better-auth 1.7.15 → 1.7.16

package/dist/oauth2/link-account.mjs

@@ -1,8 +1,12 @@
 import { isAPIError } from "../utils/is-api-error.mjs";
 import { parseAdditionalUserInputFromProviderProfile } from "../db/schema.mjs";
+import { symmetricDecrypt } from "../crypto/index.mjs";
 import { setAccountCookie } from "../cookies/session-store.mjs";
 import { assertValidUserInfo } from "../utils/validate-user-info.mjs";
+import { derivePurposeKey } from "../crypto/purpose.mjs";
 import { OAUTH_CALLBACK_ERROR_CODES, redirectOnError } from "./errors.mjs";
+import { isStateful } from "../api/routes/session.mjs";
+import { toBoolean } from "../utils/boolean.mjs";
 import { setTokenUtil } from "./utils.mjs";
 import { createEmailVerificationToken } from "../api/routes/email-verification.mjs";
 import { queueAfterTransactionHook, runWithTransaction } from "@better-auth/core/context";
@@ -19,7 +23,29 @@ function linkOAuthAccountFailure(code, message) {
 		}
 	};
 }
-async function linkOAuthAccount(c, { link, userInfo, account, profile, scopes }) {
+/**
+* Whether the session that started a link is still live when the provider
+* returns. Links whose state carries no session token (started before the
+* token was recorded, or built by a direct caller) are not checked.
+*/
+async function isLinkSessionLive(c, link) {
+	if (!link.encryptedSessionToken || !isStateful(c)) return true;
+	const sessionToken = await symmetricDecrypt({
+		key: derivePurposeKey(c.context.secretConfig, "oauth-link-session-token"),
+		data: link.encryptedSessionToken
+	}).catch(() => null);
+	if (!sessionToken) return false;
+	const source = await c.context.internalAdapter.findSession(sessionToken);
+	if (!source) return false;
+	return source.session.userId === link.userId && source.session.expiresAt > /* @__PURE__ */ new Date();
+}
+async function linkOAuthAccount(c, opts) {
+	const { link, account, profile, scopes } = opts;
+	const userInfo = {
+		...opts.userInfo,
+		emailVerified: toBoolean(opts.userInfo.emailVerified)
+	};
+	if (!await isLinkSessionLive(c, link)) return linkOAuthAccountFailure(OAUTH_CALLBACK_ERROR_CODES.UNABLE_TO_LINK_ACCOUNT);
 	try {
 		await assertValidUserInfo(c, {
 			user: {
@@ -70,7 +96,11 @@ async function linkOAuthAccount(c, { link, userInfo, account, profile, scopes })
 	return { linked: true };
 }
 async function handleOAuthUserInfo(c, opts) {
-	const { userInfo, account, callbackURL, disableSignUp, overrideUserInfo } = opts;
+	const { account, callbackURL, disableSignUp, overrideUserInfo } = opts;
+	const userInfo = {
+		...opts.userInfo,
+		emailVerified: toBoolean(opts.userInfo.emailVerified)
+	};
 	const source = opts.source ?? {
 		method: "oauth",
 		oauth: { providerId: account.providerId }
@@ -350,7 +380,7 @@ async function dispatchVerificationEmail(c, user, callbackURL, deferUntilAfterTr
 	if (!sendVerificationEmail) return;
 	const send = async () => {
 		try {
-			const token = await createEmailVerificationToken(c.context.secret, user.email, void 0, c.context.options.emailVerification?.expiresIn);
+			const token = await createEmailVerificationToken(c.context.secret, user.email, void 0, c.context.options.emailVerification?.expiresIn, { userId: user.id });
 			const url = `${c.context.baseURL}/verify-email?token=${token}&callbackURL=${encodeURIComponent(callbackURL || "/")}`;
 			await c.context.runInBackgroundOrAwait(sendVerificationEmail({
 				user,

package/dist/oauth2/state.d.mts

@@ -1,3 +1,4 @@
+import { StateData } from "../state.mjs";
 import { GenericEndpointContext } from "@better-auth/core";
 //#region src/oauth2/state.d.ts
 /**
@@ -15,11 +16,10 @@ export declare function generateIdTokenNonce(provider: {
  * by name instead of by position.
  */
 export interface GenerateStateOptions {
-  /** Link target when this flow links a provider identity to an existing user. */
-  link?: {
-    email: string;
-    userId: string;
-  } | undefined;
+  /**
+   * Link target when this flow links a provider identity to an existing user.
+   */
+  link?: StateData["link"];
   /** Extra data to round-trip through state; `false` writes none. */
   additionalData?: Record<string, any> | false | undefined;
   /** The `state` nonce already used to build the authorization URL. Minted when omitted. */
@@ -44,6 +44,7 @@ export declare function parseState(c: GenericEndpointContext): Promise<{
   link?: {
     email: string;
     userId: string;
+    encryptedSessionToken?: string | undefined;
   } | undefined;
   requestSignUp?: boolean | undefined;
   idTokenNonce?: string | undefined;

package/dist/package.mjs

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "1.7.15";
+var version = "1.7.16";
 //#endregion
 export { version };

package/dist/plugins/admin/access/statement.d.mts

@@ -2,49 +2,49 @@ import { ExactRoleStatements, Role, RoleInput, Statements } from "../../access/t
 import "../../index.mjs";
 //#region src/plugins/admin/access/statement.d.ts
 export declare const defaultStatements: {
-  readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
+  readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "set-phone", "get", "update"];
   readonly session: readonly ["list", "revoke", "delete"];
 };
 export declare const defaultAc: {
   newRole<const TRoleStatements extends Statements>(statements: RoleInput<{
-    readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
+    readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "set-phone", "get", "update"];
     readonly session: readonly ["list", "revoke", "delete"];
   }, TRoleStatements>): Role<ExactRoleStatements<TRoleStatements>, {
-    readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
+    readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "set-phone", "get", "update"];
     readonly session: readonly ["list", "revoke", "delete"];
   }>;
   statements: {
-    readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
+    readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "set-phone", "get", "update"];
     readonly session: readonly ["list", "revoke", "delete"];
   };
 };
 export declare const adminAc: Role<ExactRoleStatements<{
-  readonly user: ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "set-email", "get", "update"];
+  readonly user: ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "set-email", "set-phone", "get", "update"];
   readonly session: ["list", "revoke", "delete"];
 }>, {
-  readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
+  readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "set-phone", "get", "update"];
   readonly session: readonly ["list", "revoke", "delete"];
 }>;
 export declare const userAc: Role<ExactRoleStatements<{
   readonly user: [];
   readonly session: [];
 }>, {
-  readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
+  readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "set-phone", "get", "update"];
   readonly session: readonly ["list", "revoke", "delete"];
 }>;
 export declare const defaultRoles: {
   admin: Role<ExactRoleStatements<{
-    readonly user: ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "set-email", "get", "update"];
+    readonly user: ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "set-email", "set-phone", "get", "update"];
     readonly session: ["list", "revoke", "delete"];
   }>, {
-    readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
+    readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "set-phone", "get", "update"];
     readonly session: readonly ["list", "revoke", "delete"];
   }>;
   user: Role<ExactRoleStatements<{
     readonly user: [];
     readonly session: [];
   }>, {
-    readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
+    readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "set-phone", "get", "update"];
     readonly session: readonly ["list", "revoke", "delete"];
   }>;
 };

package/dist/plugins/admin/access/statement.mjs

@@ -11,6 +11,7 @@ const defaultStatements = {
 		"delete",
 		"set-password",
 		"set-email",
+		"set-phone",
 		"get",
 		"update"
 	],
@@ -31,6 +32,7 @@ const adminAc = defaultAc.newRole({
 		"delete",
 		"set-password",
 		"set-email",
+		"set-phone",
 		"get",
 		"update"
 	],

package/dist/plugins/admin/admin.d.mts

@@ -819,13 +819,13 @@ export declare const admin: <O extends AdminOptions>(options?: O | undefined) =>
         $Infer: {
           body: {
             permissions: { [key in keyof (O["ac"] extends AccessControl<infer S extends Statements> ? S : {
-              readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
+              readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "set-phone", "get", "update"];
               readonly session: readonly ["list", "revoke", "delete"];
             })]?: ((O["ac"] extends AccessControl<infer S extends Statements> ? S : {
-              readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
+              readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "set-phone", "get", "update"];
               readonly session: readonly ["list", "revoke", "delete"];
             })[key] extends readonly unknown[] ? ArrayElement<(O["ac"] extends AccessControl<infer S extends Statements> ? S : {
-              readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
+              readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "set-phone", "get", "update"];
               readonly session: readonly ["list", "revoke", "delete"];
             })[key]> : never)[] | undefined; };
           } & {
@@ -862,6 +862,7 @@ export declare const admin: <O extends AdminOptions>(options?: O | undefined) =>
     YOU_CANNOT_IMPERSONATE_ADMINS: import("@better-auth/core/utils/error-codes").RawError<"YOU_CANNOT_IMPERSONATE_ADMINS">;
     INVALID_ROLE_TYPE: import("@better-auth/core/utils/error-codes").RawError<"INVALID_ROLE_TYPE">;
     YOU_ARE_NOT_ALLOWED_TO_SET_USERS_EMAIL: import("@better-auth/core/utils/error-codes").RawError<"YOU_ARE_NOT_ALLOWED_TO_SET_USERS_EMAIL">;
+    YOU_ARE_NOT_ALLOWED_TO_SET_USERS_PHONE_NUMBER: import("@better-auth/core/utils/error-codes").RawError<"YOU_ARE_NOT_ALLOWED_TO_SET_USERS_PHONE_NUMBER">;
     PASSWORD_CANNOT_BE_UPDATED_VIA_UPDATE_USER: import("@better-auth/core/utils/error-codes").RawError<"PASSWORD_CANNOT_BE_UPDATED_VIA_UPDATE_USER">;
     USER_ID_CANNOT_BE_UPDATED: import("@better-auth/core/utils/error-codes").RawError<"USER_ID_CANNOT_BE_UPDATED">;
   };

package/dist/plugins/admin/client.d.mts

@@ -14,7 +14,7 @@ export declare const adminClient: <O extends AdminClientOptions>(options?: O | u
   version: string;
   $InferServerPlugin: ReturnType<typeof admin<{
     ac: O["ac"] extends AccessControl ? O["ac"] : AccessControl<{
-      readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
+      readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "set-phone", "get", "update"];
       readonly session: readonly ["list", "revoke", "delete"];
     }>;
     roles: O["roles"] extends Record<string, Role> ? O["roles"] : {
@@ -28,13 +28,13 @@ export declare const adminClient: <O extends AdminClientOptions>(options?: O | u
         roles: any;
       } ? keyof O["roles"] : "admin" | "user">(data: {
         permissions: { [key in keyof (O["ac"] extends AccessControl<infer S extends Statements> ? S : {
-          readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
+          readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "set-phone", "get", "update"];
           readonly session: readonly ["list", "revoke", "delete"];
         })]?: ((O["ac"] extends AccessControl<infer S extends Statements> ? S : {
-          readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
+          readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "set-phone", "get", "update"];
           readonly session: readonly ["list", "revoke", "delete"];
         })[key] extends readonly unknown[] ? ArrayElement<(O["ac"] extends AccessControl<infer S extends Statements> ? S : {
-          readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
+          readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "set-phone", "get", "update"];
           readonly session: readonly ["list", "revoke", "delete"];
         })[key]> : never)[] | undefined; };
       } & {
@@ -74,6 +74,7 @@ export declare const adminClient: <O extends AdminClientOptions>(options?: O | u
     YOU_CANNOT_IMPERSONATE_ADMINS: import("@better-auth/core/utils/error-codes").RawError<"YOU_CANNOT_IMPERSONATE_ADMINS">;
     INVALID_ROLE_TYPE: import("@better-auth/core/utils/error-codes").RawError<"INVALID_ROLE_TYPE">;
     YOU_ARE_NOT_ALLOWED_TO_SET_USERS_EMAIL: import("@better-auth/core/utils/error-codes").RawError<"YOU_ARE_NOT_ALLOWED_TO_SET_USERS_EMAIL">;
+    YOU_ARE_NOT_ALLOWED_TO_SET_USERS_PHONE_NUMBER: import("@better-auth/core/utils/error-codes").RawError<"YOU_ARE_NOT_ALLOWED_TO_SET_USERS_PHONE_NUMBER">;
     PASSWORD_CANNOT_BE_UPDATED_VIA_UPDATE_USER: import("@better-auth/core/utils/error-codes").RawError<"PASSWORD_CANNOT_BE_UPDATED_VIA_UPDATE_USER">;
     USER_ID_CANNOT_BE_UPDATED: import("@better-auth/core/utils/error-codes").RawError<"USER_ID_CANNOT_BE_UPDATED">;
   };

package/dist/plugins/admin/error-codes.d.mts

@@ -22,6 +22,7 @@ export declare const ADMIN_ERROR_CODES: {
   YOU_CANNOT_IMPERSONATE_ADMINS: import("@better-auth/core/utils/error-codes").RawError<"YOU_CANNOT_IMPERSONATE_ADMINS">;
   INVALID_ROLE_TYPE: import("@better-auth/core/utils/error-codes").RawError<"INVALID_ROLE_TYPE">;
   YOU_ARE_NOT_ALLOWED_TO_SET_USERS_EMAIL: import("@better-auth/core/utils/error-codes").RawError<"YOU_ARE_NOT_ALLOWED_TO_SET_USERS_EMAIL">;
+  YOU_ARE_NOT_ALLOWED_TO_SET_USERS_PHONE_NUMBER: import("@better-auth/core/utils/error-codes").RawError<"YOU_ARE_NOT_ALLOWED_TO_SET_USERS_PHONE_NUMBER">;
   PASSWORD_CANNOT_BE_UPDATED_VIA_UPDATE_USER: import("@better-auth/core/utils/error-codes").RawError<"PASSWORD_CANNOT_BE_UPDATED_VIA_UPDATE_USER">;
   USER_ID_CANNOT_BE_UPDATED: import("@better-auth/core/utils/error-codes").RawError<"USER_ID_CANNOT_BE_UPDATED">;
 };

package/dist/plugins/admin/error-codes.mjs

@@ -23,6 +23,7 @@ const ADMIN_ERROR_CODES = defineErrorCodes({
 	YOU_CANNOT_IMPERSONATE_ADMINS: "You cannot impersonate admins",
 	INVALID_ROLE_TYPE: "Invalid role type",
 	YOU_ARE_NOT_ALLOWED_TO_SET_USERS_EMAIL: "You are not allowed to update users email",
+	YOU_ARE_NOT_ALLOWED_TO_SET_USERS_PHONE_NUMBER: "You are not allowed to update users phone number",
 	PASSWORD_CANNOT_BE_UPDATED_VIA_UPDATE_USER: "Password cannot be updated through update-user. Use the set-user-password endpoint instead",
 	USER_ID_CANNOT_BE_UPDATED: "User id cannot be updated"
 });

package/dist/plugins/admin/routes.mjs

@@ -301,6 +301,14 @@ const adminUpdateUser = (opts) => createAuthEndpoint("/admin/update-user", {
 			updateData.email = email;
 		}
 	}
+	if (hasDataKey("phoneNumber") || hasDataKey("phoneNumberVerified")) {
+		if (!hasPermission({
+			userId: ctx.context.session.user.id,
+			role: ctx.context.session.user.role,
+			options: opts,
+			permissions: { user: ["set-phone"] }
+		})) throw APIError.from("FORBIDDEN", ADMIN_ERROR_CODES.YOU_ARE_NOT_ALLOWED_TO_SET_USERS_PHONE_NUMBER);
+	}
 	if (!await ctx.context.internalAdapter.findUserById(ctx.body.userId)) throw APIError.from("NOT_FOUND", BASE_ERROR_CODES.USER_NOT_FOUND);
 	const updatedUser = await ctx.context.internalAdapter.updateUser(ctx.body.userId, ctx.body.data);
 	if (updateData.banned === true) await ctx.context.internalAdapter.deleteUserSessions(ctx.body.userId);

package/dist/plugins/anonymous/index.mjs

@@ -1,8 +1,8 @@
 import { mergeSchema, parseUserOutput } from "../../db/schema.mjs";
 import { parseSetCookieHeader } from "../../cookies/cookie-utils.mjs";
 import { deleteSessionCookie, setSessionCookie } from "../../cookies/index.mjs";
-import { addOAuthServerContext, getOAuthState } from "../../api/state/oauth.mjs";
 import { getSessionFromCtx, sensitiveSessionMiddleware } from "../../api/routes/session.mjs";
+import { addOAuthServerContext, getOAuthState } from "../../api/state/oauth.mjs";
 import { APIError } from "../../api/index.mjs";
 import { PACKAGE_VERSION } from "../../version.mjs";
 import { ANONYMOUS_ERROR_CODES } from "./error-codes.mjs";
@@ -187,6 +187,7 @@ const anonymous = (options) => {
 					if (ctx.path === "/sign-in/anonymous" && !ctx.context.newSession) throw APIError.from("BAD_REQUEST", ANONYMOUS_ERROR_CODES.ANONYMOUS_USERS_CANNOT_SIGN_IN_AGAIN_ANONYMOUSLY);
 					const newSession = ctx.context.newSession;
 					if (!newSession) return;
+					if (await ctx.context.getPlugin("two-factor")?.shouldRequireTwoFactor(ctx)) return;
 					if (options?.onLinkAccount) await options.onLinkAccount({
 						anonymousUser: {
 							session: session.session,

package/dist/plugins/device-authorization/routes.mjs

@@ -1,6 +1,6 @@
 import { ms } from "../../utils/time.mjs";
 import { generateRandomString } from "../../crypto/random.mjs";
-import { getSessionFromCtx } from "../../api/routes/session.mjs";
+import { getAuthoritativeSessionFromCtx, getSessionFromCtx } from "../../api/routes/session.mjs";
 import { DEVICE_AUTHORIZATION_ERROR_CODES } from "./error-codes.mjs";
 import { APIError } from "@better-auth/core/error";
 import { createAuthEndpoint } from "@better-auth/core/api";
@@ -526,7 +526,7 @@ const deviceVerify = (grant) => createAuthEndpoint("/device", {
 		error: "expired_token",
 		error_description: DEVICE_AUTHORIZATION_ERROR_CODES.EXPIRED_USER_CODE.message
 	});
-	const session = await getSessionFromCtx(ctx);
+	const session = await getAuthoritativeSessionFromCtx(ctx);
 	if (session?.user?.id && !deviceCodeRecord.userId && deviceCodeRecord.status === "pending") {
 		if (await ctx.context.adapter.incrementOne({
 			model: "deviceCode",
@@ -587,7 +587,7 @@ const deviceApprove = createAuthEndpoint("/device/approve", {
 		} }
 	} }
 }, async (ctx) => {
-	const session = await getSessionFromCtx(ctx);
+	const session = await getAuthoritativeSessionFromCtx(ctx);
 	if (!session) throw new APIError("UNAUTHORIZED", {
 		error: "unauthorized",
 		error_description: DEVICE_AUTHORIZATION_ERROR_CODES.AUTHENTICATION_REQUIRED.message

package/dist/plugins/email-otp/routes.mjs

@@ -101,12 +101,13 @@ const sendVerificationOTP = (opts) => createAuthEndpoint("/email-otp/send-verifi
 	const identifier = toOTPIdentifier(ctx.body.type, email);
 	const otp = await resolveOTP(ctx, opts, email, ctx.body.type);
 	const shouldSendOTP = ctx.body.type === "sign-in" && !opts.disableSignUp;
-	if (!await ctx.context.internalAdapter.findUserByEmail(email) && !shouldSendOTP) {
+	const user = await ctx.context.internalAdapter.findUserByEmail(email);
+	if (!user && !shouldSendOTP) {
 		await ctx.context.internalAdapter.deleteVerificationByIdentifier(identifier);
 		return ctx.json({ success: true });
 	}
 	await ctx.context.runInBackgroundOrAwait(opts.sendVerificationOTP({
-		email,
+		email: user?.user.email ?? email,
 		otp,
 		type: ctx.body.type
 	}, ctx));
@@ -236,23 +237,7 @@ const checkVerificationOTP = (opts) => createAuthEndpoint("/email-otp/check-veri
 }, async (ctx) => {
 	const email = ctx.body.email.toLowerCase();
 	if (!z.email().safeParse(email).success) throw APIError$1.from("BAD_REQUEST", BASE_ERROR_CODES.INVALID_EMAIL);
-	const identifier = toOTPIdentifier(ctx.body.type, email);
-	const verificationValue = await ctx.context.internalAdapter.findVerificationValue(identifier);
-	if (!verificationValue) throw APIError$1.from("BAD_REQUEST", EMAIL_OTP_ERROR_CODES.INVALID_OTP);
-	if (verificationValue.expiresAt < /* @__PURE__ */ new Date()) {
-		await ctx.context.internalAdapter.deleteVerificationByIdentifier(identifier);
-		throw APIError$1.from("BAD_REQUEST", EMAIL_OTP_ERROR_CODES.OTP_EXPIRED);
-	}
-	const [otpValue, attempts] = splitAtLastColon(verificationValue.value);
-	const allowedAttempts = opts?.allowedAttempts || 3;
-	if (attempts && parseInt(attempts) >= allowedAttempts) {
-		await ctx.context.internalAdapter.deleteVerificationByIdentifier(identifier);
-		throw APIError$1.from("FORBIDDEN", EMAIL_OTP_ERROR_CODES.TOO_MANY_ATTEMPTS);
-	}
-	if (!await verifyStoredOTP(ctx, opts, otpValue, ctx.body.otp)) {
-		await ctx.context.internalAdapter.updateVerificationByIdentifier(identifier, { value: `${otpValue}:${parseInt(attempts || "0") + 1}` });
-		throw APIError$1.from("BAD_REQUEST", EMAIL_OTP_ERROR_CODES.INVALID_OTP);
-	}
+	await atomicVerifyOTP(ctx, opts, toOTPIdentifier(ctx.body.type, email), ctx.body.otp, "restore");
 	if (!await ctx.context.internalAdapter.findUserByEmail(email))
  /**
 	* safe to leak the existence of a user, given the user has already the OTP from the
@@ -480,14 +465,16 @@ const requestPasswordResetEmailOTP = (opts) => createAuthEndpoint("/email-otp/re
 	} }
 }, async (ctx) => {
 	const email = ctx.body.email.toLowerCase();
+	if (!z.email().safeParse(email).success) throw APIError$1.from("BAD_REQUEST", BASE_ERROR_CODES.INVALID_EMAIL);
 	const identifier = toOTPIdentifier("forget-password", email);
 	const otp = await resolveOTP(ctx, opts, email, "forget-password");
-	if (!await ctx.context.internalAdapter.findUserByEmail(email)) {
+	const user = await ctx.context.internalAdapter.findUserByEmail(email);
+	if (!user) {
 		await ctx.context.internalAdapter.deleteVerificationByIdentifier(identifier);
 		return ctx.json({ success: true });
 	}
 	await ctx.context.runInBackgroundOrAwait(opts.sendVerificationOTP({
-		email,
+		email: user.user.email,
 		otp,
 		type: "forget-password"
 	}, ctx));
@@ -532,14 +519,16 @@ const forgetPasswordEmailOTP = (opts) => {
 	}, async (ctx) => {
 		warnDeprecation();
 		const email = ctx.body.email.toLowerCase();
+		if (!z.email().safeParse(email).success) throw APIError$1.from("BAD_REQUEST", BASE_ERROR_CODES.INVALID_EMAIL);
 		const identifier = toOTPIdentifier("forget-password", email);
 		const otp = await resolveOTP(ctx, opts, email, "forget-password");
-		if (!await ctx.context.internalAdapter.findUserByEmail(email)) {
+		const user = await ctx.context.internalAdapter.findUserByEmail(email);
+		if (!user) {
 			await ctx.context.internalAdapter.deleteVerificationByIdentifier(identifier);
 			return ctx.json({ success: true });
 		}
 		await ctx.context.runInBackgroundOrAwait(opts.sendVerificationOTP({
-			email,
+			email: user.user.email,
 			otp,
 			type: "forget-password"
 		}, ctx));
@@ -582,18 +571,15 @@ const resetPasswordEmailOTP = (opts) => createAuthEndpoint("/email-otp/reset-pas
 	} }
 }, async (ctx) => {
 	const email = ctx.body.email.toLowerCase();
+	if (!z.email().safeParse(email).success) throw APIError$1.from("BAD_REQUEST", BASE_ERROR_CODES.INVALID_EMAIL);
 	assertPasswordNotTooShort(ctx, ctx.body.password);
 	assertPasswordNotTooLong(ctx, ctx.body.password);
 	const identifier = toOTPIdentifier("forget-password", email);
-	let otpConsumed = false;
-	if (!await matchesUsableStoredOTP(ctx, opts, identifier, ctx.body.otp)) {
-		await atomicVerifyOTP(ctx, opts, identifier, ctx.body.otp);
-		otpConsumed = true;
-	}
+	await atomicVerifyOTP(ctx, opts, identifier, ctx.body.otp, "restore");
 	const user = await ctx.context.internalAdapter.findUserByEmail(email);
 	if (!user) throw APIError$1.from("BAD_REQUEST", BASE_ERROR_CODES.USER_NOT_FOUND);
 	const passwordHash = await ctx.context.password.hash(ctx.body.password);
-	await resetCredentialPassword(ctx, user.user.id, passwordHash, otpConsumed ? void 0 : () => atomicVerifyOTP(ctx, opts, identifier, ctx.body.otp));
+	await resetCredentialPassword(ctx, user.user.id, passwordHash, () => atomicVerifyOTP(ctx, opts, identifier, ctx.body.otp));
 	if (ctx.context.options.emailAndPassword?.onPasswordReset) await ctx.context.options.emailAndPassword.onPasswordReset({ user: user.user }, ctx.request);
 	if (!user.user.emailVerified) await ctx.context.internalAdapter.updateUser(user.user.id, { emailVerified: true });
 	return ctx.json({ success: true });
@@ -653,13 +639,14 @@ const requestEmailChangeEmailOTP = (opts) => createAuthEndpoint("/email-otp/requ
 		type: "change-email"
 	}, ctx) || defaultOTPGenerator(opts);
 	const storedOTP = await storeOTP(ctx, opts, otp);
+	const identifier = toOTPIdentifier("change-email", `${ctx.context.session.user.id}:${newEmail}`);
 	await ctx.context.internalAdapter.createVerificationValue({
 		value: `${storedOTP}:0`,
-		identifier: toOTPIdentifier("change-email", `${email}-${newEmail}`),
+		identifier,
 		expiresAt: getDate(opts.expiresIn, "sec")
 	});
 	if (await ctx.context.internalAdapter.findUserByEmail(newEmail)) {
-		await ctx.context.internalAdapter.deleteVerificationByIdentifier(toOTPIdentifier("change-email", `${email}-${newEmail}`));
+		await ctx.context.internalAdapter.deleteVerificationByIdentifier(identifier);
 		return ctx.json({ success: true });
 	}
 	await ctx.context.runInBackgroundOrAwait(opts.sendVerificationOTP({
@@ -716,7 +703,7 @@ const changeEmailEmailOTP = (opts) => createAuthEndpoint("/email-otp/change-emai
 		ctx.context.logger.error("Email is the same");
 		throw APIError$1.fromStatus("BAD_REQUEST", { message: "Email is the same" });
 	}
-	await atomicVerifyOTP(ctx, opts, toOTPIdentifier("change-email", `${email}-${newEmail}`), ctx.body.otp);
+	await atomicVerifyOTP(ctx, opts, toOTPIdentifier("change-email", `${session.user.id}:${newEmail}`), ctx.body.otp);
 	const currentUser = await ctx.context.internalAdapter.findUserByEmail(email);
 	if (!currentUser)
  /**
@@ -746,28 +733,17 @@ const changeEmailEmailOTP = (opts) => createAuthEndpoint("/email-otp/change-emai
 });
 const defaultOTPGenerator = (options) => generateRandomString(options.otpLength ?? 6, "0-9");
 /**
-* Reports whether the provided OTP matches a stored, unexpired record with
-* attempts left, without consuming it or counting an attempt.
-*/
-async function matchesUsableStoredOTP(ctx, opts, identifier, providedOTP) {
-	const existing = await ctx.context.internalAdapter.findVerificationValue(identifier);
-	if (!existing || existing.expiresAt < /* @__PURE__ */ new Date()) return false;
-	const [otpValue, attempts] = splitAtLastColon(existing.value);
-	if (parseInt(attempts || "0") >= (opts?.allowedAttempts || 3)) return false;
-	return verifyStoredOTP(ctx, opts, otpValue, providedOTP);
-}
-/**
-* Verifies a single-use OTP with race-condition protection.
+* Verifies an OTP with race-condition protection.
 *
 * The atomic consume is the single gate: only the first concurrent caller
 * receives the record, every later racer receives `null` and is rejected, so
-* a correct OTP can only ever be accepted once. When the submitted code is
-* wrong the record is recreated with the same value and expiry and an
-* incremented attempt count so the next try can still find it; the budget is
-* enforced before verification, and a record whose attempts are exhausted is
-* left consumed (no recreate), locking the identifier out.
+* only one caller at a time can compare a guess. Credential routes leave a
+* successful OTP consumed. The optional preflight restores it unchanged so
+* the documented follow-up call can use it. A wrong guess restores it with
+* one additional attempt and the original expiry. An exhausted record stays
+* consumed, locking the identifier out.
 */
-async function atomicVerifyOTP(ctx, opts, identifier, providedOTP) {
+async function atomicVerifyOTP(ctx, opts, identifier, providedOTP, successDisposition = "consume") {
 	const existing = await ctx.context.internalAdapter.findVerificationValue(identifier);
 	if (existing && existing.expiresAt < /* @__PURE__ */ new Date()) {
 		await ctx.context.internalAdapter.deleteVerificationByIdentifier(identifier);
@@ -787,6 +763,13 @@ async function atomicVerifyOTP(ctx, opts, identifier, providedOTP) {
 		});
 		throw APIError$1.from("BAD_REQUEST", EMAIL_OTP_ERROR_CODES.INVALID_OTP);
 	}
+	if (successDisposition === "consume") return;
+	if (await ctx.context.internalAdapter.findVerificationValue(identifier)) throw APIError$1.from("BAD_REQUEST", EMAIL_OTP_ERROR_CODES.INVALID_OTP);
+	if (!await ctx.context.internalAdapter.createVerificationValue({
+		value: consumed.value,
+		identifier,
+		expiresAt: consumed.expiresAt
+	})) throw APIError$1.fromStatus("INTERNAL_SERVER_ERROR", { message: "Unable to complete OTP verification" });
 }
 //#endregion
 export { changeEmailEmailOTP, checkVerificationOTP, createVerificationOTP, forgetPasswordEmailOTP, getVerificationOTP, requestEmailChangeEmailOTP, requestPasswordResetEmailOTP, resetPasswordEmailOTP, sendVerificationOTP, signInEmailOTP, verifyEmailOTP };