

@@ -3,7 +3,7 @@ import * as _better_fetch_fetch from '@better-fetch/fetch';
 import { U as UnionToIntersection, P as Prettify, S as StripEmptyObjects } from './helper-DPDj8Nix.js';
 import { ClientOptions, InferClientAPI, InferActions, InferAdditionalFromClient, BetterAuthClientPlugin, IsSignal } from './types.js';
 import { useStore } from '@nanostores/react';
-import './index-BLNnHUb3.js';
+import './index-CPq0wKn7.js';
 import 'kysely';
 import './types-IzAbV4nB.js';
 import 'better-call';

package/dist/solid-start.d.ts

@@ -1,4 +1,4 @@
-import { a as Auth } from './index-BLNnHUb3.js';
+import { a as Auth } from './index-CPq0wKn7.js';
 import 'zod';
 import 'kysely';
 import './types-IzAbV4nB.js';

package/dist/solid.d.ts

@@ -3,7 +3,7 @@ import * as _better_fetch_fetch from '@better-fetch/fetch';
 import { U as UnionToIntersection, P as Prettify, S as StripEmptyObjects } from './helper-DPDj8Nix.js';
 import { ClientOptions, InferClientAPI, InferActions, InferAdditionalFromClient, BetterAuthClientPlugin, IsSignal } from './types.js';
 import { Accessor } from 'solid-js';
-import './index-BLNnHUb3.js';
+import './index-CPq0wKn7.js';
 import 'kysely';
 import './types-IzAbV4nB.js';
 import 'better-call';

package/dist/svelte-kit.d.ts

@@ -1,4 +1,4 @@
-import { a as Auth, B as BetterAuthOptions } from './index-BLNnHUb3.js';
+import { a as Auth, B as BetterAuthOptions } from './index-CPq0wKn7.js';
 import 'zod';
 import 'kysely';
 import './types-IzAbV4nB.js';

package/dist/svelte.d.ts

@@ -3,7 +3,7 @@ import * as nanostores from 'nanostores';
 import * as _better_fetch_fetch from '@better-fetch/fetch';
 import { U as UnionToIntersection, P as Prettify, S as StripEmptyObjects } from './helper-DPDj8Nix.js';
 import { ClientOptions, InferClientAPI, InferActions, InferAdditionalFromClient, BetterAuthClientPlugin, IsSignal } from './types.js';
-import './index-BLNnHUb3.js';
+import './index-CPq0wKn7.js';
 import 'kysely';
 import './types-IzAbV4nB.js';
 import 'better-call';

package/dist/types.d.ts

@@ -1,5 +1,5 @@
-import { b as BetterAuthPlugin, a as Auth, I as InferFieldsInputClient, h as InferFieldsOutput } from './index-BLNnHUb3.js';
-export { A as Adapter, k as AdditionalSessionFieldsInput, l as AdditionalSessionFieldsOutput, i as AdditionalUserFieldsInput, j as AdditionalUserFieldsOutput, g as AuthContext, B as BetterAuthOptions, G as GenericEndpointContext, H as HookEndpointContext, p as InferPluginTypes, n as InferSession, m as InferUser, P as PluginSchema, R as RateLimit, S as SecondaryStorage, W as Where, q as init } from './index-BLNnHUb3.js';
+import { b as BetterAuthPlugin, a as Auth, I as InferFieldsInputClient, h as InferFieldsOutput } from './index-CPq0wKn7.js';
+export { A as Adapter, k as AdditionalSessionFieldsInput, l as AdditionalSessionFieldsOutput, i as AdditionalUserFieldsInput, j as AdditionalUserFieldsOutput, g as AuthContext, B as BetterAuthOptions, G as GenericEndpointContext, H as HookEndpointContext, p as InferPluginTypes, n as InferSession, m as InferUser, P as PluginSchema, R as RateLimit, S as SecondaryStorage, W as Where, q as init } from './index-CPq0wKn7.js';
 import { U as UnionToIntersection, H as HasRequiredKeys, P as Prettify, S as StripEmptyObjects, L as LiteralString } from './helper-DPDj8Nix.js';
 export { D as DeepPartial, a as LiteralUnion, R as RequiredKeysOf, W as WithoutEmpty } from './helper-DPDj8Nix.js';
 import { S as Session, U as User } from './types-IzAbV4nB.js';

package/dist/vue.d.ts

@@ -3,7 +3,7 @@ import * as _better_fetch_fetch from '@better-fetch/fetch';
 import { U as UnionToIntersection, P as Prettify, S as StripEmptyObjects } from './helper-DPDj8Nix.js';
 import { ClientOptions, InferClientAPI, InferActions, InferAdditionalFromClient, BetterAuthClientPlugin, IsSignal } from './types.js';
 import { Ref, DeepReadonly } from 'vue';
-import './index-BLNnHUb3.js';
+import './index-CPq0wKn7.js';
 import 'kysely';
 import './types-IzAbV4nB.js';
 import 'better-call';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "better-auth",
-  "version": "0.4.7",
+  "version": "0.4.8",
   "description": "The most comprehensive authentication library for TypeScript.",
   "type": "module",
   "repository": {