better-auth 1.2.6-beta.7 → 1.2.7-beta.1

package/dist/plugins/phone-number/index.cjs

@@ -1,9 +1,9 @@
 'use strict';
 
 const zod = require('zod');
-const refreshToken = require('../../shared/better-auth.BDYXUcLv.cjs');
+const refreshToken = require('../../shared/better-auth.Dg0siV5C.cjs');
 const betterCall = require('better-call');
-const schema$1 = require('../../shared/better-auth.C5H9XEzZ.cjs');
+const schema$1 = require('../../shared/better-auth.DcWKCjjf.cjs');
 const random = require('../../shared/better-auth.CYeOI8C-.cjs');
 const cookies_index = require('../../cookies/index.cjs');
 require('../../shared/better-auth.DiSjtgs9.cjs');
@@ -26,14 +26,25 @@ require('@noble/hashes/utils');
 require('../../shared/better-auth.ANpbi45u.cjs');
 require('@better-auth/utils/random');
 require('../../shared/better-auth.QbbyHMYf.cjs');
+require('../../shared/better-auth.D3mtHEZg.cjs');
 require('../../shared/better-auth.Bg6iw3ig.cjs');
 require('@better-auth/utils/hmac');
 require('../../shared/better-auth.BMYo0QR-.cjs');
 require('../../shared/better-auth.C-R0J0n1.cjs');
 require('jose/errors');
-require('../../shared/better-auth.D3mtHEZg.cjs');
 require('@better-auth/utils/binary');
 
+const ERROR_CODES = {
+  INVALID_PHONE_NUMBER: "Invalid phone number",
+  PHONE_NUMBER_EXIST: "Phone number already exist",
+  INVALID_PHONE_NUMBER_OR_PASSWORD: "Invalid phone number or password",
+  UNEXPECTED_ERROR: "Unexpected error",
+  OTP_NOT_FOUND: "OTP not found",
+  OTP_EXPIRED: "OTP expired",
+  INVALID_OTP: "Invalid OTP",
+  PHONE_NUMBER_NOT_VERIFIED: "Phone number not verified"
+};
+
 function generateOTP(size) {
   return random.generateRandomString(size, "0-9");
 }
@@ -47,15 +58,6 @@ const phoneNumber = (options) => {
     code: "code",
     createdAt: "createdAt"
   };
-  const ERROR_CODES = {
-    INVALID_PHONE_NUMBER: "Invalid phone number",
-    PHONE_NUMBER_EXIST: "Phone number already exist",
-    INVALID_PHONE_NUMBER_OR_PASSWORD: "Invalid phone number or password",
-    UNEXPECTED_ERROR: "Unexpected error",
-    OTP_NOT_FOUND: "OTP not found",
-    OTP_EXPIRED: "OTP expired",
-    INVALID_OTP: "Invalid OTP"
-  };
   return {
     id: "phone-number",
     endpoints: {
@@ -130,6 +132,23 @@ const phoneNumber = (options) => {
               message: ERROR_CODES.INVALID_PHONE_NUMBER_OR_PASSWORD
             });
           }
+          if (opts.requireVerification) {
+            if (!user.phoneNumberVerified) {
+              const otp = generateOTP(opts.otpLength);
+              await ctx.context.internalAdapter.createVerificationValue({
+                value: otp,
+                identifier: phoneNumber2,
+                expiresAt: date.getDate(opts.expiresIn, "sec")
+              });
+              await opts.sendOTP?.({
+                phoneNumber: phoneNumber2,
+                code: otp
+              });
+              throw new betterCall.APIError("UNAUTHORIZED", {
+                message: ERROR_CODES.PHONE_NUMBER_NOT_VERIFIED
+              });
+            }
+          }
           const accounts = await ctx.context.internalAdapter.findAccountByUserId(user.id);
           const credentialAccount = accounts.find(
             (a) => a.providerId === "credential"
@@ -246,7 +265,7 @@ const phoneNumber = (options) => {
           }
           const code = generateOTP(opts.otpLength);
           await ctx.context.internalAdapter.createVerificationValue({
-            value: code,
+            value: `${code}:0`,
             identifier: ctx.body.phoneNumber,
             expiresAt: date.getDate(opts.expiresIn, "sec")
           });
@@ -298,20 +317,83 @@ const phoneNumber = (options) => {
               summary: "Verify phone number",
               description: "Use this endpoint to verify phone number",
               responses: {
-                200: {
-                  description: "Success",
+                "200": {
+                  description: "Phone number verified successfully",
                   content: {
                     "application/json": {
                       schema: {
                         type: "object",
                         properties: {
-                          user: {
-                            $ref: "#/components/schemas/User"
+                          status: {
+                            type: "boolean",
+                            description: "Indicates if the verification was successful",
+                            enum: [true]
                           },
-                          session: {
-                            $ref: "#/components/schemas/Session"
+                          token: {
+                            type: "string",
+                            nullable: true,
+                            description: "Session token if session is created, null if disableSession is true or no session is created"
+                          },
+                          user: {
+                            type: "object",
+                            nullable: true,
+                            properties: {
+                              id: {
+                                type: "string",
+                                description: "Unique identifier of the user"
+                              },
+                              email: {
+                                type: "string",
+                                format: "email",
+                                nullable: true,
+                                description: "User's email address"
+                              },
+                              emailVerified: {
+                                type: "boolean",
+                                nullable: true,
+                                description: "Whether the email is verified"
+                              },
+                              name: {
+                                type: "string",
+                                nullable: true,
+                                description: "User's name"
+                              },
+                              image: {
+                                type: "string",
+                                format: "uri",
+                                nullable: true,
+                                description: "User's profile image URL"
+                              },
+                              phoneNumber: {
+                                type: "string",
+                                description: "User's phone number"
+                              },
+                              phoneNumberVerified: {
+                                type: "boolean",
+                                description: "Whether the phone number is verified"
+                              },
+                              createdAt: {
+                                type: "string",
+                                format: "date-time",
+                                description: "Timestamp when the user was created"
+                              },
+                              updatedAt: {
+                                type: "string",
+                                format: "date-time",
+                                description: "Timestamp when the user was last updated"
+                              }
+                            },
+                            required: [
+                              "id",
+                              "phoneNumber",
+                              "phoneNumberVerified",
+                              "createdAt",
+                              "updatedAt"
+                            ],
+                            description: "User object with phone number details, null if no user is created or found"
                           }
-                        }
+                        },
+                        required: ["status"]
                       }
                     }
                   }
@@ -337,7 +419,18 @@ const phoneNumber = (options) => {
               message: ERROR_CODES.OTP_NOT_FOUND
             });
           }
-          if (otp.value !== ctx.body.code) {
+          const [otpValue, attempts] = otp.value.split(":");
+          const allowedAttempts = options?.allowedAttempts || 3;
+          if (attempts && parseInt(attempts) >= allowedAttempts) {
+            await ctx.context.internalAdapter.deleteVerificationValue(otp.id);
+            throw new betterCall.APIError("FORBIDDEN", {
+              message: "Too many attempts"
+            });
+          }
+          if (otpValue !== ctx.body.code) {
+            await ctx.context.internalAdapter.updateVerificationValue(otp.id, {
+              value: `${otpValue}:${parseInt(attempts || "0") + 1}`
+            });
             throw new betterCall.APIError("BAD_REQUEST", {
               message: "Invalid OTP"
             });
@@ -445,7 +538,7 @@ const phoneNumber = (options) => {
           if (!ctx.body.disableSession) {
             const session = await ctx.context.internalAdapter.createSession(
               user.id,
-              ctx.request
+              ctx.headers
             );
             if (!session) {
               throw new betterCall.APIError("INTERNAL_SERVER_ERROR", {
@@ -495,7 +588,32 @@ const phoneNumber = (options) => {
           method: "POST",
           body: zod.z.object({
             phoneNumber: zod.z.string()
-          })
+          }),
+          metadata: {
+            openapi: {
+              description: "Request OTP for password reset via phone number",
+              responses: {
+                "200": {
+                  description: "OTP sent successfully for password reset",
+                  content: {
+                    "application/json": {
+                      schema: {
+                        type: "object",
+                        properties: {
+                          status: {
+                            type: "boolean",
+                            description: "Indicates if the OTP was sent successfully",
+                            enum: [true]
+                          }
+                        },
+                        required: ["status"]
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          }
         },
         async (ctx) => {
           const user = await ctx.context.adapter.findOne({
@@ -514,7 +632,7 @@ const phoneNumber = (options) => {
           }
           const code = generateOTP(opts.otpLength);
           await ctx.context.internalAdapter.createVerificationValue({
-            value: code,
+            value: `${code}:0`,
             identifier: `${ctx.body.phoneNumber}-forget-password`,
             expiresAt: date.getDate(opts.expiresIn, "sec")
           });
@@ -538,7 +656,32 @@ const phoneNumber = (options) => {
             otp: zod.z.string(),
             phoneNumber: zod.z.string(),
             newPassword: zod.z.string()
-          })
+          }),
+          metadata: {
+            openapi: {
+              description: "Reset password using phone number OTP",
+              responses: {
+                "200": {
+                  description: "Password reset successfully",
+                  content: {
+                    "application/json": {
+                      schema: {
+                        type: "object",
+                        properties: {
+                          status: {
+                            type: "boolean",
+                            description: "Indicates if the password was reset successfully",
+                            enum: [true]
+                          }
+                        },
+                        required: ["status"]
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          }
         },
         async (ctx) => {
           const verification = await ctx.context.internalAdapter.findVerificationValue(
@@ -554,7 +697,23 @@ const phoneNumber = (options) => {
               message: ERROR_CODES.OTP_EXPIRED
             });
           }
-          if (verification.value !== ctx.body.otp) {
+          const [otpValue, attempts] = verification.value.split(":");
+          const allowedAttempts = options?.allowedAttempts || 3;
+          if (attempts && parseInt(attempts) >= allowedAttempts) {
+            await ctx.context.internalAdapter.deleteVerificationValue(
+              verification.id
+            );
+            throw new betterCall.APIError("FORBIDDEN", {
+              message: "Too many attempts"
+            });
+          }
+          if (ctx.body.otp !== otpValue) {
+            await ctx.context.internalAdapter.updateVerificationValue(
+              verification.id,
+              {
+                value: `${otpValue}:${parseInt(attempts || "0") + 1}`
+              }
+            );
             throw new betterCall.APIError("BAD_REQUEST", {
               message: ERROR_CODES.INVALID_OTP
             });
@@ -587,6 +746,15 @@ const phoneNumber = (options) => {
       )
     },
     schema: schema$1.mergeSchema(schema, options?.schema),
+    rateLimit: [
+      {
+        pathMatcher(path) {
+          return path.startsWith("/phone-number");
+        },
+        window: 60 * 1e3,
+        max: 10
+      }
+    ],
     $ERROR_CODES: ERROR_CODES
   };
 };

package/dist/plugins/phone-number/index.d.cts

@@ -1,8 +1,8 @@
 import * as better_call from 'better-call';
 import { z } from 'zod';
-import { U as User, I as InferOptionSchema } from '../../shared/better-auth.BiQsvaIP.cjs';
-import '../../shared/better-auth.Bi8FQwDD.cjs';
-import '../../shared/better-auth.B2Fw1vhH.cjs';
+import { U as User, I as InferOptionSchema } from '../../shared/better-auth.BcU1Kjyq.cjs';
+import '../../shared/better-auth.CYegVoq1.cjs';
+import '../../shared/better-auth.DTiSPWEk.cjs';
 import 'jose';
 import 'kysely';
 import 'better-sqlite3';
@@ -50,6 +50,12 @@ interface PhoneNumberOptions {
      * by default any string is accepted
      */
     phoneNumberValidator?: (phoneNumber: string) => boolean | Promise<boolean>;
+    /**
+     * Require a phone number verification before signing in
+     *
+     * @default false
+     */
+    requireVerification?: boolean;
     /**
      * Callback when phone number is verified
      */
@@ -89,6 +95,11 @@ interface PhoneNumberOptions {
      * Custom schema for the admin plugin
      */
     schema?: InferOptionSchema<typeof schema>;
+    /**
+     * Allowed attempts for the OTP code
+     * @default 3
+     */
+    allowedAttempts?: number;
 }
 declare const phoneNumber: (options?: PhoneNumberOptions) => {
     id: "phone-number";
@@ -329,20 +340,77 @@ declare const phoneNumber: (options?: PhoneNumberOptions) => {
                         summary: string;
                         description: string;
                         responses: {
-                            200: {
+                            "200": {
                                 description: string;
                                 content: {
                                     "application/json": {
                                         schema: {
                                             type: "object";
                                             properties: {
-                                                user: {
-                                                    $ref: string;
+                                                status: {
+                                                    type: string;
+                                                    description: string;
+                                                    enum: boolean[];
                                                 };
-                                                session: {
-                                                    $ref: string;
+                                                token: {
+                                                    type: string;
+                                                    nullable: boolean;
+                                                    description: string;
+                                                };
+                                                user: {
+                                                    type: string;
+                                                    nullable: boolean;
+                                                    properties: {
+                                                        id: {
+                                                            type: string;
+                                                            description: string;
+                                                        };
+                                                        email: {
+                                                            type: string;
+                                                            format: string;
+                                                            nullable: boolean;
+                                                            description: string;
+                                                        };
+                                                        emailVerified: {
+                                                            type: string;
+                                                            nullable: boolean;
+                                                            description: string;
+                                                        };
+                                                        name: {
+                                                            type: string;
+                                                            nullable: boolean;
+                                                            description: string;
+                                                        };
+                                                        image: {
+                                                            type: string;
+                                                            format: string;
+                                                            nullable: boolean;
+                                                            description: string;
+                                                        };
+                                                        phoneNumber: {
+                                                            type: string;
+                                                            description: string;
+                                                        };
+                                                        phoneNumberVerified: {
+                                                            type: string;
+                                                            description: string;
+                                                        };
+                                                        createdAt: {
+                                                            type: string;
+                                                            format: string;
+                                                            description: string;
+                                                        };
+                                                        updatedAt: {
+                                                            type: string;
+                                                            format: string;
+                                                            description: string;
+                                                        };
+                                                    };
+                                                    required: string[];
+                                                    description: string;
                                                 };
                                             };
+                                            required: string[];
                                         };
                                     };
                                 };
@@ -398,6 +466,31 @@ declare const phoneNumber: (options?: PhoneNumberOptions) => {
                 }, {
                     phoneNumber: string;
                 }>;
+                metadata: {
+                    openapi: {
+                        description: string;
+                        responses: {
+                            "200": {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                status: {
+                                                    type: string;
+                                                    description: string;
+                                                    enum: boolean[];
+                                                };
+                                            };
+                                            required: string[];
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
             } & {
                 use: any[];
             };
@@ -451,6 +544,31 @@ declare const phoneNumber: (options?: PhoneNumberOptions) => {
                     otp: string;
                     phoneNumber: string;
                 }>;
+                metadata: {
+                    openapi: {
+                        description: string;
+                        responses: {
+                            "200": {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                status: {
+                                                    type: string;
+                                                    description: string;
+                                                    enum: boolean[];
+                                                };
+                                            };
+                                            required: string[];
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
             } & {
                 use: any[];
             };
@@ -476,6 +594,11 @@ declare const phoneNumber: (options?: PhoneNumberOptions) => {
             };
         };
     };
+    rateLimit: {
+        pathMatcher(path: string): boolean;
+        window: number;
+        max: number;
+    }[];
     $ERROR_CODES: {
         readonly INVALID_PHONE_NUMBER: "Invalid phone number";
         readonly PHONE_NUMBER_EXIST: "Phone number already exist";
@@ -484,6 +607,7 @@ declare const phoneNumber: (options?: PhoneNumberOptions) => {
         readonly OTP_NOT_FOUND: "OTP not found";
         readonly OTP_EXPIRED: "OTP expired";
         readonly INVALID_OTP: "Invalid OTP";
+        readonly PHONE_NUMBER_NOT_VERIFIED: "Phone number not verified";
     };
 };
 declare const schema: {