better-auth 1.6.21 → 1.6.22

package/dist/db/index.d.mts

@@ -3,7 +3,8 @@ import { convertFromDB, convertToDB } from "./field-converter.mjs";
 import { getSchema } from "./get-schema.mjs";
 import { DatabaseHooksEntry, getWithHooks } from "./with-hooks.mjs";
 import { createInternalAdapter } from "./internal-adapter.mjs";
+import { revokeUnprovenAccountAccess } from "./revoke-unproven-account-access.mjs";
 import { buildSyntheticUserOutput, getSessionDefaultFields, mergeSchema, parseAccountInput, parseAccountOutput, parseAdditionalUserInput, parseAdditionalUserInputFromProviderProfile, parseInputData, parseSessionInput, parseSessionOutput, parseUserInput, parseUserOutput } from "./schema.mjs";
 import { FieldAttributeToSchema, toZodSchema } from "./to-zod.mjs";
 export * from "@better-auth/core/db";
-export { DatabaseHooksEntry, FieldAttributeToObject, FieldAttributeToSchema, InferAdditionalFieldsFromPluginOptions, InferFieldsInputClient, InferFieldsOutput, RemoveFieldsWithReturnedFalse, buildSyntheticUserOutput, convertFromDB, convertToDB, createInternalAdapter, getSchema, getSessionDefaultFields, getWithHooks, mergeSchema, parseAccountInput, parseAccountOutput, parseAdditionalUserInput, parseAdditionalUserInputFromProviderProfile, parseInputData, parseSessionInput, parseSessionOutput, parseUserInput, parseUserOutput, toZodSchema };
+export { DatabaseHooksEntry, FieldAttributeToObject, FieldAttributeToSchema, InferAdditionalFieldsFromPluginOptions, InferFieldsInputClient, InferFieldsOutput, RemoveFieldsWithReturnedFalse, buildSyntheticUserOutput, convertFromDB, convertToDB, createInternalAdapter, getSchema, getSessionDefaultFields, getWithHooks, mergeSchema, parseAccountInput, parseAccountOutput, parseAdditionalUserInput, parseAdditionalUserInputFromProviderProfile, parseInputData, parseSessionInput, parseSessionOutput, parseUserInput, parseUserOutput, revokeUnprovenAccountAccess, toZodSchema };

package/dist/db/index.mjs

@@ -4,6 +4,7 @@ import { buildSyntheticUserOutput, getSessionDefaultFields, mergeSchema, parseAc
 import { convertFromDB, convertToDB } from "./field-converter.mjs";
 import { getWithHooks } from "./with-hooks.mjs";
 import { createInternalAdapter } from "./internal-adapter.mjs";
+import { revokeUnprovenAccountAccess } from "./revoke-unproven-account-access.mjs";
 import { toZodSchema } from "./to-zod.mjs";
 export * from "@better-auth/core/db";
 //#region src/db/index.ts
@@ -25,9 +26,10 @@ var db_exports = /* @__PURE__ */ __exportAll({
 	parseSessionOutput: () => parseSessionOutput,
 	parseUserInput: () => parseUserInput,
 	parseUserOutput: () => parseUserOutput,
+	revokeUnprovenAccountAccess: () => revokeUnprovenAccountAccess,
 	toZodSchema: () => toZodSchema
 });
 import * as import__better_auth_core_db from "@better-auth/core/db";
 __reExport(db_exports, import__better_auth_core_db);
 //#endregion
-export { buildSyntheticUserOutput, convertFromDB, convertToDB, createInternalAdapter, db_exports, getSchema, getSessionDefaultFields, getWithHooks, mergeSchema, parseAccountInput, parseAccountOutput, parseAdditionalUserInput, parseAdditionalUserInputFromProviderProfile, parseInputData, parseSessionInput, parseSessionOutput, parseUserInput, parseUserOutput, toZodSchema };
+export { buildSyntheticUserOutput, convertFromDB, convertToDB, createInternalAdapter, db_exports, getSchema, getSessionDefaultFields, getWithHooks, mergeSchema, parseAccountInput, parseAccountOutput, parseAdditionalUserInput, parseAdditionalUserInputFromProviderProfile, parseInputData, parseSessionInput, parseSessionOutput, parseUserInput, parseUserOutput, revokeUnprovenAccountAccess, toZodSchema };

package/dist/db/revoke-unproven-account-access.d.mts

@@ -0,0 +1,19 @@
+import { GenericEndpointContext } from "@better-auth/core";
+
+//#region src/db/revoke-unproven-account-access.d.ts
+/**
+ * Strip every credential and session a pre-existing account accrued before
+ * control of its email was proven.
+ *
+ * An `emailVerified: false` row carries no proof that the password on it belongs
+ * to the mailbox owner. When an email-primary proof (magic link, email OTP)
+ * resolves to such a row, deleting the `credential` account and revoking standing
+ * sessions makes the verified owner inherit no password or session that predates
+ * the proof. Call this before flipping `emailVerified` and minting the owner's
+ * session; it no-ops if a concurrent flow has already verified the account.
+ *
+ * @param userId - The pre-existing, not-yet-verified user being promoted.
+ */
+declare function revokeUnprovenAccountAccess(ctx: GenericEndpointContext, userId: string): Promise<void>;
+//#endregion
+export { revokeUnprovenAccountAccess };

package/dist/db/revoke-unproven-account-access.mjs

@@ -0,0 +1,23 @@
+//#region src/db/revoke-unproven-account-access.ts
+/**
+* Strip every credential and session a pre-existing account accrued before
+* control of its email was proven.
+*
+* An `emailVerified: false` row carries no proof that the password on it belongs
+* to the mailbox owner. When an email-primary proof (magic link, email OTP)
+* resolves to such a row, deleting the `credential` account and revoking standing
+* sessions makes the verified owner inherit no password or session that predates
+* the proof. Call this before flipping `emailVerified` and minting the owner's
+* session; it no-ops if a concurrent flow has already verified the account.
+*
+* @param userId - The pre-existing, not-yet-verified user being promoted.
+*/
+async function revokeUnprovenAccountAccess(ctx, userId) {
+	const user = await ctx.context.internalAdapter.findUserById(userId);
+	if (!user || user.emailVerified) return;
+	const accounts = await ctx.context.internalAdapter.findAccounts(userId);
+	for (const account of accounts) if (account.providerId === "credential") await ctx.context.internalAdapter.deleteAccount(account.id);
+	await ctx.context.internalAdapter.deleteUserSessions(userId);
+}
+//#endregion
+export { revokeUnprovenAccountAccess };

package/dist/package.mjs

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "1.6.21";
+var version = "1.6.22";
 //#endregion
 export { version };

package/dist/plugins/email-otp/routes.mjs

@@ -3,6 +3,7 @@ import { getDate } from "../../utils/date.mjs";
 import { generateRandomString } from "../../crypto/random.mjs";
 import { symmetricDecrypt } from "../../crypto/index.mjs";
 import { setCookieCache, setSessionCookie } from "../../cookies/index.mjs";
+import { revokeUnprovenAccountAccess } from "../../db/revoke-unproven-account-access.mjs";
 import { getSessionFromCtx, sensitiveSessionMiddleware } from "../../api/routes/session.mjs";
 import { APIError as APIError$1 } from "../../api/index.mjs";
 import { EMAIL_OTP_ERROR_CODES } from "./error-codes.mjs";
@@ -420,7 +421,10 @@ const signInEmailOTP = (opts) => createAuthEndpoint("/sign-in/email-otp", {
 			user: parseUserOutput(ctx.context.options, newUser)
 		});
 	}
-	if (!user.user.emailVerified) await ctx.context.internalAdapter.updateUser(user.user.id, { emailVerified: true });
+	if (!user.user.emailVerified) {
+		await revokeUnprovenAccountAccess(ctx, user.user.id);
+		await ctx.context.internalAdapter.updateUser(user.user.id, { emailVerified: true });
+	}
 	const session = await ctx.context.internalAdapter.createSession(user.user.id);
 	await setSessionCookie(ctx, {
 		session,

package/dist/plugins/magic-link/index.mjs

@@ -2,6 +2,7 @@ import { originCheck } from "../../api/middlewares/origin-check.mjs";
 import { parseSessionOutput, parseUserOutput } from "../../db/schema.mjs";
 import { generateRandomString } from "../../crypto/random.mjs";
 import { setSessionCookie } from "../../cookies/index.mjs";
+import { revokeUnprovenAccountAccess } from "../../db/revoke-unproven-account-access.mjs";
 import { PACKAGE_VERSION } from "../../version.mjs";
 import { defaultKeyHasher } from "./utils.mjs";
 import { createAuthEndpoint } from "@better-auth/core/api";
@@ -134,7 +135,10 @@ const magicLink = (options) => {
 					user = newUser;
 					if (!user) redirectWithError("failed_to_create_user");
 				} else redirectWithError("new_user_signup_disabled");
-				if (!user.emailVerified) user = await ctx.context.internalAdapter.updateUser(user.id, { emailVerified: true });
+				if (!user.emailVerified) {
+					await revokeUnprovenAccountAccess(ctx, user.id);
+					user = await ctx.context.internalAdapter.updateUser(user.id, { emailVerified: true });
+				}
 				const session = await ctx.context.internalAdapter.createSession(user.id);
 				if (!session) redirectWithError("failed_to_create_session");
 				await setSessionCookie(ctx, {

package/dist/plugins/two-factor/backup-codes/index.mjs

@@ -5,7 +5,7 @@ import { sessionMiddleware } from "../../../api/routes/session.mjs";
 import { shouldRequirePassword } from "../../../utils/password.mjs";
 import { PACKAGE_VERSION } from "../../../version.mjs";
 import { TWO_FACTOR_ERROR_CODES } from "../error-code.mjs";
-import { verifyTwoFactor } from "../verify-two-factor.mjs";
+import { assertTwoFactorNotLocked, recordTwoFactorFailure, resetTwoFactorFailures, verifyTwoFactor } from "../verify-two-factor.mjs";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { safeJSONParse } from "@better-auth/core/utils/json";
 import { createAuthEndpoint } from "@better-auth/core/api";
@@ -172,6 +172,7 @@ const backupCode2fa = (opts) => {
 					}]
 				});
 				if (!twoFactor) throw APIError.from("BAD_REQUEST", TWO_FACTOR_ERROR_CODES.BACKUP_CODES_NOT_ENABLED);
+				if (isSignIn) await assertTwoFactorNotLocked(ctx, twoFactorTable, twoFactor);
 				const attempt = isSignIn ? await beginAttempt(5) : null;
 				let validate;
 				try {
@@ -185,6 +186,7 @@ const backupCode2fa = (opts) => {
 				}
 				if (!validate.status || !validate.updated) {
 					await attempt?.recordFailure();
+					if (isSignIn) await recordTwoFactorFailure(ctx, twoFactorTable, twoFactor);
 					throw APIError.from("UNAUTHORIZED", TWO_FACTOR_ERROR_CODES.INVALID_BACKUP_CODE);
 				}
 				const updatedBackupCodes = await encodeBackupCodes(validate.updated, ctx.context.secretConfig, opts);
@@ -200,6 +202,7 @@ const backupCode2fa = (opts) => {
 					increment: {},
 					set: { backupCodes: updatedBackupCodes }
 				})) throw APIError.fromStatus("CONFLICT", { message: "Failed to verify backup code. Please try again." });
+				if (isSignIn) await resetTwoFactorFailures(ctx, twoFactorTable, twoFactor);
 				if (!ctx.body.disableSession) return valid(ctx);
 				return ctx.json({
 					token: session.session?.token,

package/dist/plugins/two-factor/client.d.mts

@@ -65,6 +65,7 @@ declare const twoFactorClient: (options?: {
     INVALID_BACKUP_CODE: _better_auth_core_utils_error_codes0.RawError<"INVALID_BACKUP_CODE">;
     INVALID_CODE: _better_auth_core_utils_error_codes0.RawError<"INVALID_CODE">;
     TOO_MANY_ATTEMPTS_REQUEST_NEW_CODE: _better_auth_core_utils_error_codes0.RawError<"TOO_MANY_ATTEMPTS_REQUEST_NEW_CODE">;
+    ACCOUNT_TEMPORARILY_LOCKED: _better_auth_core_utils_error_codes0.RawError<"ACCOUNT_TEMPORARILY_LOCKED">;
     INVALID_TWO_FACTOR_COOKIE: _better_auth_core_utils_error_codes0.RawError<"INVALID_TWO_FACTOR_COOKIE">;
   };
 };

package/dist/plugins/two-factor/error-code.d.mts

@@ -10,6 +10,7 @@ declare const TWO_FACTOR_ERROR_CODES: {
   INVALID_BACKUP_CODE: _better_auth_core_utils_error_codes0.RawError<"INVALID_BACKUP_CODE">;
   INVALID_CODE: _better_auth_core_utils_error_codes0.RawError<"INVALID_CODE">;
   TOO_MANY_ATTEMPTS_REQUEST_NEW_CODE: _better_auth_core_utils_error_codes0.RawError<"TOO_MANY_ATTEMPTS_REQUEST_NEW_CODE">;
+  ACCOUNT_TEMPORARILY_LOCKED: _better_auth_core_utils_error_codes0.RawError<"ACCOUNT_TEMPORARILY_LOCKED">;
   INVALID_TWO_FACTOR_COOKIE: _better_auth_core_utils_error_codes0.RawError<"INVALID_TWO_FACTOR_COOKIE">;
 };
 //#endregion

package/dist/plugins/two-factor/error-code.mjs

@@ -9,6 +9,7 @@ const TWO_FACTOR_ERROR_CODES = defineErrorCodes({
 	INVALID_BACKUP_CODE: "Invalid backup code",
 	INVALID_CODE: "Invalid code",
 	TOO_MANY_ATTEMPTS_REQUEST_NEW_CODE: "Too many attempts. Please request a new code.",
+	ACCOUNT_TEMPORARILY_LOCKED: "Too many failed verification attempts. Your account is temporarily locked. Please try again later.",
 	INVALID_TWO_FACTOR_COOKIE: "Invalid two factor cookie"
 });
 //#endregion

package/dist/plugins/two-factor/index.d.mts

@@ -662,6 +662,19 @@ declare const twoFactor: <O extends TwoFactorOptions>(options?: O) => {
           defaultValue: true;
           input: false;
         };
+        failedVerificationCount: {
+          type: "number";
+          required: false;
+          defaultValue: number;
+          input: false;
+          returned: false;
+        };
+        lockedUntil: {
+          type: "date";
+          required: false;
+          input: false;
+          returned: false;
+        };
       };
     };
   };
@@ -679,6 +692,7 @@ declare const twoFactor: <O extends TwoFactorOptions>(options?: O) => {
     INVALID_BACKUP_CODE: _better_auth_core_utils_error_codes0.RawError<"INVALID_BACKUP_CODE">;
     INVALID_CODE: _better_auth_core_utils_error_codes0.RawError<"INVALID_CODE">;
     TOO_MANY_ATTEMPTS_REQUEST_NEW_CODE: _better_auth_core_utils_error_codes0.RawError<"TOO_MANY_ATTEMPTS_REQUEST_NEW_CODE">;
+    ACCOUNT_TEMPORARILY_LOCKED: _better_auth_core_utils_error_codes0.RawError<"ACCOUNT_TEMPORARILY_LOCKED">;
     INVALID_TWO_FACTOR_COOKIE: _better_auth_core_utils_error_codes0.RawError<"INVALID_TWO_FACTOR_COOKIE">;
   };
 };

package/dist/plugins/two-factor/otp/index.mjs

@@ -5,7 +5,7 @@ import { symmetricDecrypt, symmetricEncrypt } from "../../../crypto/index.mjs";
 import { setSessionCookie } from "../../../cookies/index.mjs";
 import { PACKAGE_VERSION } from "../../../version.mjs";
 import { TWO_FACTOR_ERROR_CODES } from "../error-code.mjs";
-import { verifyTwoFactor } from "../verify-two-factor.mjs";
+import { assertTwoFactorNotLocked, recordTwoFactorFailure, resetTwoFactorFailures, verifyTwoFactor } from "../verify-two-factor.mjs";
 import { defaultKeyHasher } from "../utils.mjs";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { createAuthEndpoint } from "@better-auth/core/api";
@@ -158,6 +158,20 @@ const otp2fa = (options) => {
 				} }
 			}, async (ctx) => {
 				const { session, key, valid, invalid } = await verifyTwoFactor(ctx);
+				const isSignIn = !session.session;
+				const twoFactorTable = "twoFactor";
+				let twoFactor = null;
+				if (isSignIn) {
+					twoFactor = await ctx.context.adapter.findOne({
+						model: twoFactorTable,
+						where: [{
+							field: "userId",
+							value: session.user.id
+						}]
+					});
+					if (!twoFactor) throw APIError.from("BAD_REQUEST", TWO_FACTOR_ERROR_CODES.TWO_FACTOR_NOT_ENABLED);
+					await assertTwoFactorNotLocked(ctx, twoFactorTable, twoFactor);
+				}
 				const consumed = await ctx.context.internalAdapter.consumeVerificationValue(`2fa-otp-${key}`);
 				if (!consumed) throw APIError.from("BAD_REQUEST", TWO_FACTOR_ERROR_CODES.OTP_HAS_EXPIRED);
 				const [otp, counter] = consumed.value?.split(":") ?? [];
@@ -166,6 +180,7 @@ const otp2fa = (options) => {
 				if (attempts >= allowedAttempts) throw APIError.from("BAD_REQUEST", TWO_FACTOR_ERROR_CODES.TOO_MANY_ATTEMPTS_REQUEST_NEW_CODE);
 				const [storedValue, inputValue] = await decryptOrHashForComparison(ctx, otp, ctx.body.code);
 				if (constantTimeEqual(new TextEncoder().encode(storedValue), new TextEncoder().encode(inputValue))) {
+					if (twoFactor) await resetTwoFactorFailures(ctx, twoFactorTable, twoFactor);
 					if (!session.user.twoFactorEnabled) {
 						if (!session.session) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.FAILED_TO_CREATE_SESSION);
 						const updatedUser = await ctx.context.internalAdapter.updateUser(session.user.id, { twoFactorEnabled: true });
@@ -187,6 +202,7 @@ const otp2fa = (options) => {
 					identifier: `2fa-otp-${key}`,
 					expiresAt: consumed.expiresAt
 				});
+				if (twoFactor) await recordTwoFactorFailure(ctx, twoFactorTable, twoFactor);
 				return invalid("INVALID_CODE");
 			})
 		}

package/dist/plugins/two-factor/schema.d.mts

@@ -39,6 +39,19 @@ declare const schema: {
         defaultValue: true;
         input: false;
       };
+      failedVerificationCount: {
+        type: "number";
+        required: false;
+        defaultValue: number;
+        input: false;
+        returned: false;
+      };
+      lockedUntil: {
+        type: "date";
+        required: false;
+        input: false;
+        returned: false;
+      };
     };
   };
 };

package/dist/plugins/two-factor/schema.mjs

@@ -33,6 +33,19 @@ const schema = {
 			required: false,
 			defaultValue: true,
 			input: false
+		},
+		failedVerificationCount: {
+			type: "number",
+			required: false,
+			defaultValue: 0,
+			input: false,
+			returned: false
+		},
+		lockedUntil: {
+			type: "date",
+			required: false,
+			input: false,
+			returned: false
 		}
 	} }
 };

package/dist/plugins/two-factor/totp/index.mjs

@@ -4,7 +4,7 @@ import { sessionMiddleware } from "../../../api/routes/session.mjs";
 import { shouldRequirePassword } from "../../../utils/password.mjs";
 import { PACKAGE_VERSION } from "../../../version.mjs";
 import { TWO_FACTOR_ERROR_CODES } from "../error-code.mjs";
-import { verifyTwoFactor } from "../verify-two-factor.mjs";
+import { assertTwoFactorNotLocked, recordTwoFactorFailure, resetTwoFactorFailures, verifyTwoFactor } from "../verify-two-factor.mjs";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { createAuthEndpoint } from "@better-auth/core/api";
 import * as z from "zod";
@@ -134,6 +134,7 @@ const totp2fa = (options) => {
 				});
 				if (!twoFactor) throw APIError.from("BAD_REQUEST", TWO_FACTOR_ERROR_CODES.TOTP_NOT_ENABLED);
 				if (isSignIn && twoFactor.verified === false) throw APIError.from("BAD_REQUEST", TWO_FACTOR_ERROR_CODES.TOTP_NOT_ENABLED);
+				if (isSignIn) await assertTwoFactorNotLocked(ctx, twoFactorTable, twoFactor);
 				const attempt = isSignIn ? await beginAttempt(5) : null;
 				let status;
 				try {
@@ -150,8 +151,10 @@ const totp2fa = (options) => {
 				}
 				if (!status) {
 					await attempt?.recordFailure();
+					if (isSignIn) await recordTwoFactorFailure(ctx, twoFactorTable, twoFactor);
 					return invalid("INVALID_CODE");
 				}
+				if (isSignIn) await resetTwoFactorFailures(ctx, twoFactorTable, twoFactor);
 				if (twoFactor.verified !== true) {
 					if (!user.twoFactorEnabled) {
 						const activeSession = session.session;

package/dist/plugins/two-factor/types.d.mts

@@ -63,6 +63,29 @@ interface TwoFactorOptions {
    * @default 2592000 (30 days)
    */
   trustDeviceMaxAge?: number | undefined;
+  /**
+   * Account-level lockout for failed second-factor verifications during
+   * sign-in. Caps consecutive failed attempts per account, across challenges
+   * and factors, and resets on a successful verification.
+   */
+  accountLockout?: {
+    /**
+     * Whether account-level lockout is enforced.
+     * @default true
+     */
+    enabled?: boolean | undefined;
+    /**
+     * Consecutive failed verifications, across challenges and factors,
+     * before the account is locked.
+     * @default 10
+     */
+    maxFailedAttempts?: number | undefined;
+    /**
+     * How long the account stays locked, in seconds.
+     * @default 900 (15 minutes)
+     */
+    durationSeconds?: number | undefined;
+  } | undefined;
 }
 interface UserWithTwoFactor extends User {
   /**
@@ -81,6 +104,8 @@ interface TwoFactorTable {
   secret: string;
   backupCodes: string;
   verified: boolean;
+  failedVerificationCount?: number;
+  lockedUntil?: Date | null;
 }
 //#endregion
 export { TwoFactorOptions, TwoFactorProvider, TwoFactorTable, UserWithTwoFactor };

package/dist/plugins/two-factor/verify-two-factor.mjs

@@ -106,5 +106,87 @@ async function verifyTwoFactor(ctx) {
 		})
 	};
 }
+function resolveAccountLockoutConfig(ctx) {
+	const lockout = (ctx.context.getPlugin("two-factor")?.options)?.accountLockout;
+	return {
+		enabled: lockout?.enabled ?? true,
+		maxFailedAttempts: lockout?.maxFailedAttempts ?? 10,
+		durationMs: (lockout?.durationSeconds ?? 900) * 1e3
+	};
+}
+/**
+* Reject the verification when the account is locked, and lazily clear an
+* expired lock. The lock caps consecutive failed verifications per account,
+* across challenges and factors (NIST SP 800-63B §5.2.2).
+*/
+async function assertTwoFactorNotLocked(ctx, twoFactorTable, twoFactor) {
+	const { enabled } = resolveAccountLockoutConfig(ctx);
+	if (!enabled || !twoFactor.lockedUntil) return;
+	if (new Date(twoFactor.lockedUntil).getTime() > Date.now()) throw APIError.from("TOO_MANY_REQUESTS", TWO_FACTOR_ERROR_CODES.ACCOUNT_TEMPORARILY_LOCKED);
+	await ctx.context.adapter.incrementOne({
+		model: twoFactorTable,
+		where: [{
+			field: "id",
+			value: twoFactor.id
+		}, {
+			field: "lockedUntil",
+			operator: "lte",
+			value: /* @__PURE__ */ new Date()
+		}],
+		increment: {},
+		set: {
+			failedVerificationCount: 0,
+			lockedUntil: null
+		}
+	});
+}
+/**
+* Count one failed verification toward the account-level budget, and lock the
+* account once the budget is spent. The increment is atomic, so concurrent
+* failures cannot lose updates. It is unguarded so it still applies to a row
+* whose counter is null or absent (a row created before the migration, or a
+* document-store record predating the column), where a guarded comparison
+* would never match.
+*/
+async function recordTwoFactorFailure(ctx, twoFactorTable, twoFactor) {
+	const { enabled, maxFailedAttempts, durationMs } = resolveAccountLockoutConfig(ctx);
+	if (!enabled) return;
+	if (((await ctx.context.adapter.incrementOne({
+		model: twoFactorTable,
+		where: [{
+			field: "id",
+			value: twoFactor.id
+		}],
+		increment: { failedVerificationCount: 1 }
+	}))?.failedVerificationCount ?? 0) >= maxFailedAttempts) await ctx.context.adapter.update({
+		model: twoFactorTable,
+		where: [{
+			field: "id",
+			value: twoFactor.id
+		}],
+		update: { lockedUntil: new Date(Date.now() + durationMs) }
+	});
+}
+/**
+* Clear the account-level failure budget after a successful verification, so the
+* count tracks only consecutive failures. The write is unconditional: a snapshot
+* read at the start of the request can miss a concurrent failure, so skipping it
+* could leave the counter non-zero after a success.
+*/
+async function resetTwoFactorFailures(ctx, twoFactorTable, twoFactor) {
+	const { enabled } = resolveAccountLockoutConfig(ctx);
+	if (!enabled) return;
+	await ctx.context.adapter.update({
+		model: twoFactorTable,
+		where: [{
+			field: "id",
+			value: twoFactor.id
+		}],
+		update: {
+			failedVerificationCount: 0,
+			lockedUntil: null
+		}
+	});
+}
 //#endregion
-export { verifyTwoFactor };
+export { assertTwoFactorNotLocked, recordTwoFactorFailure, resetTwoFactorFailures, verifyTwoFactor };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "better-auth",
-  "version": "1.6.21",
+  "version": "1.6.22",
   "description": "The most comprehensive authentication framework for TypeScript.",
   "type": "module",
   "license": "MIT",
@@ -489,13 +489,13 @@
     "kysely": "^0.28.17 || ^0.29.0",
     "nanostores": "^1.1.1",
     "zod": "^4.3.6",
-    "@better-auth/core": "1.6.21",
-    "@better-auth/drizzle-adapter": "1.6.21",
-    "@better-auth/kysely-adapter": "1.6.21",
-    "@better-auth/memory-adapter": "1.6.21",
-    "@better-auth/mongo-adapter": "1.6.21",
-    "@better-auth/prisma-adapter": "1.6.21",
-    "@better-auth/telemetry": "1.6.21"
+    "@better-auth/core": "1.6.22",
+    "@better-auth/drizzle-adapter": "1.6.22",
+    "@better-auth/kysely-adapter": "1.6.22",
+    "@better-auth/memory-adapter": "1.6.22",
+    "@better-auth/mongo-adapter": "1.6.22",
+    "@better-auth/prisma-adapter": "1.6.22",
+    "@better-auth/telemetry": "1.6.22"
   },
   "devDependencies": {
     "@lynx-js/react": "^0.116.3",