better-auth 1.7.15 → 1.7.16

package/dist/plugins/organization/routes/crud-members.mjs

@@ -2,10 +2,10 @@ import { toZodSchema } from "../../../db/to-zod.mjs";
 import { getSessionFromCtx, sessionMiddleware } from "../../../api/routes/session.mjs";
 import { defaultRoles } from "../access/statement.mjs";
 import { ORGANIZATION_ERROR_CODES } from "../error-codes.mjs";
+import { parseRoleList, parseRoles } from "../roles.mjs";
 import { getOrgAdapter } from "../adapter.mjs";
 import { orgMiddleware, orgSessionMiddleware } from "../call.mjs";
 import { hasPermission } from "../has-permission.mjs";
-import { parseRoles } from "../organization.mjs";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { whereOperators } from "@better-auth/core/db/adapter";
 import { createAuthEndpoint } from "@better-auth/core/api";
@@ -190,14 +190,12 @@ const removeMember = (options) => createAuthEndpoint("/organization/remove-membe
 		}
 	}
 	if (!toBeRemovedMember) throw APIError.from("BAD_REQUEST", ORGANIZATION_ERROR_CODES.MEMBER_NOT_FOUND);
-	const roles = toBeRemovedMember.role.split(",");
+	const roles = parseRoleList(toBeRemovedMember.role);
 	const creatorRole = ctx.context.orgOptions?.creatorRole || "owner";
 	if (roles.includes(creatorRole)) {
-		if (!member.role.split(",").map((r) => r.trim()).includes(creatorRole)) throw APIError.from("BAD_REQUEST", ORGANIZATION_ERROR_CODES.YOU_CANNOT_LEAVE_THE_ORGANIZATION_AS_THE_ONLY_OWNER);
+		if (!parseRoleList(member.role).includes(creatorRole)) throw APIError.from("BAD_REQUEST", ORGANIZATION_ERROR_CODES.YOU_CANNOT_LEAVE_THE_ORGANIZATION_AS_THE_ONLY_OWNER);
 		const { members } = await adapter.listMembers({ organizationId });
-		if (members.filter((member) => {
-			return member.role.split(",").includes(creatorRole);
-		}).length <= 1) throw APIError.from("BAD_REQUEST", ORGANIZATION_ERROR_CODES.YOU_CANNOT_LEAVE_THE_ORGANIZATION_AS_THE_ONLY_OWNER);
+		if (members.filter((member) => parseRoleList(member.role).includes(creatorRole)).length <= 1) throw APIError.from("BAD_REQUEST", ORGANIZATION_ERROR_CODES.YOU_CANNOT_LEAVE_THE_ORGANIZATION_AS_THE_ONLY_OWNER);
 	}
 	if (!await hasPermission({
 		role: member.role,
@@ -273,7 +271,7 @@ const updateMemberRole = (option) => createAuthEndpoint("/organization/update-me
 	const organizationId = ctx.body.organizationId || session.session.activeOrganizationId;
 	if (!organizationId) throw APIError.from("BAD_REQUEST", ORGANIZATION_ERROR_CODES.NO_ACTIVE_ORGANIZATION);
 	const adapter = getOrgAdapter(ctx.context, ctx.context.orgOptions);
-	const roleToSet = (Array.isArray(ctx.body.role) ? ctx.body.role : [ctx.body.role]).flatMap((role) => role.split(",")).map((role) => role.trim()).filter(Boolean);
+	const roleToSet = parseRoleList(ctx.body.role);
 	if (roleToSet.length === 0) throw APIError.fromStatus("BAD_REQUEST");
 	const member = await adapter.findMemberByOrgId({
 		userId: session.user.id,
@@ -284,8 +282,8 @@ const updateMemberRole = (option) => createAuthEndpoint("/organization/update-me
 	if (!toBeUpdatedMember) throw APIError.from("BAD_REQUEST", ORGANIZATION_ERROR_CODES.MEMBER_NOT_FOUND);
 	if (!(toBeUpdatedMember.organizationId === organizationId)) throw APIError.from("FORBIDDEN", ORGANIZATION_ERROR_CODES.YOU_ARE_NOT_ALLOWED_TO_UPDATE_THIS_MEMBER);
 	const creatorRole = ctx.context.orgOptions?.creatorRole || "owner";
-	const updatingMemberRoles = member.role.split(",");
-	const isUpdatingCreator = toBeUpdatedMember.role.split(",").includes(creatorRole);
+	const updatingMemberRoles = parseRoleList(member.role);
+	const isUpdatingCreator = parseRoleList(toBeUpdatedMember.role).includes(creatorRole);
 	const updaterIsCreator = updatingMemberRoles.includes(creatorRole);
 	const isSettingCreatorRole = roleToSet.includes(creatorRole);
 	const memberIsUpdatingThemselves = member.id === toBeUpdatedMember.id;
@@ -297,9 +295,7 @@ const updateMemberRole = (option) => createAuthEndpoint("/organization/update-me
 				field: "organizationId",
 				value: organizationId
 			}]
-		})).filter((member) => {
-			return member.role.split(",").includes(creatorRole);
-		}).length <= 1 && !isSettingCreatorRole) throw APIError.from("BAD_REQUEST", ORGANIZATION_ERROR_CODES.YOU_CANNOT_LEAVE_THE_ORGANIZATION_WITHOUT_AN_OWNER);
+		})).filter((member) => parseRoleList(member.role).includes(creatorRole)).length <= 1 && !isSettingCreatorRole) throw APIError.from("BAD_REQUEST", ORGANIZATION_ERROR_CODES.YOU_CANNOT_LEAVE_THE_ORGANIZATION_WITHOUT_AN_OWNER);
 	}
 	if (!await hasPermission({
 		role: member.role,
@@ -419,14 +415,14 @@ const leaveOrganization = (options) => createAuthEndpoint("/organization/leave",
 	});
 	if (!member) throw APIError.from("BAD_REQUEST", ORGANIZATION_ERROR_CODES.MEMBER_NOT_FOUND);
 	const creatorRole = ctx.context.orgOptions?.creatorRole || "owner";
-	if (member.role.split(",").includes(creatorRole)) {
+	if (parseRoleList(member.role).includes(creatorRole)) {
 		if ((await ctx.context.adapter.findMany({
 			model: "member",
 			where: [{
 				field: "organizationId",
 				value: ctx.body.organizationId
 			}]
-		})).filter((member) => member.role.split(",").includes(creatorRole)).length <= 1) throw APIError.from("BAD_REQUEST", ORGANIZATION_ERROR_CODES.YOU_CANNOT_LEAVE_THE_ORGANIZATION_AS_THE_ONLY_OWNER);
+		})).filter((member) => parseRoleList(member.role).includes(creatorRole)).length <= 1) throw APIError.from("BAD_REQUEST", ORGANIZATION_ERROR_CODES.YOU_CANNOT_LEAVE_THE_ORGANIZATION_AS_THE_ONLY_OWNER);
 	}
 	await adapter.deleteMember({
 		memberId: member.id,

package/dist/plugins/organization/routes/crud-org.mjs

@@ -4,7 +4,7 @@ import { getSessionFromCtx, requestOnlySessionMiddleware } from "../../../api/ro
 import { ORGANIZATION_ERROR_CODES } from "../error-codes.mjs";
 import { getOrgAdapter } from "../adapter.mjs";
 import { orgMiddleware, orgSessionMiddleware } from "../call.mjs";
-import { hasPermission } from "../has-permission.mjs";
+import { canViewInvitations, hasPermission, withoutCreatorRoleInvitations } from "../has-permission.mjs";
 import { APIError } from "@better-auth/core/error";
 import { createAuthEndpoint } from "@better-auth/core/api";
 import * as z from "zod";
@@ -362,13 +362,22 @@ const getFullOrganization = (options) => createAuthEndpoint("/organization/get-f
 		membersLimit: ctx.query?.membersLimit
 	});
 	if (!organization) throw APIError.from("BAD_REQUEST", ORGANIZATION_ERROR_CODES.ORGANIZATION_NOT_FOUND);
-	if (!await adapter.checkMembership({
+	const isMember = await adapter.checkMembership({
 		userId: session.user.id,
 		organizationId: organization.id
-	})) {
+	});
+	if (!isMember) {
 		await adapter.setActiveOrganization(session.session.token, null, ctx);
 		throw APIError.from("FORBIDDEN", ORGANIZATION_ERROR_CODES.USER_IS_NOT_A_MEMBER_OF_THE_ORGANIZATION);
 	}
+	organization.invitations = organization.invitations.length > 0 && await canViewInvitations({
+		role: isMember.role,
+		options: ctx.context.orgOptions,
+		organizationId: organization.id
+	}, ctx) ? withoutCreatorRoleInvitations(organization.invitations, {
+		role: isMember.role,
+		options: ctx.context.orgOptions
+	}) : [];
 	return ctx.json(organization);
 });
 const setActiveOrganizationBodySchema = z.object({

package/dist/plugins/phone-number/client.d.mts

@@ -21,7 +21,9 @@ export declare const phoneNumberClient: () => {
     UNEXPECTED_ERROR: import("@better-auth/core/utils/error-codes").RawError<"UNEXPECTED_ERROR">;
     OTP_NOT_FOUND: import("@better-auth/core/utils/error-codes").RawError<"OTP_NOT_FOUND">;
     PHONE_NUMBER_NOT_VERIFIED: import("@better-auth/core/utils/error-codes").RawError<"PHONE_NUMBER_NOT_VERIFIED">;
+    PHONE_NUMBER_PENDING_VERIFICATION: import("@better-auth/core/utils/error-codes").RawError<"PHONE_NUMBER_PENDING_VERIFICATION">;
     PHONE_NUMBER_CANNOT_BE_UPDATED: import("@better-auth/core/utils/error-codes").RawError<"PHONE_NUMBER_CANNOT_BE_UPDATED">;
+    PHONE_NUMBER_CANNOT_BE_SET: import("@better-auth/core/utils/error-codes").RawError<"PHONE_NUMBER_CANNOT_BE_SET">;
     SEND_OTP_NOT_IMPLEMENTED: import("@better-auth/core/utils/error-codes").RawError<"SEND_OTP_NOT_IMPLEMENTED">;
   };
 };

package/dist/plugins/phone-number/error-codes.d.mts

@@ -10,7 +10,9 @@ export declare const PHONE_NUMBER_ERROR_CODES: {
   UNEXPECTED_ERROR: import("@better-auth/core/utils/error-codes").RawError<"UNEXPECTED_ERROR">;
   OTP_NOT_FOUND: import("@better-auth/core/utils/error-codes").RawError<"OTP_NOT_FOUND">;
   PHONE_NUMBER_NOT_VERIFIED: import("@better-auth/core/utils/error-codes").RawError<"PHONE_NUMBER_NOT_VERIFIED">;
+  PHONE_NUMBER_PENDING_VERIFICATION: import("@better-auth/core/utils/error-codes").RawError<"PHONE_NUMBER_PENDING_VERIFICATION">;
   PHONE_NUMBER_CANNOT_BE_UPDATED: import("@better-auth/core/utils/error-codes").RawError<"PHONE_NUMBER_CANNOT_BE_UPDATED">;
+  PHONE_NUMBER_CANNOT_BE_SET: import("@better-auth/core/utils/error-codes").RawError<"PHONE_NUMBER_CANNOT_BE_SET">;
   SEND_OTP_NOT_IMPLEMENTED: import("@better-auth/core/utils/error-codes").RawError<"SEND_OTP_NOT_IMPLEMENTED">;
 };
 //#endregion

package/dist/plugins/phone-number/error-codes.mjs

@@ -10,7 +10,9 @@ const PHONE_NUMBER_ERROR_CODES = defineErrorCodes({
 	OTP_EXPIRED: "OTP expired",
 	INVALID_OTP: "Invalid OTP",
 	PHONE_NUMBER_NOT_VERIFIED: "Phone number not verified",
+	PHONE_NUMBER_PENDING_VERIFICATION: "Phone number requires account ownership proof",
 	PHONE_NUMBER_CANNOT_BE_UPDATED: "Phone number cannot be updated",
+	PHONE_NUMBER_CANNOT_BE_SET: "Phone number can only be set by verifying it",
 	SEND_OTP_NOT_IMPLEMENTED: "sendOTP not implemented",
 	TOO_MANY_ATTEMPTS: "Too many attempts"
 });

package/dist/plugins/phone-number/index.d.mts

@@ -14,6 +14,28 @@ export declare const phoneNumber: (options?: PhoneNumberOptions | undefined) =>
     options: {
       databaseHooks: {
         user: {
+          create: {
+            before(data: {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            } & Record<string, unknown>, ctx: import("@better-auth/core").GenericEndpointContext | null): Promise<{
+              data: {
+                [x: string]: unknown;
+                id: string;
+                createdAt: Date;
+                updatedAt: Date;
+                email: string;
+                emailVerified: boolean;
+                name: string;
+                image?: string | null | undefined;
+              };
+            } | undefined>;
+          };
           update: {
             before(data: Partial<{
               id: string;
@@ -23,7 +45,7 @@ export declare const phoneNumber: (options?: PhoneNumberOptions | undefined) =>
               emailVerified: boolean;
               name: string;
               image?: string | null | undefined;
-            }> & Record<string, unknown>): Promise<{
+            }> & Record<string, unknown>, ctx: import("@better-auth/core").GenericEndpointContext | null): Promise<{
               data: {
                 [x: string]: unknown;
                 id?: string | undefined;
@@ -346,7 +368,9 @@ export declare const phoneNumber: (options?: PhoneNumberOptions | undefined) =>
     UNEXPECTED_ERROR: import("@better-auth/core/utils/error-codes").RawError<"UNEXPECTED_ERROR">;
     OTP_NOT_FOUND: import("@better-auth/core/utils/error-codes").RawError<"OTP_NOT_FOUND">;
     PHONE_NUMBER_NOT_VERIFIED: import("@better-auth/core/utils/error-codes").RawError<"PHONE_NUMBER_NOT_VERIFIED">;
+    PHONE_NUMBER_PENDING_VERIFICATION: import("@better-auth/core/utils/error-codes").RawError<"PHONE_NUMBER_PENDING_VERIFICATION">;
     PHONE_NUMBER_CANNOT_BE_UPDATED: import("@better-auth/core/utils/error-codes").RawError<"PHONE_NUMBER_CANNOT_BE_UPDATED">;
+    PHONE_NUMBER_CANNOT_BE_SET: import("@better-auth/core/utils/error-codes").RawError<"PHONE_NUMBER_CANNOT_BE_SET">;
     SEND_OTP_NOT_IMPLEMENTED: import("@better-auth/core/utils/error-codes").RawError<"SEND_OTP_NOT_IMPLEMENTED">;
   };
 };

package/dist/plugins/phone-number/index.mjs

@@ -20,12 +20,28 @@ const phoneNumber = (options) => {
 		id: "phone-number",
 		version: PACKAGE_VERSION,
 		init() {
-			return { options: { databaseHooks: { user: { update: { async before(data) {
-				if (opts.phoneNumber in data && data[opts.phoneNumber] === null) return { data: {
-					...data,
-					[opts.phoneNumberVerified]: false
-				} };
-			} } } } } };
+			return { options: { databaseHooks: { user: {
+				create: { async before(data, ctx) {
+					if (!data[opts.phoneNumber] || data[opts.phoneNumberVerified] === true) return;
+					if (ctx?.body?.[opts.phoneNumber]) throw APIError.from("BAD_REQUEST", PHONE_NUMBER_ERROR_CODES.PHONE_NUMBER_CANNOT_BE_SET);
+					return { data: {
+						...data,
+						[opts.phoneNumber]: null,
+						[opts.phoneNumberVerified]: false
+					} };
+				} },
+				update: { async before(data, ctx) {
+					if (opts.phoneNumber in data && data[opts.phoneNumber] === null) return { data: {
+						...data,
+						[opts.phoneNumberVerified]: false
+					} };
+					if (!ctx || !data[opts.phoneNumber] || data[opts.phoneNumberVerified] === true || ctx.path === "/admin/update-user") return;
+					return { data: {
+						...data,
+						[opts.phoneNumber]: void 0
+					} };
+				} }
+			} } } };
 		},
 		hooks: { before: [{
 			matcher: (ctx) => ctx.path === "/update-user" && "phoneNumber" in ctx.body && ctx.body.phoneNumber !== null,

package/dist/plugins/phone-number/routes.mjs

@@ -2,9 +2,10 @@ import { parseUserInput, parseUserOutput } from "../../db/schema.mjs";
 import { getDate } from "../../utils/date.mjs";
 import { generateRandomString } from "../../crypto/random.mjs";
 import { setSessionCookie } from "../../cookies/index.mjs";
-import { getSessionFromCtx } from "../../api/routes/session.mjs";
+import { getAuthoritativeSessionFromCtx } from "../../api/routes/session.mjs";
 import { HIDE_METADATA } from "../../utils/hide-metadata.mjs";
 import { assertPasswordNotTooLong, assertPasswordNotTooShort, resetCredentialPassword } from "../../utils/password.mjs";
+import { isSessionOutsideStore } from "../../api/state/session-source.mjs";
 import { PHONE_NUMBER_ERROR_CODES } from "./error-codes.mjs";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { createAuthEndpoint } from "@better-auth/core/api";
@@ -69,7 +70,7 @@ const signInPhoneNumber = (opts) => createAuthEndpoint("/sign-in/phone-number",
 			const otp = generateOTP(opts.otpLength);
 			await ctx.context.internalAdapter.createVerificationValue({
 				value: otp,
-				identifier: phoneNumber,
+				identifier: phoneNumberOTPIdentifier(phoneNumber),
 				expiresAt: getDate(opts.expiresIn, "sec")
 			});
 			if (opts.sendOTP) await ctx.context.runInBackgroundOrAwait(opts.sendOTP({
@@ -155,7 +156,7 @@ const sendPhoneNumberOTP = (opts) => createAuthEndpoint("/phone-number/send-otp"
 	const code = generateOTP(opts.otpLength);
 	await ctx.context.internalAdapter.createVerificationValue({
 		value: `${code}:0`,
-		identifier: ctx.body.phoneNumber,
+		identifier: phoneNumberOTPIdentifier(ctx.body.phoneNumber),
 		expiresAt: getDate(opts.expiresIn, "sec")
 	});
 	const sendOTPResult = opts.sendOTP({
@@ -174,11 +175,12 @@ const sendPhoneNumberOTP = (opts) => createAuthEndpoint("/phone-number/send-otp"
 });
 async function verifyAndConsumePhoneNumberOTP(ctx, opts, body) {
 	const { phoneNumber, code } = body;
+	const identifier = phoneNumberOTPIdentifier(phoneNumber);
 	if (opts.verifyOTP) {
-		await verifyWithCustomVerifier(ctx, opts.verifyOTP, phoneNumber, code, phoneNumber);
+		await verifyWithCustomVerifier(ctx, opts.verifyOTP, phoneNumber, code, identifier);
 		return;
 	}
-	await verifyPhoneNumberOTP(ctx, opts, phoneNumber, code);
+	await verifyPhoneNumberOTP(ctx, opts, identifier, code);
 }
 /** Checks the code with `verifyOTP`, then drops the code stored under `identifier`. */
 async function verifyWithCustomVerifier(ctx, verifyOTP, phoneNumber, code, identifier) {
@@ -330,7 +332,8 @@ const verifyPhoneNumber = (opts) => createAuthEndpoint("/phone-number/verify", {
 }, async (ctx) => {
 	await verifyAndConsumePhoneNumberOTP(ctx, opts, ctx.body);
 	if (ctx.body.updatePhoneNumber) {
-		const session = await getSessionFromCtx(ctx);
+		const requestSession = ctx.context.session;
+		const session = requestSession && await isSessionOutsideStore(requestSession.session.token) ? requestSession : await getAuthoritativeSessionFromCtx(ctx);
 		if (!session) throw APIError.from("UNAUTHORIZED", BASE_ERROR_CODES.USER_NOT_FOUND);
 		if ((await ctx.context.adapter.findMany({
 			model: "user",
@@ -429,10 +432,10 @@ const requestPasswordResetPhoneNumber = (opts) => createAuthEndpoint("/phone-num
 	const code = generateOTP(opts.otpLength);
 	await ctx.context.internalAdapter.createVerificationValue({
 		value: `${code}:0`,
-		identifier: `${ctx.body.phoneNumber}-request-password-reset`,
+		identifier: phoneNumberResetIdentifier(ctx.body.phoneNumber),
 		expiresAt: getDate(opts.expiresIn, "sec")
 	});
-	if (!user) return ctx.json({ status: true });
+	if (!user || opts.requireVerification && !user.phoneNumberVerified) return ctx.json({ status: true });
 	if (opts.sendPasswordResetOTP) await ctx.context.runInBackgroundOrAwait(opts.sendPasswordResetOTP({
 		phoneNumber: ctx.body.phoneNumber,
 		code
@@ -463,17 +466,11 @@ const resetPasswordPhoneNumber = (opts) => createAuthEndpoint("/phone-number/res
 		} }
 	} }
 }, async (ctx) => {
-	const phoneResetIdentifier = `${ctx.body.phoneNumber}-request-password-reset`;
-	let otpConsumed = false;
-	if (opts.verifyOTP) {
-		assertPasswordNotTooShort(ctx, ctx.body.newPassword);
-		assertPasswordNotTooLong(ctx, ctx.body.newPassword);
-		await verifyWithCustomVerifier(ctx, opts.verifyOTP, ctx.body.phoneNumber, ctx.body.otp, phoneResetIdentifier);
-		otpConsumed = true;
-	} else if (!await matchesUsableStoredPhoneNumberOTP(ctx, opts, phoneResetIdentifier, ctx.body.otp)) {
-		await verifyPhoneNumberOTP(ctx, opts, phoneResetIdentifier, ctx.body.otp);
-		otpConsumed = true;
-	}
+	const phoneResetIdentifier = phoneNumberResetIdentifier(ctx.body.phoneNumber);
+	assertPasswordNotTooShort(ctx, ctx.body.newPassword);
+	assertPasswordNotTooLong(ctx, ctx.body.newPassword);
+	if (opts.verifyOTP) await verifyWithCustomVerifier(ctx, opts.verifyOTP, ctx.body.phoneNumber, ctx.body.otp, phoneResetIdentifier);
+	else await verifyPhoneNumberOTP(ctx, opts, phoneResetIdentifier, ctx.body.otp, "restore");
 	const user = await ctx.context.adapter.findOne({
 		model: "user",
 		where: [{
@@ -482,10 +479,9 @@ const resetPasswordPhoneNumber = (opts) => createAuthEndpoint("/phone-number/res
 		}]
 	});
 	if (!user) throw APIError.from("BAD_REQUEST", PHONE_NUMBER_ERROR_CODES.UNEXPECTED_ERROR);
-	assertPasswordNotTooShort(ctx, ctx.body.newPassword);
-	assertPasswordNotTooLong(ctx, ctx.body.newPassword);
+	if (opts.requireVerification && !user.phoneNumberVerified) throw APIError.from("BAD_REQUEST", PHONE_NUMBER_ERROR_CODES.PHONE_NUMBER_PENDING_VERIFICATION);
 	const hashedPassword = await ctx.context.password.hash(ctx.body.newPassword);
-	await resetCredentialPassword(ctx, user.id, hashedPassword, otpConsumed ? void 0 : () => verifyPhoneNumberOTP(ctx, opts, phoneResetIdentifier, ctx.body.otp));
+	await resetCredentialPassword(ctx, user.id, hashedPassword, opts.verifyOTP ? void 0 : () => verifyPhoneNumberOTP(ctx, opts, phoneResetIdentifier, ctx.body.otp));
 	if (ctx.context.options.emailAndPassword?.onPasswordReset) await ctx.context.options.emailAndPassword.onPasswordReset({ user }, ctx.request);
 	return ctx.json({ status: true });
 });
@@ -497,9 +493,10 @@ const resetPasswordPhoneNumber = (opts) => createAuthEndpoint("/phone-number/res
 * never satisfy two simultaneous verifications. On a wrong code that is still
 * within the attempt budget, the row is recreated with the same value and
 * expiry and an incremented attempt counter. Once the budget is exhausted the
-* row is not recreated.
+* row is not recreated. With `"restore"`, a correct code is written back
+* unchanged so a follow-up call can spend it.
 */
-async function verifyPhoneNumberOTP(ctx, opts, identifier, providedCode) {
+async function verifyPhoneNumberOTP(ctx, opts, identifier, providedCode, successDisposition = "consume") {
 	const existing = await ctx.context.internalAdapter.findVerificationValue(identifier);
 	if (!existing) throw APIError.from("BAD_REQUEST", PHONE_NUMBER_ERROR_CODES.OTP_NOT_FOUND);
 	if (existing.expiresAt < /* @__PURE__ */ new Date()) {
@@ -524,22 +521,24 @@ async function verifyPhoneNumberOTP(ctx, opts, identifier, providedCode) {
 		});
 		throw APIError.from("BAD_REQUEST", PHONE_NUMBER_ERROR_CODES.INVALID_OTP);
 	}
-}
-/**
-* Reports whether the provided code matches a stored, unexpired record with
-* attempts left, without consuming it or counting an attempt.
-*/
-async function matchesUsableStoredPhoneNumberOTP(ctx, opts, identifier, providedCode) {
-	const existing = await ctx.context.internalAdapter.findVerificationValue(identifier);
-	if (!existing || existing.expiresAt < /* @__PURE__ */ new Date()) return false;
-	const [otpValue, rawAttempts] = existing.value.split(":");
-	if (parseVerificationAttempts(rawAttempts) >= (opts?.allowedAttempts ?? 3)) return false;
-	return otpValue === providedCode;
+	if (successDisposition === "consume") return;
+	if (await ctx.context.internalAdapter.findVerificationValue(identifier)) throw APIError.from("BAD_REQUEST", PHONE_NUMBER_ERROR_CODES.INVALID_OTP);
+	if (!await ctx.context.internalAdapter.createVerificationValue({
+		value: consumed.value,
+		identifier,
+		expiresAt: consumed.expiresAt
+	})) throw APIError.fromStatus("INTERNAL_SERVER_ERROR", { message: "Unable to complete OTP verification" });
 }
 function parseVerificationAttempts(value) {
 	const attempts = Number(value ?? 0);
 	return Number.isSafeInteger(attempts) && attempts > 0 ? attempts : 0;
 }
+function phoneNumberOTPIdentifier(phoneNumber) {
+	return `phone-number-otp-${phoneNumber}`;
+}
+function phoneNumberResetIdentifier(phoneNumber) {
+	return `phone-number-reset-${phoneNumber}`;
+}
 function generateOTP(size) {
 	return generateRandomString(size, "0-9");
 }

package/dist/plugins/two-factor/index.d.mts

@@ -4,6 +4,7 @@ import { TOTPOptions, totp2fa } from "./totp/index.mjs";
 import { TwoFactorOptions, TwoFactorProvider, TwoFactorTable, UserWithTwoFactor } from "./types.mjs";
 import { TWO_FACTOR_ERROR_CODES } from "./error-code.mjs";
 import { twoFactorClient } from "./client.mjs";
+import { GenericEndpointContext } from "@better-auth/core";
 import * as z from "zod";
 //#region src/plugins/two-factor/index.d.ts
 declare module "@better-auth/core" {
@@ -16,6 +17,12 @@ declare module "@better-auth/core" {
 export declare const twoFactor: <O extends TwoFactorOptions>(options?: O) => {
   id: "two-factor";
   version: string;
+  /**
+   * Whether this sign-in still requires a second factor.
+   *
+   * @internal
+   */
+  shouldRequireTwoFactor: (ctx: GenericEndpointContext) => Promise<boolean>;
   endpoints: {
     /**
      * ### Endpoint
@@ -37,15 +44,15 @@ export declare const twoFactor: <O extends TwoFactorOptions>(options?: O) => {
       body: z.ZodObject<{
         password: z.ZodOptional<z.ZodString>;
         method: z.ZodDefault<z.ZodEnum<{
-          otp: "otp";
           totp: "totp";
+          otp: "otp";
         }>>;
         issuer: z.ZodOptional<z.ZodString>;
       }, z.core.$strip> | z.ZodObject<{
         password: z.ZodString;
         method: z.ZodDefault<z.ZodEnum<{
-          otp: "otp";
           totp: "totp";
+          otp: "otp";
         }>>;
         issuer: z.ZodOptional<z.ZodString>;
       }, z.core.$strip>;

package/dist/plugins/two-factor/index.mjs

@@ -2,8 +2,9 @@ import { mergeSchema } from "../../db/schema.mjs";
 import { generateRandomString } from "../../crypto/random.mjs";
 import { symmetricEncrypt } from "../../crypto/index.mjs";
 import { deleteSessionCookie, expireCookie, setSessionCookie } from "../../cookies/index.mjs";
-import { sensitiveSessionMiddleware, sessionMiddleware } from "../../api/routes/session.mjs";
+import { getAuthoritativeSessionFromCtx, sensitiveSessionMiddleware, sessionMiddleware } from "../../api/routes/session.mjs";
 import { shouldRequirePassword, validatePassword } from "../../utils/password.mjs";
+import { isSessionOutsideStore } from "../../api/state/session-source.mjs";
 import { PACKAGE_VERSION } from "../../version.mjs";
 import { TWO_FACTOR_ERROR_CODES } from "./error-code.mjs";
 import { twoFactorClient } from "./client.mjs";
@@ -18,6 +19,39 @@ import * as z from "zod";
 import { createHMAC } from "@better-auth/utils/hmac";
 import { createOTP } from "@better-auth/utils/otp";
 //#region src/plugins/two-factor/index.ts
+const signInPaths = /* @__PURE__ */ new Set([
+	"/sign-in/email",
+	"/sign-in/username",
+	"/sign-in/phone-number"
+]);
+const signInTwoFactorStates = /* @__PURE__ */ new WeakMap();
+async function readSignInTwoFactorState(ctx, trustDeviceMaxAge) {
+	const data = ctx.context.newSession;
+	if (!signInPaths.has(ctx.path) || !data?.user.twoFactorEnabled) return {
+		requiresTwoFactor: false,
+		trustDeviceCookie: null
+	};
+	const cookie = ctx.context.createAuthCookie(TRUST_DEVICE_COOKIE_NAME, { maxAge: trustDeviceMaxAge });
+	const trustDeviceCookie = await ctx.getSignedCookie(cookie.name, ctx.context.secret);
+	if (!trustDeviceCookie) return {
+		requiresTwoFactor: true,
+		trustDeviceCookie
+	};
+	const [token, trustIdentifier] = trustDeviceCookie.split("!");
+	if (!token || !trustIdentifier) return {
+		requiresTwoFactor: true,
+		trustDeviceCookie
+	};
+	if (token !== await createHMAC("SHA-256", "base64urlnopad").sign(ctx.context.secret, `${data.user.id}!${trustIdentifier}`)) return {
+		requiresTwoFactor: true,
+		trustDeviceCookie
+	};
+	const verificationRecord = await ctx.context.internalAdapter.findVerificationValue(trustIdentifier);
+	return {
+		requiresTwoFactor: !verificationRecord || verificationRecord.value !== data.user.id || !(verificationRecord.expiresAt > /* @__PURE__ */ new Date()),
+		trustDeviceCookie
+	};
+}
 const twoFactor = (options) => {
 	const opts = { twoFactorTable: "twoFactor" };
 	const trustDeviceMaxAge = options?.trustDeviceMaxAge ?? 2592e3;
@@ -48,9 +82,25 @@ const twoFactor = (options) => {
 		issuer: issuerField
 	});
 	const disableTwoFactorBodySchema = allowPasswordless ? z.object({ password: passwordSchema.optional() }) : z.object({ password: passwordSchema });
+	function getSignInTwoFactorState(ctx) {
+		const remembered = signInTwoFactorStates.get(ctx.context);
+		if (remembered) return remembered;
+		const state = readSignInTwoFactorState(ctx, trustDeviceMaxAge);
+		signInTwoFactorStates.set(ctx.context, state);
+		return state;
+	}
+	async function shouldRequireTwoFactor(ctx) {
+		return (await getSignInTwoFactorState(ctx)).requiresTwoFactor;
+	}
 	return {
 		id: "two-factor",
 		version: PACKAGE_VERSION,
+		/**
+		* Whether this sign-in still requires a second factor.
+		*
+		* @internal
+		*/
+		shouldRequireTwoFactor,
 		endpoints: {
 			...totp.endpoints,
 			...otp.endpoints,
@@ -102,7 +152,12 @@ const twoFactor = (options) => {
 					} }
 				} }
 			}, async (ctx) => {
-				const user = ctx.context.session.user;
+				const session = await isSessionOutsideStore(ctx.context.session.session.token) ? ctx.context.session : await getAuthoritativeSessionFromCtx(ctx);
+				if (!session) throw APIError.from("UNAUTHORIZED", {
+					message: "Unauthorized",
+					code: "UNAUTHORIZED"
+				});
+				const user = session.user;
 				const { password, issuer, method } = ctx.body;
 				if (await shouldRequirePassword(ctx, user.id, allowPasswordless)) {
 					if (!password) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.INVALID_PASSWORD);
@@ -246,36 +301,28 @@ const twoFactor = (options) => {
 		options,
 		hooks: { after: [{
 			matcher(context) {
-				return context.path === "/sign-in/email" || context.path === "/sign-in/username" || context.path === "/sign-in/phone-number";
+				return signInPaths.has(context.path ?? "");
 			},
 			handler: createAuthMiddleware(async (ctx) => {
 				const data = ctx.context.newSession;
-				if (!data) return;
 				if (!data?.user.twoFactorEnabled) return;
+				const { requiresTwoFactor, trustDeviceCookie } = await getSignInTwoFactorState(ctx);
 				const trustDeviceCookieAttrs = ctx.context.createAuthCookie(TRUST_DEVICE_COOKIE_NAME, { maxAge: trustDeviceMaxAge });
-				const trustDeviceCookie = await ctx.getSignedCookie(trustDeviceCookieAttrs.name, ctx.context.secret);
-				if (trustDeviceCookie) {
-					const [token, trustIdentifier] = trustDeviceCookie.split("!");
-					if (token && trustIdentifier) {
-						if (token === await createHMAC("SHA-256", "base64urlnopad").sign(ctx.context.secret, `${data.user.id}!${trustIdentifier}`)) {
-							const verificationRecord = await ctx.context.internalAdapter.findVerificationValue(trustIdentifier);
-							if (verificationRecord && verificationRecord.value === data.user.id && verificationRecord.expiresAt > /* @__PURE__ */ new Date()) {
-								await ctx.context.internalAdapter.deleteVerificationByIdentifier(trustIdentifier);
-								const newTrustIdentifier = `trust-device-${generateRandomString(32)}`;
-								const newToken = await createHMAC("SHA-256", "base64urlnopad").sign(ctx.context.secret, `${data.user.id}!${newTrustIdentifier}`);
-								await ctx.context.internalAdapter.createVerificationValue({
-									value: data.user.id,
-									identifier: newTrustIdentifier,
-									expiresAt: new Date(Date.now() + trustDeviceMaxAge * 1e3)
-								});
-								const newTrustDeviceCookie = ctx.context.createAuthCookie(TRUST_DEVICE_COOKIE_NAME, { maxAge: trustDeviceMaxAge });
-								await ctx.setSignedCookie(newTrustDeviceCookie.name, `${newToken}!${newTrustIdentifier}`, ctx.context.secret, trustDeviceCookieAttrs.attributes);
-								return;
-							}
-						}
-					}
-					expireCookie(ctx, trustDeviceCookieAttrs);
+				if (!requiresTwoFactor && trustDeviceCookie) {
+					const trustIdentifier = trustDeviceCookie.split("!")[1];
+					await ctx.context.internalAdapter.deleteVerificationByIdentifier(trustIdentifier);
+					const newTrustIdentifier = `trust-device-${generateRandomString(32)}`;
+					const newToken = await createHMAC("SHA-256", "base64urlnopad").sign(ctx.context.secret, `${data.user.id}!${newTrustIdentifier}`);
+					await ctx.context.internalAdapter.createVerificationValue({
+						value: data.user.id,
+						identifier: newTrustIdentifier,
+						expiresAt: new Date(Date.now() + trustDeviceMaxAge * 1e3)
+					});
+					const newTrustDeviceCookie = ctx.context.createAuthCookie(TRUST_DEVICE_COOKIE_NAME, { maxAge: trustDeviceMaxAge });
+					await ctx.setSignedCookie(newTrustDeviceCookie.name, `${newToken}!${newTrustIdentifier}`, ctx.context.secret, trustDeviceCookieAttrs.attributes);
+					return;
 				}
+				if (trustDeviceCookie) expireCookie(ctx, trustDeviceCookieAttrs);
 				/**
 				* Remove the session cookie set by the credential sign-in.
 				*

package/dist/plugins/two-factor/verify-two-factor.mjs

@@ -1,7 +1,7 @@
 import { parseUserOutput } from "../../db/schema.mjs";
 import { generateRandomString } from "../../crypto/random.mjs";
 import { expireCookie, setSessionCookie } from "../../cookies/index.mjs";
-import { getSessionFromCtx } from "../../api/routes/session.mjs";
+import { getAuthoritativeSessionFromCtx } from "../../api/routes/session.mjs";
 import { TWO_FACTOR_ERROR_CODES } from "./error-code.mjs";
 import { TRUST_DEVICE_COOKIE_NAME, TWO_FACTOR_COOKIE_NAME } from "./constant.mjs";
 import { APIError } from "@better-auth/core/error";
@@ -11,7 +11,7 @@ async function verifyTwoFactor(ctx) {
 	const invalid = (errorKey) => {
 		throw APIError.from("UNAUTHORIZED", TWO_FACTOR_ERROR_CODES[errorKey]);
 	};
-	const session = await getSessionFromCtx(ctx);
+	const session = await getAuthoritativeSessionFromCtx(ctx);
 	if (!session) {
 		const twoFactorCookie = ctx.context.createAuthCookie(TWO_FACTOR_COOKIE_NAME);
 		const signedTwoFactorCookie = await ctx.getSignedCookie(twoFactorCookie.name, ctx.context.secret);

package/dist/plugins/username/index.mjs

@@ -187,7 +187,7 @@ const usernameImpl = (options, includeDisplayUsername) => {
 				if (ctx.context.options?.emailAndPassword?.requireEmailVerification && !user.emailVerified) {
 					if (!ctx.context.options?.emailVerification?.sendVerificationEmail) throw APIError.from("FORBIDDEN", USERNAME_ERROR_CODES.EMAIL_NOT_VERIFIED);
 					if (ctx.context.options?.emailVerification?.sendOnSignIn) {
-						const token = await createEmailVerificationToken(ctx.context.secret, user.email, void 0, ctx.context.options.emailVerification?.expiresIn);
+						const token = await createEmailVerificationToken(ctx.context.secret, user.email, void 0, ctx.context.options.emailVerification?.expiresIn, { userId: user.id });
 						const url = `${ctx.context.baseURL}/verify-email?token=${token}&callbackURL=${encodeURIComponent(ctx.body.callbackURL || "/")}`;
 						await ctx.context.runInBackgroundOrAwait(ctx.context.options.emailVerification.sendVerificationEmail({
 							user,

package/dist/state.d.mts

@@ -12,12 +12,17 @@ declare const stateDataSchema: z.ZodObject<{
   link: z.ZodOptional<z.ZodObject<{
     email: z.ZodString;
     userId: z.ZodCoercedString<unknown>;
+    encryptedSessionToken: z.ZodOptional<z.ZodString>;
   }, z.core.$strip>>;
   requestSignUp: z.ZodOptional<z.ZodBoolean>;
   idTokenNonce: z.ZodOptional<z.ZodString>;
   serverContext: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 }, z.core.$loose>;
 export type StateData = z.infer<typeof stateDataSchema>;
+/**
+ * Verification key for database-backed OAuth and SAML relay state.
+ */
+export declare const getAuthStateVerificationIdentifier: (state: string) => string;
 export declare function generateGenericState(c: GenericEndpointContext, stateData: StateData, settings?: {
   cookieName: string;
 }): Promise<{
@@ -38,6 +43,7 @@ export declare function parseGenericState(c: GenericEndpointContext, state: stri
   link?: {
     email: string;
     userId: string;
+    encryptedSessionToken?: string | undefined;
   } | undefined;
   requestSignUp?: boolean | undefined;
   idTokenNonce?: string | undefined;

package/dist/state.mjs

@@ -18,7 +18,8 @@ const stateDataSchema = z.looseObject({
 	oauthState: z.string().optional(),
 	link: z.object({
 		email: z.string(),
-		userId: z.coerce.string()
+		userId: z.coerce.string(),
+		encryptedSessionToken: z.string().optional()
 	}).optional(),
 	requestSignUp: z.boolean().optional(),
 	/**
@@ -33,7 +34,9 @@ const stateDataSchema = z.looseObject({
 	*/
 	serverContext: z.record(z.string(), z.unknown()).optional()
 });
-/** Verification key for database-backed OAuth and SAML relay state. */
+/**
+* Verification key for database-backed OAuth and SAML relay state.
+*/
 const getAuthStateVerificationIdentifier = (state) => `auth-state:${state}`;
 const INTERNAL_STATE_KEYS = new Set(Object.keys(stateDataSchema.shape));
 var StateError = class extends BetterAuthError {