better-auth 1.7.12 → 1.7.14

package/dist/plugins/two-factor/otp/index.mjs

@@ -57,6 +57,163 @@ const otp2fa = (options) => {
 		if (typeof opts.storeOTP === "object" && "hash" in opts.storeOTP) return [storedOtp, await opts.storeOTP.hash(userInput)];
 		return [storedOtp, userInput];
 	}
+	/**
+	* Generate OTP and send it to the user.
+	*/
+	const send2FaOTP = createAuthEndpoint("/two-factor/send-otp", {
+		method: "POST",
+		body: send2FaOTPBodySchema,
+		metadata: { openapi: {
+			summary: "Send two factor OTP",
+			description: "Send two factor OTP to the user",
+			responses: { 200: {
+				description: "Successful response",
+				content: { "application/json": { schema: {
+					type: "object",
+					properties: { status: { type: "boolean" } }
+				} } }
+			} }
+		} }
+	}, async (ctx) => {
+		if (!options || !options.sendOTP) {
+			ctx.context.logger.error("send otp isn't configured. Please configure the send otp function on otp options.");
+			throw APIError.from("BAD_REQUEST", {
+				message: "otp isn't configured",
+				code: "OTP_NOT_CONFIGURED"
+			});
+		}
+		const { session, key } = await verifyTwoFactor(ctx);
+		const code = generateRandomString(opts.digits, "0-9");
+		const hashedCode = await storeOTP(ctx, code);
+		await ctx.context.internalAdapter.createVerificationValue({
+			value: `${hashedCode}:0`,
+			identifier: `2fa-otp-${key}`,
+			expiresAt: new Date(Date.now() + opts.period)
+		});
+		const sendOTPResult = options.sendOTP({
+			user: session.user,
+			otp: code
+		}, ctx);
+		if (sendOTPResult instanceof Promise) await ctx.context.runInBackgroundOrAwait(sendOTPResult.catch((e) => {
+			ctx.context.logger.error("Failed to send two-factor OTP", e);
+		}));
+		return ctx.json({ status: true });
+	});
+	const verifyOTP = createAuthEndpoint("/two-factor/verify-otp", {
+		method: "POST",
+		body: verifyOTPBodySchema,
+		metadata: { openapi: {
+			summary: "Verify two factor OTP",
+			description: "Verify two factor OTP",
+			responses: { "200": {
+				description: "Two-factor OTP verified successfully",
+				content: { "application/json": { schema: {
+					type: "object",
+					properties: {
+						token: {
+							type: "string",
+							description: "Session token for the authenticated session"
+						},
+						user: {
+							type: "object",
+							properties: {
+								id: {
+									type: "string",
+									description: "Unique identifier of the user"
+								},
+								email: {
+									type: "string",
+									format: "email",
+									nullable: true,
+									description: "User's email address"
+								},
+								emailVerified: {
+									type: "boolean",
+									nullable: true,
+									description: "Whether the email is verified"
+								},
+								name: {
+									type: "string",
+									nullable: true,
+									description: "User's name"
+								},
+								image: {
+									type: "string",
+									format: "uri",
+									nullable: true,
+									description: "User's profile image URL"
+								},
+								createdAt: {
+									type: "string",
+									format: "date-time",
+									description: "Timestamp when the user was created"
+								},
+								updatedAt: {
+									type: "string",
+									format: "date-time",
+									description: "Timestamp when the user was last updated"
+								}
+							},
+							required: [
+								"id",
+								"createdAt",
+								"updatedAt"
+							],
+							description: "The authenticated user object"
+						}
+					},
+					required: ["token", "user"]
+				} } }
+			} }
+		} }
+	}, async (ctx) => {
+		const { session, key, valid, invalid } = await verifyTwoFactor(ctx);
+		const isSignIn = !session.session;
+		const twoFactorTable = "twoFactor";
+		let twoFactor = null;
+		if (isSignIn) {
+			twoFactor = await ctx.context.adapter.findOne({
+				model: twoFactorTable,
+				where: [{
+					field: "userId",
+					value: session.user.id
+				}]
+			});
+			if (twoFactor) await assertTwoFactorNotLocked(ctx, twoFactorTable, twoFactor);
+		}
+		const consumed = await ctx.context.internalAdapter.consumeVerificationValue(`2fa-otp-${key}`);
+		if (!consumed) throw APIError.from("BAD_REQUEST", TWO_FACTOR_ERROR_CODES.OTP_HAS_EXPIRED);
+		const [otp, counter] = consumed.value?.split(":") ?? [];
+		const allowedAttempts = options?.allowedAttempts || 5;
+		const attempts = parseInt(counter, 10) || 0;
+		if (attempts >= allowedAttempts) throw APIError.from("BAD_REQUEST", TWO_FACTOR_ERROR_CODES.TOO_MANY_ATTEMPTS_REQUEST_NEW_CODE);
+		const [storedValue, inputValue] = await decryptOrHashForComparison(ctx, otp, ctx.body.code);
+		if (constantTimeEqual(new TextEncoder().encode(storedValue), new TextEncoder().encode(inputValue))) {
+			if (twoFactor) await resetTwoFactorFailures(ctx, twoFactorTable, twoFactor);
+			if (!session.user.twoFactorEnabled) {
+				if (!session.session) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.FAILED_TO_CREATE_SESSION);
+				const updatedUser = await ctx.context.internalAdapter.updateUser(session.user.id, { twoFactorEnabled: true });
+				const newSession = await ctx.context.internalAdapter.createSession(session.user.id, false, session.session);
+				await setSessionCookie(ctx, {
+					session: newSession,
+					user: updatedUser
+				});
+				await ctx.context.internalAdapter.deleteSession(session.session.token);
+				return ctx.json({
+					token: newSession.token,
+					user: parseUserOutput(ctx.context.options, updatedUser)
+				});
+			}
+			return valid(ctx);
+		}
+		await ctx.context.internalAdapter.createVerificationValue({
+			value: `${otp}:${attempts + 1}`,
+			identifier: `2fa-otp-${key}`,
+			expiresAt: consumed.expiresAt
+		});
+		if (twoFactor) await recordTwoFactorFailure(ctx, twoFactorTable, twoFactor);
+		return invalid("INVALID_CODE");
+	});
 	return {
 		id: "otp",
 		version: PACKAGE_VERSION,
@@ -76,45 +233,7 @@ const otp2fa = (options) => {
 			*
 			* @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/2fa#api-method-two-factor-send-otp)
 			*/
-			sendTwoFactorOTP: createAuthEndpoint("/two-factor/send-otp", {
-				method: "POST",
-				body: send2FaOTPBodySchema,
-				metadata: { openapi: {
-					summary: "Send two factor OTP",
-					description: "Send two factor OTP to the user",
-					responses: { 200: {
-						description: "Successful response",
-						content: { "application/json": { schema: {
-							type: "object",
-							properties: { status: { type: "boolean" } }
-						} } }
-					} }
-				} }
-			}, async (ctx) => {
-				if (!options || !options.sendOTP) {
-					ctx.context.logger.error("send otp isn't configured. Please configure the send otp function on otp options.");
-					throw APIError.from("BAD_REQUEST", {
-						message: "otp isn't configured",
-						code: "OTP_NOT_CONFIGURED"
-					});
-				}
-				const { session, key } = await verifyTwoFactor(ctx);
-				const code = generateRandomString(opts.digits, "0-9");
-				const hashedCode = await storeOTP(ctx, code);
-				await ctx.context.internalAdapter.createVerificationValue({
-					value: `${hashedCode}:0`,
-					identifier: `2fa-otp-${key}`,
-					expiresAt: new Date(Date.now() + opts.period)
-				});
-				const sendOTPResult = options.sendOTP({
-					user: session.user,
-					otp: code
-				}, ctx);
-				if (sendOTPResult instanceof Promise) await ctx.context.runInBackgroundOrAwait(sendOTPResult.catch((e) => {
-					ctx.context.logger.error("Failed to send two-factor OTP", e);
-				}));
-				return ctx.json({ status: true });
-			}),
+			sendTwoFactorOTP: send2FaOTP,
 			/**
 			* ### Endpoint
 			*
@@ -130,121 +249,7 @@ const otp2fa = (options) => {
 			*
 			* @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/2fa#api-method-two-factor-verify-otp)
 			*/
-			verifyTwoFactorOTP: createAuthEndpoint("/two-factor/verify-otp", {
-				method: "POST",
-				body: verifyOTPBodySchema,
-				metadata: { openapi: {
-					summary: "Verify two factor OTP",
-					description: "Verify two factor OTP",
-					responses: { "200": {
-						description: "Two-factor OTP verified successfully",
-						content: { "application/json": { schema: {
-							type: "object",
-							properties: {
-								token: {
-									type: "string",
-									description: "Session token for the authenticated session"
-								},
-								user: {
-									type: "object",
-									properties: {
-										id: {
-											type: "string",
-											description: "Unique identifier of the user"
-										},
-										email: {
-											type: "string",
-											format: "email",
-											nullable: true,
-											description: "User's email address"
-										},
-										emailVerified: {
-											type: "boolean",
-											nullable: true,
-											description: "Whether the email is verified"
-										},
-										name: {
-											type: "string",
-											nullable: true,
-											description: "User's name"
-										},
-										image: {
-											type: "string",
-											format: "uri",
-											nullable: true,
-											description: "User's profile image URL"
-										},
-										createdAt: {
-											type: "string",
-											format: "date-time",
-											description: "Timestamp when the user was created"
-										},
-										updatedAt: {
-											type: "string",
-											format: "date-time",
-											description: "Timestamp when the user was last updated"
-										}
-									},
-									required: [
-										"id",
-										"createdAt",
-										"updatedAt"
-									],
-									description: "The authenticated user object"
-								}
-							},
-							required: ["token", "user"]
-						} } }
-					} }
-				} }
-			}, async (ctx) => {
-				const { session, key, valid, invalid } = await verifyTwoFactor(ctx);
-				const isSignIn = !session.session;
-				const twoFactorTable = "twoFactor";
-				let twoFactor = null;
-				if (isSignIn) {
-					twoFactor = await ctx.context.adapter.findOne({
-						model: twoFactorTable,
-						where: [{
-							field: "userId",
-							value: session.user.id
-						}]
-					});
-					if (twoFactor) await assertTwoFactorNotLocked(ctx, twoFactorTable, twoFactor);
-				}
-				const consumed = await ctx.context.internalAdapter.consumeVerificationValue(`2fa-otp-${key}`);
-				if (!consumed) throw APIError.from("BAD_REQUEST", TWO_FACTOR_ERROR_CODES.OTP_HAS_EXPIRED);
-				const [otp, counter] = consumed.value?.split(":") ?? [];
-				const allowedAttempts = options?.allowedAttempts || 5;
-				const attempts = parseInt(counter, 10) || 0;
-				if (attempts >= allowedAttempts) throw APIError.from("BAD_REQUEST", TWO_FACTOR_ERROR_CODES.TOO_MANY_ATTEMPTS_REQUEST_NEW_CODE);
-				const [storedValue, inputValue] = await decryptOrHashForComparison(ctx, otp, ctx.body.code);
-				if (constantTimeEqual(new TextEncoder().encode(storedValue), new TextEncoder().encode(inputValue))) {
-					if (twoFactor) await resetTwoFactorFailures(ctx, twoFactorTable, twoFactor);
-					if (!session.user.twoFactorEnabled) {
-						if (!session.session) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.FAILED_TO_CREATE_SESSION);
-						const updatedUser = await ctx.context.internalAdapter.updateUser(session.user.id, { twoFactorEnabled: true });
-						const newSession = await ctx.context.internalAdapter.createSession(session.user.id, false, session.session);
-						await setSessionCookie(ctx, {
-							session: newSession,
-							user: updatedUser
-						});
-						await ctx.context.internalAdapter.deleteSession(session.session.token);
-						return ctx.json({
-							token: newSession.token,
-							user: parseUserOutput(ctx.context.options, updatedUser)
-						});
-					}
-					return valid(ctx);
-				}
-				await ctx.context.internalAdapter.createVerificationValue({
-					value: `${otp}:${attempts + 1}`,
-					identifier: `2fa-otp-${key}`,
-					expiresAt: consumed.expiresAt
-				});
-				if (twoFactor) await recordTwoFactorFailure(ctx, twoFactorTable, twoFactor);
-				return invalid("INVALID_CODE");
-			})
+			verifyTwoFactorOTP: verifyOTP
 		}
 	};
 };

package/dist/plugins/two-factor/schema.d.mts

@@ -1,5 +1,5 @@
 //#region src/plugins/two-factor/schema.d.ts
-declare const schema: {
+export declare const schema: {
   user: {
     fields: {
       twoFactorEnabled: {
@@ -55,5 +55,4 @@ declare const schema: {
     };
   };
 };
-//#endregion
-export { schema };
+//#endregion

package/dist/plugins/two-factor/totp/index.d.mts

@@ -1,10 +1,8 @@
 import { BackupCodeOptions } from "../backup-codes/index.mjs";
 import { UserWithTwoFactor } from "../types.mjs";
-import * as _$better_call0 from "better-call";
 import * as z from "zod";
-
 //#region src/plugins/two-factor/totp/index.d.ts
-type TOTPOptions = {
+export type TOTPOptions = {
   /**
    * Issuer
    */
@@ -36,7 +34,7 @@ type TOTPOptions = {
    */
   disable?: boolean | undefined;
 };
-declare const totp2fa: (options?: TOTPOptions | undefined) => {
+export declare const totp2fa: (options?: TOTPOptions | undefined) => {
   id: "totp";
   version: string;
   endpoints: {
@@ -52,7 +50,7 @@ declare const totp2fa: (options?: TOTPOptions | undefined) => {
      *
      * @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/2fa#totp)
      */
-    generateTOTP: _$better_call0.StrictEndpoint<string, {
+    generateTOTP: import("better-call").StrictEndpoint<string, {
       method: "POST";
       body: z.ZodObject<{
         secret: z.ZodString;
@@ -98,9 +96,9 @@ declare const totp2fa: (options?: TOTPOptions | undefined) => {
      *
      * @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/2fa#getting-totp-uri)
      */
-    getTOTPURI: _$better_call0.StrictEndpoint<"/two-factor/get-totp-uri", {
+    getTOTPURI: import("better-call").StrictEndpoint<"/two-factor/get-totp-uri", {
       method: "POST";
-      use: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<{
+      use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
         session: {
           session: Record<string, any> & {
             id: string;
@@ -169,7 +167,7 @@ declare const totp2fa: (options?: TOTPOptions | undefined) => {
      *
      * @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/2fa#verifying-totp)
      */
-    verifyTOTP: _$better_call0.StrictEndpoint<"/two-factor/verify-totp", {
+    verifyTOTP: import("better-call").StrictEndpoint<"/two-factor/verify-totp", {
       method: "POST";
       body: z.ZodObject<{
         code: z.ZodString;
@@ -215,5 +213,4 @@ declare const totp2fa: (options?: TOTPOptions | undefined) => {
     }>;
   };
 };
-//#endregion
-export { TOTPOptions, totp2fa };
+//#endregion