better-auth 1.6.20 → 1.6.22

package/dist/plugins/magic-link/index.mjs

@@ -2,6 +2,7 @@ import { originCheck } from "../../api/middlewares/origin-check.mjs";
 import { parseSessionOutput, parseUserOutput } from "../../db/schema.mjs";
 import { generateRandomString } from "../../crypto/random.mjs";
 import { setSessionCookie } from "../../cookies/index.mjs";
+import { revokeUnprovenAccountAccess } from "../../db/revoke-unproven-account-access.mjs";
 import { PACKAGE_VERSION } from "../../version.mjs";
 import { defaultKeyHasher } from "./utils.mjs";
 import { createAuthEndpoint } from "@better-auth/core/api";
@@ -27,7 +28,7 @@ const magicLink = (options) => {
 		allowedAttempts: 1,
 		...options
 	};
-	if (options.allowedAttempts !== void 0 && options.allowedAttempts !== 1) console.warn("[better-auth/magic-link] `allowedAttempts` is ignored: tokens are consumed atomically on the first verification call (GHSA-hc7v-rggr-4hvx). Any value other than `1` has no effect; remove the option to silence this warning.");
+	if (options.allowedAttempts !== void 0 && options.allowedAttempts !== 1) console.warn("[better-auth/magic-link] `allowedAttempts` is ignored: tokens are consumed atomically on the first verification call. Any value other than `1` has no effect; remove the option to silence this warning.");
 	async function storeToken(ctx, token) {
 		if (opts.storeToken === "hashed") return await defaultKeyHasher(token);
 		if (typeof opts.storeToken === "object" && "type" in opts.storeToken && opts.storeToken.type === "custom-hasher") return await opts.storeToken.hash(token);
@@ -134,7 +135,10 @@ const magicLink = (options) => {
 					user = newUser;
 					if (!user) redirectWithError("failed_to_create_user");
 				} else redirectWithError("new_user_signup_disabled");
-				if (!user.emailVerified) user = await ctx.context.internalAdapter.updateUser(user.id, { emailVerified: true });
+				if (!user.emailVerified) {
+					await revokeUnprovenAccountAccess(ctx, user.id);
+					user = await ctx.context.internalAdapter.updateUser(user.id, { emailVerified: true });
+				}
 				const session = await ctx.context.internalAdapter.createSession(user.id);
 				if (!session) redirectWithError("failed_to_create_session");
 				await setSessionCookie(ctx, {

package/dist/plugins/oauth-proxy/index.mjs

@@ -14,6 +14,15 @@ import { defu } from "defu";
 import { createAuthEndpoint, createAuthMiddleware } from "@better-auth/core/api";
 import * as z from "zod";
 //#region src/plugins/oauth-proxy/index.ts
+const consumeOAuthProxyState = async (ctx, state) => {
+	try {
+		await parseGenericState(ctx, state, { skipStateCookieCheck: true });
+		return true;
+	} catch (e) {
+		ctx.context.logger.warn("OAuth proxy state missing or invalid", e);
+		return false;
+	}
+};
 const oauthProxyQuerySchema = z.object({
 	callbackURL: z.string().meta({ description: "The URL to redirect to after the proxy" }),
 	profile: z.string().optional().meta({ description: "Encrypted OAuth profile data" })
@@ -81,7 +90,7 @@ const oAuthProxy = (opts) => {
 				ctx.context.logger.error("Failed to parse OAuth proxy payload", e);
 				throw redirectOnError(ctx, defaultErrorURL, "invalid_payload");
 			}
-			if (typeof payload.timestamp !== "number" || !payload.userInfo || !payload.account || !payload.callbackURL) {
+			if (typeof payload.timestamp !== "number" || !payload.userInfo || !payload.account || !payload.state || !payload.callbackURL) {
 				ctx.context.logger.error("Failed to parse OAuth proxy payload");
 				throw redirectOnError(ctx, defaultErrorURL, "invalid_payload");
 			}
@@ -91,11 +100,7 @@ const oAuthProxy = (opts) => {
 				ctx.context.logger.error(`OAuth proxy payload expired or invalid (age: ${age}s, maxAge: ${maxAge}s)`);
 				throw redirectOnError(ctx, errorURL, "payload_expired");
 			}
-			try {
-				await parseGenericState(ctx, payload.state, { skipStateCookieCheck: true });
-			} catch (e) {
-				ctx.context.logger.warn("Failed to clean up OAuth state", e);
-			}
+			if (!await consumeOAuthProxyState(ctx, payload.state)) throw redirectOnError(ctx, errorURL, "state_mismatch");
 			let result;
 			try {
 				result = await handleOAuthUserInfo(ctx, {

package/dist/plugins/one-tap/index.mjs

@@ -4,9 +4,9 @@ import { handleOAuthUserInfo } from "../../oauth2/link-account.mjs";
 import { APIError } from "../../api/index.mjs";
 import { PACKAGE_VERSION } from "../../version.mjs";
 import { toBoolean } from "../../utils/boolean.mjs";
+import { isGoogleHostedDomainAllowed, verifyGoogleIdToken } from "@better-auth/core/social-providers";
 import { createAuthEndpoint } from "@better-auth/core/api";
 import * as z from "zod";
-import { createRemoteJWKSet, jwtVerify } from "jose";
 //#region src/plugins/one-tap/index.ts
 const oneTapCallbackBodySchema = z.object({
 	idToken: z.string().meta({ description: "Google ID token, which the client obtains from the One Tap API" }),
@@ -40,14 +40,15 @@ const oneTap = (options) => ({
 		const googleProvider = typeof ctx.context.options.socialProviders?.google === "function" ? await ctx.context.options.socialProviders?.google() : ctx.context.options.socialProviders?.google;
 		const audience = options?.clientId || googleProvider?.clientId;
 		if (!audience || Array.isArray(audience) && audience.length === 0) throw new APIError("BAD_REQUEST", { message: "Google client ID is required for One Tap. Set it on the oneTap plugin (clientId) or on socialProviders.google." });
-		let payload;
-		try {
-			const { payload: verifiedPayload } = await jwtVerify(idToken, createRemoteJWKSet(new URL("https://www.googleapis.com/oauth2/v3/certs")), {
-				issuer: ["https://accounts.google.com", "accounts.google.com"],
-				audience
-			});
-			payload = verifiedPayload;
-		} catch {
+		const payload = await verifyGoogleIdToken({
+			token: idToken,
+			audience
+		});
+		if (!payload) throw new APIError("BAD_REQUEST", { message: "invalid id token" });
+		if (!payload.sub) throw new APIError("BAD_REQUEST", { message: "invalid id token" });
+		const configuredHostedDomain = googleProvider?.hd;
+		if (!isGoogleHostedDomainAllowed(configuredHostedDomain, payload.hd)) {
+			ctx.context.logger.error(`Google One Tap sign-in rejected: id token hosted domain (hd) "${payload.hd ?? "<missing>"}" does not satisfy the configured "hd" option "${configuredHostedDomain}".`);
 			throw new APIError("BAD_REQUEST", { message: "invalid id token" });
 		}
 		const { email: rawEmail, email_verified, name, picture, sub } = payload;

package/dist/plugins/siwe/index.mjs

@@ -166,7 +166,11 @@ const siwe = (options) => {
 					}
 					if (!user) {
 						const domain = options.emailDomainName ?? getOrigin(ctx.context.baseURL);
-						const userEmail = !isAnon && email ? email : `${walletAddress}@${domain}`;
+						const normalizedEmail = email?.toLowerCase();
+						let userEmail = `${walletAddress}@${domain}`;
+						if (!isAnon && normalizedEmail) {
+							if (!await ctx.context.internalAdapter.findUserByEmail(normalizedEmail)) userEmail = normalizedEmail;
+						}
 						const { name, avatar } = await options.ensLookup?.({ walletAddress }) ?? {};
 						user = await ctx.context.internalAdapter.createUser({
 							name: name ?? walletAddress,

package/dist/plugins/two-factor/backup-codes/index.mjs

@@ -5,7 +5,7 @@ import { sessionMiddleware } from "../../../api/routes/session.mjs";
 import { shouldRequirePassword } from "../../../utils/password.mjs";
 import { PACKAGE_VERSION } from "../../../version.mjs";
 import { TWO_FACTOR_ERROR_CODES } from "../error-code.mjs";
-import { verifyTwoFactor } from "../verify-two-factor.mjs";
+import { assertTwoFactorNotLocked, recordTwoFactorFailure, resetTwoFactorFailures, verifyTwoFactor } from "../verify-two-factor.mjs";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { safeJSONParse } from "@better-auth/core/utils/json";
 import { createAuthEndpoint } from "@better-auth/core/api";
@@ -161,8 +161,9 @@ const backupCode2fa = (opts) => {
 					} }
 				} }
 			}, async (ctx) => {
-				const { session, valid } = await verifyTwoFactor(ctx);
+				const { session, valid, beginAttempt } = await verifyTwoFactor(ctx);
 				const user = session.user;
+				const isSignIn = !session.session;
 				const twoFactor = await ctx.context.adapter.findOne({
 					model: twoFactorTable,
 					where: [{
@@ -171,11 +172,23 @@ const backupCode2fa = (opts) => {
 					}]
 				});
 				if (!twoFactor) throw APIError.from("BAD_REQUEST", TWO_FACTOR_ERROR_CODES.BACKUP_CODES_NOT_ENABLED);
-				const validate = await verifyBackupCode({
-					backupCodes: twoFactor.backupCodes,
-					code: ctx.body.code
-				}, ctx.context.secretConfig, opts);
-				if (!validate.status || !validate.updated) throw APIError.from("UNAUTHORIZED", TWO_FACTOR_ERROR_CODES.INVALID_BACKUP_CODE);
+				if (isSignIn) await assertTwoFactorNotLocked(ctx, twoFactorTable, twoFactor);
+				const attempt = isSignIn ? await beginAttempt(5) : null;
+				let validate;
+				try {
+					validate = await verifyBackupCode({
+						backupCodes: twoFactor.backupCodes,
+						code: ctx.body.code
+					}, ctx.context.secretConfig, opts);
+				} catch (error) {
+					await attempt?.restore();
+					throw error;
+				}
+				if (!validate.status || !validate.updated) {
+					await attempt?.recordFailure();
+					if (isSignIn) await recordTwoFactorFailure(ctx, twoFactorTable, twoFactor);
+					throw APIError.from("UNAUTHORIZED", TWO_FACTOR_ERROR_CODES.INVALID_BACKUP_CODE);
+				}
 				const updatedBackupCodes = await encodeBackupCodes(validate.updated, ctx.context.secretConfig, opts);
 				if (!await ctx.context.adapter.incrementOne({
 					model: twoFactorTable,
@@ -189,6 +202,7 @@ const backupCode2fa = (opts) => {
 					increment: {},
 					set: { backupCodes: updatedBackupCodes }
 				})) throw APIError.fromStatus("CONFLICT", { message: "Failed to verify backup code. Please try again." });
+				if (isSignIn) await resetTwoFactorFailures(ctx, twoFactorTable, twoFactor);
 				if (!ctx.body.disableSession) return valid(ctx);
 				return ctx.json({
 					token: session.session?.token,

package/dist/plugins/two-factor/client.d.mts

@@ -65,6 +65,7 @@ declare const twoFactorClient: (options?: {
     INVALID_BACKUP_CODE: _better_auth_core_utils_error_codes0.RawError<"INVALID_BACKUP_CODE">;
     INVALID_CODE: _better_auth_core_utils_error_codes0.RawError<"INVALID_CODE">;
     TOO_MANY_ATTEMPTS_REQUEST_NEW_CODE: _better_auth_core_utils_error_codes0.RawError<"TOO_MANY_ATTEMPTS_REQUEST_NEW_CODE">;
+    ACCOUNT_TEMPORARILY_LOCKED: _better_auth_core_utils_error_codes0.RawError<"ACCOUNT_TEMPORARILY_LOCKED">;
     INVALID_TWO_FACTOR_COOKIE: _better_auth_core_utils_error_codes0.RawError<"INVALID_TWO_FACTOR_COOKIE">;
   };
 };

package/dist/plugins/two-factor/error-code.d.mts

@@ -10,6 +10,7 @@ declare const TWO_FACTOR_ERROR_CODES: {
   INVALID_BACKUP_CODE: _better_auth_core_utils_error_codes0.RawError<"INVALID_BACKUP_CODE">;
   INVALID_CODE: _better_auth_core_utils_error_codes0.RawError<"INVALID_CODE">;
   TOO_MANY_ATTEMPTS_REQUEST_NEW_CODE: _better_auth_core_utils_error_codes0.RawError<"TOO_MANY_ATTEMPTS_REQUEST_NEW_CODE">;
+  ACCOUNT_TEMPORARILY_LOCKED: _better_auth_core_utils_error_codes0.RawError<"ACCOUNT_TEMPORARILY_LOCKED">;
   INVALID_TWO_FACTOR_COOKIE: _better_auth_core_utils_error_codes0.RawError<"INVALID_TWO_FACTOR_COOKIE">;
 };
 //#endregion

package/dist/plugins/two-factor/error-code.mjs

@@ -9,6 +9,7 @@ const TWO_FACTOR_ERROR_CODES = defineErrorCodes({
 	INVALID_BACKUP_CODE: "Invalid backup code",
 	INVALID_CODE: "Invalid code",
 	TOO_MANY_ATTEMPTS_REQUEST_NEW_CODE: "Too many attempts. Please request a new code.",
+	ACCOUNT_TEMPORARILY_LOCKED: "Too many failed verification attempts. Your account is temporarily locked. Please try again later.",
 	INVALID_TWO_FACTOR_COOKIE: "Invalid two factor cookie"
 });
 //#endregion

package/dist/plugins/two-factor/index.d.mts

@@ -662,6 +662,19 @@ declare const twoFactor: <O extends TwoFactorOptions>(options?: O) => {
           defaultValue: true;
           input: false;
         };
+        failedVerificationCount: {
+          type: "number";
+          required: false;
+          defaultValue: number;
+          input: false;
+          returned: false;
+        };
+        lockedUntil: {
+          type: "date";
+          required: false;
+          input: false;
+          returned: false;
+        };
       };
     };
   };
@@ -679,6 +692,7 @@ declare const twoFactor: <O extends TwoFactorOptions>(options?: O) => {
     INVALID_BACKUP_CODE: _better_auth_core_utils_error_codes0.RawError<"INVALID_BACKUP_CODE">;
     INVALID_CODE: _better_auth_core_utils_error_codes0.RawError<"INVALID_CODE">;
     TOO_MANY_ATTEMPTS_REQUEST_NEW_CODE: _better_auth_core_utils_error_codes0.RawError<"TOO_MANY_ATTEMPTS_REQUEST_NEW_CODE">;
+    ACCOUNT_TEMPORARILY_LOCKED: _better_auth_core_utils_error_codes0.RawError<"ACCOUNT_TEMPORARILY_LOCKED">;
     INVALID_TWO_FACTOR_COOKIE: _better_auth_core_utils_error_codes0.RawError<"INVALID_TWO_FACTOR_COOKIE">;
   };
 };

package/dist/plugins/two-factor/index.mjs

@@ -236,10 +236,16 @@ const twoFactor = (options) => {
 				const maxAge = options?.twoFactorCookieMaxAge ?? 600;
 				const twoFactorCookie = ctx.context.createAuthCookie(TWO_FACTOR_COOKIE_NAME, { maxAge });
 				const identifier = `2fa-${generateRandomString(20)}`;
+				const expiresAt = new Date(Date.now() + maxAge * 1e3);
 				await ctx.context.internalAdapter.createVerificationValue({
 					value: data.user.id,
 					identifier,
-					expiresAt: new Date(Date.now() + maxAge * 1e3)
+					expiresAt
+				});
+				await ctx.context.internalAdapter.createVerificationValue({
+					value: "0",
+					identifier: `2fa-attempts-${identifier}`,
+					expiresAt
 				});
 				await ctx.setSignedCookie(twoFactorCookie.name, identifier, ctx.context.secret, twoFactorCookie.attributes);
 				const twoFactorMethods = [];

package/dist/plugins/two-factor/otp/index.mjs

@@ -5,7 +5,7 @@ import { symmetricDecrypt, symmetricEncrypt } from "../../../crypto/index.mjs";
 import { setSessionCookie } from "../../../cookies/index.mjs";
 import { PACKAGE_VERSION } from "../../../version.mjs";
 import { TWO_FACTOR_ERROR_CODES } from "../error-code.mjs";
-import { verifyTwoFactor } from "../verify-two-factor.mjs";
+import { assertTwoFactorNotLocked, recordTwoFactorFailure, resetTwoFactorFailures, verifyTwoFactor } from "../verify-two-factor.mjs";
 import { defaultKeyHasher } from "../utils.mjs";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { createAuthEndpoint } from "@better-auth/core/api";
@@ -158,6 +158,20 @@ const otp2fa = (options) => {
 				} }
 			}, async (ctx) => {
 				const { session, key, valid, invalid } = await verifyTwoFactor(ctx);
+				const isSignIn = !session.session;
+				const twoFactorTable = "twoFactor";
+				let twoFactor = null;
+				if (isSignIn) {
+					twoFactor = await ctx.context.adapter.findOne({
+						model: twoFactorTable,
+						where: [{
+							field: "userId",
+							value: session.user.id
+						}]
+					});
+					if (!twoFactor) throw APIError.from("BAD_REQUEST", TWO_FACTOR_ERROR_CODES.TWO_FACTOR_NOT_ENABLED);
+					await assertTwoFactorNotLocked(ctx, twoFactorTable, twoFactor);
+				}
 				const consumed = await ctx.context.internalAdapter.consumeVerificationValue(`2fa-otp-${key}`);
 				if (!consumed) throw APIError.from("BAD_REQUEST", TWO_FACTOR_ERROR_CODES.OTP_HAS_EXPIRED);
 				const [otp, counter] = consumed.value?.split(":") ?? [];
@@ -166,6 +180,7 @@ const otp2fa = (options) => {
 				if (attempts >= allowedAttempts) throw APIError.from("BAD_REQUEST", TWO_FACTOR_ERROR_CODES.TOO_MANY_ATTEMPTS_REQUEST_NEW_CODE);
 				const [storedValue, inputValue] = await decryptOrHashForComparison(ctx, otp, ctx.body.code);
 				if (constantTimeEqual(new TextEncoder().encode(storedValue), new TextEncoder().encode(inputValue))) {
+					if (twoFactor) await resetTwoFactorFailures(ctx, twoFactorTable, twoFactor);
 					if (!session.user.twoFactorEnabled) {
 						if (!session.session) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.FAILED_TO_CREATE_SESSION);
 						const updatedUser = await ctx.context.internalAdapter.updateUser(session.user.id, { twoFactorEnabled: true });
@@ -187,6 +202,7 @@ const otp2fa = (options) => {
 					identifier: `2fa-otp-${key}`,
 					expiresAt: consumed.expiresAt
 				});
+				if (twoFactor) await recordTwoFactorFailure(ctx, twoFactorTable, twoFactor);
 				return invalid("INVALID_CODE");
 			})
 		}

package/dist/plugins/two-factor/schema.d.mts

@@ -39,6 +39,19 @@ declare const schema: {
         defaultValue: true;
         input: false;
       };
+      failedVerificationCount: {
+        type: "number";
+        required: false;
+        defaultValue: number;
+        input: false;
+        returned: false;
+      };
+      lockedUntil: {
+        type: "date";
+        required: false;
+        input: false;
+        returned: false;
+      };
     };
   };
 };

package/dist/plugins/two-factor/schema.mjs

@@ -33,6 +33,19 @@ const schema = {
 			required: false,
 			defaultValue: true,
 			input: false
+		},
+		failedVerificationCount: {
+			type: "number",
+			required: false,
+			defaultValue: 0,
+			input: false,
+			returned: false
+		},
+		lockedUntil: {
+			type: "date",
+			required: false,
+			input: false,
+			returned: false
 		}
 	} }
 };

package/dist/plugins/two-factor/totp/index.mjs

@@ -4,7 +4,7 @@ import { sessionMiddleware } from "../../../api/routes/session.mjs";
 import { shouldRequirePassword } from "../../../utils/password.mjs";
 import { PACKAGE_VERSION } from "../../../version.mjs";
 import { TWO_FACTOR_ERROR_CODES } from "../error-code.mjs";
-import { verifyTwoFactor } from "../verify-two-factor.mjs";
+import { assertTwoFactorNotLocked, recordTwoFactorFailure, resetTwoFactorFailures, verifyTwoFactor } from "../verify-two-factor.mjs";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { createAuthEndpoint } from "@better-auth/core/api";
 import * as z from "zod";
@@ -122,7 +122,7 @@ const totp2fa = (options) => {
 						code: "TOTP_NOT_CONFIGURED"
 					});
 				}
-				const { session, valid, invalid } = await verifyTwoFactor(ctx);
+				const { session, valid, invalid, beginAttempt } = await verifyTwoFactor(ctx);
 				const user = session.user;
 				const isSignIn = !session.session;
 				const twoFactor = await ctx.context.adapter.findOne({
@@ -134,13 +134,27 @@ const totp2fa = (options) => {
 				});
 				if (!twoFactor) throw APIError.from("BAD_REQUEST", TWO_FACTOR_ERROR_CODES.TOTP_NOT_ENABLED);
 				if (isSignIn && twoFactor.verified === false) throw APIError.from("BAD_REQUEST", TWO_FACTOR_ERROR_CODES.TOTP_NOT_ENABLED);
-				if (!await createOTP(await symmetricDecrypt({
-					key: ctx.context.secretConfig,
-					data: twoFactor.secret
-				}), {
-					period: opts.period,
-					digits: opts.digits
-				}).verify(ctx.body.code)) return invalid("INVALID_CODE");
+				if (isSignIn) await assertTwoFactorNotLocked(ctx, twoFactorTable, twoFactor);
+				const attempt = isSignIn ? await beginAttempt(5) : null;
+				let status;
+				try {
+					status = await createOTP(await symmetricDecrypt({
+						key: ctx.context.secretConfig,
+						data: twoFactor.secret
+					}), {
+						period: opts.period,
+						digits: opts.digits
+					}).verify(ctx.body.code);
+				} catch (error) {
+					await attempt?.restore();
+					throw error;
+				}
+				if (!status) {
+					await attempt?.recordFailure();
+					if (isSignIn) await recordTwoFactorFailure(ctx, twoFactorTable, twoFactor);
+					return invalid("INVALID_CODE");
+				}
+				if (isSignIn) await resetTwoFactorFailures(ctx, twoFactorTable, twoFactor);
 				if (twoFactor.verified !== true) {
 					if (!user.twoFactorEnabled) {
 						const activeSession = session.session;

package/dist/plugins/two-factor/types.d.mts

@@ -63,6 +63,29 @@ interface TwoFactorOptions {
    * @default 2592000 (30 days)
    */
   trustDeviceMaxAge?: number | undefined;
+  /**
+   * Account-level lockout for failed second-factor verifications during
+   * sign-in. Caps consecutive failed attempts per account, across challenges
+   * and factors, and resets on a successful verification.
+   */
+  accountLockout?: {
+    /**
+     * Whether account-level lockout is enforced.
+     * @default true
+     */
+    enabled?: boolean | undefined;
+    /**
+     * Consecutive failed verifications, across challenges and factors,
+     * before the account is locked.
+     * @default 10
+     */
+    maxFailedAttempts?: number | undefined;
+    /**
+     * How long the account stays locked, in seconds.
+     * @default 900 (15 minutes)
+     */
+    durationSeconds?: number | undefined;
+  } | undefined;
 }
 interface UserWithTwoFactor extends User {
   /**
@@ -81,6 +104,8 @@ interface TwoFactorTable {
   secret: string;
   backupCodes: string;
   verified: boolean;
+  failedVerificationCount?: number;
+  lockedUntil?: Date | null;
 }
 //#endregion
 export { TwoFactorOptions, TwoFactorProvider, TwoFactorTable, UserWithTwoFactor };

package/dist/plugins/two-factor/verify-two-factor.mjs

@@ -66,7 +66,28 @@ async function verifyTwoFactor(ctx) {
 				session: null,
 				user
 			},
-			key: signedTwoFactorCookie
+			key: signedTwoFactorCookie,
+			beginAttempt: async (allowedAttempts) => {
+				const identifier = `2fa-attempts-${signedTwoFactorCookie}`;
+				const consumed = await ctx.context.internalAdapter.consumeVerificationValue(identifier).catch(() => null);
+				if (!consumed) throw APIError.from("UNAUTHORIZED", TWO_FACTOR_ERROR_CODES.INVALID_TWO_FACTOR_COOKIE);
+				const parsed = Number(consumed.value);
+				const attempts = Number.isInteger(parsed) && parsed >= 0 ? parsed : allowedAttempts;
+				if (attempts >= allowedAttempts) {
+					await ctx.context.internalAdapter.consumeVerificationValue(signedTwoFactorCookie).catch(() => {});
+					expireCookie(ctx, twoFactorCookie);
+					throw APIError.from("BAD_REQUEST", TWO_FACTOR_ERROR_CODES.TOO_MANY_ATTEMPTS_REQUEST_NEW_CODE);
+				}
+				const rearm = (count) => ctx.context.internalAdapter.createVerificationValue({
+					value: `${count}`,
+					identifier,
+					expiresAt: verificationToken.expiresAt
+				}).catch(() => {});
+				return {
+					recordFailure: () => rearm(attempts + 1),
+					restore: () => rearm(attempts)
+				};
+			}
 		};
 	}
 	return {
@@ -78,8 +99,94 @@ async function verifyTwoFactor(ctx) {
 		},
 		invalid,
 		session,
-		key: `${session.user.id}!${session.session.id}`
+		key: `${session.user.id}!${session.session.id}`,
+		beginAttempt: async (_allowedAttempts) => ({
+			recordFailure: async () => {},
+			restore: async () => {}
+		})
+	};
+}
+function resolveAccountLockoutConfig(ctx) {
+	const lockout = (ctx.context.getPlugin("two-factor")?.options)?.accountLockout;
+	return {
+		enabled: lockout?.enabled ?? true,
+		maxFailedAttempts: lockout?.maxFailedAttempts ?? 10,
+		durationMs: (lockout?.durationSeconds ?? 900) * 1e3
 	};
 }
+/**
+* Reject the verification when the account is locked, and lazily clear an
+* expired lock. The lock caps consecutive failed verifications per account,
+* across challenges and factors (NIST SP 800-63B §5.2.2).
+*/
+async function assertTwoFactorNotLocked(ctx, twoFactorTable, twoFactor) {
+	const { enabled } = resolveAccountLockoutConfig(ctx);
+	if (!enabled || !twoFactor.lockedUntil) return;
+	if (new Date(twoFactor.lockedUntil).getTime() > Date.now()) throw APIError.from("TOO_MANY_REQUESTS", TWO_FACTOR_ERROR_CODES.ACCOUNT_TEMPORARILY_LOCKED);
+	await ctx.context.adapter.incrementOne({
+		model: twoFactorTable,
+		where: [{
+			field: "id",
+			value: twoFactor.id
+		}, {
+			field: "lockedUntil",
+			operator: "lte",
+			value: /* @__PURE__ */ new Date()
+		}],
+		increment: {},
+		set: {
+			failedVerificationCount: 0,
+			lockedUntil: null
+		}
+	});
+}
+/**
+* Count one failed verification toward the account-level budget, and lock the
+* account once the budget is spent. The increment is atomic, so concurrent
+* failures cannot lose updates. It is unguarded so it still applies to a row
+* whose counter is null or absent (a row created before the migration, or a
+* document-store record predating the column), where a guarded comparison
+* would never match.
+*/
+async function recordTwoFactorFailure(ctx, twoFactorTable, twoFactor) {
+	const { enabled, maxFailedAttempts, durationMs } = resolveAccountLockoutConfig(ctx);
+	if (!enabled) return;
+	if (((await ctx.context.adapter.incrementOne({
+		model: twoFactorTable,
+		where: [{
+			field: "id",
+			value: twoFactor.id
+		}],
+		increment: { failedVerificationCount: 1 }
+	}))?.failedVerificationCount ?? 0) >= maxFailedAttempts) await ctx.context.adapter.update({
+		model: twoFactorTable,
+		where: [{
+			field: "id",
+			value: twoFactor.id
+		}],
+		update: { lockedUntil: new Date(Date.now() + durationMs) }
+	});
+}
+/**
+* Clear the account-level failure budget after a successful verification, so the
+* count tracks only consecutive failures. The write is unconditional: a snapshot
+* read at the start of the request can miss a concurrent failure, so skipping it
+* could leave the counter non-zero after a success.
+*/
+async function resetTwoFactorFailures(ctx, twoFactorTable, twoFactor) {
+	const { enabled } = resolveAccountLockoutConfig(ctx);
+	if (!enabled) return;
+	await ctx.context.adapter.update({
+		model: twoFactorTable,
+		where: [{
+			field: "id",
+			value: twoFactor.id
+		}],
+		update: {
+			failedVerificationCount: 0,
+			lockedUntil: null
+		}
+	});
+}
 //#endregion
-export { verifyTwoFactor };
+export { assertTwoFactorNotLocked, recordTwoFactorFailure, resetTwoFactorFailures, verifyTwoFactor };