better-auth 1.6.21 → 1.6.23

package/dist/client/plugins/index.d.mts

@@ -14,6 +14,7 @@ import { MicrosoftEntraIdOptions, microsoftEntraId } from "../../plugins/generic
 import { OktaOptions, okta } from "../../plugins/generic-oauth/providers/okta.mjs";
 import { PatreonOptions, patreon } from "../../plugins/generic-oauth/providers/patreon.mjs";
 import { SlackOptions, slack } from "../../plugins/generic-oauth/providers/slack.mjs";
+import { YandexOptions, yandex } from "../../plugins/generic-oauth/providers/yandex.mjs";
 import { BaseOAuthProviderOptions } from "../../plugins/generic-oauth/index.mjs";
 import { JWKOptions, JWSAlgorithms, Jwk, JwtOptions } from "../../plugins/jwt/types.mjs";
 import { AuthorizationQuery, Client, CodeVerificationValue, OAuthAccessToken, OIDCMetadata, OIDCOptions, TokenBody } from "../../plugins/oidc-provider/types.mjs";
@@ -56,4 +57,4 @@ import { phoneNumberClient } from "../../plugins/phone-number/client.mjs";
 import { siweClient } from "../../plugins/siwe/client.mjs";
 import { usernameClient } from "../../plugins/username/client.mjs";
 import { InferServerPlugin } from "./infer-plugin.mjs";
-export { ADMIN_ERROR_CODES, ANONYMOUS_ERROR_CODES, AdminClientOptions, AdminOptions, AnonymousOptions, AnonymousSession, Auth0Options, AuthorizationQuery, BackupCodeOptions, BaseOAuthProviderOptions, Client, CodeVerificationValue, EMAIL_OTP_ERROR_CODES, ExtractPluginField, type FieldAttributeToObject, GENERIC_OAUTH_ERROR_CODES, GenericOAuthConfig, GenericOAuthOptions, GoogleOneTapActionOptions, GoogleOneTapOptions, GsiButtonConfiguration, GumroadOptions, HasRequiredKeys, HubSpotOptions, InferAdminRolesFromOption, InferInvitation, InferMember, InferOrganization, InferOrganizationRolesFromOption, InferOrganizationZodRolesFromOption, InferPluginFieldFromTuple, InferServerPlugin, InferTeam, Invitation, InvitationInput, InvitationStatus, IsAny, JWKOptions, JWSAlgorithms, Jwk, JwtOptions, KeycloakOptions, LastLoginMethodClientConfig, LineOptions, MULTI_SESSION_ERROR_CODES, Member, MemberInput, MicrosoftEntraIdOptions, MultiSessionConfig, OAUTH_POPUP_ERROR_CODES, OAuthAccessToken, OIDCMetadata, OIDCOptions, ORGANIZATION_ERROR_CODES, OTPOptions, OidcClientPlugin, OktaOptions, OneTimeTokenOptions, Organization, OrganizationClientOptions, OrganizationInput, OrganizationRole, OrganizationSchema, OverrideMerge, PHONE_NUMBER_ERROR_CODES, POPUP_TOKEN_STORAGE_KEY, PatreonOptions, PhoneNumberOptions, Prettify, PrettifyDeep, type RemoveFieldsWithReturnedFalse, RequiredKeysOf, SessionWithImpersonatedBy, SignInPopupOptions, SignInPopupResult, SlackOptions, StripEmptyObjects, TOTPOptions, TWO_FACTOR_ERROR_CODES, Team, TeamInput, TeamMember, TeamMemberInput, TokenBody, TwoFactorOptions, TwoFactorProvider, TwoFactorTable, USERNAME_ERROR_CODES, UnionToIntersection, UserWithAnonymous, UserWithPhoneNumber, UserWithRole, UserWithTwoFactor, adminClient, anonymousClient, auth0, backupCode2fa, clientSideHasPermission, createSignInPopup, customSessionClient, defaultRolesSchema, deviceAuthorizationClient, emailOTPClient, encodeBackupCodes, generateBackupCodes, genericOAuthClient, getBackupCodes, getStoredPopupToken, gumroad, hubspot, inferAdditionalFields, inferOrgAdditionalFields, invitationSchema, invitationStatus, jwtClient, keycloak, lastLoginMethodClient, line, magicLinkClient, memberSchema, microsoftEntraId, multiSessionClient, oauthPopupClient, oidcClient, okta, oneTapClient, oneTimeTokenClient, organizationClient, organizationRoleSchema, organizationSchema, otp2fa, patreon, phoneNumberClient, popupBearerFetchPlugin, roleSchema, schema, siweClient, slack, teamMemberSchema, teamSchema, totp2fa, twoFactorClient, usernameClient, verifyBackupCode };
+export { ADMIN_ERROR_CODES, ANONYMOUS_ERROR_CODES, AdminClientOptions, AdminOptions, AnonymousOptions, AnonymousSession, Auth0Options, AuthorizationQuery, BackupCodeOptions, BaseOAuthProviderOptions, Client, CodeVerificationValue, EMAIL_OTP_ERROR_CODES, ExtractPluginField, type FieldAttributeToObject, GENERIC_OAUTH_ERROR_CODES, GenericOAuthConfig, GenericOAuthOptions, GoogleOneTapActionOptions, GoogleOneTapOptions, GsiButtonConfiguration, GumroadOptions, HasRequiredKeys, HubSpotOptions, InferAdminRolesFromOption, InferInvitation, InferMember, InferOrganization, InferOrganizationRolesFromOption, InferOrganizationZodRolesFromOption, InferPluginFieldFromTuple, InferServerPlugin, InferTeam, Invitation, InvitationInput, InvitationStatus, IsAny, JWKOptions, JWSAlgorithms, Jwk, JwtOptions, KeycloakOptions, LastLoginMethodClientConfig, LineOptions, MULTI_SESSION_ERROR_CODES, Member, MemberInput, MicrosoftEntraIdOptions, MultiSessionConfig, OAUTH_POPUP_ERROR_CODES, OAuthAccessToken, OIDCMetadata, OIDCOptions, ORGANIZATION_ERROR_CODES, OTPOptions, OidcClientPlugin, OktaOptions, OneTimeTokenOptions, Organization, OrganizationClientOptions, OrganizationInput, OrganizationRole, OrganizationSchema, OverrideMerge, PHONE_NUMBER_ERROR_CODES, POPUP_TOKEN_STORAGE_KEY, PatreonOptions, PhoneNumberOptions, Prettify, PrettifyDeep, type RemoveFieldsWithReturnedFalse, RequiredKeysOf, SessionWithImpersonatedBy, SignInPopupOptions, SignInPopupResult, SlackOptions, StripEmptyObjects, TOTPOptions, TWO_FACTOR_ERROR_CODES, Team, TeamInput, TeamMember, TeamMemberInput, TokenBody, TwoFactorOptions, TwoFactorProvider, TwoFactorTable, USERNAME_ERROR_CODES, UnionToIntersection, UserWithAnonymous, UserWithPhoneNumber, UserWithRole, UserWithTwoFactor, YandexOptions, adminClient, anonymousClient, auth0, backupCode2fa, clientSideHasPermission, createSignInPopup, customSessionClient, defaultRolesSchema, deviceAuthorizationClient, emailOTPClient, encodeBackupCodes, generateBackupCodes, genericOAuthClient, getBackupCodes, getStoredPopupToken, gumroad, hubspot, inferAdditionalFields, inferOrgAdditionalFields, invitationSchema, invitationStatus, jwtClient, keycloak, lastLoginMethodClient, line, magicLinkClient, memberSchema, microsoftEntraId, multiSessionClient, oauthPopupClient, oidcClient, okta, oneTapClient, oneTimeTokenClient, organizationClient, organizationRoleSchema, organizationSchema, otp2fa, patreon, phoneNumberClient, popupBearerFetchPlugin, roleSchema, schema, siweClient, slack, teamMemberSchema, teamSchema, totp2fa, twoFactorClient, usernameClient, verifyBackupCode, yandex };

package/dist/db/index.d.mts

@@ -3,7 +3,8 @@ import { convertFromDB, convertToDB } from "./field-converter.mjs";
 import { getSchema } from "./get-schema.mjs";
 import { DatabaseHooksEntry, getWithHooks } from "./with-hooks.mjs";
 import { createInternalAdapter } from "./internal-adapter.mjs";
+import { revokeUnprovenAccountAccess } from "./revoke-unproven-account-access.mjs";
 import { buildSyntheticUserOutput, getSessionDefaultFields, mergeSchema, parseAccountInput, parseAccountOutput, parseAdditionalUserInput, parseAdditionalUserInputFromProviderProfile, parseInputData, parseSessionInput, parseSessionOutput, parseUserInput, parseUserOutput } from "./schema.mjs";
 import { FieldAttributeToSchema, toZodSchema } from "./to-zod.mjs";
 export * from "@better-auth/core/db";
-export { DatabaseHooksEntry, FieldAttributeToObject, FieldAttributeToSchema, InferAdditionalFieldsFromPluginOptions, InferFieldsInputClient, InferFieldsOutput, RemoveFieldsWithReturnedFalse, buildSyntheticUserOutput, convertFromDB, convertToDB, createInternalAdapter, getSchema, getSessionDefaultFields, getWithHooks, mergeSchema, parseAccountInput, parseAccountOutput, parseAdditionalUserInput, parseAdditionalUserInputFromProviderProfile, parseInputData, parseSessionInput, parseSessionOutput, parseUserInput, parseUserOutput, toZodSchema };
+export { DatabaseHooksEntry, FieldAttributeToObject, FieldAttributeToSchema, InferAdditionalFieldsFromPluginOptions, InferFieldsInputClient, InferFieldsOutput, RemoveFieldsWithReturnedFalse, buildSyntheticUserOutput, convertFromDB, convertToDB, createInternalAdapter, getSchema, getSessionDefaultFields, getWithHooks, mergeSchema, parseAccountInput, parseAccountOutput, parseAdditionalUserInput, parseAdditionalUserInputFromProviderProfile, parseInputData, parseSessionInput, parseSessionOutput, parseUserInput, parseUserOutput, revokeUnprovenAccountAccess, toZodSchema };

package/dist/db/index.mjs

@@ -4,6 +4,7 @@ import { buildSyntheticUserOutput, getSessionDefaultFields, mergeSchema, parseAc
 import { convertFromDB, convertToDB } from "./field-converter.mjs";
 import { getWithHooks } from "./with-hooks.mjs";
 import { createInternalAdapter } from "./internal-adapter.mjs";
+import { revokeUnprovenAccountAccess } from "./revoke-unproven-account-access.mjs";
 import { toZodSchema } from "./to-zod.mjs";
 export * from "@better-auth/core/db";
 //#region src/db/index.ts
@@ -25,9 +26,10 @@ var db_exports = /* @__PURE__ */ __exportAll({
 	parseSessionOutput: () => parseSessionOutput,
 	parseUserInput: () => parseUserInput,
 	parseUserOutput: () => parseUserOutput,
+	revokeUnprovenAccountAccess: () => revokeUnprovenAccountAccess,
 	toZodSchema: () => toZodSchema
 });
 import * as import__better_auth_core_db from "@better-auth/core/db";
 __reExport(db_exports, import__better_auth_core_db);
 //#endregion
-export { buildSyntheticUserOutput, convertFromDB, convertToDB, createInternalAdapter, db_exports, getSchema, getSessionDefaultFields, getWithHooks, mergeSchema, parseAccountInput, parseAccountOutput, parseAdditionalUserInput, parseAdditionalUserInputFromProviderProfile, parseInputData, parseSessionInput, parseSessionOutput, parseUserInput, parseUserOutput, toZodSchema };
+export { buildSyntheticUserOutput, convertFromDB, convertToDB, createInternalAdapter, db_exports, getSchema, getSessionDefaultFields, getWithHooks, mergeSchema, parseAccountInput, parseAccountOutput, parseAdditionalUserInput, parseAdditionalUserInputFromProviderProfile, parseInputData, parseSessionInput, parseSessionOutput, parseUserInput, parseUserOutput, revokeUnprovenAccountAccess, toZodSchema };

package/dist/db/revoke-unproven-account-access.d.mts

@@ -0,0 +1,19 @@
+import { GenericEndpointContext } from "@better-auth/core";
+
+//#region src/db/revoke-unproven-account-access.d.ts
+/**
+ * Strip every credential and session a pre-existing account accrued before
+ * control of its email was proven.
+ *
+ * An `emailVerified: false` row carries no proof that the password on it belongs
+ * to the mailbox owner. When an email-primary proof (magic link, email OTP)
+ * resolves to such a row, deleting the `credential` account and revoking standing
+ * sessions makes the verified owner inherit no password or session that predates
+ * the proof. Call this before flipping `emailVerified` and minting the owner's
+ * session; it no-ops if a concurrent flow has already verified the account.
+ *
+ * @param userId - The pre-existing, not-yet-verified user being promoted.
+ */
+declare function revokeUnprovenAccountAccess(ctx: GenericEndpointContext, userId: string): Promise<void>;
+//#endregion
+export { revokeUnprovenAccountAccess };

package/dist/db/revoke-unproven-account-access.mjs

@@ -0,0 +1,23 @@
+//#region src/db/revoke-unproven-account-access.ts
+/**
+* Strip every credential and session a pre-existing account accrued before
+* control of its email was proven.
+*
+* An `emailVerified: false` row carries no proof that the password on it belongs
+* to the mailbox owner. When an email-primary proof (magic link, email OTP)
+* resolves to such a row, deleting the `credential` account and revoking standing
+* sessions makes the verified owner inherit no password or session that predates
+* the proof. Call this before flipping `emailVerified` and minting the owner's
+* session; it no-ops if a concurrent flow has already verified the account.
+*
+* @param userId - The pre-existing, not-yet-verified user being promoted.
+*/
+async function revokeUnprovenAccountAccess(ctx, userId) {
+	const user = await ctx.context.internalAdapter.findUserById(userId);
+	if (!user || user.emailVerified) return;
+	const accounts = await ctx.context.internalAdapter.findAccounts(userId);
+	for (const account of accounts) if (account.providerId === "credential") await ctx.context.internalAdapter.deleteAccount(account.id);
+	await ctx.context.internalAdapter.deleteUserSessions(userId);
+}
+//#endregion
+export { revokeUnprovenAccountAccess };

package/dist/package.mjs

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "1.6.21";
+var version = "1.6.23";
 //#endregion
 export { version };

package/dist/plugins/email-otp/routes.mjs

@@ -3,6 +3,7 @@ import { getDate } from "../../utils/date.mjs";
 import { generateRandomString } from "../../crypto/random.mjs";
 import { symmetricDecrypt } from "../../crypto/index.mjs";
 import { setCookieCache, setSessionCookie } from "../../cookies/index.mjs";
+import { revokeUnprovenAccountAccess } from "../../db/revoke-unproven-account-access.mjs";
 import { getSessionFromCtx, sensitiveSessionMiddleware } from "../../api/routes/session.mjs";
 import { APIError as APIError$1 } from "../../api/index.mjs";
 import { EMAIL_OTP_ERROR_CODES } from "./error-codes.mjs";
@@ -420,7 +421,10 @@ const signInEmailOTP = (opts) => createAuthEndpoint("/sign-in/email-otp", {
 			user: parseUserOutput(ctx.context.options, newUser)
 		});
 	}
-	if (!user.user.emailVerified) await ctx.context.internalAdapter.updateUser(user.user.id, { emailVerified: true });
+	if (!user.user.emailVerified) {
+		await revokeUnprovenAccountAccess(ctx, user.user.id);
+		await ctx.context.internalAdapter.updateUser(user.user.id, { emailVerified: true });
+	}
 	const session = await ctx.context.internalAdapter.createSession(user.user.id);
 	await setSessionCookie(ctx, {
 		session,

package/dist/plugins/generic-oauth/client.d.mts

@@ -8,6 +8,7 @@ import { MicrosoftEntraIdOptions, microsoftEntraId } from "./providers/microsoft
 import { OktaOptions, okta } from "./providers/okta.mjs";
 import { PatreonOptions, patreon } from "./providers/patreon.mjs";
 import { SlackOptions, slack } from "./providers/slack.mjs";
+import { YandexOptions, yandex } from "./providers/yandex.mjs";
 import { BaseOAuthProviderOptions, genericOAuth } from "./index.mjs";
 import { GENERIC_OAUTH_ERROR_CODES } from "./error-codes.mjs";
 import * as _better_auth_core_utils_error_codes0 from "@better-auth/core/utils/error-codes";

package/dist/plugins/generic-oauth/index.d.mts

@@ -8,6 +8,7 @@ import { MicrosoftEntraIdOptions, microsoftEntraId } from "./providers/microsoft
 import { OktaOptions, okta } from "./providers/okta.mjs";
 import { PatreonOptions, patreon } from "./providers/patreon.mjs";
 import { SlackOptions, slack } from "./providers/slack.mjs";
+import { YandexOptions, yandex } from "./providers/yandex.mjs";
 import { AuthContext } from "@better-auth/core";
 import * as _better_auth_core_oauth20 from "@better-auth/core/oauth2";
 import { OAuthProvider } from "@better-auth/core/oauth2";
@@ -197,4 +198,4 @@ declare const genericOAuth: (options: GenericOAuthOptions) => {
   };
 };
 //#endregion
-export { Auth0Options, BaseOAuthProviderOptions, type GenericOAuthConfig, type GenericOAuthOptions, GumroadOptions, HubSpotOptions, KeycloakOptions, LineOptions, MicrosoftEntraIdOptions, OktaOptions, PatreonOptions, SlackOptions, auth0, genericOAuth, gumroad, hubspot, keycloak, line, microsoftEntraId, okta, patreon, slack };
+export { Auth0Options, BaseOAuthProviderOptions, type GenericOAuthConfig, type GenericOAuthOptions, GumroadOptions, HubSpotOptions, KeycloakOptions, LineOptions, MicrosoftEntraIdOptions, OktaOptions, PatreonOptions, SlackOptions, YandexOptions, auth0, genericOAuth, gumroad, hubspot, keycloak, line, microsoftEntraId, okta, patreon, slack, yandex };

package/dist/plugins/generic-oauth/index.mjs

@@ -10,6 +10,7 @@ import { microsoftEntraId } from "./providers/microsoft-entra-id.mjs";
 import { okta } from "./providers/okta.mjs";
 import { patreon } from "./providers/patreon.mjs";
 import { slack } from "./providers/slack.mjs";
+import { yandex } from "./providers/yandex.mjs";
 import { APIError } from "@better-auth/core/error";
 import { applyDefaultAccessTokenExpiry, createAuthorizationURL, refreshAccessToken, validateAuthorizationCode } from "@better-auth/core/oauth2";
 import { betterFetch } from "@better-fetch/fetch";
@@ -145,4 +146,4 @@ const genericOAuth = (options) => {
 	};
 };
 //#endregion
-export { auth0, genericOAuth, gumroad, hubspot, keycloak, line, microsoftEntraId, okta, patreon, slack };
+export { auth0, genericOAuth, gumroad, hubspot, keycloak, line, microsoftEntraId, okta, patreon, slack, yandex };

package/dist/plugins/generic-oauth/providers/index.d.mts

@@ -6,4 +6,5 @@ import { LineOptions, line } from "./line.mjs";
 import { MicrosoftEntraIdOptions, microsoftEntraId } from "./microsoft-entra-id.mjs";
 import { OktaOptions, okta } from "./okta.mjs";
 import { PatreonOptions, patreon } from "./patreon.mjs";
-import { SlackOptions, slack } from "./slack.mjs";
+import { SlackOptions, slack } from "./slack.mjs";
+import { YandexOptions, yandex } from "./yandex.mjs";

package/dist/plugins/generic-oauth/providers/yandex.d.mts

@@ -0,0 +1,29 @@
+import { GenericOAuthConfig } from "../types.mjs";
+import { BaseOAuthProviderOptions } from "../index.mjs";
+
+//#region src/plugins/generic-oauth/providers/yandex.d.ts
+interface YandexOptions extends BaseOAuthProviderOptions {}
+/**
+ * Yandex OAuth provider helper
+ *
+ * @example
+ * ```ts
+ * import { genericOAuth, yandex } from "better-auth/plugins/generic-oauth";
+ *
+ * export const auth = betterAuth({
+ *   plugins: [
+ *     genericOAuth({
+ *       config: [
+ *         yandex({
+ *           clientId: process.env.YANDEX_CLIENT_ID,
+ *           clientSecret: process.env.YANDEX_CLIENT_SECRET,
+ *         }),
+ *       ],
+ *     }),
+ *   ],
+ * });
+ * ```
+ */
+declare function yandex(options: YandexOptions): GenericOAuthConfig;
+//#endregion
+export { YandexOptions, yandex };

package/dist/plugins/generic-oauth/providers/yandex.mjs

@@ -0,0 +1,60 @@
+import { betterFetch } from "@better-fetch/fetch";
+//#region src/plugins/generic-oauth/providers/yandex.ts
+/**
+* Yandex OAuth provider helper
+*
+* @example
+* ```ts
+* import { genericOAuth, yandex } from "better-auth/plugins/generic-oauth";
+*
+* export const auth = betterAuth({
+*   plugins: [
+*     genericOAuth({
+*       config: [
+*         yandex({
+*           clientId: process.env.YANDEX_CLIENT_ID,
+*           clientSecret: process.env.YANDEX_CLIENT_SECRET,
+*         }),
+*       ],
+*     }),
+*   ],
+* });
+* ```
+*/
+function yandex(options) {
+	const defaultScopes = [
+		"login:info",
+		"login:email",
+		"login:avatar"
+	];
+	const getUserInfo = async (tokens) => {
+		const { data: profile, error } = await betterFetch("https://login.yandex.ru/info?format=json", {
+			method: "GET",
+			headers: { Authorization: `OAuth ${tokens.accessToken}` }
+		});
+		if (error || !profile) return null;
+		return {
+			id: profile.id,
+			name: profile.display_name ?? profile.real_name ?? profile.first_name ?? profile.login,
+			email: profile.default_email ?? profile.emails?.[0],
+			emailVerified: false,
+			image: !profile.is_avatar_empty && profile.default_avatar_id ? `https://avatars.yandex.net/get-yapic/${profile.default_avatar_id}/islands-200` : void 0
+		};
+	};
+	return {
+		providerId: "yandex",
+		authorizationUrl: "https://oauth.yandex.com/authorize",
+		tokenUrl: "https://oauth.yandex.com/token",
+		clientId: options.clientId,
+		clientSecret: options.clientSecret,
+		scopes: options.scopes ?? defaultScopes,
+		redirectURI: options.redirectURI,
+		pkce: options.pkce,
+		disableImplicitSignUp: options.disableImplicitSignUp,
+		disableSignUp: options.disableSignUp,
+		overrideUserInfo: options.overrideUserInfo,
+		getUserInfo
+	};
+}
+//#endregion
+export { yandex };

package/dist/plugins/index.d.mts

@@ -27,6 +27,7 @@ import { MicrosoftEntraIdOptions, microsoftEntraId } from "./generic-oauth/provi
 import { OktaOptions, okta } from "./generic-oauth/providers/okta.mjs";
 import { PatreonOptions, patreon } from "./generic-oauth/providers/patreon.mjs";
 import { SlackOptions, slack } from "./generic-oauth/providers/slack.mjs";
+import { YandexOptions, yandex } from "./generic-oauth/providers/yandex.mjs";
 import { BaseOAuthProviderOptions, genericOAuth } from "./generic-oauth/index.mjs";
 import { HaveIBeenPwnedOptions, haveIBeenPwned } from "./haveibeenpwned/index.mjs";
 import { JWKOptions, JWSAlgorithms, Jwk, JwtOptions } from "./jwt/types.mjs";
@@ -66,4 +67,4 @@ import { USERNAME_ERROR_CODES } from "./username/error-codes.mjs";
 import { UsernameOptions, username } from "./username/index.mjs";
 import { hasPermission } from "./organization/has-permission.mjs";
 import { DefaultOrganizationPlugin, DynamicAccessControlEndpoints, OrganizationCreator, OrganizationEndpoints, OrganizationPlugin, TeamEndpoints, organization, parseRoles } from "./organization/organization.mjs";
-export { AccessControl, AdminOptions, AnonymousOptions, AnonymousSession, ArrayElement, Auth0Options, AuthorizationQuery, AuthorizeResponse, BackupCodeOptions, BaseCaptchaOptions, BaseOAuthProviderOptions, BearerOptions, CaptchaFoxOptions, CaptchaOptions, Client, CloudflareTurnstileOptions, CodeVerificationValue, CustomSessionPluginOptions, DefaultOrganizationPlugin, DeviceAuthorizationOptions, DynamicAccessControlEndpoints, MULTI_SESSION_ERROR_CODES as ERROR_CODES, EmailOTPOptions, ExactRoleStatements, FieldSchema, GenericOAuthConfig, GenericOAuthOptions, GoogleRecaptchaOptions, GumroadOptions, HCaptchaOptions, HIDE_METADATA, HaveIBeenPwnedOptions, HubSpotOptions, InferAdminRolesFromOption, InferInvitation, InferMember, InferOptionSchema, InferOrganization, InferOrganizationRolesFromOption, InferOrganizationZodRolesFromOption, InferPluginContext, InferPluginErrorCodes, InferPluginIDs, InferTeam, Invitation, InvitationInput, InvitationStatus, JWKOptions, JWSAlgorithms, Jwk, JwtOptions, KeycloakOptions, LastLoginMethodOptions, LineOptions, LoginResult, MagicLinkOptions, Member, MemberInput, MicrosoftEntraIdOptions, MultiSessionConfig, OAUTH_POPUP_COMPLETE_SCRIPT, OAUTH_POPUP_DATA_ELEMENT_ID, OAUTH_POPUP_ERROR_CODES, OAUTH_POPUP_MESSAGE_TYPE, OAUTH_POPUP_SCRIPT_CSP_HASH, OAuthAccessToken, OAuthPopupData, OAuthPopupMessage, OAuthProxyOptions, OIDCMetadata, OIDCOptions, OTPOptions, OktaOptions, OneTapOptions, OneTimeTokenOptions, OpenAPIModelSchema, OpenAPIOptions, OpenAPIParameter, OpenAPISchema, Organization, OrganizationCreator, OrganizationEndpoints, OrganizationInput, OrganizationOptions, OrganizationPlugin, OrganizationRole, OrganizationSchema, POPUP_MARKER_COOKIE, Path, PatreonOptions, PhoneNumberOptions, Provider, Role, RoleAuthorizeRequest, RoleInput, RoleStatements, SIWEPluginOptions, SessionWithImpersonatedBy, SlackOptions, Statements, SubArray, Subset, TOTPOptions, TWO_FACTOR_ERROR_CODES, Team, TeamEndpoints, TeamInput, TeamMember, TeamMemberInput, TestCookie, TestHelpers, TestUtilsOptions, TimeString, TokenBody, TwoFactorOptions, TwoFactorProvider, TwoFactorTable, USERNAME_ERROR_CODES, UserWithAnonymous, UserWithPhoneNumber, UserWithRole, UserWithTwoFactor, UsernameOptions, admin, anonymous, auth0, backupCode2fa, bearer, captcha, createAccessControl, createJwk, customSession, defaultRolesSchema, deviceAuthorization, deviceAuthorizationOptionsSchema, emailOTP, encodeBackupCodes, generateBackupCodes, generateExportedKeyPair, generator, genericOAuth, getBackupCodes, getClient, getJwtToken, getMCPProtectedResourceMetadata, getMCPProviderMetadata, getMetadata, getOrgAdapter, gumroad, hasPermission, haveIBeenPwned, hubspot, invitationSchema, invitationStatus, jwt, keycloak, lastLoginMethod, line, magicLink, mcp, memberSchema, microsoftEntraId, ms, multiSession, oAuthDiscoveryMetadata, oAuthProtectedResourceMetadata, oAuthProxy, oauthPopup, oidcProvider, okta, oneTap, oneTimeToken, openAPI, organization, organizationRoleSchema, organizationSchema, otp2fa, parseRoles, patreon, phoneNumber, role, roleSchema, sec, signJWT, siwe, slack, teamMemberSchema, teamSchema, testUtils, toExpJWT, totp2fa, twoFactor, twoFactorClient, username, verifyBackupCode, verifyJWT, withMcpAuth };
+export { AccessControl, AdminOptions, AnonymousOptions, AnonymousSession, ArrayElement, Auth0Options, AuthorizationQuery, AuthorizeResponse, BackupCodeOptions, BaseCaptchaOptions, BaseOAuthProviderOptions, BearerOptions, CaptchaFoxOptions, CaptchaOptions, Client, CloudflareTurnstileOptions, CodeVerificationValue, CustomSessionPluginOptions, DefaultOrganizationPlugin, DeviceAuthorizationOptions, DynamicAccessControlEndpoints, MULTI_SESSION_ERROR_CODES as ERROR_CODES, EmailOTPOptions, ExactRoleStatements, FieldSchema, GenericOAuthConfig, GenericOAuthOptions, GoogleRecaptchaOptions, GumroadOptions, HCaptchaOptions, HIDE_METADATA, HaveIBeenPwnedOptions, HubSpotOptions, InferAdminRolesFromOption, InferInvitation, InferMember, InferOptionSchema, InferOrganization, InferOrganizationRolesFromOption, InferOrganizationZodRolesFromOption, InferPluginContext, InferPluginErrorCodes, InferPluginIDs, InferTeam, Invitation, InvitationInput, InvitationStatus, JWKOptions, JWSAlgorithms, Jwk, JwtOptions, KeycloakOptions, LastLoginMethodOptions, LineOptions, LoginResult, MagicLinkOptions, Member, MemberInput, MicrosoftEntraIdOptions, MultiSessionConfig, OAUTH_POPUP_COMPLETE_SCRIPT, OAUTH_POPUP_DATA_ELEMENT_ID, OAUTH_POPUP_ERROR_CODES, OAUTH_POPUP_MESSAGE_TYPE, OAUTH_POPUP_SCRIPT_CSP_HASH, OAuthAccessToken, OAuthPopupData, OAuthPopupMessage, OAuthProxyOptions, OIDCMetadata, OIDCOptions, OTPOptions, OktaOptions, OneTapOptions, OneTimeTokenOptions, OpenAPIModelSchema, OpenAPIOptions, OpenAPIParameter, OpenAPISchema, Organization, OrganizationCreator, OrganizationEndpoints, OrganizationInput, OrganizationOptions, OrganizationPlugin, OrganizationRole, OrganizationSchema, POPUP_MARKER_COOKIE, Path, PatreonOptions, PhoneNumberOptions, Provider, Role, RoleAuthorizeRequest, RoleInput, RoleStatements, SIWEPluginOptions, SessionWithImpersonatedBy, SlackOptions, Statements, SubArray, Subset, TOTPOptions, TWO_FACTOR_ERROR_CODES, Team, TeamEndpoints, TeamInput, TeamMember, TeamMemberInput, TestCookie, TestHelpers, TestUtilsOptions, TimeString, TokenBody, TwoFactorOptions, TwoFactorProvider, TwoFactorTable, USERNAME_ERROR_CODES, UserWithAnonymous, UserWithPhoneNumber, UserWithRole, UserWithTwoFactor, UsernameOptions, YandexOptions, admin, anonymous, auth0, backupCode2fa, bearer, captcha, createAccessControl, createJwk, customSession, defaultRolesSchema, deviceAuthorization, deviceAuthorizationOptionsSchema, emailOTP, encodeBackupCodes, generateBackupCodes, generateExportedKeyPair, generator, genericOAuth, getBackupCodes, getClient, getJwtToken, getMCPProtectedResourceMetadata, getMCPProviderMetadata, getMetadata, getOrgAdapter, gumroad, hasPermission, haveIBeenPwned, hubspot, invitationSchema, invitationStatus, jwt, keycloak, lastLoginMethod, line, magicLink, mcp, memberSchema, microsoftEntraId, ms, multiSession, oAuthDiscoveryMetadata, oAuthProtectedResourceMetadata, oAuthProxy, oauthPopup, oidcProvider, okta, oneTap, oneTimeToken, openAPI, organization, organizationRoleSchema, organizationSchema, otp2fa, parseRoles, patreon, phoneNumber, role, roleSchema, sec, signJWT, siwe, slack, teamMemberSchema, teamSchema, testUtils, toExpJWT, totp2fa, twoFactor, twoFactorClient, username, verifyBackupCode, verifyJWT, withMcpAuth, yandex };

package/dist/plugins/index.mjs

@@ -22,6 +22,7 @@ import { microsoftEntraId } from "./generic-oauth/providers/microsoft-entra-id.m
 import { okta } from "./generic-oauth/providers/okta.mjs";
 import { patreon } from "./generic-oauth/providers/patreon.mjs";
 import { slack } from "./generic-oauth/providers/slack.mjs";
+import { yandex } from "./generic-oauth/providers/yandex.mjs";
 import { genericOAuth } from "./generic-oauth/index.mjs";
 import { haveIBeenPwned } from "./haveibeenpwned/index.mjs";
 import { createJwk, generateExportedKeyPair, toExpJWT } from "./jwt/utils.mjs";
@@ -46,4 +47,4 @@ import { siwe } from "./siwe/index.mjs";
 import { testUtils } from "./test-utils/index.mjs";
 import { twoFactor } from "./two-factor/index.mjs";
 import { username } from "./username/index.mjs";
-export { MULTI_SESSION_ERROR_CODES as ERROR_CODES, HIDE_METADATA, OAUTH_POPUP_COMPLETE_SCRIPT, OAUTH_POPUP_DATA_ELEMENT_ID, OAUTH_POPUP_ERROR_CODES, OAUTH_POPUP_MESSAGE_TYPE, OAUTH_POPUP_SCRIPT_CSP_HASH, POPUP_MARKER_COOKIE, TWO_FACTOR_ERROR_CODES, USERNAME_ERROR_CODES, admin, anonymous, auth0, bearer, captcha, createAccessControl, createJwk, customSession, deviceAuthorization, deviceAuthorizationOptionsSchema, emailOTP, generateExportedKeyPair, genericOAuth, getClient, getJwtToken, getMCPProtectedResourceMetadata, getMCPProviderMetadata, getMetadata, getOrgAdapter, gumroad, hasPermission, haveIBeenPwned, hubspot, jwt, keycloak, lastLoginMethod, line, magicLink, mcp, microsoftEntraId, multiSession, oAuthDiscoveryMetadata, oAuthProtectedResourceMetadata, oAuthProxy, oauthPopup, oidcProvider, okta, oneTap, oneTimeToken, openAPI, organization, parseRoles, patreon, phoneNumber, role, signJWT, siwe, slack, testUtils, toExpJWT, twoFactor, twoFactorClient, username, verifyJWT, withMcpAuth };
+export { MULTI_SESSION_ERROR_CODES as ERROR_CODES, HIDE_METADATA, OAUTH_POPUP_COMPLETE_SCRIPT, OAUTH_POPUP_DATA_ELEMENT_ID, OAUTH_POPUP_ERROR_CODES, OAUTH_POPUP_MESSAGE_TYPE, OAUTH_POPUP_SCRIPT_CSP_HASH, POPUP_MARKER_COOKIE, TWO_FACTOR_ERROR_CODES, USERNAME_ERROR_CODES, admin, anonymous, auth0, bearer, captcha, createAccessControl, createJwk, customSession, deviceAuthorization, deviceAuthorizationOptionsSchema, emailOTP, generateExportedKeyPair, genericOAuth, getClient, getJwtToken, getMCPProtectedResourceMetadata, getMCPProviderMetadata, getMetadata, getOrgAdapter, gumroad, hasPermission, haveIBeenPwned, hubspot, jwt, keycloak, lastLoginMethod, line, magicLink, mcp, microsoftEntraId, multiSession, oAuthDiscoveryMetadata, oAuthProtectedResourceMetadata, oAuthProxy, oauthPopup, oidcProvider, okta, oneTap, oneTimeToken, openAPI, organization, parseRoles, patreon, phoneNumber, role, signJWT, siwe, slack, testUtils, toExpJWT, twoFactor, twoFactorClient, username, verifyJWT, withMcpAuth, yandex };

package/dist/plugins/magic-link/index.mjs

@@ -2,6 +2,7 @@ import { originCheck } from "../../api/middlewares/origin-check.mjs";
 import { parseSessionOutput, parseUserOutput } from "../../db/schema.mjs";
 import { generateRandomString } from "../../crypto/random.mjs";
 import { setSessionCookie } from "../../cookies/index.mjs";
+import { revokeUnprovenAccountAccess } from "../../db/revoke-unproven-account-access.mjs";
 import { PACKAGE_VERSION } from "../../version.mjs";
 import { defaultKeyHasher } from "./utils.mjs";
 import { createAuthEndpoint } from "@better-auth/core/api";
@@ -134,7 +135,10 @@ const magicLink = (options) => {
 					user = newUser;
 					if (!user) redirectWithError("failed_to_create_user");
 				} else redirectWithError("new_user_signup_disabled");
-				if (!user.emailVerified) user = await ctx.context.internalAdapter.updateUser(user.id, { emailVerified: true });
+				if (!user.emailVerified) {
+					await revokeUnprovenAccountAccess(ctx, user.id);
+					user = await ctx.context.internalAdapter.updateUser(user.id, { emailVerified: true });
+				}
 				const session = await ctx.context.internalAdapter.createSession(user.id);
 				if (!session) redirectWithError("failed_to_create_session");
 				await setSessionCookie(ctx, {

package/dist/plugins/two-factor/backup-codes/index.mjs

@@ -5,7 +5,7 @@ import { sessionMiddleware } from "../../../api/routes/session.mjs";
 import { shouldRequirePassword } from "../../../utils/password.mjs";
 import { PACKAGE_VERSION } from "../../../version.mjs";
 import { TWO_FACTOR_ERROR_CODES } from "../error-code.mjs";
-import { verifyTwoFactor } from "../verify-two-factor.mjs";
+import { assertTwoFactorNotLocked, recordTwoFactorFailure, resetTwoFactorFailures, verifyTwoFactor } from "../verify-two-factor.mjs";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { safeJSONParse } from "@better-auth/core/utils/json";
 import { createAuthEndpoint } from "@better-auth/core/api";
@@ -172,6 +172,7 @@ const backupCode2fa = (opts) => {
 					}]
 				});
 				if (!twoFactor) throw APIError.from("BAD_REQUEST", TWO_FACTOR_ERROR_CODES.BACKUP_CODES_NOT_ENABLED);
+				if (isSignIn) await assertTwoFactorNotLocked(ctx, twoFactorTable, twoFactor);
 				const attempt = isSignIn ? await beginAttempt(5) : null;
 				let validate;
 				try {
@@ -185,6 +186,7 @@ const backupCode2fa = (opts) => {
 				}
 				if (!validate.status || !validate.updated) {
 					await attempt?.recordFailure();
+					if (isSignIn) await recordTwoFactorFailure(ctx, twoFactorTable, twoFactor);
 					throw APIError.from("UNAUTHORIZED", TWO_FACTOR_ERROR_CODES.INVALID_BACKUP_CODE);
 				}
 				const updatedBackupCodes = await encodeBackupCodes(validate.updated, ctx.context.secretConfig, opts);
@@ -200,6 +202,7 @@ const backupCode2fa = (opts) => {
 					increment: {},
 					set: { backupCodes: updatedBackupCodes }
 				})) throw APIError.fromStatus("CONFLICT", { message: "Failed to verify backup code. Please try again." });
+				if (isSignIn) await resetTwoFactorFailures(ctx, twoFactorTable, twoFactor);
 				if (!ctx.body.disableSession) return valid(ctx);
 				return ctx.json({
 					token: session.session?.token,

package/dist/plugins/two-factor/client.d.mts

@@ -65,6 +65,7 @@ declare const twoFactorClient: (options?: {
     INVALID_BACKUP_CODE: _better_auth_core_utils_error_codes0.RawError<"INVALID_BACKUP_CODE">;
     INVALID_CODE: _better_auth_core_utils_error_codes0.RawError<"INVALID_CODE">;
     TOO_MANY_ATTEMPTS_REQUEST_NEW_CODE: _better_auth_core_utils_error_codes0.RawError<"TOO_MANY_ATTEMPTS_REQUEST_NEW_CODE">;
+    ACCOUNT_TEMPORARILY_LOCKED: _better_auth_core_utils_error_codes0.RawError<"ACCOUNT_TEMPORARILY_LOCKED">;
     INVALID_TWO_FACTOR_COOKIE: _better_auth_core_utils_error_codes0.RawError<"INVALID_TWO_FACTOR_COOKIE">;
   };
 };

package/dist/plugins/two-factor/error-code.d.mts

@@ -10,6 +10,7 @@ declare const TWO_FACTOR_ERROR_CODES: {
   INVALID_BACKUP_CODE: _better_auth_core_utils_error_codes0.RawError<"INVALID_BACKUP_CODE">;
   INVALID_CODE: _better_auth_core_utils_error_codes0.RawError<"INVALID_CODE">;
   TOO_MANY_ATTEMPTS_REQUEST_NEW_CODE: _better_auth_core_utils_error_codes0.RawError<"TOO_MANY_ATTEMPTS_REQUEST_NEW_CODE">;
+  ACCOUNT_TEMPORARILY_LOCKED: _better_auth_core_utils_error_codes0.RawError<"ACCOUNT_TEMPORARILY_LOCKED">;
   INVALID_TWO_FACTOR_COOKIE: _better_auth_core_utils_error_codes0.RawError<"INVALID_TWO_FACTOR_COOKIE">;
 };
 //#endregion

package/dist/plugins/two-factor/error-code.mjs

@@ -9,6 +9,7 @@ const TWO_FACTOR_ERROR_CODES = defineErrorCodes({
 	INVALID_BACKUP_CODE: "Invalid backup code",
 	INVALID_CODE: "Invalid code",
 	TOO_MANY_ATTEMPTS_REQUEST_NEW_CODE: "Too many attempts. Please request a new code.",
+	ACCOUNT_TEMPORARILY_LOCKED: "Too many failed verification attempts. Your account is temporarily locked. Please try again later.",
 	INVALID_TWO_FACTOR_COOKIE: "Invalid two factor cookie"
 });
 //#endregion

package/dist/plugins/two-factor/index.d.mts

@@ -662,6 +662,19 @@ declare const twoFactor: <O extends TwoFactorOptions>(options?: O) => {
           defaultValue: true;
           input: false;
         };
+        failedVerificationCount: {
+          type: "number";
+          required: false;
+          defaultValue: number;
+          input: false;
+          returned: false;
+        };
+        lockedUntil: {
+          type: "date";
+          required: false;
+          input: false;
+          returned: false;
+        };
       };
     };
   };
@@ -679,6 +692,7 @@ declare const twoFactor: <O extends TwoFactorOptions>(options?: O) => {
     INVALID_BACKUP_CODE: _better_auth_core_utils_error_codes0.RawError<"INVALID_BACKUP_CODE">;
     INVALID_CODE: _better_auth_core_utils_error_codes0.RawError<"INVALID_CODE">;
     TOO_MANY_ATTEMPTS_REQUEST_NEW_CODE: _better_auth_core_utils_error_codes0.RawError<"TOO_MANY_ATTEMPTS_REQUEST_NEW_CODE">;
+    ACCOUNT_TEMPORARILY_LOCKED: _better_auth_core_utils_error_codes0.RawError<"ACCOUNT_TEMPORARILY_LOCKED">;
     INVALID_TWO_FACTOR_COOKIE: _better_auth_core_utils_error_codes0.RawError<"INVALID_TWO_FACTOR_COOKIE">;
   };
 };

package/dist/plugins/two-factor/otp/index.mjs

@@ -5,7 +5,7 @@ import { symmetricDecrypt, symmetricEncrypt } from "../../../crypto/index.mjs";
 import { setSessionCookie } from "../../../cookies/index.mjs";
 import { PACKAGE_VERSION } from "../../../version.mjs";
 import { TWO_FACTOR_ERROR_CODES } from "../error-code.mjs";
-import { verifyTwoFactor } from "../verify-two-factor.mjs";
+import { assertTwoFactorNotLocked, recordTwoFactorFailure, resetTwoFactorFailures, verifyTwoFactor } from "../verify-two-factor.mjs";
 import { defaultKeyHasher } from "../utils.mjs";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { createAuthEndpoint } from "@better-auth/core/api";
@@ -158,6 +158,20 @@ const otp2fa = (options) => {
 				} }
 			}, async (ctx) => {
 				const { session, key, valid, invalid } = await verifyTwoFactor(ctx);
+				const isSignIn = !session.session;
+				const twoFactorTable = "twoFactor";
+				let twoFactor = null;
+				if (isSignIn) {
+					twoFactor = await ctx.context.adapter.findOne({
+						model: twoFactorTable,
+						where: [{
+							field: "userId",
+							value: session.user.id
+						}]
+					});
+					if (!twoFactor) throw APIError.from("BAD_REQUEST", TWO_FACTOR_ERROR_CODES.TWO_FACTOR_NOT_ENABLED);
+					await assertTwoFactorNotLocked(ctx, twoFactorTable, twoFactor);
+				}
 				const consumed = await ctx.context.internalAdapter.consumeVerificationValue(`2fa-otp-${key}`);
 				if (!consumed) throw APIError.from("BAD_REQUEST", TWO_FACTOR_ERROR_CODES.OTP_HAS_EXPIRED);
 				const [otp, counter] = consumed.value?.split(":") ?? [];
@@ -166,6 +180,7 @@ const otp2fa = (options) => {
 				if (attempts >= allowedAttempts) throw APIError.from("BAD_REQUEST", TWO_FACTOR_ERROR_CODES.TOO_MANY_ATTEMPTS_REQUEST_NEW_CODE);
 				const [storedValue, inputValue] = await decryptOrHashForComparison(ctx, otp, ctx.body.code);
 				if (constantTimeEqual(new TextEncoder().encode(storedValue), new TextEncoder().encode(inputValue))) {
+					if (twoFactor) await resetTwoFactorFailures(ctx, twoFactorTable, twoFactor);
 					if (!session.user.twoFactorEnabled) {
 						if (!session.session) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.FAILED_TO_CREATE_SESSION);
 						const updatedUser = await ctx.context.internalAdapter.updateUser(session.user.id, { twoFactorEnabled: true });
@@ -187,6 +202,7 @@ const otp2fa = (options) => {
 					identifier: `2fa-otp-${key}`,
 					expiresAt: consumed.expiresAt
 				});
+				if (twoFactor) await recordTwoFactorFailure(ctx, twoFactorTable, twoFactor);
 				return invalid("INVALID_CODE");
 			})
 		}

package/dist/plugins/two-factor/schema.d.mts

@@ -39,6 +39,19 @@ declare const schema: {
         defaultValue: true;
         input: false;
       };
+      failedVerificationCount: {
+        type: "number";
+        required: false;
+        defaultValue: number;
+        input: false;
+        returned: false;
+      };
+      lockedUntil: {
+        type: "date";
+        required: false;
+        input: false;
+        returned: false;
+      };
     };
   };
 };

package/dist/plugins/two-factor/schema.mjs

@@ -33,6 +33,19 @@ const schema = {
 			required: false,
 			defaultValue: true,
 			input: false
+		},
+		failedVerificationCount: {
+			type: "number",
+			required: false,
+			defaultValue: 0,
+			input: false,
+			returned: false
+		},
+		lockedUntil: {
+			type: "date",
+			required: false,
+			input: false,
+			returned: false
 		}
 	} }
 };

package/dist/plugins/two-factor/totp/index.mjs

@@ -4,7 +4,7 @@ import { sessionMiddleware } from "../../../api/routes/session.mjs";
 import { shouldRequirePassword } from "../../../utils/password.mjs";
 import { PACKAGE_VERSION } from "../../../version.mjs";
 import { TWO_FACTOR_ERROR_CODES } from "../error-code.mjs";
-import { verifyTwoFactor } from "../verify-two-factor.mjs";
+import { assertTwoFactorNotLocked, recordTwoFactorFailure, resetTwoFactorFailures, verifyTwoFactor } from "../verify-two-factor.mjs";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { createAuthEndpoint } from "@better-auth/core/api";
 import * as z from "zod";
@@ -134,6 +134,7 @@ const totp2fa = (options) => {
 				});
 				if (!twoFactor) throw APIError.from("BAD_REQUEST", TWO_FACTOR_ERROR_CODES.TOTP_NOT_ENABLED);
 				if (isSignIn && twoFactor.verified === false) throw APIError.from("BAD_REQUEST", TWO_FACTOR_ERROR_CODES.TOTP_NOT_ENABLED);
+				if (isSignIn) await assertTwoFactorNotLocked(ctx, twoFactorTable, twoFactor);
 				const attempt = isSignIn ? await beginAttempt(5) : null;
 				let status;
 				try {
@@ -150,8 +151,10 @@ const totp2fa = (options) => {
 				}
 				if (!status) {
 					await attempt?.recordFailure();
+					if (isSignIn) await recordTwoFactorFailure(ctx, twoFactorTable, twoFactor);
 					return invalid("INVALID_CODE");
 				}
+				if (isSignIn) await resetTwoFactorFailures(ctx, twoFactorTable, twoFactor);
 				if (twoFactor.verified !== true) {
 					if (!user.twoFactorEnabled) {
 						const activeSession = session.session;

package/dist/plugins/two-factor/types.d.mts

@@ -63,6 +63,29 @@ interface TwoFactorOptions {
    * @default 2592000 (30 days)
    */
   trustDeviceMaxAge?: number | undefined;
+  /**
+   * Account-level lockout for failed second-factor verifications during
+   * sign-in. Caps consecutive failed attempts per account, across challenges
+   * and factors, and resets on a successful verification.
+   */
+  accountLockout?: {
+    /**
+     * Whether account-level lockout is enforced.
+     * @default true
+     */
+    enabled?: boolean | undefined;
+    /**
+     * Consecutive failed verifications, across challenges and factors,
+     * before the account is locked.
+     * @default 10
+     */
+    maxFailedAttempts?: number | undefined;
+    /**
+     * How long the account stays locked, in seconds.
+     * @default 900 (15 minutes)
+     */
+    durationSeconds?: number | undefined;
+  } | undefined;
 }
 interface UserWithTwoFactor extends User {
   /**
@@ -81,6 +104,8 @@ interface TwoFactorTable {
   secret: string;
   backupCodes: string;
   verified: boolean;
+  failedVerificationCount?: number;
+  lockedUntil?: Date | null;
 }
 //#endregion
 export { TwoFactorOptions, TwoFactorProvider, TwoFactorTable, UserWithTwoFactor };

package/dist/plugins/two-factor/verify-two-factor.mjs

@@ -106,5 +106,87 @@ async function verifyTwoFactor(ctx) {
 		})
 	};
 }
+function resolveAccountLockoutConfig(ctx) {
+	const lockout = (ctx.context.getPlugin("two-factor")?.options)?.accountLockout;
+	return {
+		enabled: lockout?.enabled ?? true,
+		maxFailedAttempts: lockout?.maxFailedAttempts ?? 10,
+		durationMs: (lockout?.durationSeconds ?? 900) * 1e3
+	};
+}
+/**
+* Reject the verification when the account is locked, and lazily clear an
+* expired lock. The lock caps consecutive failed verifications per account,
+* across challenges and factors (NIST SP 800-63B §5.2.2).
+*/
+async function assertTwoFactorNotLocked(ctx, twoFactorTable, twoFactor) {
+	const { enabled } = resolveAccountLockoutConfig(ctx);
+	if (!enabled || !twoFactor.lockedUntil) return;
+	if (new Date(twoFactor.lockedUntil).getTime() > Date.now()) throw APIError.from("TOO_MANY_REQUESTS", TWO_FACTOR_ERROR_CODES.ACCOUNT_TEMPORARILY_LOCKED);
+	await ctx.context.adapter.incrementOne({
+		model: twoFactorTable,
+		where: [{
+			field: "id",
+			value: twoFactor.id
+		}, {
+			field: "lockedUntil",
+			operator: "lte",
+			value: /* @__PURE__ */ new Date()
+		}],
+		increment: {},
+		set: {
+			failedVerificationCount: 0,
+			lockedUntil: null
+		}
+	});
+}
+/**
+* Count one failed verification toward the account-level budget, and lock the
+* account once the budget is spent. The increment is atomic, so concurrent
+* failures cannot lose updates. It is unguarded so it still applies to a row
+* whose counter is null or absent (a row created before the migration, or a
+* document-store record predating the column), where a guarded comparison
+* would never match.
+*/
+async function recordTwoFactorFailure(ctx, twoFactorTable, twoFactor) {
+	const { enabled, maxFailedAttempts, durationMs } = resolveAccountLockoutConfig(ctx);
+	if (!enabled) return;
+	if (((await ctx.context.adapter.incrementOne({
+		model: twoFactorTable,
+		where: [{
+			field: "id",
+			value: twoFactor.id
+		}],
+		increment: { failedVerificationCount: 1 }
+	}))?.failedVerificationCount ?? 0) >= maxFailedAttempts) await ctx.context.adapter.update({
+		model: twoFactorTable,
+		where: [{
+			field: "id",
+			value: twoFactor.id
+		}],
+		update: { lockedUntil: new Date(Date.now() + durationMs) }
+	});
+}
+/**
+* Clear the account-level failure budget after a successful verification, so the
+* count tracks only consecutive failures. The write is unconditional: a snapshot
+* read at the start of the request can miss a concurrent failure, so skipping it
+* could leave the counter non-zero after a success.
+*/
+async function resetTwoFactorFailures(ctx, twoFactorTable, twoFactor) {
+	const { enabled } = resolveAccountLockoutConfig(ctx);
+	if (!enabled) return;
+	await ctx.context.adapter.update({
+		model: twoFactorTable,
+		where: [{
+			field: "id",
+			value: twoFactor.id
+		}],
+		update: {
+			failedVerificationCount: 0,
+			lockedUntil: null
+		}
+	});
+}
 //#endregion
-export { verifyTwoFactor };
+export { assertTwoFactorNotLocked, recordTwoFactorFailure, resetTwoFactorFailures, verifyTwoFactor };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "better-auth",
-  "version": "1.6.21",
+  "version": "1.6.23",
   "description": "The most comprehensive authentication framework for TypeScript.",
   "type": "module",
   "license": "MIT",
@@ -489,13 +489,13 @@
     "kysely": "^0.28.17 || ^0.29.0",
     "nanostores": "^1.1.1",
     "zod": "^4.3.6",
-    "@better-auth/core": "1.6.21",
-    "@better-auth/drizzle-adapter": "1.6.21",
-    "@better-auth/kysely-adapter": "1.6.21",
-    "@better-auth/memory-adapter": "1.6.21",
-    "@better-auth/mongo-adapter": "1.6.21",
-    "@better-auth/prisma-adapter": "1.6.21",
-    "@better-auth/telemetry": "1.6.21"
+    "@better-auth/core": "1.6.23",
+    "@better-auth/drizzle-adapter": "1.6.23",
+    "@better-auth/kysely-adapter": "1.6.23",
+    "@better-auth/memory-adapter": "1.6.23",
+    "@better-auth/mongo-adapter": "1.6.23",
+    "@better-auth/prisma-adapter": "1.6.23",
+    "@better-auth/telemetry": "1.6.23"
   },
   "devDependencies": {
     "@lynx-js/react": "^0.116.3",