better-auth 1.3.0-beta.5 → 1.3.0-beta.7

package/dist/plugins/email-otp/index.cjs

@@ -2,26 +2,27 @@
 
 const zod = require('zod');
 const betterCall = require('better-call');
-const socialProviders_index = require('../../shared/better-auth.Ds-w2spb.cjs');
+const socialProviders_index = require('../../shared/better-auth.HT3cSIq4.cjs');
 const cookies_index = require('../../cookies/index.cjs');
 require('../../shared/better-auth.DcWKCjjf.cjs');
 require('../../shared/better-auth.DiSjtgs9.cjs');
 require('../../shared/better-auth.CXhVNgXP.cjs');
 require('defu');
-require('@better-auth/utils/hash');
+const crypto_index = require('../../crypto/index.cjs');
+const date = require('../../shared/better-auth.C1hdVENX.cjs');
+const pluginHelper = require('../../shared/better-auth.DNqtHmvg.cjs');
+const hash = require('@better-auth/utils/hash');
+const base64 = require('@better-auth/utils/base64');
+const random = require('../../shared/better-auth.CYeOI8C-.cjs');
+require('@better-fetch/fetch');
+require('jose');
 require('@noble/ciphers/chacha');
 require('@noble/ciphers/utils');
 require('@noble/ciphers/webcrypto');
-require('@better-auth/utils/base64');
-require('jose');
 require('@noble/hashes/scrypt');
 require('@better-auth/utils');
 require('@better-auth/utils/hex');
 require('@noble/hashes/utils');
-const random = require('../../shared/better-auth.CYeOI8C-.cjs');
-const date = require('../../shared/better-auth.C1hdVENX.cjs');
-const pluginHelper = require('../../shared/better-auth.DNqtHmvg.cjs');
-require('@better-fetch/fetch');
 require('../../shared/better-auth.C-R0J0n1.cjs');
 require('../../shared/better-auth.ANpbi45u.cjs');
 require('../../shared/better-auth.D3mtHEZg.cjs');
@@ -30,12 +31,31 @@ require('@better-auth/utils/binary');
 require('../../shared/better-auth.BMYo0QR-.cjs');
 require('jose/errors');
 require('@better-auth/utils/random');
+require('../../shared/better-auth.YUF6P-PB.cjs');
+
+const defaultKeyHasher = async (otp) => {
+  const hash$1 = await hash.createHash("SHA-256").digest(
+    new TextEncoder().encode(otp)
+  );
+  const hashed = base64.base64Url.encode(new Uint8Array(hash$1), {
+    padding: false
+  });
+  return hashed;
+};
+function splitAtLastColon(input) {
+  const idx = input.lastIndexOf(":");
+  if (idx === -1) {
+    return [input, ""];
+  }
+  return [input.slice(0, idx), input.slice(idx + 1)];
+}
 
 const types = ["email-verification", "sign-in", "forget-password"];
 const emailOTP = (options) => {
   const opts = {
     expiresIn: 5 * 60,
     generateOTP: () => random.generateRandomString(options.otpLength ?? 6, "0-9"),
+    storeOTP: "plain",
     ...options
   };
   const ERROR_CODES = {
@@ -45,35 +65,71 @@ const emailOTP = (options) => {
     USER_NOT_FOUND: "User not found",
     TOO_MANY_ATTEMPTS: "Too many attempts"
   };
-  return {
-    id: "email-otp",
-    endpoints: {
-      sendVerificationOTP: socialProviders_index.createAuthEndpoint(
-        "/email-otp/send-verification-otp",
-        {
-          method: "POST",
-          body: zod.z.object({
-            email: zod.z.string({
-              description: "Email address to send the OTP"
-            }),
-            type: zod.z.enum(types, {
-              description: "Type of the OTP"
-            })
+  async function storeOTP(ctx, otp) {
+    if (opts.storeOTP === "encrypted") {
+      return await crypto_index.symmetricEncrypt({
+        key: ctx.context.secret,
+        data: otp
+      });
+    }
+    if (opts.storeOTP === "hashed") {
+      return await defaultKeyHasher(otp);
+    }
+    if (typeof opts.storeOTP === "object" && "hash" in opts.storeOTP) {
+      return await opts.storeOTP.hash(otp);
+    }
+    if (typeof opts.storeOTP === "object" && "encrypt" in opts.storeOTP) {
+      return await opts.storeOTP.encrypt(otp);
+    }
+    return otp;
+  }
+  async function verifyStoredOTP(ctx, storedOtp, otp) {
+    if (opts.storeOTP === "encrypted") {
+      return await crypto_index.symmetricDecrypt({
+        key: ctx.context.secret,
+        data: storedOtp
+      }) === otp;
+    }
+    if (opts.storeOTP === "hashed") {
+      const hashedOtp = await defaultKeyHasher(otp);
+      return hashedOtp === storedOtp;
+    }
+    if (typeof opts.storeOTP === "object" && "hash" in opts.storeOTP) {
+      const hashedOtp = await opts.storeOTP.hash(otp);
+      return hashedOtp === storedOtp;
+    }
+    if (typeof opts.storeOTP === "object" && "decrypt" in opts.storeOTP) {
+      const decryptedOtp = await opts.storeOTP.decrypt(storedOtp);
+      return decryptedOtp === otp;
+    }
+    return otp === storedOtp;
+  }
+  const endpoints = {
+    sendVerificationOTP: socialProviders_index.createAuthEndpoint(
+      "/email-otp/send-verification-otp",
+      {
+        method: "POST",
+        body: zod.z.object({
+          email: zod.z.string({
+            description: "Email address to send the OTP"
           }),
-          metadata: {
-            openapi: {
-              description: "Send verification OTP",
-              responses: {
-                200: {
-                  description: "Success",
-                  content: {
-                    "application/json": {
-                      schema: {
-                        type: "object",
-                        properties: {
-                          success: {
-                            type: "boolean"
-                          }
+          type: zod.z.enum(types, {
+            description: "Type of the OTP"
+          })
+        }),
+        metadata: {
+          openapi: {
+            description: "Send verification OTP",
+            responses: {
+              200: {
+                description: "Success",
+                content: {
+                  "application/json": {
+                    schema: {
+                      type: "object",
+                      properties: {
+                        success: {
+                          type: "boolean"
                         }
                       }
                     }
@@ -82,75 +138,101 @@ const emailOTP = (options) => {
               }
             }
           }
-        },
-        async (ctx) => {
-          if (!options?.sendVerificationOTP) {
-            ctx.context.logger.error(
-              "send email verification is not implemented"
-            );
+        }
+      },
+      async (ctx) => {
+        if (!options?.sendVerificationOTP) {
+          ctx.context.logger.error(
+            "send email verification is not implemented"
+          );
+          throw new betterCall.APIError("BAD_REQUEST", {
+            message: "send email verification is not implemented"
+          });
+        }
+        const email = ctx.body.email;
+        const emailRegex = /^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$/;
+        if (!emailRegex.test(email)) {
+          throw ctx.error("BAD_REQUEST", {
+            message: ERROR_CODES.INVALID_EMAIL
+          });
+        }
+        if (opts.disableSignUp) {
+          const user = await ctx.context.internalAdapter.findUserByEmail(email);
+          if (!user) {
             throw new betterCall.APIError("BAD_REQUEST", {
-              message: "send email verification is not implemented"
+              message: ERROR_CODES.USER_NOT_FOUND
             });
           }
-          const email = ctx.body.email;
-          const emailRegex = /^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$/;
-          if (!emailRegex.test(email)) {
-            throw ctx.error("BAD_REQUEST", {
-              message: ERROR_CODES.INVALID_EMAIL
+        } else if (ctx.body.type === "forget-password") {
+          const user = await ctx.context.internalAdapter.findUserByEmail(email);
+          if (!user) {
+            return ctx.json({
+              success: true
             });
           }
-          if (opts.disableSignUp) {
-            const user = await ctx.context.internalAdapter.findUserByEmail(email);
-            if (!user) {
-              throw new betterCall.APIError("BAD_REQUEST", {
-                message: ERROR_CODES.USER_NOT_FOUND
-              });
-            }
-          } else if (ctx.body.type === "forget-password") {
-            const user = await ctx.context.internalAdapter.findUserByEmail(email);
-            if (!user) {
-              return ctx.json({
-                success: true
-              });
-            }
-          }
-          const otp = opts.generateOTP(
-            { email, type: ctx.body.type },
-            ctx.request
+        }
+        let otp = opts.generateOTP({ email, type: ctx.body.type }, ctx.request);
+        let storedOTP = await storeOTP(ctx, otp);
+        await ctx.context.internalAdapter.createVerificationValue(
+          {
+            value: `${storedOTP}:0`,
+            identifier: `${ctx.body.type}-otp-${email}`,
+            expiresAt: date.getDate(opts.expiresIn, "sec")
+          },
+          ctx
+        ).catch(async (error) => {
+          await ctx.context.internalAdapter.deleteVerificationByIdentifier(
+            `${ctx.body.type}-otp-${email}`
           );
           await ctx.context.internalAdapter.createVerificationValue(
             {
-              value: `${otp}:0`,
+              value: `${storedOTP}:0`,
               identifier: `${ctx.body.type}-otp-${email}`,
               expiresAt: date.getDate(opts.expiresIn, "sec")
             },
             ctx
-          ).catch(async (error) => {
-            await ctx.context.internalAdapter.deleteVerificationByIdentifier(
-              `${ctx.body.type}-otp-${email}`
-            );
-            await ctx.context.internalAdapter.createVerificationValue(
-              {
-                value: `${otp}:0`,
-                identifier: `${ctx.body.type}-otp-${email}`,
-                expiresAt: date.getDate(opts.expiresIn, "sec")
-              },
-              ctx
-            );
-          });
-          await options.sendVerificationOTP(
-            {
-              email,
-              otp,
-              type: ctx.body.type
-            },
-            ctx.request
           );
-          return ctx.json({
-            success: true
-          });
+        });
+        await options.sendVerificationOTP(
+          {
+            email,
+            otp,
+            type: ctx.body.type
+          },
+          ctx.request
+        );
+        return ctx.json({
+          success: true
+        });
+      }
+    )
+  };
+  return {
+    id: "email-otp",
+    init(ctx) {
+      return {
+        options: {
+          emailVerification: {
+            ...opts.overrideDefaultEmailVerification ? {
+              async sendVerificationEmail(data, request) {
+                await endpoints.sendVerificationOTP({
+                  //@ts-expect-error - we need to pass the context
+                  context: ctx,
+                  request,
+                  body: {
+                    email: data.user.email,
+                    type: "email-verification"
+                  },
+                  ctx
+                });
+              }
+            } : {}
+          }
         }
-      ),
+      };
+    },
+    endpoints: {
+      ...endpoints,
       createVerificationOTP: socialProviders_index.createAuthEndpoint(
         "/email-otp/create-verification-otp",
         {
@@ -188,9 +270,10 @@ const emailOTP = (options) => {
             { email, type: ctx.body.type },
             ctx.request
           );
+          let storedOTP = await storeOTP(ctx, otp);
           await ctx.context.internalAdapter.createVerificationValue(
             {
-              value: `${otp}:0`,
+              value: `${storedOTP}:0`,
               identifier: `${ctx.body.type}-otp-${email}`,
               expiresAt: date.getDate(opts.expiresIn, "sec")
             },
@@ -246,8 +329,26 @@ const emailOTP = (options) => {
               otp: null
             });
           }
+          if (opts.storeOTP === "hashed" || typeof opts.storeOTP === "object" && "hash" in opts.storeOTP) {
+            throw new betterCall.APIError("BAD_REQUEST", {
+              message: "OTP is hashed, cannot return the plain text OTP"
+            });
+          }
+          let [storedOtp, _attempts] = splitAtLastColon(
+            verificationValue.value
+          );
+          let otp = storedOtp;
+          if (opts.storeOTP === "encrypted") {
+            otp = await crypto_index.symmetricDecrypt({
+              key: ctx.context.secret,
+              data: storedOtp
+            });
+          }
+          if (typeof opts.storeOTP === "object" && "decrypt" in opts.storeOTP) {
+            otp = await opts.storeOTP.decrypt(storedOtp);
+          }
           return ctx.json({
-            otp: verificationValue.value
+            otp
           });
         }
       ),
@@ -318,7 +419,9 @@ const emailOTP = (options) => {
               message: ERROR_CODES.OTP_EXPIRED
             });
           }
-          const [otpValue, attempts] = verificationValue.value.split(":");
+          const [otpValue, attempts] = splitAtLastColon(
+            verificationValue.value
+          );
           const allowedAttempts = options?.allowedAttempts || 3;
           if (attempts && parseInt(attempts) >= allowedAttempts) {
             await ctx.context.internalAdapter.deleteVerificationValue(
@@ -328,7 +431,8 @@ const emailOTP = (options) => {
               message: ERROR_CODES.TOO_MANY_ATTEMPTS
             });
           }
-          if (ctx.body.otp !== otpValue) {
+          const verified = await verifyStoredOTP(ctx, otpValue, ctx.body.otp);
+          if (!verified) {
             await ctx.context.internalAdapter.updateVerificationValue(
               verificationValue.id,
               {
@@ -453,7 +557,9 @@ const emailOTP = (options) => {
               message: ERROR_CODES.OTP_EXPIRED
             });
           }
-          const [otpValue, attempts] = verificationValue.value.split(":");
+          const [otpValue, attempts] = splitAtLastColon(
+            verificationValue.value
+          );
           const allowedAttempts = options?.allowedAttempts || 3;
           if (attempts && parseInt(attempts) >= allowedAttempts) {
             await ctx.context.internalAdapter.deleteVerificationValue(
@@ -463,7 +569,8 @@ const emailOTP = (options) => {
               message: ERROR_CODES.TOO_MANY_ATTEMPTS
             });
           }
-          if (ctx.body.otp !== otpValue) {
+          const verified = await verifyStoredOTP(ctx, otpValue, ctx.body.otp);
+          if (!verified) {
             await ctx.context.internalAdapter.updateVerificationValue(
               verificationValue.id,
               {
@@ -589,9 +696,10 @@ const emailOTP = (options) => {
             { email, type: "forget-password" },
             ctx.request
           );
+          let storedOTP = await storeOTP(ctx, otp);
           await ctx.context.internalAdapter.createVerificationValue(
             {
-              value: `${otp}:0`,
+              value: `${storedOTP}:0`,
               identifier: `forget-password-otp-${email}`,
               expiresAt: date.getDate(opts.expiresIn, "sec")
             },
@@ -677,7 +785,9 @@ const emailOTP = (options) => {
               message: ERROR_CODES.OTP_EXPIRED
             });
           }
-          const [otpValue, attempts] = verificationValue.value.split(":");
+          const [otpValue, attempts] = splitAtLastColon(
+            verificationValue.value
+          );
           const allowedAttempts = options?.allowedAttempts || 3;
           if (attempts && parseInt(attempts) >= allowedAttempts) {
             await ctx.context.internalAdapter.deleteVerificationValue(
@@ -687,7 +797,8 @@ const emailOTP = (options) => {
               message: ERROR_CODES.TOO_MANY_ATTEMPTS
             });
           }
-          if (ctx.body.otp !== otpValue) {
+          const verified = await verifyStoredOTP(ctx, otpValue, ctx.body.otp);
+          if (!verified) {
             await ctx.context.internalAdapter.updateVerificationValue(
               verificationValue.id,
               {
@@ -753,9 +864,10 @@ const emailOTP = (options) => {
                 { email, type: ctx.body.type },
                 ctx.request
               );
+              let storedOTP = await storeOTP(ctx, otp);
               await ctx.context.internalAdapter.createVerificationValue(
                 {
-                  value: `${otp}:0`,
+                  value: `${storedOTP}:0`,
                   identifier: `email-verification-otp-${email}`,
                   expiresAt: date.getDate(opts.expiresIn, "sec")
                 },

package/dist/plugins/email-otp/index.d.cts

@@ -1,8 +1,8 @@
 import * as better_call from 'better-call';
+import { p as AuthContext, U as User, H as HookEndpointContext } from '../../shared/better-auth.1M3xAdJC.cjs';
 import { z } from 'zod';
-import { H as HookEndpointContext } from '../../shared/better-auth.CqTBLifU.cjs';
 import '../../shared/better-auth.9XhOL8gb.cjs';
-import '../../shared/better-auth.BnAeoMet.cjs';
+import '../../shared/better-auth.VwFr4owi.cjs';
 import 'kysely';
 import 'better-sqlite3';
 import 'bun:sqlite';
@@ -53,81 +53,39 @@ interface EmailOTPOptions {
      * @default 3
      */
     allowedAttempts?: number;
+    /**
+     * Store the OTP in your database in a secure way
+     * Note: This will not affect the OTP sent to the user, it will only affect the OTP stored in your database
+     *
+     * @default "plain"
+     */
+    storeOTP?: "hashed" | "plain" | "encrypted" | {
+        hash: (otp: string) => Promise<string>;
+    } | {
+        encrypt: (otp: string) => Promise<string>;
+        decrypt: (otp: string) => Promise<string>;
+    };
+    /**
+     * Override the default email verification to use email otp instead
+     *
+     * @default false
+     */
+    overrideDefaultEmailVerification?: boolean;
 }
 declare const emailOTP: (options: EmailOTPOptions) => {
     id: "email-otp";
-    endpoints: {
-        sendVerificationOTP: {
-            <AsResponse extends boolean = false, ReturnHeaders extends boolean = false>(inputCtx_0: {
-                body: {
-                    type: "sign-in" | "forget-password" | "email-verification";
-                    email: string;
-                };
-            } & {
-                method?: "POST" | undefined;
-            } & {
-                query?: Record<string, any> | undefined;
-            } & {
-                params?: Record<string, any>;
-            } & {
-                request?: Request;
-            } & {
-                headers?: HeadersInit;
-            } & {
-                asResponse?: boolean;
-                returnHeaders?: boolean;
-                use?: better_call.Middleware[];
-                path?: string;
-            } & {
-                asResponse?: AsResponse | undefined;
-                returnHeaders?: ReturnHeaders | undefined;
-            }): Promise<[AsResponse] extends [true] ? Response : [ReturnHeaders] extends [true] ? {
-                headers: Headers;
-                response: {
-                    success: boolean;
-                };
-            } : {
-                success: boolean;
-            }>;
-            options: {
-                method: "POST";
-                body: z.ZodObject<{
-                    email: z.ZodString;
-                    type: z.ZodEnum<["email-verification", "sign-in", "forget-password"]>;
-                }, "strip", z.ZodTypeAny, {
-                    type: "sign-in" | "forget-password" | "email-verification";
-                    email: string;
-                }, {
-                    type: "sign-in" | "forget-password" | "email-verification";
-                    email: string;
-                }>;
-                metadata: {
-                    openapi: {
-                        description: string;
-                        responses: {
-                            200: {
-                                description: string;
-                                content: {
-                                    "application/json": {
-                                        schema: {
-                                            type: "object";
-                                            properties: {
-                                                success: {
-                                                    type: string;
-                                                };
-                                            };
-                                        };
-                                    };
-                                };
-                            };
-                        };
-                    };
-                };
-            } & {
-                use: any[];
+    init(ctx: AuthContext): {
+        options: {
+            emailVerification: {
+                sendVerificationEmail?: ((data: {
+                    user: User;
+                    url: string;
+                    token: string;
+                }, request: Request | undefined) => Promise<void>) | undefined;
             };
-            path: "/email-otp/send-verification-otp";
         };
+    };
+    endpoints: {
         createVerificationOTP: {
             <AsResponse extends boolean = false, ReturnHeaders extends boolean = false>(inputCtx_0: {
                 body: {
@@ -633,6 +591,77 @@ declare const emailOTP: (options: EmailOTPOptions) => {
             };
             path: "/email-otp/reset-password";
         };
+        sendVerificationOTP: {
+            <AsResponse extends boolean = false, ReturnHeaders extends boolean = false>(inputCtx_0: {
+                body: {
+                    type: "sign-in" | "forget-password" | "email-verification";
+                    email: string;
+                };
+            } & {
+                method?: "POST" | undefined;
+            } & {
+                query?: Record<string, any> | undefined;
+            } & {
+                params?: Record<string, any>;
+            } & {
+                request?: Request;
+            } & {
+                headers?: HeadersInit;
+            } & {
+                asResponse?: boolean;
+                returnHeaders?: boolean;
+                use?: better_call.Middleware[];
+                path?: string;
+            } & {
+                asResponse?: AsResponse | undefined;
+                returnHeaders?: ReturnHeaders | undefined;
+            }): Promise<[AsResponse] extends [true] ? Response : [ReturnHeaders] extends [true] ? {
+                headers: Headers;
+                response: {
+                    success: boolean;
+                };
+            } : {
+                success: boolean;
+            }>;
+            options: {
+                method: "POST";
+                body: z.ZodObject<{
+                    email: z.ZodString;
+                    type: z.ZodEnum<["email-verification", "sign-in", "forget-password"]>;
+                }, "strip", z.ZodTypeAny, {
+                    type: "sign-in" | "forget-password" | "email-verification";
+                    email: string;
+                }, {
+                    type: "sign-in" | "forget-password" | "email-verification";
+                    email: string;
+                }>;
+                metadata: {
+                    openapi: {
+                        description: string;
+                        responses: {
+                            200: {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                success: {
+                                                    type: string;
+                                                };
+                                            };
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            } & {
+                use: any[];
+            };
+            path: "/email-otp/send-verification-otp";
+        };
     };
     hooks: {
         after: {