better-auth 1.5.5 → 1.5.6

package/dist/plugins/email-otp/index.mjs

@@ -3,6 +3,7 @@ import { generateRandomString } from "../../crypto/random.mjs";
 import "../../crypto/index.mjs";
 import { EMAIL_OTP_ERROR_CODES } from "./error-codes.mjs";
 import { getEndpointResponse } from "../../utils/plugin-helper.mjs";
+import { toOTPIdentifier } from "./utils.mjs";
 import { storeOTP } from "./otp-token.mjs";
 import { changeEmailEmailOTP, checkVerificationOTP, createVerificationOTP, forgetPasswordEmailOTP, getVerificationOTP, requestEmailChangeEmailOTP, requestPasswordResetEmailOTP, resetPasswordEmailOTP, sendVerificationOTP, signInEmailOTP, verifyEmailOTP } from "./routes.mjs";
 import { createAuthMiddleware } from "@better-auth/core/api";
@@ -60,7 +61,7 @@ const emailOTP = (options) => {
 					const storedOTP = await storeOTP(ctx, opts, otp);
 					await ctx.context.internalAdapter.createVerificationValue({
 						value: `${storedOTP}:0`,
-						identifier: `email-verification-otp-${email}`,
+						identifier: toOTPIdentifier("email-verification", email),
 						expiresAt: getDate(opts.expiresIn, "sec")
 					});
 					await ctx.context.runInBackgroundOrAwait(options.sendVerificationOTP({

package/dist/plugins/email-otp/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../../src/plugins/email-otp/index.ts"],"sourcesContent":["import type { BetterAuthPlugin } from \"@better-auth/core\";\nimport { createAuthMiddleware } from \"@better-auth/core/api\";\nimport { generateRandomString } from \"../../crypto\";\nimport { getDate } from \"../../utils/date\";\nimport { getEndpointResponse } from \"../../utils/plugin-helper\";\nimport { EMAIL_OTP_ERROR_CODES } from \"./error-codes\";\nimport { storeOTP } from \"./otp-token\";\nimport {\n\tchangeEmailEmailOTP,\n\tcheckVerificationOTP,\n\tcreateVerificationOTP,\n\tforgetPasswordEmailOTP,\n\tgetVerificationOTP,\n\trequestEmailChangeEmailOTP,\n\trequestPasswordResetEmailOTP,\n\tresetPasswordEmailOTP,\n\tsendVerificationOTP,\n\tsignInEmailOTP,\n\tverifyEmailOTP,\n} from \"./routes\";\nimport type { EmailOTPOptions } from \"./types\";\n\ndeclare module \"@better-auth/core\" {\n\tinterface BetterAuthPluginRegistry<AuthOptions, Options> {\n\t\t\"email-otp\": {\n\t\t\tcreator: typeof emailOTP;\n\t\t};\n\t}\n}\n\nexport type { EmailOTPOptions } from \"./types\";\n\nconst defaultOTPGenerator = (options: EmailOTPOptions) =>\n\tgenerateRandomString(options.otpLength ?? 6, \"0-9\");\n\nexport const emailOTP = (options: EmailOTPOptions) => {\n\tconst opts = {\n\t\texpiresIn: 5 * 60,\n\t\tgenerateOTP: () => defaultOTPGenerator(options),\n\t\tstoreOTP: \"plain\",\n\t\t...options,\n\t} satisfies EmailOTPOptions;\n\n\tconst sendVerificationOTPAction = sendVerificationOTP(opts);\n\n\treturn {\n\t\tid: \"email-otp\",\n\t\tinit(ctx) {\n\t\t\tif (!opts.overrideDefaultEmailVerification) {\n\t\t\t\treturn;\n\t\t\t}\n\t\t\treturn {\n\t\t\t\toptions: {\n\t\t\t\t\temailVerification: {\n\t\t\t\t\t\tasync sendVerificationEmail(data, request) {\n\t\t\t\t\t\t\tawait ctx.runInBackgroundOrAwait(\n\t\t\t\t\t\t\t\tsendVerificationOTPAction({\n\t\t\t\t\t\t\t\t\tcontext: ctx,\n\t\t\t\t\t\t\t\t\trequest: request,\n\t\t\t\t\t\t\t\t\tbody: {\n\t\t\t\t\t\t\t\t\t\temail: data.user.email,\n\t\t\t\t\t\t\t\t\t\ttype: \"email-verification\",\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t//@ts-expect-error\n\t\t\t\t\t\t\t\t\tctx,\n\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\t},\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t};\n\t\t},\n\t\tendpoints: {\n\t\t\tsendVerificationOTP: sendVerificationOTPAction,\n\t\t\tcreateVerificationOTP: createVerificationOTP(opts),\n\t\t\tgetVerificationOTP: getVerificationOTP(opts),\n\t\t\tcheckVerificationOTP: checkVerificationOTP(opts),\n\t\t\tverifyEmailOTP: verifyEmailOTP(opts),\n\t\t\tsignInEmailOTP: signInEmailOTP(opts),\n\t\t\trequestPasswordResetEmailOTP: requestPasswordResetEmailOTP(opts),\n\t\t\tforgetPasswordEmailOTP: forgetPasswordEmailOTP(opts),\n\t\t\tresetPasswordEmailOTP: resetPasswordEmailOTP(opts),\n\t\t\trequestEmailChangeEmailOTP: requestEmailChangeEmailOTP(opts),\n\t\t\tchangeEmailEmailOTP: changeEmailEmailOTP(opts),\n\t\t},\n\t\thooks: {\n\t\t\tafter: [\n\t\t\t\t{\n\t\t\t\t\tmatcher(context) {\n\t\t\t\t\t\treturn !!(\n\t\t\t\t\t\t\tcontext.path?.startsWith(\"/sign-up\") &&\n\t\t\t\t\t\t\topts.sendVerificationOnSignUp &&\n\t\t\t\t\t\t\t!opts.overrideDefaultEmailVerification\n\t\t\t\t\t\t);\n\t\t\t\t\t},\n\t\t\t\t\thandler: createAuthMiddleware(async (ctx) => {\n\t\t\t\t\t\tconst response = await getEndpointResponse<{\n\t\t\t\t\t\t\tuser: { email: string };\n\t\t\t\t\t\t}>(ctx);\n\t\t\t\t\t\tconst email = response?.user.email;\n\t\t\t\t\t\tif (email) {\n\t\t\t\t\t\t\tconst otp =\n\t\t\t\t\t\t\t\topts.generateOTP({ email, type: ctx.body.type }, ctx) ||\n\t\t\t\t\t\t\t\tdefaultOTPGenerator(opts);\n\t\t\t\t\t\t\tconst storedOTP = await storeOTP(ctx, opts, otp);\n\t\t\t\t\t\t\tawait ctx.context.internalAdapter.createVerificationValue({\n\t\t\t\t\t\t\t\tvalue: `${storedOTP}:0`,\n\t\t\t\t\t\t\t\tidentifier: `email-verification-otp-${email}`,\n\t\t\t\t\t\t\t\texpiresAt: getDate(opts.expiresIn, \"sec\"),\n\t\t\t\t\t\t\t});\n\t\t\t\t\t\t\tawait ctx.context.runInBackgroundOrAwait(\n\t\t\t\t\t\t\t\toptions.sendVerificationOTP(\n\t\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\t\temail,\n\t\t\t\t\t\t\t\t\t\totp,\n\t\t\t\t\t\t\t\t\t\ttype: \"email-verification\",\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\tctx,\n\t\t\t\t\t\t\t\t),\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\t}\n\t\t\t\t\t}),\n\t\t\t\t},\n\t\t\t],\n\t\t},\n\n\t\trateLimit: [\n\t\t\t{\n\t\t\t\tpathMatcher(path) {\n\t\t\t\t\treturn path === \"/email-otp/send-verification-otp\";\n\t\t\t\t},\n\t\t\t\twindow: opts.rateLimit?.window || 60,\n\t\t\t\tmax: opts.rateLimit?.max || 3,\n\t\t\t},\n\t\t\t{\n\t\t\t\tpathMatcher(path) {\n\t\t\t\t\treturn path === \"/email-otp/check-verification-otp\";\n\t\t\t\t},\n\t\t\t\twindow: opts.rateLimit?.window || 60,\n\t\t\t\tmax: opts.rateLimit?.max || 3,\n\t\t\t},\n\t\t\t{\n\t\t\t\tpathMatcher(path) {\n\t\t\t\t\treturn path === \"/email-otp/verify-email\";\n\t\t\t\t},\n\t\t\t\twindow: opts.rateLimit?.window || 60,\n\t\t\t\tmax: opts.rateLimit?.max || 3,\n\t\t\t},\n\t\t\t{\n\t\t\t\tpathMatcher(path) {\n\t\t\t\t\treturn path === \"/sign-in/email-otp\";\n\t\t\t\t},\n\t\t\t\twindow: opts.rateLimit?.window || 60,\n\t\t\t\tmax: opts.rateLimit?.max || 3,\n\t\t\t},\n\t\t\t{\n\t\t\t\tpathMatcher(path) {\n\t\t\t\t\treturn path === \"/email-otp/request-password-reset\";\n\t\t\t\t},\n\t\t\t\twindow: opts.rateLimit?.window || 60,\n\t\t\t\tmax: opts.rateLimit?.max || 3,\n\t\t\t},\n\t\t\t{\n\t\t\t\tpathMatcher(path) {\n\t\t\t\t\treturn path === \"/email-otp/reset-password\";\n\t\t\t\t},\n\t\t\t\twindow: opts.rateLimit?.window || 60,\n\t\t\t\tmax: opts.rateLimit?.max || 3,\n\t\t\t},\n\t\t\t{\n\t\t\t\tpathMatcher(path) {\n\t\t\t\t\treturn path === \"/forget-password/email-otp\";\n\t\t\t\t},\n\t\t\t\twindow: opts.rateLimit?.window || 60,\n\t\t\t\tmax: opts.rateLimit?.max || 3,\n\t\t\t},\n\t\t\t{\n\t\t\t\tpathMatcher(path) {\n\t\t\t\t\treturn path === \"/email-otp/request-email-change\";\n\t\t\t\t},\n\t\t\t\twindow: opts.rateLimit?.window || 60,\n\t\t\t\tmax: opts.rateLimit?.max || 3,\n\t\t\t},\n\t\t\t{\n\t\t\t\tpathMatcher(path) {\n\t\t\t\t\treturn path === \"/email-otp/change-email\";\n\t\t\t\t},\n\t\t\t\twindow: opts.rateLimit?.window || 60,\n\t\t\t\tmax: opts.rateLimit?.max || 3,\n\t\t\t},\n\t\t],\n\t\toptions,\n\t\t$ERROR_CODES: EMAIL_OTP_ERROR_CODES,\n\t} satisfies BetterAuthPlugin;\n};\n"],"mappings":";;;;;;;;;;AAgCA,MAAM,uBAAuB,YAC5B,qBAAqB,QAAQ,aAAa,GAAG,MAAM;AAEpD,MAAa,YAAY,YAA6B;CACrD,MAAM,OAAO;EACZ,WAAW;EACX,mBAAmB,oBAAoB,QAAQ;EAC/C,UAAU;EACV,GAAG;EACH;CAED,MAAM,4BAA4B,oBAAoB,KAAK;AAE3D,QAAO;EACN,IAAI;EACJ,KAAK,KAAK;AACT,OAAI,CAAC,KAAK,iCACT;AAED,UAAO,EACN,SAAS,EACR,mBAAmB,EAClB,MAAM,sBAAsB,MAAM,SAAS;AAC1C,UAAM,IAAI,uBACT,0BAA0B;KACzB,SAAS;KACA;KACT,MAAM;MACL,OAAO,KAAK,KAAK;MACjB,MAAM;MACN;KAED;KACA,CAAC,CACF;MAEF,EACD,EACD;;EAEF,WAAW;GACV,qBAAqB;GACrB,uBAAuB,sBAAsB,KAAK;GAClD,oBAAoB,mBAAmB,KAAK;GAC5C,sBAAsB,qBAAqB,KAAK;GAChD,gBAAgB,eAAe,KAAK;GACpC,gBAAgB,eAAe,KAAK;GACpC,8BAA8B,6BAA6B,KAAK;GAChE,wBAAwB,uBAAuB,KAAK;GACpD,uBAAuB,sBAAsB,KAAK;GAClD,4BAA4B,2BAA2B,KAAK;GAC5D,qBAAqB,oBAAoB,KAAK;GAC9C;EACD,OAAO,EACN,OAAO,CACN;GACC,QAAQ,SAAS;AAChB,WAAO,CAAC,EACP,QAAQ,MAAM,WAAW,WAAW,IACpC,KAAK,4BACL,CAAC,KAAK;;GAGR,SAAS,qBAAqB,OAAO,QAAQ;IAI5C,MAAM,SAHW,MAAM,oBAEpB,IAAI,GACiB,KAAK;AAC7B,QAAI,OAAO;KACV,MAAM,MACL,KAAK,YAAY;MAAE;MAAO,MAAM,IAAI,KAAK;MAAM,EAAE,IAAI,IACrD,oBAAoB,KAAK;KAC1B,MAAM,YAAY,MAAM,SAAS,KAAK,MAAM,IAAI;AAChD,WAAM,IAAI,QAAQ,gBAAgB,wBAAwB;MACzD,OAAO,GAAG,UAAU;MACpB,YAAY,0BAA0B;MACtC,WAAW,QAAQ,KAAK,WAAW,MAAM;MACzC,CAAC;AACF,WAAM,IAAI,QAAQ,uBACjB,QAAQ,oBACP;MACC;MACA;MACA,MAAM;MACN,EACD,IACA,CACD;;KAED;GACF,CACD,EACD;EAED,WAAW;GACV;IACC,YAAY,MAAM;AACjB,YAAO,SAAS;;IAEjB,QAAQ,KAAK,WAAW,UAAU;IAClC,KAAK,KAAK,WAAW,OAAO;IAC5B;GACD;IACC,YAAY,MAAM;AACjB,YAAO,SAAS;;IAEjB,QAAQ,KAAK,WAAW,UAAU;IAClC,KAAK,KAAK,WAAW,OAAO;IAC5B;GACD;IACC,YAAY,MAAM;AACjB,YAAO,SAAS;;IAEjB,QAAQ,KAAK,WAAW,UAAU;IAClC,KAAK,KAAK,WAAW,OAAO;IAC5B;GACD;IACC,YAAY,MAAM;AACjB,YAAO,SAAS;;IAEjB,QAAQ,KAAK,WAAW,UAAU;IAClC,KAAK,KAAK,WAAW,OAAO;IAC5B;GACD;IACC,YAAY,MAAM;AACjB,YAAO,SAAS;;IAEjB,QAAQ,KAAK,WAAW,UAAU;IAClC,KAAK,KAAK,WAAW,OAAO;IAC5B;GACD;IACC,YAAY,MAAM;AACjB,YAAO,SAAS;;IAEjB,QAAQ,KAAK,WAAW,UAAU;IAClC,KAAK,KAAK,WAAW,OAAO;IAC5B;GACD;IACC,YAAY,MAAM;AACjB,YAAO,SAAS;;IAEjB,QAAQ,KAAK,WAAW,UAAU;IAClC,KAAK,KAAK,WAAW,OAAO;IAC5B;GACD;IACC,YAAY,MAAM;AACjB,YAAO,SAAS;;IAEjB,QAAQ,KAAK,WAAW,UAAU;IAClC,KAAK,KAAK,WAAW,OAAO;IAC5B;GACD;IACC,YAAY,MAAM;AACjB,YAAO,SAAS;;IAEjB,QAAQ,KAAK,WAAW,UAAU;IAClC,KAAK,KAAK,WAAW,OAAO;IAC5B;GACD;EACD;EACA,cAAc;EACd"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../src/plugins/email-otp/index.ts"],"sourcesContent":["import type { BetterAuthPlugin } from \"@better-auth/core\";\nimport { createAuthMiddleware } from \"@better-auth/core/api\";\nimport { generateRandomString } from \"../../crypto\";\nimport { getDate } from \"../../utils/date\";\nimport { getEndpointResponse } from \"../../utils/plugin-helper\";\nimport { EMAIL_OTP_ERROR_CODES } from \"./error-codes\";\nimport { storeOTP } from \"./otp-token\";\nimport {\n\tchangeEmailEmailOTP,\n\tcheckVerificationOTP,\n\tcreateVerificationOTP,\n\tforgetPasswordEmailOTP,\n\tgetVerificationOTP,\n\trequestEmailChangeEmailOTP,\n\trequestPasswordResetEmailOTP,\n\tresetPasswordEmailOTP,\n\tsendVerificationOTP,\n\tsignInEmailOTP,\n\tverifyEmailOTP,\n} from \"./routes\";\nimport type { EmailOTPOptions } from \"./types\";\nimport { toOTPIdentifier } from \"./utils\";\n\ndeclare module \"@better-auth/core\" {\n\tinterface BetterAuthPluginRegistry<AuthOptions, Options> {\n\t\t\"email-otp\": {\n\t\t\tcreator: typeof emailOTP;\n\t\t};\n\t}\n}\n\nexport type { EmailOTPOptions } from \"./types\";\n\nconst defaultOTPGenerator = (options: EmailOTPOptions) =>\n\tgenerateRandomString(options.otpLength ?? 6, \"0-9\");\n\nexport const emailOTP = (options: EmailOTPOptions) => {\n\tconst opts = {\n\t\texpiresIn: 5 * 60,\n\t\tgenerateOTP: () => defaultOTPGenerator(options),\n\t\tstoreOTP: \"plain\",\n\t\t...options,\n\t} satisfies EmailOTPOptions;\n\n\tconst sendVerificationOTPAction = sendVerificationOTP(opts);\n\n\treturn {\n\t\tid: \"email-otp\",\n\t\tinit(ctx) {\n\t\t\tif (!opts.overrideDefaultEmailVerification) {\n\t\t\t\treturn;\n\t\t\t}\n\t\t\treturn {\n\t\t\t\toptions: {\n\t\t\t\t\temailVerification: {\n\t\t\t\t\t\tasync sendVerificationEmail(data, request) {\n\t\t\t\t\t\t\tawait ctx.runInBackgroundOrAwait(\n\t\t\t\t\t\t\t\tsendVerificationOTPAction({\n\t\t\t\t\t\t\t\t\tcontext: ctx,\n\t\t\t\t\t\t\t\t\trequest: request,\n\t\t\t\t\t\t\t\t\tbody: {\n\t\t\t\t\t\t\t\t\t\temail: data.user.email,\n\t\t\t\t\t\t\t\t\t\ttype: \"email-verification\",\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t//@ts-expect-error\n\t\t\t\t\t\t\t\t\tctx,\n\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\t},\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t};\n\t\t},\n\t\tendpoints: {\n\t\t\tsendVerificationOTP: sendVerificationOTPAction,\n\t\t\tcreateVerificationOTP: createVerificationOTP(opts),\n\t\t\tgetVerificationOTP: getVerificationOTP(opts),\n\t\t\tcheckVerificationOTP: checkVerificationOTP(opts),\n\t\t\tverifyEmailOTP: verifyEmailOTP(opts),\n\t\t\tsignInEmailOTP: signInEmailOTP(opts),\n\t\t\trequestPasswordResetEmailOTP: requestPasswordResetEmailOTP(opts),\n\t\t\tforgetPasswordEmailOTP: forgetPasswordEmailOTP(opts),\n\t\t\tresetPasswordEmailOTP: resetPasswordEmailOTP(opts),\n\t\t\trequestEmailChangeEmailOTP: requestEmailChangeEmailOTP(opts),\n\t\t\tchangeEmailEmailOTP: changeEmailEmailOTP(opts),\n\t\t},\n\t\thooks: {\n\t\t\tafter: [\n\t\t\t\t{\n\t\t\t\t\tmatcher(context) {\n\t\t\t\t\t\treturn !!(\n\t\t\t\t\t\t\tcontext.path?.startsWith(\"/sign-up\") &&\n\t\t\t\t\t\t\topts.sendVerificationOnSignUp &&\n\t\t\t\t\t\t\t!opts.overrideDefaultEmailVerification\n\t\t\t\t\t\t);\n\t\t\t\t\t},\n\t\t\t\t\thandler: createAuthMiddleware(async (ctx) => {\n\t\t\t\t\t\tconst response = await getEndpointResponse<{\n\t\t\t\t\t\t\tuser: { email: string };\n\t\t\t\t\t\t}>(ctx);\n\t\t\t\t\t\tconst email = response?.user.email;\n\t\t\t\t\t\tif (email) {\n\t\t\t\t\t\t\tconst otp =\n\t\t\t\t\t\t\t\topts.generateOTP({ email, type: ctx.body.type }, ctx) ||\n\t\t\t\t\t\t\t\tdefaultOTPGenerator(opts);\n\t\t\t\t\t\t\tconst storedOTP = await storeOTP(ctx, opts, otp);\n\t\t\t\t\t\t\tawait ctx.context.internalAdapter.createVerificationValue({\n\t\t\t\t\t\t\t\tvalue: `${storedOTP}:0`,\n\t\t\t\t\t\t\t\tidentifier: toOTPIdentifier(\"email-verification\", email),\n\t\t\t\t\t\t\t\texpiresAt: getDate(opts.expiresIn, \"sec\"),\n\t\t\t\t\t\t\t});\n\t\t\t\t\t\t\tawait ctx.context.runInBackgroundOrAwait(\n\t\t\t\t\t\t\t\toptions.sendVerificationOTP(\n\t\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\t\temail,\n\t\t\t\t\t\t\t\t\t\totp,\n\t\t\t\t\t\t\t\t\t\ttype: \"email-verification\",\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\tctx,\n\t\t\t\t\t\t\t\t),\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\t}\n\t\t\t\t\t}),\n\t\t\t\t},\n\t\t\t],\n\t\t},\n\n\t\trateLimit: [\n\t\t\t{\n\t\t\t\tpathMatcher(path) {\n\t\t\t\t\treturn path === \"/email-otp/send-verification-otp\";\n\t\t\t\t},\n\t\t\t\twindow: opts.rateLimit?.window || 60,\n\t\t\t\tmax: opts.rateLimit?.max || 3,\n\t\t\t},\n\t\t\t{\n\t\t\t\tpathMatcher(path) {\n\t\t\t\t\treturn path === \"/email-otp/check-verification-otp\";\n\t\t\t\t},\n\t\t\t\twindow: opts.rateLimit?.window || 60,\n\t\t\t\tmax: opts.rateLimit?.max || 3,\n\t\t\t},\n\t\t\t{\n\t\t\t\tpathMatcher(path) {\n\t\t\t\t\treturn path === \"/email-otp/verify-email\";\n\t\t\t\t},\n\t\t\t\twindow: opts.rateLimit?.window || 60,\n\t\t\t\tmax: opts.rateLimit?.max || 3,\n\t\t\t},\n\t\t\t{\n\t\t\t\tpathMatcher(path) {\n\t\t\t\t\treturn path === \"/sign-in/email-otp\";\n\t\t\t\t},\n\t\t\t\twindow: opts.rateLimit?.window || 60,\n\t\t\t\tmax: opts.rateLimit?.max || 3,\n\t\t\t},\n\t\t\t{\n\t\t\t\tpathMatcher(path) {\n\t\t\t\t\treturn path === \"/email-otp/request-password-reset\";\n\t\t\t\t},\n\t\t\t\twindow: opts.rateLimit?.window || 60,\n\t\t\t\tmax: opts.rateLimit?.max || 3,\n\t\t\t},\n\t\t\t{\n\t\t\t\tpathMatcher(path) {\n\t\t\t\t\treturn path === \"/email-otp/reset-password\";\n\t\t\t\t},\n\t\t\t\twindow: opts.rateLimit?.window || 60,\n\t\t\t\tmax: opts.rateLimit?.max || 3,\n\t\t\t},\n\t\t\t{\n\t\t\t\tpathMatcher(path) {\n\t\t\t\t\treturn path === \"/forget-password/email-otp\";\n\t\t\t\t},\n\t\t\t\twindow: opts.rateLimit?.window || 60,\n\t\t\t\tmax: opts.rateLimit?.max || 3,\n\t\t\t},\n\t\t\t{\n\t\t\t\tpathMatcher(path) {\n\t\t\t\t\treturn path === \"/email-otp/request-email-change\";\n\t\t\t\t},\n\t\t\t\twindow: opts.rateLimit?.window || 60,\n\t\t\t\tmax: opts.rateLimit?.max || 3,\n\t\t\t},\n\t\t\t{\n\t\t\t\tpathMatcher(path) {\n\t\t\t\t\treturn path === \"/email-otp/change-email\";\n\t\t\t\t},\n\t\t\t\twindow: opts.rateLimit?.window || 60,\n\t\t\t\tmax: opts.rateLimit?.max || 3,\n\t\t\t},\n\t\t],\n\t\toptions,\n\t\t$ERROR_CODES: EMAIL_OTP_ERROR_CODES,\n\t} satisfies BetterAuthPlugin;\n};\n"],"mappings":";;;;;;;;;;;AAiCA,MAAM,uBAAuB,YAC5B,qBAAqB,QAAQ,aAAa,GAAG,MAAM;AAEpD,MAAa,YAAY,YAA6B;CACrD,MAAM,OAAO;EACZ,WAAW;EACX,mBAAmB,oBAAoB,QAAQ;EAC/C,UAAU;EACV,GAAG;EACH;CAED,MAAM,4BAA4B,oBAAoB,KAAK;AAE3D,QAAO;EACN,IAAI;EACJ,KAAK,KAAK;AACT,OAAI,CAAC,KAAK,iCACT;AAED,UAAO,EACN,SAAS,EACR,mBAAmB,EAClB,MAAM,sBAAsB,MAAM,SAAS;AAC1C,UAAM,IAAI,uBACT,0BAA0B;KACzB,SAAS;KACA;KACT,MAAM;MACL,OAAO,KAAK,KAAK;MACjB,MAAM;MACN;KAED;KACA,CAAC,CACF;MAEF,EACD,EACD;;EAEF,WAAW;GACV,qBAAqB;GACrB,uBAAuB,sBAAsB,KAAK;GAClD,oBAAoB,mBAAmB,KAAK;GAC5C,sBAAsB,qBAAqB,KAAK;GAChD,gBAAgB,eAAe,KAAK;GACpC,gBAAgB,eAAe,KAAK;GACpC,8BAA8B,6BAA6B,KAAK;GAChE,wBAAwB,uBAAuB,KAAK;GACpD,uBAAuB,sBAAsB,KAAK;GAClD,4BAA4B,2BAA2B,KAAK;GAC5D,qBAAqB,oBAAoB,KAAK;GAC9C;EACD,OAAO,EACN,OAAO,CACN;GACC,QAAQ,SAAS;AAChB,WAAO,CAAC,EACP,QAAQ,MAAM,WAAW,WAAW,IACpC,KAAK,4BACL,CAAC,KAAK;;GAGR,SAAS,qBAAqB,OAAO,QAAQ;IAI5C,MAAM,SAHW,MAAM,oBAEpB,IAAI,GACiB,KAAK;AAC7B,QAAI,OAAO;KACV,MAAM,MACL,KAAK,YAAY;MAAE;MAAO,MAAM,IAAI,KAAK;MAAM,EAAE,IAAI,IACrD,oBAAoB,KAAK;KAC1B,MAAM,YAAY,MAAM,SAAS,KAAK,MAAM,IAAI;AAChD,WAAM,IAAI,QAAQ,gBAAgB,wBAAwB;MACzD,OAAO,GAAG,UAAU;MACpB,YAAY,gBAAgB,sBAAsB,MAAM;MACxD,WAAW,QAAQ,KAAK,WAAW,MAAM;MACzC,CAAC;AACF,WAAM,IAAI,QAAQ,uBACjB,QAAQ,oBACP;MACC;MACA;MACA,MAAM;MACN,EACD,IACA,CACD;;KAED;GACF,CACD,EACD;EAED,WAAW;GACV;IACC,YAAY,MAAM;AACjB,YAAO,SAAS;;IAEjB,QAAQ,KAAK,WAAW,UAAU;IAClC,KAAK,KAAK,WAAW,OAAO;IAC5B;GACD;IACC,YAAY,MAAM;AACjB,YAAO,SAAS;;IAEjB,QAAQ,KAAK,WAAW,UAAU;IAClC,KAAK,KAAK,WAAW,OAAO;IAC5B;GACD;IACC,YAAY,MAAM;AACjB,YAAO,SAAS;;IAEjB,QAAQ,KAAK,WAAW,UAAU;IAClC,KAAK,KAAK,WAAW,OAAO;IAC5B;GACD;IACC,YAAY,MAAM;AACjB,YAAO,SAAS;;IAEjB,QAAQ,KAAK,WAAW,UAAU;IAClC,KAAK,KAAK,WAAW,OAAO;IAC5B;GACD;IACC,YAAY,MAAM;AACjB,YAAO,SAAS;;IAEjB,QAAQ,KAAK,WAAW,UAAU;IAClC,KAAK,KAAK,WAAW,OAAO;IAC5B;GACD;IACC,YAAY,MAAM;AACjB,YAAO,SAAS;;IAEjB,QAAQ,KAAK,WAAW,UAAU;IAClC,KAAK,KAAK,WAAW,OAAO;IAC5B;GACD;IACC,YAAY,MAAM;AACjB,YAAO,SAAS;;IAEjB,QAAQ,KAAK,WAAW,UAAU;IAClC,KAAK,KAAK,WAAW,OAAO;IAC5B;GACD;IACC,YAAY,MAAM;AACjB,YAAO,SAAS;;IAEjB,QAAQ,KAAK,WAAW,UAAU;IAClC,KAAK,KAAK,WAAW,OAAO;IAC5B;GACD;IACC,YAAY,MAAM;AACjB,YAAO,SAAS;;IAEjB,QAAQ,KAAK,WAAW,UAAU;IAClC,KAAK,KAAK,WAAW,OAAO;IAC5B;GACD;EACD;EACA,cAAc;EACd"}

package/dist/plugins/email-otp/otp-token.mjs

@@ -1,6 +1,7 @@
+import { getDate } from "../../utils/date.mjs";
 import { constantTimeEqual } from "../../crypto/buffer.mjs";
 import { symmetricDecrypt, symmetricEncrypt } from "../../crypto/index.mjs";
-import { defaultKeyHasher } from "./utils.mjs";
+import { defaultKeyHasher, splitAtLastColon } from "./utils.mjs";
 
 //#region src/plugins/email-otp/otp-token.ts
 async function storeOTP(ctx, opts, otp) {
@@ -23,7 +24,35 @@ async function verifyStoredOTP(ctx, opts, storedOtp, otp) {
 	if (typeof opts.storeOTP === "object" && "decrypt" in opts.storeOTP) return constantTimeEqual(await opts.storeOTP.decrypt(storedOtp), otp);
 	return constantTimeEqual(otp, storedOtp);
 }
+/**
+* Retrieves the plain-text OTP from a stored value.
+* Returns `null` if the OTP is hashed and cannot be recovered.
+*/
+async function retrieveOTP(ctx, opts, storedOtp) {
+	if (opts.storeOTP === "plain" || opts.storeOTP === void 0) return storedOtp;
+	if (opts.storeOTP === "encrypted") return await symmetricDecrypt({
+		key: ctx.context.secretConfig,
+		data: storedOtp
+	});
+	if (typeof opts.storeOTP === "object" && "decrypt" in opts.storeOTP) return await opts.storeOTP.decrypt(storedOtp);
+	return null;
+}
+/**
+* Tries to reuse an existing unexpired OTP.
+* Returns the plain-text OTP if reusable, `null` otherwise.
+*/
+async function tryReuseOTP(ctx, opts, identifier) {
+	const existing = await ctx.context.internalAdapter.findVerificationValue(identifier);
+	if (!existing || existing.expiresAt < /* @__PURE__ */ new Date()) return null;
+	const [storedOtpValue, attempts] = splitAtLastColon(existing.value);
+	const allowedAttempts = opts.allowedAttempts || 3;
+	if (attempts && parseInt(attempts) >= allowedAttempts) return null;
+	const plainOtp = await retrieveOTP(ctx, opts, storedOtpValue);
+	if (!plainOtp) return null;
+	await ctx.context.internalAdapter.updateVerificationByIdentifier(identifier, { expiresAt: getDate(opts.expiresIn, "sec") });
+	return plainOtp;
+}
 
 //#endregion
-export { storeOTP, verifyStoredOTP };
+export { storeOTP, tryReuseOTP, verifyStoredOTP };
 //# sourceMappingURL=otp-token.mjs.map

package/dist/plugins/email-otp/otp-token.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"otp-token.mjs","names":[],"sources":["../../../src/plugins/email-otp/otp-token.ts"],"sourcesContent":["import type { GenericEndpointContext } from \"@better-auth/core\";\nimport {\n\tconstantTimeEqual,\n\tsymmetricDecrypt,\n\tsymmetricEncrypt,\n} from \"../../crypto\";\nimport type { EmailOTPOptions } from \"./types\";\nimport { defaultKeyHasher } from \"./utils\";\n\nexport async function storeOTP(\n\tctx: GenericEndpointContext,\n\topts: EmailOTPOptions,\n\totp: string,\n) {\n\tif (opts.storeOTP === \"encrypted\") {\n\t\treturn await symmetricEncrypt({\n\t\t\tkey: ctx.context.secretConfig,\n\t\t\tdata: otp,\n\t\t});\n\t}\n\tif (opts.storeOTP === \"hashed\") {\n\t\treturn await defaultKeyHasher(otp);\n\t}\n\tif (typeof opts.storeOTP === \"object\" && \"hash\" in opts.storeOTP) {\n\t\treturn await opts.storeOTP.hash(otp);\n\t}\n\tif (typeof opts.storeOTP === \"object\" && \"encrypt\" in opts.storeOTP) {\n\t\treturn await opts.storeOTP.encrypt(otp);\n\t}\n\n\treturn otp;\n}\n\nexport async function verifyStoredOTP(\n\tctx: GenericEndpointContext,\n\topts: EmailOTPOptions,\n\tstoredOtp: string,\n\totp: string,\n): Promise<boolean> {\n\tif (opts.storeOTP === \"encrypted\") {\n\t\tconst decryptedOtp = await symmetricDecrypt({\n\t\t\tkey: ctx.context.secretConfig,\n\t\t\tdata: storedOtp,\n\t\t});\n\t\treturn constantTimeEqual(decryptedOtp, otp);\n\t}\n\tif (opts.storeOTP === \"hashed\") {\n\t\tconst hashedOtp = await defaultKeyHasher(otp);\n\t\treturn constantTimeEqual(hashedOtp, storedOtp);\n\t}\n\tif (typeof opts.storeOTP === \"object\" && \"hash\" in opts.storeOTP) {\n\t\tconst hashedOtp = await opts.storeOTP.hash(otp);\n\t\treturn constantTimeEqual(hashedOtp, storedOtp);\n\t}\n\tif (typeof opts.storeOTP === \"object\" && \"decrypt\" in opts.storeOTP) {\n\t\tconst decryptedOtp = await opts.storeOTP.decrypt(storedOtp);\n\t\treturn constantTimeEqual(decryptedOtp, otp);\n\t}\n\n\treturn constantTimeEqual(otp, storedOtp);\n}\n"],"mappings":";;;;;AASA,eAAsB,SACrB,KACA,MACA,KACC;AACD,KAAI,KAAK,aAAa,YACrB,QAAO,MAAM,iBAAiB;EAC7B,KAAK,IAAI,QAAQ;EACjB,MAAM;EACN,CAAC;AAEH,KAAI,KAAK,aAAa,SACrB,QAAO,MAAM,iBAAiB,IAAI;AAEnC,KAAI,OAAO,KAAK,aAAa,YAAY,UAAU,KAAK,SACvD,QAAO,MAAM,KAAK,SAAS,KAAK,IAAI;AAErC,KAAI,OAAO,KAAK,aAAa,YAAY,aAAa,KAAK,SAC1D,QAAO,MAAM,KAAK,SAAS,QAAQ,IAAI;AAGxC,QAAO;;AAGR,eAAsB,gBACrB,KACA,MACA,WACA,KACmB;AACnB,KAAI,KAAK,aAAa,YAKrB,QAAO,kBAJc,MAAM,iBAAiB;EAC3C,KAAK,IAAI,QAAQ;EACjB,MAAM;EACN,CAAC,EACqC,IAAI;AAE5C,KAAI,KAAK,aAAa,SAErB,QAAO,kBADW,MAAM,iBAAiB,IAAI,EACT,UAAU;AAE/C,KAAI,OAAO,KAAK,aAAa,YAAY,UAAU,KAAK,SAEvD,QAAO,kBADW,MAAM,KAAK,SAAS,KAAK,IAAI,EACX,UAAU;AAE/C,KAAI,OAAO,KAAK,aAAa,YAAY,aAAa,KAAK,SAE1D,QAAO,kBADc,MAAM,KAAK,SAAS,QAAQ,UAAU,EACpB,IAAI;AAG5C,QAAO,kBAAkB,KAAK,UAAU"}
+{"version":3,"file":"otp-token.mjs","names":[],"sources":["../../../src/plugins/email-otp/otp-token.ts"],"sourcesContent":["import type { GenericEndpointContext } from \"@better-auth/core\";\nimport {\n\tconstantTimeEqual,\n\tsymmetricDecrypt,\n\tsymmetricEncrypt,\n} from \"../../crypto\";\nimport { getDate } from \"../../utils/date\";\nimport type { EmailOTPOptions, RequiredEmailOTPOptions } from \"./types\";\nimport { defaultKeyHasher, splitAtLastColon } from \"./utils\";\n\nexport async function storeOTP(\n\tctx: GenericEndpointContext,\n\topts: EmailOTPOptions,\n\totp: string,\n) {\n\tif (opts.storeOTP === \"encrypted\") {\n\t\treturn await symmetricEncrypt({\n\t\t\tkey: ctx.context.secretConfig,\n\t\t\tdata: otp,\n\t\t});\n\t}\n\tif (opts.storeOTP === \"hashed\") {\n\t\treturn await defaultKeyHasher(otp);\n\t}\n\tif (typeof opts.storeOTP === \"object\" && \"hash\" in opts.storeOTP) {\n\t\treturn await opts.storeOTP.hash(otp);\n\t}\n\tif (typeof opts.storeOTP === \"object\" && \"encrypt\" in opts.storeOTP) {\n\t\treturn await opts.storeOTP.encrypt(otp);\n\t}\n\n\treturn otp;\n}\n\nexport async function verifyStoredOTP(\n\tctx: GenericEndpointContext,\n\topts: EmailOTPOptions,\n\tstoredOtp: string,\n\totp: string,\n): Promise<boolean> {\n\tif (opts.storeOTP === \"encrypted\") {\n\t\tconst decryptedOtp = await symmetricDecrypt({\n\t\t\tkey: ctx.context.secretConfig,\n\t\t\tdata: storedOtp,\n\t\t});\n\t\treturn constantTimeEqual(decryptedOtp, otp);\n\t}\n\tif (opts.storeOTP === \"hashed\") {\n\t\tconst hashedOtp = await defaultKeyHasher(otp);\n\t\treturn constantTimeEqual(hashedOtp, storedOtp);\n\t}\n\tif (typeof opts.storeOTP === \"object\" && \"hash\" in opts.storeOTP) {\n\t\tconst hashedOtp = await opts.storeOTP.hash(otp);\n\t\treturn constantTimeEqual(hashedOtp, storedOtp);\n\t}\n\tif (typeof opts.storeOTP === \"object\" && \"decrypt\" in opts.storeOTP) {\n\t\tconst decryptedOtp = await opts.storeOTP.decrypt(storedOtp);\n\t\treturn constantTimeEqual(decryptedOtp, otp);\n\t}\n\n\treturn constantTimeEqual(otp, storedOtp);\n}\n\n/**\n * Retrieves the plain-text OTP from a stored value.\n * Returns `null` if the OTP is hashed and cannot be recovered.\n */\nasync function retrieveOTP(\n\tctx: GenericEndpointContext,\n\topts: EmailOTPOptions,\n\tstoredOtp: string,\n): Promise<string | null> {\n\tif (opts.storeOTP === \"plain\" || opts.storeOTP === undefined) {\n\t\treturn storedOtp;\n\t}\n\tif (opts.storeOTP === \"encrypted\") {\n\t\treturn await symmetricDecrypt({\n\t\t\tkey: ctx.context.secretConfig,\n\t\t\tdata: storedOtp,\n\t\t});\n\t}\n\tif (typeof opts.storeOTP === \"object\" && \"decrypt\" in opts.storeOTP) {\n\t\treturn await opts.storeOTP.decrypt(storedOtp);\n\t}\n\t// hashed or custom hash -> cannot recover\n\treturn null;\n}\n\n/**\n * Tries to reuse an existing unexpired OTP.\n * Returns the plain-text OTP if reusable, `null` otherwise.\n */\nexport async function tryReuseOTP(\n\tctx: GenericEndpointContext,\n\topts: RequiredEmailOTPOptions,\n\tidentifier: string,\n): Promise<string | null> {\n\tconst existing =\n\t\tawait ctx.context.internalAdapter.findVerificationValue(identifier);\n\tif (!existing || existing.expiresAt < new Date()) return null;\n\n\tconst [storedOtpValue, attempts] = splitAtLastColon(existing.value);\n\tconst allowedAttempts = opts.allowedAttempts || 3;\n\tif (attempts && parseInt(attempts) >= allowedAttempts) return null;\n\n\tconst plainOtp = await retrieveOTP(ctx, opts, storedOtpValue);\n\tif (!plainOtp) return null;\n\n\tawait ctx.context.internalAdapter.updateVerificationByIdentifier(identifier, {\n\t\texpiresAt: getDate(opts.expiresIn, \"sec\"),\n\t});\n\n\treturn plainOtp;\n}\n"],"mappings":";;;;;;AAUA,eAAsB,SACrB,KACA,MACA,KACC;AACD,KAAI,KAAK,aAAa,YACrB,QAAO,MAAM,iBAAiB;EAC7B,KAAK,IAAI,QAAQ;EACjB,MAAM;EACN,CAAC;AAEH,KAAI,KAAK,aAAa,SACrB,QAAO,MAAM,iBAAiB,IAAI;AAEnC,KAAI,OAAO,KAAK,aAAa,YAAY,UAAU,KAAK,SACvD,QAAO,MAAM,KAAK,SAAS,KAAK,IAAI;AAErC,KAAI,OAAO,KAAK,aAAa,YAAY,aAAa,KAAK,SAC1D,QAAO,MAAM,KAAK,SAAS,QAAQ,IAAI;AAGxC,QAAO;;AAGR,eAAsB,gBACrB,KACA,MACA,WACA,KACmB;AACnB,KAAI,KAAK,aAAa,YAKrB,QAAO,kBAJc,MAAM,iBAAiB;EAC3C,KAAK,IAAI,QAAQ;EACjB,MAAM;EACN,CAAC,EACqC,IAAI;AAE5C,KAAI,KAAK,aAAa,SAErB,QAAO,kBADW,MAAM,iBAAiB,IAAI,EACT,UAAU;AAE/C,KAAI,OAAO,KAAK,aAAa,YAAY,UAAU,KAAK,SAEvD,QAAO,kBADW,MAAM,KAAK,SAAS,KAAK,IAAI,EACX,UAAU;AAE/C,KAAI,OAAO,KAAK,aAAa,YAAY,aAAa,KAAK,SAE1D,QAAO,kBADc,MAAM,KAAK,SAAS,QAAQ,UAAU,EACpB,IAAI;AAG5C,QAAO,kBAAkB,KAAK,UAAU;;;;;;AAOzC,eAAe,YACd,KACA,MACA,WACyB;AACzB,KAAI,KAAK,aAAa,WAAW,KAAK,aAAa,OAClD,QAAO;AAER,KAAI,KAAK,aAAa,YACrB,QAAO,MAAM,iBAAiB;EAC7B,KAAK,IAAI,QAAQ;EACjB,MAAM;EACN,CAAC;AAEH,KAAI,OAAO,KAAK,aAAa,YAAY,aAAa,KAAK,SAC1D,QAAO,MAAM,KAAK,SAAS,QAAQ,UAAU;AAG9C,QAAO;;;;;;AAOR,eAAsB,YACrB,KACA,MACA,YACyB;CACzB,MAAM,WACL,MAAM,IAAI,QAAQ,gBAAgB,sBAAsB,WAAW;AACpE,KAAI,CAAC,YAAY,SAAS,4BAAY,IAAI,MAAM,CAAE,QAAO;CAEzD,MAAM,CAAC,gBAAgB,YAAY,iBAAiB,SAAS,MAAM;CACnE,MAAM,kBAAkB,KAAK,mBAAmB;AAChD,KAAI,YAAY,SAAS,SAAS,IAAI,gBAAiB,QAAO;CAE9D,MAAM,WAAW,MAAM,YAAY,KAAK,MAAM,eAAe;AAC7D,KAAI,CAAC,SAAU,QAAO;AAEtB,OAAM,IAAI,QAAQ,gBAAgB,+BAA+B,YAAY,EAC5E,WAAW,QAAQ,KAAK,WAAW,MAAM,EACzC,CAAC;AAEF,QAAO"}

package/dist/plugins/email-otp/routes.mjs

@@ -6,8 +6,8 @@ import { setCookieCache, setSessionCookie } from "../../cookies/index.mjs";
 import { getSessionFromCtx, sensitiveSessionMiddleware } from "../../api/routes/session.mjs";
 import { APIError as APIError$1 } from "../../api/index.mjs";
 import { EMAIL_OTP_ERROR_CODES } from "./error-codes.mjs";
-import { splitAtLastColon } from "./utils.mjs";
-import { storeOTP, verifyStoredOTP } from "./otp-token.mjs";
+import { splitAtLastColon, toOTPIdentifier } from "./utils.mjs";
+import { storeOTP, tryReuseOTP, verifyStoredOTP } from "./otp-token.mjs";
 import { BASE_ERROR_CODES } from "@better-auth/core/error";
 import { createAuthEndpoint } from "@better-auth/core/api";
 import { deprecate } from "@better-auth/core/utils/deprecate";
@@ -20,6 +20,37 @@ const types = [
 	"forget-password",
 	"change-email"
 ];
+/**
+* Resolves the OTP to send: reuses an existing one if possible,
+* otherwise generates and stores a new one.
+*
+* @internal
+*/
+async function resolveOTP(ctx, opts, email, type) {
+	const identifier = toOTPIdentifier(type, email);
+	if (opts.resendStrategy === "reuse") {
+		const reused = await tryReuseOTP(ctx, opts, identifier);
+		if (reused) return reused;
+	}
+	const otp = opts.generateOTP({
+		email,
+		type
+	}, ctx) || defaultOTPGenerator(opts);
+	const storedOTP = await storeOTP(ctx, opts, otp);
+	await ctx.context.internalAdapter.createVerificationValue({
+		value: `${storedOTP}:0`,
+		identifier,
+		expiresAt: getDate(opts.expiresIn, "sec")
+	}).catch(async () => {
+		await ctx.context.internalAdapter.deleteVerificationByIdentifier(identifier);
+		await ctx.context.internalAdapter.createVerificationValue({
+			value: `${storedOTP}:0`,
+			identifier,
+			expiresAt: getDate(opts.expiresIn, "sec")
+		});
+	});
+	return otp;
+}
 const sendVerificationOTPBodySchema = z.object({
 	email: z.string({}).meta({ description: "Email address to send the OTP" }),
 	type: z.enum(types).meta({ description: "Type of the OTP" })
@@ -64,25 +95,11 @@ const sendVerificationOTP = (opts) => createAuthEndpoint("/email-otp/send-verifi
 		ctx.context.logger.error("Use the /email-otp/request-email-change endpoint to send OTP for changing email");
 		throw APIError$1.fromStatus("BAD_REQUEST", { message: "Invalid OTP type" });
 	}
-	const otp = opts.generateOTP({
-		email,
-		type: ctx.body.type
-	}, ctx) || defaultOTPGenerator(opts);
-	const storedOTP = await storeOTP(ctx, opts, otp);
-	await ctx.context.internalAdapter.createVerificationValue({
-		value: `${storedOTP}:0`,
-		identifier: `${ctx.body.type}-otp-${email}`,
-		expiresAt: getDate(opts.expiresIn, "sec")
-	}).catch(async (error) => {
-		await ctx.context.internalAdapter.deleteVerificationByIdentifier(`${ctx.body.type}-otp-${email}`);
-		await ctx.context.internalAdapter.createVerificationValue({
-			value: `${storedOTP}:0`,
-			identifier: `${ctx.body.type}-otp-${email}`,
-			expiresAt: getDate(opts.expiresIn, "sec")
-		});
-	});
-	if (!await ctx.context.internalAdapter.findUserByEmail(email)) if (ctx.body.type === "sign-in" && !opts.disableSignUp) {} else {
-		await ctx.context.internalAdapter.deleteVerificationByIdentifier(`${ctx.body.type}-otp-${email}`);
+	const identifier = toOTPIdentifier(ctx.body.type, email);
+	const otp = await resolveOTP(ctx, opts, email, ctx.body.type);
+	const shouldSendOTP = ctx.body.type === "sign-in" && !opts.disableSignUp;
+	if (!await ctx.context.internalAdapter.findUserByEmail(email) && !shouldSendOTP) {
+		await ctx.context.internalAdapter.deleteVerificationByIdentifier(identifier);
 		return ctx.json({ success: true });
 	}
 	await ctx.context.runInBackgroundOrAwait(opts.sendVerificationOTP({
@@ -119,7 +136,7 @@ const createVerificationOTP = (opts) => createAuthEndpoint({
 	const storedOTP = await storeOTP(ctx, opts, otp);
 	await ctx.context.internalAdapter.createVerificationValue({
 		value: `${storedOTP}:0`,
-		identifier: `${ctx.body.type}-otp-${email}`,
+		identifier: toOTPIdentifier(ctx.body.type, email),
 		expiresAt: getDate(opts.expiresIn, "sec")
 	});
 	return otp;
@@ -164,7 +181,7 @@ const getVerificationOTP = (opts) => createAuthEndpoint({
 	} }
 }, async (ctx) => {
 	const email = ctx.query.email.toLowerCase();
-	const verificationValue = await ctx.context.internalAdapter.findVerificationValue(`${ctx.query.type}-otp-${email}`);
+	const verificationValue = await ctx.context.internalAdapter.findVerificationValue(toOTPIdentifier(ctx.query.type, email));
 	if (!verificationValue || verificationValue.expiresAt < /* @__PURE__ */ new Date()) return ctx.json({ otp: null });
 	if (opts.storeOTP === "hashed" || typeof opts.storeOTP === "object" && "hash" in opts.storeOTP) throw APIError$1.fromStatus("BAD_REQUEST", { message: "OTP is hashed, cannot return the plain text OTP" });
 	const [storedOtp, _attempts] = splitAtLastColon(verificationValue.value);
@@ -217,21 +234,21 @@ const checkVerificationOTP = (opts) => createAuthEndpoint("/email-otp/check-veri
 	const email = ctx.body.email.toLowerCase();
 	if (!z.email().safeParse(email).success) throw APIError$1.from("BAD_REQUEST", BASE_ERROR_CODES.INVALID_EMAIL);
 	if (!await ctx.context.internalAdapter.findUserByEmail(email)) throw APIError$1.from("BAD_REQUEST", BASE_ERROR_CODES.USER_NOT_FOUND);
-	const verificationValue = await ctx.context.internalAdapter.findVerificationValue(`${ctx.body.type}-otp-${email}`);
+	const identifier = toOTPIdentifier(ctx.body.type, email);
+	const verificationValue = await ctx.context.internalAdapter.findVerificationValue(identifier);
 	if (!verificationValue) throw APIError$1.from("BAD_REQUEST", EMAIL_OTP_ERROR_CODES.INVALID_OTP);
-	const otpIdentifier = `${ctx.body.type}-otp-${email}`;
 	if (verificationValue.expiresAt < /* @__PURE__ */ new Date()) {
-		await ctx.context.internalAdapter.deleteVerificationByIdentifier(otpIdentifier);
+		await ctx.context.internalAdapter.deleteVerificationByIdentifier(identifier);
 		throw APIError$1.from("BAD_REQUEST", EMAIL_OTP_ERROR_CODES.OTP_EXPIRED);
 	}
 	const [otpValue, attempts] = splitAtLastColon(verificationValue.value);
 	const allowedAttempts = opts?.allowedAttempts || 3;
 	if (attempts && parseInt(attempts) >= allowedAttempts) {
-		await ctx.context.internalAdapter.deleteVerificationByIdentifier(otpIdentifier);
+		await ctx.context.internalAdapter.deleteVerificationByIdentifier(identifier);
 		throw APIError$1.from("FORBIDDEN", EMAIL_OTP_ERROR_CODES.TOO_MANY_ATTEMPTS);
 	}
 	if (!await verifyStoredOTP(ctx, opts, otpValue, ctx.body.otp)) {
-		await ctx.context.internalAdapter.updateVerificationByIdentifier(otpIdentifier, { value: `${otpValue}:${parseInt(attempts || "0") + 1}` });
+		await ctx.context.internalAdapter.updateVerificationByIdentifier(identifier, { value: `${otpValue}:${parseInt(attempts || "0") + 1}` });
 		throw APIError$1.from("BAD_REQUEST", EMAIL_OTP_ERROR_CODES.INVALID_OTP);
 	}
 	return ctx.json({ success: true });
@@ -291,7 +308,7 @@ const verifyEmailOTP = (opts) => createAuthEndpoint("/email-otp/verify-email", {
 }, async (ctx) => {
 	const email = ctx.body.email.toLowerCase();
 	if (!z.email().safeParse(email).success) throw APIError$1.from("BAD_REQUEST", BASE_ERROR_CODES.INVALID_EMAIL);
-	await atomicVerifyOTP(ctx, opts, `email-verification-otp-${email}`, ctx.body.otp);
+	await atomicVerifyOTP(ctx, opts, toOTPIdentifier("email-verification", email), ctx.body.otp);
 	const user = await ctx.context.internalAdapter.findUserByEmail(email);
 	if (!user)
  /**
@@ -382,7 +399,7 @@ const signInEmailOTP = (opts) => createAuthEndpoint("/sign-in/email-otp", {
 }, async (ctx) => {
 	const { email: rawEmail, otp, name, image, ...rest } = ctx.body;
 	const email = rawEmail.toLowerCase();
-	await atomicVerifyOTP(ctx, opts, `sign-in-otp-${email}`, otp);
+	await atomicVerifyOTP(ctx, opts, toOTPIdentifier("sign-in", email), otp);
 	const user = await ctx.context.internalAdapter.findUserByEmail(email);
 	if (!user) {
 		if (opts.disableSignUp) throw APIError$1.from("BAD_REQUEST", EMAIL_OTP_ERROR_CODES.INVALID_OTP);
@@ -450,18 +467,10 @@ const requestPasswordResetEmailOTP = (opts) => createAuthEndpoint("/email-otp/re
 	} }
 }, async (ctx) => {
 	const email = ctx.body.email;
-	const otp = opts.generateOTP({
-		email,
-		type: "forget-password"
-	}, ctx) || defaultOTPGenerator(opts);
-	const storedOTP = await storeOTP(ctx, opts, otp);
-	await ctx.context.internalAdapter.createVerificationValue({
-		value: `${storedOTP}:0`,
-		identifier: `forget-password-otp-${email}`,
-		expiresAt: getDate(opts.expiresIn, "sec")
-	});
+	const identifier = toOTPIdentifier("forget-password", email);
+	const otp = await resolveOTP(ctx, opts, email, "forget-password");
 	if (!await ctx.context.internalAdapter.findUserByEmail(email)) {
-		await ctx.context.internalAdapter.deleteVerificationByIdentifier(`forget-password-otp-${email}`);
+		await ctx.context.internalAdapter.deleteVerificationByIdentifier(identifier);
 		return ctx.json({ success: true });
 	}
 	await ctx.context.runInBackgroundOrAwait(opts.sendVerificationOTP({
@@ -510,18 +519,10 @@ const forgetPasswordEmailOTP = (opts) => {
 	}, async (ctx) => {
 		warnDeprecation();
 		const email = ctx.body.email;
-		const otp = opts.generateOTP({
-			email,
-			type: "forget-password"
-		}, ctx) || defaultOTPGenerator(opts);
-		const storedOTP = await storeOTP(ctx, opts, otp);
-		await ctx.context.internalAdapter.createVerificationValue({
-			value: `${storedOTP}:0`,
-			identifier: `forget-password-otp-${email}`,
-			expiresAt: getDate(opts.expiresIn, "sec")
-		});
+		const identifier = toOTPIdentifier("forget-password", email);
+		const otp = await resolveOTP(ctx, opts, email, "forget-password");
 		if (!await ctx.context.internalAdapter.findUserByEmail(email)) {
-			await ctx.context.internalAdapter.deleteVerificationByIdentifier(`forget-password-otp-${email}`);
+			await ctx.context.internalAdapter.deleteVerificationByIdentifier(identifier);
 			return ctx.json({ success: true });
 		}
 		await ctx.context.runInBackgroundOrAwait(opts.sendVerificationOTP({
@@ -568,7 +569,7 @@ const resetPasswordEmailOTP = (opts) => createAuthEndpoint("/email-otp/reset-pas
 	} }
 }, async (ctx) => {
 	const email = ctx.body.email;
-	await atomicVerifyOTP(ctx, opts, `forget-password-otp-${email}`, ctx.body.otp);
+	await atomicVerifyOTP(ctx, opts, toOTPIdentifier("forget-password", email), ctx.body.otp);
 	const user = await ctx.context.internalAdapter.findUserByEmail(email, { includeAccounts: true });
 	if (!user) throw APIError$1.from("BAD_REQUEST", BASE_ERROR_CODES.USER_NOT_FOUND);
 	const minPasswordLength = ctx.context.password.config.minPasswordLength;
@@ -636,9 +637,9 @@ const requestEmailChangeEmailOTP = (opts) => createAuthEndpoint("/email-otp/requ
 	}
 	if (opts.changeEmail?.verifyCurrentEmail) {
 		if (!ctx.body.otp) throw APIError$1.fromStatus("BAD_REQUEST", { message: "OTP is required to verify current email" });
-		const currentEmailVerificationValue = await ctx.context.internalAdapter.findVerificationValue(`email-verification-otp-${email}`);
+		const currentEmailVerificationValue = await ctx.context.internalAdapter.findVerificationValue(toOTPIdentifier("email-verification", email));
 		if (!currentEmailVerificationValue) throw APIError$1.from("BAD_REQUEST", EMAIL_OTP_ERROR_CODES.INVALID_OTP);
-		const currentEmailIdentifier = `email-verification-otp-${email}`;
+		const currentEmailIdentifier = toOTPIdentifier("email-verification", email);
 		if (currentEmailVerificationValue.expiresAt < /* @__PURE__ */ new Date()) {
 			await ctx.context.internalAdapter.deleteVerificationByIdentifier(currentEmailIdentifier);
 			throw APIError$1.from("BAD_REQUEST", EMAIL_OTP_ERROR_CODES.OTP_EXPIRED);
@@ -662,11 +663,11 @@ const requestEmailChangeEmailOTP = (opts) => createAuthEndpoint("/email-otp/requ
 	const storedOTP = await storeOTP(ctx, opts, otp);
 	await ctx.context.internalAdapter.createVerificationValue({
 		value: `${storedOTP}:0`,
-		identifier: `change-email-otp-${email}-${newEmail}`,
+		identifier: toOTPIdentifier("change-email", `${email}-${newEmail}`),
 		expiresAt: getDate(opts.expiresIn, "sec")
 	});
 	if (await ctx.context.internalAdapter.findUserByEmail(newEmail)) {
-		await ctx.context.internalAdapter.deleteVerificationByIdentifier(`change-email-otp-${email}-${newEmail}`);
+		await ctx.context.internalAdapter.deleteVerificationByIdentifier(toOTPIdentifier("change-email", `${email}-${newEmail}`));
 		return ctx.json({ success: true });
 	}
 	await ctx.context.runInBackgroundOrAwait(opts.sendVerificationOTP({
@@ -723,9 +724,9 @@ const changeEmailEmailOTP = (opts) => createAuthEndpoint("/email-otp/change-emai
 		ctx.context.logger.error("Email is the same");
 		throw APIError$1.fromStatus("BAD_REQUEST", { message: "Email is the same" });
 	}
-	const verificationValue = await ctx.context.internalAdapter.findVerificationValue(`change-email-otp-${email}-${newEmail}`);
+	const verificationValue = await ctx.context.internalAdapter.findVerificationValue(toOTPIdentifier("change-email", `${email}-${newEmail}`));
 	if (!verificationValue) throw APIError$1.from("BAD_REQUEST", EMAIL_OTP_ERROR_CODES.INVALID_OTP);
-	const changeEmailIdentifier = `change-email-otp-${email}-${newEmail}`;
+	const changeEmailIdentifier = toOTPIdentifier("change-email", `${email}-${newEmail}`);
 	if (verificationValue.expiresAt < /* @__PURE__ */ new Date()) {
 		await ctx.context.internalAdapter.deleteVerificationByIdentifier(changeEmailIdentifier);
 		throw APIError$1.from("BAD_REQUEST", EMAIL_OTP_ERROR_CODES.OTP_EXPIRED);