better-auth 1.2.6-beta.7 → 1.2.7-beta.1

package/dist/plugins/two-factor/index.cjs

@@ -2,21 +2,20 @@
 
 const random = require('../../shared/better-auth.CYeOI8C-.cjs');
 const zod = require('zod');
-const refreshToken = require('../../shared/better-auth.BDYXUcLv.cjs');
+const refreshToken = require('../../shared/better-auth.Dg0siV5C.cjs');
 const betterCall = require('better-call');
 const cookies_index = require('../../cookies/index.cjs');
-const schema$1 = require('../../shared/better-auth.C5H9XEzZ.cjs');
+const schema$1 = require('../../shared/better-auth.DcWKCjjf.cjs');
 require('../../shared/better-auth.DiSjtgs9.cjs');
 require('../../shared/better-auth.GpOOav9x.cjs');
 require('defu');
 const crypto_index = require('../../crypto/index.cjs');
-const verifyMiddleware = require('../../shared/better-auth.m575EIBC.cjs');
-const errorCode = require('../../shared/better-auth.C1-vpKly.cjs');
+require('@better-auth/utils/base64');
+const hmac = require('@better-auth/utils/hmac');
 require('@better-auth/utils/hash');
 require('@noble/ciphers/chacha');
 require('@noble/ciphers/utils');
 require('@noble/ciphers/webcrypto');
-require('@better-auth/utils/base64');
 require('jose');
 require('@noble/hashes/scrypt');
 require('@better-auth/utils');
@@ -24,7 +23,6 @@ require('@better-auth/utils/hex');
 require('@noble/hashes/utils');
 const otp = require('@better-auth/utils/otp');
 const password = require('../../shared/better-auth.CDXNofOe.cjs');
-const hmac = require('@better-auth/utils/hmac');
 const client = require('../../shared/better-auth.DnER2-iT.cjs');
 require('@better-auth/utils/random');
 require('../../social-providers/index.cjs');
@@ -33,14 +31,151 @@ require('../../shared/better-auth.Cm29ZKNJ.cjs');
 require('../../shared/better-auth.C1hdVENX.cjs');
 require('../../shared/better-auth.ANpbi45u.cjs');
 require('../../shared/better-auth.QbbyHMYf.cjs');
+require('../../shared/better-auth.D3mtHEZg.cjs');
 require('../../shared/better-auth.Bg6iw3ig.cjs');
 require('../../shared/better-auth.BMYo0QR-.cjs');
 require('../../shared/better-auth.C-R0J0n1.cjs');
 require('jose/errors');
-require('../../shared/better-auth.D3mtHEZg.cjs');
 require('@better-auth/utils/binary');
 require('../../shared/better-auth.YUF6P-PB.cjs');
 
+const TWO_FACTOR_ERROR_CODES = {
+  OTP_NOT_ENABLED: "OTP not enabled",
+  OTP_HAS_EXPIRED: "OTP has expired",
+  TOTP_NOT_ENABLED: "TOTP not enabled",
+  TWO_FACTOR_NOT_ENABLED: "Two factor isn't enabled",
+  BACKUP_CODES_NOT_ENABLED: "Backup codes aren't enabled",
+  INVALID_BACKUP_CODE: "Invalid backup code",
+  INVALID_CODE: "Invalid code",
+  TOO_MANY_ATTEMPTS_REQUEST_NEW_CODE: "Too many attempts. Please request a new code.",
+  INVALID_TWO_FACTOR_COOKIE: "Invalid two factor cookie"
+};
+
+const TWO_FACTOR_COOKIE_NAME = "two_factor";
+const TRUST_DEVICE_COOKIE_NAME = "trust_device";
+
+async function verifyTwoFactor(ctx) {
+  const session = await refreshToken.getSessionFromCtx(ctx);
+  if (!session) {
+    const cookieName = ctx.context.createAuthCookie(TWO_FACTOR_COOKIE_NAME);
+    const twoFactorCookie = await ctx.getSignedCookie(
+      cookieName.name,
+      ctx.context.secret
+    );
+    if (!twoFactorCookie) {
+      throw new betterCall.APIError("UNAUTHORIZED", {
+        message: TWO_FACTOR_ERROR_CODES.INVALID_TWO_FACTOR_COOKIE
+      });
+    }
+    const verificationToken = await ctx.context.internalAdapter.findVerificationValue(twoFactorCookie);
+    if (!verificationToken) {
+      throw new betterCall.APIError("UNAUTHORIZED", {
+        message: TWO_FACTOR_ERROR_CODES.INVALID_TWO_FACTOR_COOKIE
+      });
+    }
+    const user = await ctx.context.internalAdapter.findUserById(
+      verificationToken.value
+    );
+    if (!user) {
+      throw new betterCall.APIError("UNAUTHORIZED", {
+        message: TWO_FACTOR_ERROR_CODES.INVALID_TWO_FACTOR_COOKIE
+      });
+    }
+    const dontRememberMe = await ctx.getSignedCookie(
+      ctx.context.authCookies.dontRememberToken.name,
+      ctx.context.secret
+    );
+    return {
+      valid: async (ctx2) => {
+        const session2 = await ctx2.context.internalAdapter.createSession(
+          verificationToken.value,
+          ctx2.headers,
+          !!dontRememberMe
+        );
+        if (!session2) {
+          throw new betterCall.APIError("INTERNAL_SERVER_ERROR", {
+            message: "failed to create session"
+          });
+        }
+        await cookies_index.setSessionCookie(ctx2, {
+          session: session2,
+          user
+        });
+        if (ctx2.body.trustDevice) {
+          const trustDeviceCookie = ctx2.context.createAuthCookie(
+            TRUST_DEVICE_COOKIE_NAME,
+            {
+              maxAge: 30 * 24 * 60 * 60
+              // 30 days, it'll be refreshed on sign in requests
+            }
+          );
+          const token = await hmac.createHMAC("SHA-256", "base64urlnopad").sign(
+            ctx2.context.secret,
+            `${user.id}!${session2.token}`
+          );
+          await ctx2.setSignedCookie(
+            trustDeviceCookie.name,
+            `${token}!${session2.token}`,
+            ctx2.context.secret,
+            trustDeviceCookie.attributes
+          );
+          ctx2.setCookie(ctx2.context.authCookies.dontRememberToken.name, "", {
+            maxAge: 0
+          });
+          ctx2.setCookie(cookieName.name, "", {
+            maxAge: 0
+          });
+        }
+        return ctx2.json({
+          token: session2.token,
+          user: {
+            id: user.id,
+            email: user.email,
+            emailVerified: user.emailVerified,
+            name: user.name,
+            image: user.image,
+            createdAt: user.createdAt,
+            updatedAt: user.updatedAt
+          }
+        });
+      },
+      invalid: async (errorKey) => {
+        throw new betterCall.APIError("UNAUTHORIZED", {
+          message: TWO_FACTOR_ERROR_CODES[errorKey]
+        });
+      },
+      session: {
+        session: null,
+        user
+      },
+      key: twoFactorCookie
+    };
+  }
+  return {
+    valid: async (ctx2) => {
+      return ctx2.json({
+        token: session.session.token,
+        user: {
+          id: session.user.id,
+          email: session.user.email,
+          emailVerified: session.user.emailVerified,
+          name: session.user.name,
+          image: session.user.image,
+          createdAt: session.user.createdAt,
+          updatedAt: session.user.updatedAt
+        }
+      });
+    },
+    invalid: async () => {
+      throw new betterCall.APIError("UNAUTHORIZED", {
+        message: TWO_FACTOR_ERROR_CODES.INVALID_TWO_FACTOR_COOKIE
+      });
+    },
+    session,
+    key: `${session.user.id}!${session.session.id}`
+  };
+}
+
 function generateBackupCodesFn(options) {
   return Array.from({ length: options?.amount ?? 10 }).fill(null).map(() => random.generateRandomString(options?.length ?? 10, "a-z", "0-9", "A-Z")).map((code) => `${code.slice(0, 5)}-${code.slice(5)}`);
 }
@@ -108,10 +243,112 @@ const backupCode2fa = (options) => {
               description: "If true, the device will be trusted for 30 days. It'll be refreshed on every sign in request within this time."
             }).optional()
           }),
-          use: [verifyMiddleware.verifyTwoFactorMiddleware]
+          metadata: {
+            openapi: {
+              description: "Verify a backup code for two-factor authentication",
+              responses: {
+                "200": {
+                  description: "Backup code verified successfully",
+                  content: {
+                    "application/json": {
+                      schema: {
+                        type: "object",
+                        properties: {
+                          user: {
+                            type: "object",
+                            properties: {
+                              id: {
+                                type: "string",
+                                description: "Unique identifier of the user"
+                              },
+                              email: {
+                                type: "string",
+                                format: "email",
+                                nullable: true,
+                                description: "User's email address"
+                              },
+                              emailVerified: {
+                                type: "boolean",
+                                nullable: true,
+                                description: "Whether the email is verified"
+                              },
+                              name: {
+                                type: "string",
+                                nullable: true,
+                                description: "User's name"
+                              },
+                              image: {
+                                type: "string",
+                                format: "uri",
+                                nullable: true,
+                                description: "User's profile image URL"
+                              },
+                              twoFactorEnabled: {
+                                type: "boolean",
+                                description: "Whether two-factor authentication is enabled for the user"
+                              },
+                              createdAt: {
+                                type: "string",
+                                format: "date-time",
+                                description: "Timestamp when the user was created"
+                              },
+                              updatedAt: {
+                                type: "string",
+                                format: "date-time",
+                                description: "Timestamp when the user was last updated"
+                              }
+                            },
+                            required: [
+                              "id",
+                              "twoFactorEnabled",
+                              "createdAt",
+                              "updatedAt"
+                            ],
+                            description: "The authenticated user object with two-factor details"
+                          },
+                          session: {
+                            type: "object",
+                            properties: {
+                              token: {
+                                type: "string",
+                                description: "Session token"
+                              },
+                              userId: {
+                                type: "string",
+                                description: "ID of the user associated with the session"
+                              },
+                              createdAt: {
+                                type: "string",
+                                format: "date-time",
+                                description: "Timestamp when the session was created"
+                              },
+                              expiresAt: {
+                                type: "string",
+                                format: "date-time",
+                                description: "Timestamp when the session expires"
+                              }
+                            },
+                            required: [
+                              "token",
+                              "userId",
+                              "createdAt",
+                              "expiresAt"
+                            ],
+                            description: "The current session object, included unless disableSession is true"
+                          }
+                        },
+                        required: ["user", "session"]
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          }
         },
         async (ctx) => {
-          const user = ctx.context.session.user;
+          const { session, valid } = await verifyTwoFactor(ctx);
+          const user = session.user;
           const twoFactor = await ctx.context.adapter.findOne({
             model: twoFactorTable,
             where: [
@@ -123,7 +360,7 @@ const backupCode2fa = (options) => {
           });
           if (!twoFactor) {
             throw new betterCall.APIError("BAD_REQUEST", {
-              message: errorCode.TWO_FACTOR_ERROR_CODES.BACKUP_CODES_NOT_ENABLED
+              message: TWO_FACTOR_ERROR_CODES.BACKUP_CODES_NOT_ENABLED
             });
           }
           const validate = await verifyBackupCode(
@@ -135,7 +372,7 @@ const backupCode2fa = (options) => {
           );
           if (!validate.status) {
             throw new betterCall.APIError("UNAUTHORIZED", {
-              message: errorCode.TWO_FACTOR_ERROR_CODES.INVALID_BACKUP_CODE
+              message: TWO_FACTOR_ERROR_CODES.INVALID_BACKUP_CODE
             });
           }
           const updatedBackupCodes = await crypto_index.symmetricEncrypt({
@@ -155,14 +392,19 @@ const backupCode2fa = (options) => {
             ]
           });
           if (!ctx.body.disableSession) {
-            await cookies_index.setSessionCookie(ctx, {
-              session: ctx.context.session.session,
-              user
-            });
+            return valid(ctx);
           }
           return ctx.json({
-            user,
-            session: ctx.context.session
+            token: session.session?.token,
+            user: {
+              id: session.user?.id,
+              email: session.user.email,
+              emailVerified: session.user.emailVerified,
+              name: session.user.name,
+              image: session.user.image,
+              createdAt: session.user.createdAt,
+              updatedAt: session.user.updatedAt
+            }
           });
         }
       ),
@@ -173,13 +415,43 @@ const backupCode2fa = (options) => {
           body: zod.z.object({
             password: zod.z.string()
           }),
-          use: [refreshToken.sessionMiddleware]
+          use: [refreshToken.sessionMiddleware],
+          metadata: {
+            openapi: {
+              description: "Generate new backup codes for two-factor authentication",
+              responses: {
+                "200": {
+                  description: "Backup codes generated successfully",
+                  content: {
+                    "application/json": {
+                      schema: {
+                        type: "object",
+                        properties: {
+                          status: {
+                            type: "boolean",
+                            description: "Indicates if the backup codes were generated successfully",
+                            enum: [true]
+                          },
+                          backupCodes: {
+                            type: "array",
+                            items: { type: "string" },
+                            description: "Array of generated backup codes in plain text"
+                          }
+                        },
+                        required: ["status", "backupCodes"]
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          }
         },
         async (ctx) => {
           const user = ctx.context.session.user;
           if (!user.twoFactorEnabled) {
             throw new betterCall.APIError("BAD_REQUEST", {
-              message: errorCode.TWO_FACTOR_ERROR_CODES.TWO_FACTOR_NOT_ENABLED
+              message: TWO_FACTOR_ERROR_CODES.TWO_FACTOR_NOT_ENABLED
             });
           }
           await ctx.context.password.checkPassword(user.id, ctx);
@@ -237,7 +509,7 @@ const backupCode2fa = (options) => {
           );
           if (!backupCodes) {
             throw new betterCall.APIError("BAD_REQUEST", {
-              message: errorCode.TWO_FACTOR_ERROR_CODES.BACKUP_CODES_NOT_ENABLED
+              message: TWO_FACTOR_ERROR_CODES.BACKUP_CODES_NOT_ENABLED
             });
           }
           return ctx.json({
@@ -269,7 +541,6 @@ const otp2fa = (options) => {
          */
         trustDevice: zod.z.boolean().optional()
       }).optional(),
-      use: [verifyMiddleware.verifyTwoFactorMiddleware],
       metadata: {
         openapi: {
           summary: "Send two factor OTP",
@@ -303,28 +574,31 @@ const otp2fa = (options) => {
           message: "otp isn't configured"
         });
       }
-      const user = ctx.context.session.user;
+      const { session, key } = await verifyTwoFactor(ctx);
       const twoFactor = await ctx.context.adapter.findOne({
         model: twoFactorTable,
         where: [
           {
             field: "userId",
-            value: user.id
+            value: session.user.id
           }
         ]
       });
       if (!twoFactor) {
         throw new betterCall.APIError("BAD_REQUEST", {
-          message: errorCode.TWO_FACTOR_ERROR_CODES.OTP_NOT_ENABLED
+          message: TWO_FACTOR_ERROR_CODES.OTP_NOT_ENABLED
         });
       }
       const code = random.generateRandomString(opts.digits, "0-9");
       await ctx.context.internalAdapter.createVerificationValue({
-        value: code,
-        identifier: `2fa-otp-${user.id}`,
+        value: `${code}!0`,
+        identifier: `2fa-otp-${key}`,
         expiresAt: new Date(Date.now() + opts.period)
       });
-      await options.sendOTP({ user, otp: code }, ctx.request);
+      await options.sendOTP(
+        { user: session.user, otp: code },
+        ctx.request
+      );
       return ctx.json({ status: true });
     }
   );
@@ -343,23 +617,67 @@ const otp2fa = (options) => {
          */
         trustDevice: zod.z.boolean().optional()
       }),
-      use: [verifyMiddleware.verifyTwoFactorMiddleware],
       metadata: {
         openapi: {
           summary: "Verify two factor OTP",
           description: "Verify two factor OTP",
           responses: {
-            200: {
-              description: "Success",
+            "200": {
+              description: "Two-factor OTP verified successfully",
               content: {
                 "application/json": {
                   schema: {
                     type: "object",
                     properties: {
-                      status: {
-                        type: "boolean"
+                      token: {
+                        type: "string",
+                        description: "Session token for the authenticated session"
+                      },
+                      user: {
+                        type: "object",
+                        properties: {
+                          id: {
+                            type: "string",
+                            description: "Unique identifier of the user"
+                          },
+                          email: {
+                            type: "string",
+                            format: "email",
+                            nullable: true,
+                            description: "User's email address"
+                          },
+                          emailVerified: {
+                            type: "boolean",
+                            nullable: true,
+                            description: "Whether the email is verified"
+                          },
+                          name: {
+                            type: "string",
+                            nullable: true,
+                            description: "User's name"
+                          },
+                          image: {
+                            type: "string",
+                            format: "uri",
+                            nullable: true,
+                            description: "User's profile image URL"
+                          },
+                          createdAt: {
+                            type: "string",
+                            format: "date-time",
+                            description: "Timestamp when the user was created"
+                          },
+                          updatedAt: {
+                            type: "string",
+                            format: "date-time",
+                            description: "Timestamp when the user was last updated"
+                          }
+                        },
+                        required: ["id", "createdAt", "updatedAt"],
+                        description: "The authenticated user object"
                       }
-                    }
+                    },
+                    required: ["token", "user"]
                   }
                 }
               }
@@ -369,54 +687,90 @@ const otp2fa = (options) => {
       }
     },
     async (ctx) => {
-      const user = ctx.context.session.user;
+      const { session, key, valid, invalid } = await verifyTwoFactor(ctx);
       const twoFactor = await ctx.context.adapter.findOne({
         model: twoFactorTable,
         where: [
           {
             field: "userId",
-            value: user.id
+            value: session.user.id
           }
         ]
       });
       if (!twoFactor) {
         throw new betterCall.APIError("BAD_REQUEST", {
-          message: errorCode.TWO_FACTOR_ERROR_CODES.OTP_NOT_ENABLED
+          message: TWO_FACTOR_ERROR_CODES.OTP_NOT_ENABLED
         });
       }
       const toCheckOtp = await ctx.context.internalAdapter.findVerificationValue(
-        `2fa-otp-${user.id}`
+        `2fa-otp-${key}`
       );
+      const [otp, counter] = toCheckOtp?.value?.split("!") ?? [];
       if (!toCheckOtp || toCheckOtp.expiresAt < /* @__PURE__ */ new Date()) {
+        await ctx.context.internalAdapter.deleteVerificationValue(
+          `2fa-otp-${key}`
+        );
+        throw new betterCall.APIError("BAD_REQUEST", {
+          message: TWO_FACTOR_ERROR_CODES.OTP_HAS_EXPIRED
+        });
+      }
+      const allowedAttempts = options?.allowedAttempts || 5;
+      if (parseInt(counter) >= allowedAttempts) {
+        await ctx.context.internalAdapter.deleteVerificationValue(
+          `2fa-otp-${key}`
+        );
         throw new betterCall.APIError("BAD_REQUEST", {
-          message: errorCode.TWO_FACTOR_ERROR_CODES.OTP_HAS_EXPIRED
+          message: TWO_FACTOR_ERROR_CODES.TOO_MANY_ATTEMPTS_REQUEST_NEW_CODE
         });
       }
-      if (toCheckOtp.value === ctx.body.code) {
-        if (!user.twoFactorEnabled) {
+      if (otp === ctx.body.code) {
+        if (!session.user.twoFactorEnabled) {
+          if (!session.session) {
+            throw new betterCall.APIError("BAD_REQUEST", {
+              message: refreshToken.BASE_ERROR_CODES.FAILED_TO_CREATE_SESSION
+            });
+          }
           const updatedUser = await ctx.context.internalAdapter.updateUser(
-            user.id,
+            session.user.id,
             {
               twoFactorEnabled: true
             }
           );
           const newSession = await ctx.context.internalAdapter.createSession(
-            user.id,
-            ctx.request,
+            session.user.id,
+            ctx.headers,
             false,
-            ctx.context.session.session
+            session.session
           );
           await ctx.context.internalAdapter.deleteSession(
-            ctx.context.session.session.token
+            session.session.token
           );
           await cookies_index.setSessionCookie(ctx, {
             session: newSession,
             user: updatedUser
           });
+          return ctx.json({
+            token: newSession.token,
+            user: {
+              id: updatedUser.id,
+              email: updatedUser.email,
+              emailVerified: updatedUser.emailVerified,
+              name: updatedUser.name,
+              image: updatedUser.image,
+              createdAt: updatedUser.createdAt,
+              updatedAt: updatedUser.updatedAt
+            }
+          });
         }
-        return ctx.context.valid(ctx);
+        return valid(ctx);
       } else {
-        return ctx.context.invalid();
+        await ctx.context.internalAdapter.updateVerificationValue(
+          toCheckOtp.id,
+          {
+            value: `${otp}!${parseInt(counter) + 1}`
+          }
+        );
+        return invalid("INVALID_CODE");
       }
     }
   );
@@ -440,7 +794,11 @@ const totp2fa = (options) => {
     "/totp/generate",
     {
       method: "POST",
-      use: [refreshToken.sessionMiddleware],
+      body: zod.z.object({
+        secret: zod.z.string({
+          description: "The secret to generate the TOTP code"
+        })
+      }),
       metadata: {
         openapi: {
           summary: "Generate TOTP code",
@@ -462,7 +820,8 @@ const totp2fa = (options) => {
               }
             }
           }
-        }
+        },
+        SERVER_ONLY: true
       }
     },
     async (ctx) => {
@@ -474,22 +833,7 @@ const totp2fa = (options) => {
           message: "totp isn't configured"
         });
       }
-      const user = ctx.context.session.user;
-      const twoFactor = await ctx.context.adapter.findOne({
-        model: twoFactorTable,
-        where: [
-          {
-            field: "userId",
-            value: user.id
-          }
-        ]
-      });
-      if (!twoFactor) {
-        throw new betterCall.APIError("BAD_REQUEST", {
-          message: errorCode.TWO_FACTOR_ERROR_CODES.TOTP_NOT_ENABLED
-        });
-      }
-      const code = await otp.createOTP(twoFactor.secret, {
+      const code = await otp.createOTP(ctx.body.secret, {
         period: opts.period,
         digits: opts.digits
       }).totp();
@@ -551,7 +895,7 @@ const totp2fa = (options) => {
       });
       if (!twoFactor || !user.twoFactorEnabled) {
         throw new betterCall.APIError("BAD_REQUEST", {
-          message: errorCode.TWO_FACTOR_ERROR_CODES.TOTP_NOT_ENABLED
+          message: TWO_FACTOR_ERROR_CODES.TOTP_NOT_ENABLED
         });
       }
       const secret = await crypto_index.symmetricDecrypt({
@@ -585,7 +929,6 @@ const totp2fa = (options) => {
           description: "If true, the device will be trusted for 30 days. It'll be refreshed on every sign in request within this time."
         }).optional()
       }),
-      use: [verifyMiddleware.verifyTwoFactorMiddleware],
       metadata: {
         openapi: {
           summary: "Verify two factor TOTP",
@@ -619,7 +962,8 @@ const totp2fa = (options) => {
           message: "totp isn't configured"
         });
       }
-      const user = ctx.context.session.user;
+      const { session, valid, invalid } = await verifyTwoFactor(ctx);
+      const user = session.user;
       const twoFactor = await ctx.context.adapter.findOne({
         model: twoFactorTable,
         where: [
@@ -631,7 +975,7 @@ const totp2fa = (options) => {
       });
       if (!twoFactor) {
         throw new betterCall.APIError("BAD_REQUEST", {
-          message: errorCode.TWO_FACTOR_ERROR_CODES.TOTP_NOT_ENABLED
+          message: TWO_FACTOR_ERROR_CODES.TOTP_NOT_ENABLED
         });
       }
       const decrypted = await crypto_index.symmetricDecrypt({
@@ -643,9 +987,14 @@ const totp2fa = (options) => {
         digits: opts.digits
       }).verify(ctx.body.code);
       if (!status) {
-        return ctx.context.invalid();
+        return invalid("INVALID_CODE");
       }
       if (!user.twoFactorEnabled) {
+        if (!session.session) {
+          throw new betterCall.APIError("BAD_REQUEST", {
+            message: refreshToken.BASE_ERROR_CODES.FAILED_TO_CREATE_SESSION
+          });
+        }
         const updatedUser = await ctx.context.internalAdapter.updateUser(
           user.id,
           {
@@ -653,23 +1002,16 @@ const totp2fa = (options) => {
           },
           ctx
         );
-        const newSession = await ctx.context.internalAdapter.createSession(
-          user.id,
-          ctx.request,
-          false,
-          ctx.context.session.session
-        ).catch((e) => {
+        const newSession = await ctx.context.internalAdapter.createSession(user.id, ctx.headers, false, session.session).catch((e) => {
           throw e;
         });
-        await ctx.context.internalAdapter.deleteSession(
-          ctx.context.session.session.token
-        );
+        await ctx.context.internalAdapter.deleteSession(session.session.token);
         await cookies_index.setSessionCookie(ctx, {
           session: newSession,
           user: updatedUser
         });
       }
-      return ctx.context.valid(ctx);
+      return valid(ctx);
     }
   );
   return {
@@ -738,7 +1080,10 @@ const twoFactor = (options) => {
           body: zod.z.object({
             password: zod.z.string({
               description: "User password"
-            })
+            }),
+            issuer: zod.z.string({
+              description: "Custom issuer for the TOTP URI"
+            }).optional()
           }),
           use: [refreshToken.sessionMiddleware],
           metadata: {
@@ -775,7 +1120,7 @@ const twoFactor = (options) => {
         },
         async (ctx) => {
           const user = ctx.context.session.user;
-          const { password: password$1 } = ctx.body;
+          const { password: password$1, issuer } = ctx.body;
           const isPasswordValid = await password.validatePassword(ctx, {
             password: password$1,
             userId: user.id
@@ -804,7 +1149,7 @@ const twoFactor = (options) => {
             );
             const newSession = await ctx.context.internalAdapter.createSession(
               updatedUser.id,
-              ctx.request,
+              ctx.headers,
               false,
               ctx.context.session.session
             );
@@ -836,7 +1181,7 @@ const twoFactor = (options) => {
           const totpURI = otp.createOTP(secret, {
             digits: options?.totpOptions?.digits || 6,
             period: options?.totpOptions?.period
-          }).url(options?.issuer || ctx.context.appName, user.email);
+          }).url(issuer || options?.issuer || ctx.context.appName, user.email);
           return ctx.json({ totpURI, backupCodes: backupCodes.backupCodes });
         }
       ),
@@ -904,7 +1249,7 @@ const twoFactor = (options) => {
           });
           const newSession = await ctx.context.internalAdapter.createSession(
             updatedUser.id,
-            ctx.request,
+            ctx.headers,
             false,
             ctx.context.session.session
           );
@@ -935,7 +1280,7 @@ const twoFactor = (options) => {
               return;
             }
             const trustDeviceCookieName = ctx.context.createAuthCookie(
-              verifyMiddleware.TRUST_DEVICE_COOKIE_NAME
+              TRUST_DEVICE_COOKIE_NAME
             );
             const trustDeviceCookie = await ctx.getSignedCookie(
               trustDeviceCookieName.name,
@@ -963,16 +1308,22 @@ const twoFactor = (options) => {
             }
             cookies_index.deleteSessionCookie(ctx, true);
             await ctx.context.internalAdapter.deleteSession(data.session.token);
+            const maxAge = options?.otpOptions?.period || 60 * 5;
             const twoFactorCookie = ctx.context.createAuthCookie(
-              verifyMiddleware.TWO_FACTOR_COOKIE_NAME,
+              TWO_FACTOR_COOKIE_NAME,
               {
-                maxAge: 60 * 10
-                // 10 minutes
+                maxAge
               }
             );
+            const identifier = `2fa-${random.generateRandomString(20)}`;
+            await ctx.context.internalAdapter.createVerificationValue({
+              value: data.user.id,
+              identifier,
+              expiresAt: new Date(Date.now() + maxAge * 1e3)
+            });
             await ctx.setSignedCookie(
               twoFactorCookie.name,
-              data.user.id,
+              identifier,
               ctx.context.secret,
               twoFactorCookie.attributes
             );
@@ -993,10 +1344,10 @@ const twoFactor = (options) => {
         max: 3
       }
     ],
-    $ERROR_CODES: errorCode.TWO_FACTOR_ERROR_CODES
+    $ERROR_CODES: TWO_FACTOR_ERROR_CODES
   };
 };
 
-exports.TWO_FACTOR_ERROR_CODES = errorCode.TWO_FACTOR_ERROR_CODES;
 exports.twoFactorClient = client.twoFactorClient;
+exports.TWO_FACTOR_ERROR_CODES = TWO_FACTOR_ERROR_CODES;
 exports.twoFactor = twoFactor;