better-auth 1.2.6-beta.7 → 1.2.7-beta.1

package/dist/plugins/two-factor/index.mjs

@@ -1,20 +1,19 @@
 import { g as generateRandomString } from '../../shared/better-auth.B4Qoxdgc.mjs';
 import { z } from 'zod';
-import { a as createAuthEndpoint, s as sessionMiddleware, c as createAuthMiddleware, B as BASE_ERROR_CODES } from '../../shared/better-auth.D4jH-sJA.mjs';
+import { g as getSessionFromCtx, a as createAuthEndpoint, s as sessionMiddleware, B as BASE_ERROR_CODES, c as createAuthMiddleware } from '../../shared/better-auth.CWwVo_61.mjs';
 import { APIError } from 'better-call';
 import { setSessionCookie, deleteSessionCookie } from '../../cookies/index.mjs';
-import { m as mergeSchema } from '../../shared/better-auth.CepcSj5H.mjs';
+import { m as mergeSchema } from '../../shared/better-auth.Cc72UxUH.mjs';
 import '../../shared/better-auth.8zoxzg-F.mjs';
-import '../../shared/better-auth.DH3YjMQH.mjs';
+import '../../shared/better-auth.Cqykj82J.mjs';
 import 'defu';
 import { symmetricEncrypt, symmetricDecrypt } from '../../crypto/index.mjs';
-import { v as verifyTwoFactorMiddleware, T as TRUST_DEVICE_COOKIE_NAME, a as TWO_FACTOR_COOKIE_NAME } from '../../shared/better-auth.ClTSOgiD.mjs';
-import { T as TWO_FACTOR_ERROR_CODES } from '../../shared/better-auth.BcoSd9tC.mjs';
+import '@better-auth/utils/base64';
+import { createHMAC } from '@better-auth/utils/hmac';
 import '@better-auth/utils/hash';
 import '@noble/ciphers/chacha';
 import '@noble/ciphers/utils';
 import '@noble/ciphers/webcrypto';
-import '@better-auth/utils/base64';
 import 'jose';
 import '@noble/hashes/scrypt';
 import '@better-auth/utils';
@@ -22,7 +21,6 @@ import '@better-auth/utils/hex';
 import '@noble/hashes/utils';
 import { createOTP } from '@better-auth/utils/otp';
 import { v as validatePassword } from '../../shared/better-auth.YwDQhoPc.mjs';
-import { createHMAC } from '@better-auth/utils/hmac';
 export { t as twoFactorClient } from '../../shared/better-auth.Ddw8bVyV.mjs';
 import '@better-auth/utils/random';
 import '../../social-providers/index.mjs';
@@ -31,14 +29,151 @@ import '../../shared/better-auth.DCVeP5-W.mjs';
 import '../../shared/better-auth.CW6D9eSx.mjs';
 import '../../shared/better-auth.DdzSJf-n.mjs';
 import '../../shared/better-auth.BdyOG_p4.mjs';
+import '../../shared/better-auth.tB5eU6EY.mjs';
 import '../../shared/better-auth.BUPPRXfK.mjs';
 import '../../shared/better-auth.DDEbWX-S.mjs';
 import '../../shared/better-auth.VTXNLFMT.mjs';
 import 'jose/errors';
-import '../../shared/better-auth.tB5eU6EY.mjs';
 import '@better-auth/utils/binary';
 import '../../shared/better-auth.OT3XFeFk.mjs';
 
+const TWO_FACTOR_ERROR_CODES = {
+  OTP_NOT_ENABLED: "OTP not enabled",
+  OTP_HAS_EXPIRED: "OTP has expired",
+  TOTP_NOT_ENABLED: "TOTP not enabled",
+  TWO_FACTOR_NOT_ENABLED: "Two factor isn't enabled",
+  BACKUP_CODES_NOT_ENABLED: "Backup codes aren't enabled",
+  INVALID_BACKUP_CODE: "Invalid backup code",
+  INVALID_CODE: "Invalid code",
+  TOO_MANY_ATTEMPTS_REQUEST_NEW_CODE: "Too many attempts. Please request a new code.",
+  INVALID_TWO_FACTOR_COOKIE: "Invalid two factor cookie"
+};
+
+const TWO_FACTOR_COOKIE_NAME = "two_factor";
+const TRUST_DEVICE_COOKIE_NAME = "trust_device";
+
+async function verifyTwoFactor(ctx) {
+  const session = await getSessionFromCtx(ctx);
+  if (!session) {
+    const cookieName = ctx.context.createAuthCookie(TWO_FACTOR_COOKIE_NAME);
+    const twoFactorCookie = await ctx.getSignedCookie(
+      cookieName.name,
+      ctx.context.secret
+    );
+    if (!twoFactorCookie) {
+      throw new APIError("UNAUTHORIZED", {
+        message: TWO_FACTOR_ERROR_CODES.INVALID_TWO_FACTOR_COOKIE
+      });
+    }
+    const verificationToken = await ctx.context.internalAdapter.findVerificationValue(twoFactorCookie);
+    if (!verificationToken) {
+      throw new APIError("UNAUTHORIZED", {
+        message: TWO_FACTOR_ERROR_CODES.INVALID_TWO_FACTOR_COOKIE
+      });
+    }
+    const user = await ctx.context.internalAdapter.findUserById(
+      verificationToken.value
+    );
+    if (!user) {
+      throw new APIError("UNAUTHORIZED", {
+        message: TWO_FACTOR_ERROR_CODES.INVALID_TWO_FACTOR_COOKIE
+      });
+    }
+    const dontRememberMe = await ctx.getSignedCookie(
+      ctx.context.authCookies.dontRememberToken.name,
+      ctx.context.secret
+    );
+    return {
+      valid: async (ctx2) => {
+        const session2 = await ctx2.context.internalAdapter.createSession(
+          verificationToken.value,
+          ctx2.headers,
+          !!dontRememberMe
+        );
+        if (!session2) {
+          throw new APIError("INTERNAL_SERVER_ERROR", {
+            message: "failed to create session"
+          });
+        }
+        await setSessionCookie(ctx2, {
+          session: session2,
+          user
+        });
+        if (ctx2.body.trustDevice) {
+          const trustDeviceCookie = ctx2.context.createAuthCookie(
+            TRUST_DEVICE_COOKIE_NAME,
+            {
+              maxAge: 30 * 24 * 60 * 60
+              // 30 days, it'll be refreshed on sign in requests
+            }
+          );
+          const token = await createHMAC("SHA-256", "base64urlnopad").sign(
+            ctx2.context.secret,
+            `${user.id}!${session2.token}`
+          );
+          await ctx2.setSignedCookie(
+            trustDeviceCookie.name,
+            `${token}!${session2.token}`,
+            ctx2.context.secret,
+            trustDeviceCookie.attributes
+          );
+          ctx2.setCookie(ctx2.context.authCookies.dontRememberToken.name, "", {
+            maxAge: 0
+          });
+          ctx2.setCookie(cookieName.name, "", {
+            maxAge: 0
+          });
+        }
+        return ctx2.json({
+          token: session2.token,
+          user: {
+            id: user.id,
+            email: user.email,
+            emailVerified: user.emailVerified,
+            name: user.name,
+            image: user.image,
+            createdAt: user.createdAt,
+            updatedAt: user.updatedAt
+          }
+        });
+      },
+      invalid: async (errorKey) => {
+        throw new APIError("UNAUTHORIZED", {
+          message: TWO_FACTOR_ERROR_CODES[errorKey]
+        });
+      },
+      session: {
+        session: null,
+        user
+      },
+      key: twoFactorCookie
+    };
+  }
+  return {
+    valid: async (ctx2) => {
+      return ctx2.json({
+        token: session.session.token,
+        user: {
+          id: session.user.id,
+          email: session.user.email,
+          emailVerified: session.user.emailVerified,
+          name: session.user.name,
+          image: session.user.image,
+          createdAt: session.user.createdAt,
+          updatedAt: session.user.updatedAt
+        }
+      });
+    },
+    invalid: async () => {
+      throw new APIError("UNAUTHORIZED", {
+        message: TWO_FACTOR_ERROR_CODES.INVALID_TWO_FACTOR_COOKIE
+      });
+    },
+    session,
+    key: `${session.user.id}!${session.session.id}`
+  };
+}
+
 function generateBackupCodesFn(options) {
   return Array.from({ length: options?.amount ?? 10 }).fill(null).map(() => generateRandomString(options?.length ?? 10, "a-z", "0-9", "A-Z")).map((code) => `${code.slice(0, 5)}-${code.slice(5)}`);
 }
@@ -106,10 +241,112 @@ const backupCode2fa = (options) => {
               description: "If true, the device will be trusted for 30 days. It'll be refreshed on every sign in request within this time."
             }).optional()
           }),
-          use: [verifyTwoFactorMiddleware]
+          metadata: {
+            openapi: {
+              description: "Verify a backup code for two-factor authentication",
+              responses: {
+                "200": {
+                  description: "Backup code verified successfully",
+                  content: {
+                    "application/json": {
+                      schema: {
+                        type: "object",
+                        properties: {
+                          user: {
+                            type: "object",
+                            properties: {
+                              id: {
+                                type: "string",
+                                description: "Unique identifier of the user"
+                              },
+                              email: {
+                                type: "string",
+                                format: "email",
+                                nullable: true,
+                                description: "User's email address"
+                              },
+                              emailVerified: {
+                                type: "boolean",
+                                nullable: true,
+                                description: "Whether the email is verified"
+                              },
+                              name: {
+                                type: "string",
+                                nullable: true,
+                                description: "User's name"
+                              },
+                              image: {
+                                type: "string",
+                                format: "uri",
+                                nullable: true,
+                                description: "User's profile image URL"
+                              },
+                              twoFactorEnabled: {
+                                type: "boolean",
+                                description: "Whether two-factor authentication is enabled for the user"
+                              },
+                              createdAt: {
+                                type: "string",
+                                format: "date-time",
+                                description: "Timestamp when the user was created"
+                              },
+                              updatedAt: {
+                                type: "string",
+                                format: "date-time",
+                                description: "Timestamp when the user was last updated"
+                              }
+                            },
+                            required: [
+                              "id",
+                              "twoFactorEnabled",
+                              "createdAt",
+                              "updatedAt"
+                            ],
+                            description: "The authenticated user object with two-factor details"
+                          },
+                          session: {
+                            type: "object",
+                            properties: {
+                              token: {
+                                type: "string",
+                                description: "Session token"
+                              },
+                              userId: {
+                                type: "string",
+                                description: "ID of the user associated with the session"
+                              },
+                              createdAt: {
+                                type: "string",
+                                format: "date-time",
+                                description: "Timestamp when the session was created"
+                              },
+                              expiresAt: {
+                                type: "string",
+                                format: "date-time",
+                                description: "Timestamp when the session expires"
+                              }
+                            },
+                            required: [
+                              "token",
+                              "userId",
+                              "createdAt",
+                              "expiresAt"
+                            ],
+                            description: "The current session object, included unless disableSession is true"
+                          }
+                        },
+                        required: ["user", "session"]
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          }
         },
         async (ctx) => {
-          const user = ctx.context.session.user;
+          const { session, valid } = await verifyTwoFactor(ctx);
+          const user = session.user;
           const twoFactor = await ctx.context.adapter.findOne({
             model: twoFactorTable,
             where: [
@@ -153,14 +390,19 @@ const backupCode2fa = (options) => {
             ]
           });
           if (!ctx.body.disableSession) {
-            await setSessionCookie(ctx, {
-              session: ctx.context.session.session,
-              user
-            });
+            return valid(ctx);
           }
           return ctx.json({
-            user,
-            session: ctx.context.session
+            token: session.session?.token,
+            user: {
+              id: session.user?.id,
+              email: session.user.email,
+              emailVerified: session.user.emailVerified,
+              name: session.user.name,
+              image: session.user.image,
+              createdAt: session.user.createdAt,
+              updatedAt: session.user.updatedAt
+            }
           });
         }
       ),
@@ -171,7 +413,37 @@ const backupCode2fa = (options) => {
           body: z.object({
             password: z.string()
           }),
-          use: [sessionMiddleware]
+          use: [sessionMiddleware],
+          metadata: {
+            openapi: {
+              description: "Generate new backup codes for two-factor authentication",
+              responses: {
+                "200": {
+                  description: "Backup codes generated successfully",
+                  content: {
+                    "application/json": {
+                      schema: {
+                        type: "object",
+                        properties: {
+                          status: {
+                            type: "boolean",
+                            description: "Indicates if the backup codes were generated successfully",
+                            enum: [true]
+                          },
+                          backupCodes: {
+                            type: "array",
+                            items: { type: "string" },
+                            description: "Array of generated backup codes in plain text"
+                          }
+                        },
+                        required: ["status", "backupCodes"]
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          }
         },
         async (ctx) => {
           const user = ctx.context.session.user;
@@ -267,7 +539,6 @@ const otp2fa = (options) => {
          */
         trustDevice: z.boolean().optional()
       }).optional(),
-      use: [verifyTwoFactorMiddleware],
       metadata: {
         openapi: {
           summary: "Send two factor OTP",
@@ -301,13 +572,13 @@ const otp2fa = (options) => {
           message: "otp isn't configured"
         });
       }
-      const user = ctx.context.session.user;
+      const { session, key } = await verifyTwoFactor(ctx);
       const twoFactor = await ctx.context.adapter.findOne({
         model: twoFactorTable,
         where: [
           {
             field: "userId",
-            value: user.id
+            value: session.user.id
           }
         ]
       });
@@ -318,11 +589,14 @@ const otp2fa = (options) => {
       }
       const code = generateRandomString(opts.digits, "0-9");
       await ctx.context.internalAdapter.createVerificationValue({
-        value: code,
-        identifier: `2fa-otp-${user.id}`,
+        value: `${code}!0`,
+        identifier: `2fa-otp-${key}`,
         expiresAt: new Date(Date.now() + opts.period)
       });
-      await options.sendOTP({ user, otp: code }, ctx.request);
+      await options.sendOTP(
+        { user: session.user, otp: code },
+        ctx.request
+      );
       return ctx.json({ status: true });
     }
   );
@@ -341,23 +615,67 @@ const otp2fa = (options) => {
          */
         trustDevice: z.boolean().optional()
       }),
-      use: [verifyTwoFactorMiddleware],
       metadata: {
         openapi: {
           summary: "Verify two factor OTP",
           description: "Verify two factor OTP",
           responses: {
-            200: {
-              description: "Success",
+            "200": {
+              description: "Two-factor OTP verified successfully",
               content: {
                 "application/json": {
                   schema: {
                     type: "object",
                     properties: {
-                      status: {
-                        type: "boolean"
+                      token: {
+                        type: "string",
+                        description: "Session token for the authenticated session"
+                      },
+                      user: {
+                        type: "object",
+                        properties: {
+                          id: {
+                            type: "string",
+                            description: "Unique identifier of the user"
+                          },
+                          email: {
+                            type: "string",
+                            format: "email",
+                            nullable: true,
+                            description: "User's email address"
+                          },
+                          emailVerified: {
+                            type: "boolean",
+                            nullable: true,
+                            description: "Whether the email is verified"
+                          },
+                          name: {
+                            type: "string",
+                            nullable: true,
+                            description: "User's name"
+                          },
+                          image: {
+                            type: "string",
+                            format: "uri",
+                            nullable: true,
+                            description: "User's profile image URL"
+                          },
+                          createdAt: {
+                            type: "string",
+                            format: "date-time",
+                            description: "Timestamp when the user was created"
+                          },
+                          updatedAt: {
+                            type: "string",
+                            format: "date-time",
+                            description: "Timestamp when the user was last updated"
+                          }
+                        },
+                        required: ["id", "createdAt", "updatedAt"],
+                        description: "The authenticated user object"
                       }
-                    }
+                    },
+                    required: ["token", "user"]
                   }
                 }
               }
@@ -367,13 +685,13 @@ const otp2fa = (options) => {
       }
     },
     async (ctx) => {
-      const user = ctx.context.session.user;
+      const { session, key, valid, invalid } = await verifyTwoFactor(ctx);
       const twoFactor = await ctx.context.adapter.findOne({
         model: twoFactorTable,
         where: [
           {
             field: "userId",
-            value: user.id
+            value: session.user.id
           }
         ]
       });
@@ -383,38 +701,74 @@ const otp2fa = (options) => {
         });
       }
       const toCheckOtp = await ctx.context.internalAdapter.findVerificationValue(
-        `2fa-otp-${user.id}`
+        `2fa-otp-${key}`
       );
+      const [otp, counter] = toCheckOtp?.value?.split("!") ?? [];
       if (!toCheckOtp || toCheckOtp.expiresAt < /* @__PURE__ */ new Date()) {
+        await ctx.context.internalAdapter.deleteVerificationValue(
+          `2fa-otp-${key}`
+        );
         throw new APIError("BAD_REQUEST", {
           message: TWO_FACTOR_ERROR_CODES.OTP_HAS_EXPIRED
         });
       }
-      if (toCheckOtp.value === ctx.body.code) {
-        if (!user.twoFactorEnabled) {
+      const allowedAttempts = options?.allowedAttempts || 5;
+      if (parseInt(counter) >= allowedAttempts) {
+        await ctx.context.internalAdapter.deleteVerificationValue(
+          `2fa-otp-${key}`
+        );
+        throw new APIError("BAD_REQUEST", {
+          message: TWO_FACTOR_ERROR_CODES.TOO_MANY_ATTEMPTS_REQUEST_NEW_CODE
+        });
+      }
+      if (otp === ctx.body.code) {
+        if (!session.user.twoFactorEnabled) {
+          if (!session.session) {
+            throw new APIError("BAD_REQUEST", {
+              message: BASE_ERROR_CODES.FAILED_TO_CREATE_SESSION
+            });
+          }
           const updatedUser = await ctx.context.internalAdapter.updateUser(
-            user.id,
+            session.user.id,
             {
               twoFactorEnabled: true
             }
           );
           const newSession = await ctx.context.internalAdapter.createSession(
-            user.id,
-            ctx.request,
+            session.user.id,
+            ctx.headers,
             false,
-            ctx.context.session.session
+            session.session
           );
           await ctx.context.internalAdapter.deleteSession(
-            ctx.context.session.session.token
+            session.session.token
           );
           await setSessionCookie(ctx, {
             session: newSession,
             user: updatedUser
           });
+          return ctx.json({
+            token: newSession.token,
+            user: {
+              id: updatedUser.id,
+              email: updatedUser.email,
+              emailVerified: updatedUser.emailVerified,
+              name: updatedUser.name,
+              image: updatedUser.image,
+              createdAt: updatedUser.createdAt,
+              updatedAt: updatedUser.updatedAt
+            }
+          });
         }
-        return ctx.context.valid(ctx);
+        return valid(ctx);
       } else {
-        return ctx.context.invalid();
+        await ctx.context.internalAdapter.updateVerificationValue(
+          toCheckOtp.id,
+          {
+            value: `${otp}!${parseInt(counter) + 1}`
+          }
+        );
+        return invalid("INVALID_CODE");
       }
     }
   );
@@ -438,7 +792,11 @@ const totp2fa = (options) => {
     "/totp/generate",
     {
       method: "POST",
-      use: [sessionMiddleware],
+      body: z.object({
+        secret: z.string({
+          description: "The secret to generate the TOTP code"
+        })
+      }),
       metadata: {
         openapi: {
           summary: "Generate TOTP code",
@@ -460,7 +818,8 @@ const totp2fa = (options) => {
               }
             }
           }
-        }
+        },
+        SERVER_ONLY: true
       }
     },
     async (ctx) => {
@@ -472,22 +831,7 @@ const totp2fa = (options) => {
           message: "totp isn't configured"
         });
       }
-      const user = ctx.context.session.user;
-      const twoFactor = await ctx.context.adapter.findOne({
-        model: twoFactorTable,
-        where: [
-          {
-            field: "userId",
-            value: user.id
-          }
-        ]
-      });
-      if (!twoFactor) {
-        throw new APIError("BAD_REQUEST", {
-          message: TWO_FACTOR_ERROR_CODES.TOTP_NOT_ENABLED
-        });
-      }
-      const code = await createOTP(twoFactor.secret, {
+      const code = await createOTP(ctx.body.secret, {
         period: opts.period,
         digits: opts.digits
       }).totp();
@@ -583,7 +927,6 @@ const totp2fa = (options) => {
           description: "If true, the device will be trusted for 30 days. It'll be refreshed on every sign in request within this time."
         }).optional()
       }),
-      use: [verifyTwoFactorMiddleware],
       metadata: {
         openapi: {
           summary: "Verify two factor TOTP",
@@ -617,7 +960,8 @@ const totp2fa = (options) => {
           message: "totp isn't configured"
         });
       }
-      const user = ctx.context.session.user;
+      const { session, valid, invalid } = await verifyTwoFactor(ctx);
+      const user = session.user;
       const twoFactor = await ctx.context.adapter.findOne({
         model: twoFactorTable,
         where: [
@@ -641,9 +985,14 @@ const totp2fa = (options) => {
         digits: opts.digits
       }).verify(ctx.body.code);
       if (!status) {
-        return ctx.context.invalid();
+        return invalid("INVALID_CODE");
       }
       if (!user.twoFactorEnabled) {
+        if (!session.session) {
+          throw new APIError("BAD_REQUEST", {
+            message: BASE_ERROR_CODES.FAILED_TO_CREATE_SESSION
+          });
+        }
         const updatedUser = await ctx.context.internalAdapter.updateUser(
           user.id,
           {
@@ -651,23 +1000,16 @@ const totp2fa = (options) => {
           },
           ctx
         );
-        const newSession = await ctx.context.internalAdapter.createSession(
-          user.id,
-          ctx.request,
-          false,
-          ctx.context.session.session
-        ).catch((e) => {
+        const newSession = await ctx.context.internalAdapter.createSession(user.id, ctx.headers, false, session.session).catch((e) => {
           throw e;
         });
-        await ctx.context.internalAdapter.deleteSession(
-          ctx.context.session.session.token
-        );
+        await ctx.context.internalAdapter.deleteSession(session.session.token);
         await setSessionCookie(ctx, {
           session: newSession,
           user: updatedUser
         });
       }
-      return ctx.context.valid(ctx);
+      return valid(ctx);
     }
   );
   return {
@@ -736,7 +1078,10 @@ const twoFactor = (options) => {
           body: z.object({
             password: z.string({
               description: "User password"
-            })
+            }),
+            issuer: z.string({
+              description: "Custom issuer for the TOTP URI"
+            }).optional()
           }),
           use: [sessionMiddleware],
           metadata: {
@@ -773,7 +1118,7 @@ const twoFactor = (options) => {
         },
         async (ctx) => {
           const user = ctx.context.session.user;
-          const { password } = ctx.body;
+          const { password, issuer } = ctx.body;
           const isPasswordValid = await validatePassword(ctx, {
             password,
             userId: user.id
@@ -802,7 +1147,7 @@ const twoFactor = (options) => {
             );
             const newSession = await ctx.context.internalAdapter.createSession(
               updatedUser.id,
-              ctx.request,
+              ctx.headers,
               false,
               ctx.context.session.session
             );
@@ -834,7 +1179,7 @@ const twoFactor = (options) => {
           const totpURI = createOTP(secret, {
             digits: options?.totpOptions?.digits || 6,
             period: options?.totpOptions?.period
-          }).url(options?.issuer || ctx.context.appName, user.email);
+          }).url(issuer || options?.issuer || ctx.context.appName, user.email);
           return ctx.json({ totpURI, backupCodes: backupCodes.backupCodes });
         }
       ),
@@ -902,7 +1247,7 @@ const twoFactor = (options) => {
           });
           const newSession = await ctx.context.internalAdapter.createSession(
             updatedUser.id,
-            ctx.request,
+            ctx.headers,
             false,
             ctx.context.session.session
           );
@@ -961,16 +1306,22 @@ const twoFactor = (options) => {
             }
             deleteSessionCookie(ctx, true);
             await ctx.context.internalAdapter.deleteSession(data.session.token);
+            const maxAge = options?.otpOptions?.period || 60 * 5;
             const twoFactorCookie = ctx.context.createAuthCookie(
               TWO_FACTOR_COOKIE_NAME,
               {
-                maxAge: 60 * 10
-                // 10 minutes
+                maxAge
               }
             );
+            const identifier = `2fa-${generateRandomString(20)}`;
+            await ctx.context.internalAdapter.createVerificationValue({
+              value: data.user.id,
+              identifier,
+              expiresAt: new Date(Date.now() + maxAge * 1e3)
+            });
             await ctx.setSignedCookie(
               twoFactorCookie.name,
-              data.user.id,
+              identifier,
               ctx.context.secret,
               twoFactorCookie.attributes
             );