better-auth 1.7.15 → 1.7.17

package/dist/plugins/organization/routes/crud-members.mjs

@@ -2,10 +2,10 @@ import { toZodSchema } from "../../../db/to-zod.mjs";
 import { getSessionFromCtx, sessionMiddleware } from "../../../api/routes/session.mjs";
 import { defaultRoles } from "../access/statement.mjs";
 import { ORGANIZATION_ERROR_CODES } from "../error-codes.mjs";
+import { parseRoleList, parseRoles } from "../roles.mjs";
 import { getOrgAdapter } from "../adapter.mjs";
 import { orgMiddleware, orgSessionMiddleware } from "../call.mjs";
 import { hasPermission } from "../has-permission.mjs";
-import { parseRoles } from "../organization.mjs";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { whereOperators } from "@better-auth/core/db/adapter";
 import { createAuthEndpoint } from "@better-auth/core/api";
@@ -190,14 +190,12 @@ const removeMember = (options) => createAuthEndpoint("/organization/remove-membe
 		}
 	}
 	if (!toBeRemovedMember) throw APIError.from("BAD_REQUEST", ORGANIZATION_ERROR_CODES.MEMBER_NOT_FOUND);
-	const roles = toBeRemovedMember.role.split(",");
+	const roles = parseRoleList(toBeRemovedMember.role);
 	const creatorRole = ctx.context.orgOptions?.creatorRole || "owner";
 	if (roles.includes(creatorRole)) {
-		if (!member.role.split(",").map((r) => r.trim()).includes(creatorRole)) throw APIError.from("BAD_REQUEST", ORGANIZATION_ERROR_CODES.YOU_CANNOT_LEAVE_THE_ORGANIZATION_AS_THE_ONLY_OWNER);
+		if (!parseRoleList(member.role).includes(creatorRole)) throw APIError.from("BAD_REQUEST", ORGANIZATION_ERROR_CODES.YOU_CANNOT_LEAVE_THE_ORGANIZATION_AS_THE_ONLY_OWNER);
 		const { members } = await adapter.listMembers({ organizationId });
-		if (members.filter((member) => {
-			return member.role.split(",").includes(creatorRole);
-		}).length <= 1) throw APIError.from("BAD_REQUEST", ORGANIZATION_ERROR_CODES.YOU_CANNOT_LEAVE_THE_ORGANIZATION_AS_THE_ONLY_OWNER);
+		if (members.filter((member) => parseRoleList(member.role).includes(creatorRole)).length <= 1) throw APIError.from("BAD_REQUEST", ORGANIZATION_ERROR_CODES.YOU_CANNOT_LEAVE_THE_ORGANIZATION_AS_THE_ONLY_OWNER);
 	}
 	if (!await hasPermission({
 		role: member.role,
@@ -273,7 +271,7 @@ const updateMemberRole = (option) => createAuthEndpoint("/organization/update-me
 	const organizationId = ctx.body.organizationId || session.session.activeOrganizationId;
 	if (!organizationId) throw APIError.from("BAD_REQUEST", ORGANIZATION_ERROR_CODES.NO_ACTIVE_ORGANIZATION);
 	const adapter = getOrgAdapter(ctx.context, ctx.context.orgOptions);
-	const roleToSet = (Array.isArray(ctx.body.role) ? ctx.body.role : [ctx.body.role]).flatMap((role) => role.split(",")).map((role) => role.trim()).filter(Boolean);
+	const roleToSet = parseRoleList(ctx.body.role);
 	if (roleToSet.length === 0) throw APIError.fromStatus("BAD_REQUEST");
 	const member = await adapter.findMemberByOrgId({
 		userId: session.user.id,
@@ -284,8 +282,8 @@ const updateMemberRole = (option) => createAuthEndpoint("/organization/update-me
 	if (!toBeUpdatedMember) throw APIError.from("BAD_REQUEST", ORGANIZATION_ERROR_CODES.MEMBER_NOT_FOUND);
 	if (!(toBeUpdatedMember.organizationId === organizationId)) throw APIError.from("FORBIDDEN", ORGANIZATION_ERROR_CODES.YOU_ARE_NOT_ALLOWED_TO_UPDATE_THIS_MEMBER);
 	const creatorRole = ctx.context.orgOptions?.creatorRole || "owner";
-	const updatingMemberRoles = member.role.split(",");
-	const isUpdatingCreator = toBeUpdatedMember.role.split(",").includes(creatorRole);
+	const updatingMemberRoles = parseRoleList(member.role);
+	const isUpdatingCreator = parseRoleList(toBeUpdatedMember.role).includes(creatorRole);
 	const updaterIsCreator = updatingMemberRoles.includes(creatorRole);
 	const isSettingCreatorRole = roleToSet.includes(creatorRole);
 	const memberIsUpdatingThemselves = member.id === toBeUpdatedMember.id;
@@ -297,9 +295,7 @@ const updateMemberRole = (option) => createAuthEndpoint("/organization/update-me
 				field: "organizationId",
 				value: organizationId
 			}]
-		})).filter((member) => {
-			return member.role.split(",").includes(creatorRole);
-		}).length <= 1 && !isSettingCreatorRole) throw APIError.from("BAD_REQUEST", ORGANIZATION_ERROR_CODES.YOU_CANNOT_LEAVE_THE_ORGANIZATION_WITHOUT_AN_OWNER);
+		})).filter((member) => parseRoleList(member.role).includes(creatorRole)).length <= 1 && !isSettingCreatorRole) throw APIError.from("BAD_REQUEST", ORGANIZATION_ERROR_CODES.YOU_CANNOT_LEAVE_THE_ORGANIZATION_WITHOUT_AN_OWNER);
 	}
 	if (!await hasPermission({
 		role: member.role,
@@ -419,14 +415,14 @@ const leaveOrganization = (options) => createAuthEndpoint("/organization/leave",
 	});
 	if (!member) throw APIError.from("BAD_REQUEST", ORGANIZATION_ERROR_CODES.MEMBER_NOT_FOUND);
 	const creatorRole = ctx.context.orgOptions?.creatorRole || "owner";
-	if (member.role.split(",").includes(creatorRole)) {
+	if (parseRoleList(member.role).includes(creatorRole)) {
 		if ((await ctx.context.adapter.findMany({
 			model: "member",
 			where: [{
 				field: "organizationId",
 				value: ctx.body.organizationId
 			}]
-		})).filter((member) => member.role.split(",").includes(creatorRole)).length <= 1) throw APIError.from("BAD_REQUEST", ORGANIZATION_ERROR_CODES.YOU_CANNOT_LEAVE_THE_ORGANIZATION_AS_THE_ONLY_OWNER);
+		})).filter((member) => parseRoleList(member.role).includes(creatorRole)).length <= 1) throw APIError.from("BAD_REQUEST", ORGANIZATION_ERROR_CODES.YOU_CANNOT_LEAVE_THE_ORGANIZATION_AS_THE_ONLY_OWNER);
 	}
 	await adapter.deleteMember({
 		memberId: member.id,

package/dist/plugins/organization/routes/crud-org.mjs

@@ -4,7 +4,7 @@ import { getSessionFromCtx, requestOnlySessionMiddleware } from "../../../api/ro
 import { ORGANIZATION_ERROR_CODES } from "../error-codes.mjs";
 import { getOrgAdapter } from "../adapter.mjs";
 import { orgMiddleware, orgSessionMiddleware } from "../call.mjs";
-import { hasPermission } from "../has-permission.mjs";
+import { canViewInvitations, hasPermission, withoutCreatorRoleInvitations } from "../has-permission.mjs";
 import { APIError } from "@better-auth/core/error";
 import { createAuthEndpoint } from "@better-auth/core/api";
 import * as z from "zod";
@@ -362,13 +362,22 @@ const getFullOrganization = (options) => createAuthEndpoint("/organization/get-f
 		membersLimit: ctx.query?.membersLimit
 	});
 	if (!organization) throw APIError.from("BAD_REQUEST", ORGANIZATION_ERROR_CODES.ORGANIZATION_NOT_FOUND);
-	if (!await adapter.checkMembership({
+	const isMember = await adapter.checkMembership({
 		userId: session.user.id,
 		organizationId: organization.id
-	})) {
+	});
+	if (!isMember) {
 		await adapter.setActiveOrganization(session.session.token, null, ctx);
 		throw APIError.from("FORBIDDEN", ORGANIZATION_ERROR_CODES.USER_IS_NOT_A_MEMBER_OF_THE_ORGANIZATION);
 	}
+	organization.invitations = organization.invitations.length > 0 && await canViewInvitations({
+		role: isMember.role,
+		options: ctx.context.orgOptions,
+		organizationId: organization.id
+	}, ctx) ? withoutCreatorRoleInvitations(organization.invitations, {
+		role: isMember.role,
+		options: ctx.context.orgOptions
+	}) : [];
 	return ctx.json(organization);
 });
 const setActiveOrganizationBodySchema = z.object({

package/dist/plugins/phone-number/client.d.mts

@@ -21,7 +21,9 @@ export declare const phoneNumberClient: () => {
     UNEXPECTED_ERROR: import("@better-auth/core/utils/error-codes").RawError<"UNEXPECTED_ERROR">;
     OTP_NOT_FOUND: import("@better-auth/core/utils/error-codes").RawError<"OTP_NOT_FOUND">;
     PHONE_NUMBER_NOT_VERIFIED: import("@better-auth/core/utils/error-codes").RawError<"PHONE_NUMBER_NOT_VERIFIED">;
+    PHONE_NUMBER_PENDING_VERIFICATION: import("@better-auth/core/utils/error-codes").RawError<"PHONE_NUMBER_PENDING_VERIFICATION">;
     PHONE_NUMBER_CANNOT_BE_UPDATED: import("@better-auth/core/utils/error-codes").RawError<"PHONE_NUMBER_CANNOT_BE_UPDATED">;
+    PHONE_NUMBER_CANNOT_BE_SET: import("@better-auth/core/utils/error-codes").RawError<"PHONE_NUMBER_CANNOT_BE_SET">;
     SEND_OTP_NOT_IMPLEMENTED: import("@better-auth/core/utils/error-codes").RawError<"SEND_OTP_NOT_IMPLEMENTED">;
   };
 };

package/dist/plugins/phone-number/error-codes.d.mts

@@ -10,7 +10,9 @@ export declare const PHONE_NUMBER_ERROR_CODES: {
   UNEXPECTED_ERROR: import("@better-auth/core/utils/error-codes").RawError<"UNEXPECTED_ERROR">;
   OTP_NOT_FOUND: import("@better-auth/core/utils/error-codes").RawError<"OTP_NOT_FOUND">;
   PHONE_NUMBER_NOT_VERIFIED: import("@better-auth/core/utils/error-codes").RawError<"PHONE_NUMBER_NOT_VERIFIED">;
+  PHONE_NUMBER_PENDING_VERIFICATION: import("@better-auth/core/utils/error-codes").RawError<"PHONE_NUMBER_PENDING_VERIFICATION">;
   PHONE_NUMBER_CANNOT_BE_UPDATED: import("@better-auth/core/utils/error-codes").RawError<"PHONE_NUMBER_CANNOT_BE_UPDATED">;
+  PHONE_NUMBER_CANNOT_BE_SET: import("@better-auth/core/utils/error-codes").RawError<"PHONE_NUMBER_CANNOT_BE_SET">;
   SEND_OTP_NOT_IMPLEMENTED: import("@better-auth/core/utils/error-codes").RawError<"SEND_OTP_NOT_IMPLEMENTED">;
 };
 //#endregion

package/dist/plugins/phone-number/error-codes.mjs

@@ -10,7 +10,9 @@ const PHONE_NUMBER_ERROR_CODES = defineErrorCodes({
 	OTP_EXPIRED: "OTP expired",
 	INVALID_OTP: "Invalid OTP",
 	PHONE_NUMBER_NOT_VERIFIED: "Phone number not verified",
+	PHONE_NUMBER_PENDING_VERIFICATION: "Phone number requires account ownership proof",
 	PHONE_NUMBER_CANNOT_BE_UPDATED: "Phone number cannot be updated",
+	PHONE_NUMBER_CANNOT_BE_SET: "Phone number can only be set by verifying it",
 	SEND_OTP_NOT_IMPLEMENTED: "sendOTP not implemented",
 	TOO_MANY_ATTEMPTS: "Too many attempts"
 });

package/dist/plugins/phone-number/index.d.mts

@@ -14,6 +14,28 @@ export declare const phoneNumber: (options?: PhoneNumberOptions | undefined) =>
     options: {
       databaseHooks: {
         user: {
+          create: {
+            before(data: {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            } & Record<string, unknown>, ctx: import("@better-auth/core").GenericEndpointContext | null): Promise<{
+              data: {
+                [x: string]: unknown;
+                id: string;
+                createdAt: Date;
+                updatedAt: Date;
+                email: string;
+                emailVerified: boolean;
+                name: string;
+                image?: string | null | undefined;
+              };
+            } | undefined>;
+          };
           update: {
             before(data: Partial<{
               id: string;
@@ -23,7 +45,7 @@ export declare const phoneNumber: (options?: PhoneNumberOptions | undefined) =>
               emailVerified: boolean;
               name: string;
               image?: string | null | undefined;
-            }> & Record<string, unknown>): Promise<{
+            }> & Record<string, unknown>, ctx: import("@better-auth/core").GenericEndpointContext | null): Promise<{
               data: {
                 [x: string]: unknown;
                 id?: string | undefined;
@@ -346,7 +368,9 @@ export declare const phoneNumber: (options?: PhoneNumberOptions | undefined) =>
     UNEXPECTED_ERROR: import("@better-auth/core/utils/error-codes").RawError<"UNEXPECTED_ERROR">;
     OTP_NOT_FOUND: import("@better-auth/core/utils/error-codes").RawError<"OTP_NOT_FOUND">;
     PHONE_NUMBER_NOT_VERIFIED: import("@better-auth/core/utils/error-codes").RawError<"PHONE_NUMBER_NOT_VERIFIED">;
+    PHONE_NUMBER_PENDING_VERIFICATION: import("@better-auth/core/utils/error-codes").RawError<"PHONE_NUMBER_PENDING_VERIFICATION">;
     PHONE_NUMBER_CANNOT_BE_UPDATED: import("@better-auth/core/utils/error-codes").RawError<"PHONE_NUMBER_CANNOT_BE_UPDATED">;
+    PHONE_NUMBER_CANNOT_BE_SET: import("@better-auth/core/utils/error-codes").RawError<"PHONE_NUMBER_CANNOT_BE_SET">;
     SEND_OTP_NOT_IMPLEMENTED: import("@better-auth/core/utils/error-codes").RawError<"SEND_OTP_NOT_IMPLEMENTED">;
   };
 };

package/dist/plugins/phone-number/index.mjs

@@ -20,12 +20,28 @@ const phoneNumber = (options) => {
 		id: "phone-number",
 		version: PACKAGE_VERSION,
 		init() {
-			return { options: { databaseHooks: { user: { update: { async before(data) {
-				if (opts.phoneNumber in data && data[opts.phoneNumber] === null) return { data: {
-					...data,
-					[opts.phoneNumberVerified]: false
-				} };
-			} } } } } };
+			return { options: { databaseHooks: { user: {
+				create: { async before(data, ctx) {
+					if (data[opts.phoneNumber] == null || data[opts.phoneNumberVerified] === true) return;
+					if (ctx?.body?.[opts.phoneNumber]) throw APIError.from("BAD_REQUEST", PHONE_NUMBER_ERROR_CODES.PHONE_NUMBER_CANNOT_BE_SET);
+					return { data: {
+						...data,
+						[opts.phoneNumber]: null,
+						[opts.phoneNumberVerified]: false
+					} };
+				} },
+				update: { async before(data, ctx) {
+					if (opts.phoneNumber in data && data[opts.phoneNumber] === null) return { data: {
+						...data,
+						[opts.phoneNumberVerified]: false
+					} };
+					if (!ctx || data[opts.phoneNumber] == null || data[opts.phoneNumberVerified] === true || ctx.path === "/admin/update-user") return;
+					return { data: {
+						...data,
+						[opts.phoneNumber]: void 0
+					} };
+				} }
+			} } } };
 		},
 		hooks: { before: [{
 			matcher: (ctx) => ctx.path === "/update-user" && "phoneNumber" in ctx.body && ctx.body.phoneNumber !== null,

package/dist/plugins/phone-number/routes.mjs

@@ -2,9 +2,10 @@ import { parseUserInput, parseUserOutput } from "../../db/schema.mjs";
 import { getDate } from "../../utils/date.mjs";
 import { generateRandomString } from "../../crypto/random.mjs";
 import { setSessionCookie } from "../../cookies/index.mjs";
-import { getSessionFromCtx } from "../../api/routes/session.mjs";
+import { getAuthoritativeSessionFromCtx } from "../../api/routes/session.mjs";
 import { HIDE_METADATA } from "../../utils/hide-metadata.mjs";
 import { assertPasswordNotTooLong, assertPasswordNotTooShort, resetCredentialPassword } from "../../utils/password.mjs";
+import { isSessionOutsideStore } from "../../api/state/session-source.mjs";
 import { PHONE_NUMBER_ERROR_CODES } from "./error-codes.mjs";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { createAuthEndpoint } from "@better-auth/core/api";
@@ -69,7 +70,7 @@ const signInPhoneNumber = (opts) => createAuthEndpoint("/sign-in/phone-number",
 			const otp = generateOTP(opts.otpLength);
 			await ctx.context.internalAdapter.createVerificationValue({
 				value: otp,
-				identifier: phoneNumber,
+				identifier: phoneNumberOTPIdentifier(phoneNumber),
 				expiresAt: getDate(opts.expiresIn, "sec")
 			});
 			if (opts.sendOTP) await ctx.context.runInBackgroundOrAwait(opts.sendOTP({
@@ -155,7 +156,7 @@ const sendPhoneNumberOTP = (opts) => createAuthEndpoint("/phone-number/send-otp"
 	const code = generateOTP(opts.otpLength);
 	await ctx.context.internalAdapter.createVerificationValue({
 		value: `${code}:0`,
-		identifier: ctx.body.phoneNumber,
+		identifier: phoneNumberOTPIdentifier(ctx.body.phoneNumber),
 		expiresAt: getDate(opts.expiresIn, "sec")
 	});
 	const sendOTPResult = opts.sendOTP({
@@ -174,11 +175,12 @@ const sendPhoneNumberOTP = (opts) => createAuthEndpoint("/phone-number/send-otp"
 });
 async function verifyAndConsumePhoneNumberOTP(ctx, opts, body) {
 	const { phoneNumber, code } = body;
+	const identifier = phoneNumberOTPIdentifier(phoneNumber);
 	if (opts.verifyOTP) {
-		await verifyWithCustomVerifier(ctx, opts.verifyOTP, phoneNumber, code, phoneNumber);
+		await verifyWithCustomVerifier(ctx, opts.verifyOTP, phoneNumber, code, identifier);
 		return;
 	}
-	await verifyPhoneNumberOTP(ctx, opts, phoneNumber, code);
+	await verifyPhoneNumberOTP(ctx, opts, identifier, code);
 }
 /** Checks the code with `verifyOTP`, then drops the code stored under `identifier`. */
 async function verifyWithCustomVerifier(ctx, verifyOTP, phoneNumber, code, identifier) {
@@ -330,7 +332,8 @@ const verifyPhoneNumber = (opts) => createAuthEndpoint("/phone-number/verify", {
 }, async (ctx) => {
 	await verifyAndConsumePhoneNumberOTP(ctx, opts, ctx.body);
 	if (ctx.body.updatePhoneNumber) {
-		const session = await getSessionFromCtx(ctx);
+		const requestSession = ctx.context.session;
+		const session = requestSession && await isSessionOutsideStore(requestSession.session.token) ? requestSession : await getAuthoritativeSessionFromCtx(ctx);
 		if (!session) throw APIError.from("UNAUTHORIZED", BASE_ERROR_CODES.USER_NOT_FOUND);
 		if ((await ctx.context.adapter.findMany({
 			model: "user",
@@ -429,10 +432,10 @@ const requestPasswordResetPhoneNumber = (opts) => createAuthEndpoint("/phone-num
 	const code = generateOTP(opts.otpLength);
 	await ctx.context.internalAdapter.createVerificationValue({
 		value: `${code}:0`,
-		identifier: `${ctx.body.phoneNumber}-request-password-reset`,
+		identifier: phoneNumberResetIdentifier(ctx.body.phoneNumber),
 		expiresAt: getDate(opts.expiresIn, "sec")
 	});
-	if (!user) return ctx.json({ status: true });
+	if (!user || opts.requireVerification && !user.phoneNumberVerified) return ctx.json({ status: true });
 	if (opts.sendPasswordResetOTP) await ctx.context.runInBackgroundOrAwait(opts.sendPasswordResetOTP({
 		phoneNumber: ctx.body.phoneNumber,
 		code
@@ -463,17 +466,11 @@ const resetPasswordPhoneNumber = (opts) => createAuthEndpoint("/phone-number/res
 		} }
 	} }
 }, async (ctx) => {
-	const phoneResetIdentifier = `${ctx.body.phoneNumber}-request-password-reset`;
-	let otpConsumed = false;
-	if (opts.verifyOTP) {
-		assertPasswordNotTooShort(ctx, ctx.body.newPassword);
-		assertPasswordNotTooLong(ctx, ctx.body.newPassword);
-		await verifyWithCustomVerifier(ctx, opts.verifyOTP, ctx.body.phoneNumber, ctx.body.otp, phoneResetIdentifier);
-		otpConsumed = true;
-	} else if (!await matchesUsableStoredPhoneNumberOTP(ctx, opts, phoneResetIdentifier, ctx.body.otp)) {
-		await verifyPhoneNumberOTP(ctx, opts, phoneResetIdentifier, ctx.body.otp);
-		otpConsumed = true;
-	}
+	const phoneResetIdentifier = phoneNumberResetIdentifier(ctx.body.phoneNumber);
+	assertPasswordNotTooShort(ctx, ctx.body.newPassword);
+	assertPasswordNotTooLong(ctx, ctx.body.newPassword);
+	if (opts.verifyOTP) await verifyWithCustomVerifier(ctx, opts.verifyOTP, ctx.body.phoneNumber, ctx.body.otp, phoneResetIdentifier);
+	else await verifyPhoneNumberOTP(ctx, opts, phoneResetIdentifier, ctx.body.otp, "restore");
 	const user = await ctx.context.adapter.findOne({
 		model: "user",
 		where: [{
@@ -482,10 +479,9 @@ const resetPasswordPhoneNumber = (opts) => createAuthEndpoint("/phone-number/res
 		}]
 	});
 	if (!user) throw APIError.from("BAD_REQUEST", PHONE_NUMBER_ERROR_CODES.UNEXPECTED_ERROR);
-	assertPasswordNotTooShort(ctx, ctx.body.newPassword);
-	assertPasswordNotTooLong(ctx, ctx.body.newPassword);
+	if (opts.requireVerification && !user.phoneNumberVerified) throw APIError.from("BAD_REQUEST", PHONE_NUMBER_ERROR_CODES.PHONE_NUMBER_PENDING_VERIFICATION);
 	const hashedPassword = await ctx.context.password.hash(ctx.body.newPassword);
-	await resetCredentialPassword(ctx, user.id, hashedPassword, otpConsumed ? void 0 : () => verifyPhoneNumberOTP(ctx, opts, phoneResetIdentifier, ctx.body.otp));
+	await resetCredentialPassword(ctx, user.id, hashedPassword, opts.verifyOTP ? void 0 : () => verifyPhoneNumberOTP(ctx, opts, phoneResetIdentifier, ctx.body.otp));
 	if (ctx.context.options.emailAndPassword?.onPasswordReset) await ctx.context.options.emailAndPassword.onPasswordReset({ user }, ctx.request);
 	return ctx.json({ status: true });
 });
@@ -497,9 +493,10 @@ const resetPasswordPhoneNumber = (opts) => createAuthEndpoint("/phone-number/res
 * never satisfy two simultaneous verifications. On a wrong code that is still
 * within the attempt budget, the row is recreated with the same value and
 * expiry and an incremented attempt counter. Once the budget is exhausted the
-* row is not recreated.
+* row is not recreated. With `"restore"`, a correct code is written back
+* unchanged so a follow-up call can spend it.
 */
-async function verifyPhoneNumberOTP(ctx, opts, identifier, providedCode) {
+async function verifyPhoneNumberOTP(ctx, opts, identifier, providedCode, successDisposition = "consume") {
 	const existing = await ctx.context.internalAdapter.findVerificationValue(identifier);
 	if (!existing) throw APIError.from("BAD_REQUEST", PHONE_NUMBER_ERROR_CODES.OTP_NOT_FOUND);
 	if (existing.expiresAt < /* @__PURE__ */ new Date()) {
@@ -524,22 +521,24 @@ async function verifyPhoneNumberOTP(ctx, opts, identifier, providedCode) {
 		});
 		throw APIError.from("BAD_REQUEST", PHONE_NUMBER_ERROR_CODES.INVALID_OTP);
 	}
-}
-/**
-* Reports whether the provided code matches a stored, unexpired record with
-* attempts left, without consuming it or counting an attempt.
-*/
-async function matchesUsableStoredPhoneNumberOTP(ctx, opts, identifier, providedCode) {
-	const existing = await ctx.context.internalAdapter.findVerificationValue(identifier);
-	if (!existing || existing.expiresAt < /* @__PURE__ */ new Date()) return false;
-	const [otpValue, rawAttempts] = existing.value.split(":");
-	if (parseVerificationAttempts(rawAttempts) >= (opts?.allowedAttempts ?? 3)) return false;
-	return otpValue === providedCode;
+	if (successDisposition === "consume") return;
+	if (await ctx.context.internalAdapter.findVerificationValue(identifier)) throw APIError.from("BAD_REQUEST", PHONE_NUMBER_ERROR_CODES.INVALID_OTP);
+	if (!await ctx.context.internalAdapter.createVerificationValue({
+		value: consumed.value,
+		identifier,
+		expiresAt: consumed.expiresAt
+	})) throw APIError.fromStatus("INTERNAL_SERVER_ERROR", { message: "Unable to complete OTP verification" });
 }
 function parseVerificationAttempts(value) {
 	const attempts = Number(value ?? 0);
 	return Number.isSafeInteger(attempts) && attempts > 0 ? attempts : 0;
 }
+function phoneNumberOTPIdentifier(phoneNumber) {
+	return `phone-number-otp-${phoneNumber}`;
+}
+function phoneNumberResetIdentifier(phoneNumber) {
+	return `phone-number-reset-${phoneNumber}`;
+}
 function generateOTP(size) {
 	return generateRandomString(size, "0-9");
 }

package/dist/plugins/two-factor/backup-codes/index.d.mts

@@ -170,7 +170,7 @@ export declare const backupCode2fa: (opts: BackupCodeOptions) => {
       };
     }, {
       token: string | undefined;
-      user: (Record<string, any> & {
+      user: ({
         id: string;
         createdAt: Date;
         updatedAt: Date;
@@ -178,7 +178,7 @@ export declare const backupCode2fa: (opts: BackupCodeOptions) => {
         emailVerified: boolean;
         name: string;
         image?: string | null | undefined;
-      }) | UserWithTwoFactor;
+      } & Record<string, any>) | UserWithTwoFactor;
     }>;
     /**
      * ### Endpoint

package/dist/plugins/two-factor/index.d.mts

@@ -4,6 +4,7 @@ import { TOTPOptions, totp2fa } from "./totp/index.mjs";
 import { TwoFactorOptions, TwoFactorProvider, TwoFactorTable, UserWithTwoFactor } from "./types.mjs";
 import { TWO_FACTOR_ERROR_CODES } from "./error-code.mjs";
 import { twoFactorClient } from "./client.mjs";
+import { GenericEndpointContext } from "@better-auth/core";
 import * as z from "zod";
 //#region src/plugins/two-factor/index.d.ts
 declare module "@better-auth/core" {
@@ -16,6 +17,12 @@ declare module "@better-auth/core" {
 export declare const twoFactor: <O extends TwoFactorOptions>(options?: O) => {
   id: "two-factor";
   version: string;
+  /**
+   * Whether this sign-in still requires a second factor.
+   *
+   * @internal
+   */
+  shouldRequireTwoFactor: (ctx: GenericEndpointContext) => Promise<boolean>;
   endpoints: {
     /**
      * ### Endpoint
@@ -37,15 +44,15 @@ export declare const twoFactor: <O extends TwoFactorOptions>(options?: O) => {
       body: z.ZodObject<{
         password: z.ZodOptional<z.ZodString>;
         method: z.ZodDefault<z.ZodEnum<{
-          otp: "otp";
           totp: "totp";
+          otp: "otp";
         }>>;
         issuer: z.ZodOptional<z.ZodString>;
       }, z.core.$strip> | z.ZodObject<{
         password: z.ZodString;
         method: z.ZodDefault<z.ZodEnum<{
-          otp: "otp";
           totp: "totp";
+          otp: "otp";
         }>>;
         issuer: z.ZodOptional<z.ZodString>;
       }, z.core.$strip>;
@@ -288,7 +295,7 @@ export declare const twoFactor: <O extends TwoFactorOptions>(options?: O) => {
       };
     }, {
       token: string | undefined;
-      user: (Record<string, any> & {
+      user: ({
         id: string;
         createdAt: Date;
         updatedAt: Date;
@@ -296,7 +303,7 @@ export declare const twoFactor: <O extends TwoFactorOptions>(options?: O) => {
         emailVerified: boolean;
         name: string;
         image?: string | null | undefined;
-      }) | UserWithTwoFactor;
+      } & Record<string, any>) | UserWithTwoFactor;
     }>;
     generateBackupCodes: import("better-call").StrictEndpoint<"/two-factor/generate-backup-codes", {
       method: "POST";
@@ -483,7 +490,7 @@ export declare const twoFactor: <O extends TwoFactorOptions>(options?: O) => {
       user: UserWithTwoFactor;
     } | {
       token: string;
-      user: Record<string, any> & {
+      user: {
         id: string;
         createdAt: Date;
         updatedAt: Date;
@@ -491,7 +498,7 @@ export declare const twoFactor: <O extends TwoFactorOptions>(options?: O) => {
         emailVerified: boolean;
         name: string;
         image?: string | null | undefined;
-      };
+      } & Record<string, any>;
     }>;
     generateTOTP: import("better-call").StrictEndpoint<string, {
       method: "POST";
@@ -614,7 +621,7 @@ export declare const twoFactor: <O extends TwoFactorOptions>(options?: O) => {
       user: UserWithTwoFactor;
     } | {
       token: string;
-      user: Record<string, any> & {
+      user: {
         id: string;
         createdAt: Date;
         updatedAt: Date;
@@ -622,7 +629,7 @@ export declare const twoFactor: <O extends TwoFactorOptions>(options?: O) => {
         emailVerified: boolean;
         name: string;
         image?: string | null | undefined;
-      };
+      } & Record<string, any>;
     }>;
   };
   options: NoInfer<O>;

package/dist/plugins/two-factor/index.mjs

@@ -2,8 +2,9 @@ import { mergeSchema } from "../../db/schema.mjs";
 import { generateRandomString } from "../../crypto/random.mjs";
 import { symmetricEncrypt } from "../../crypto/index.mjs";
 import { deleteSessionCookie, expireCookie, setSessionCookie } from "../../cookies/index.mjs";
-import { sensitiveSessionMiddleware, sessionMiddleware } from "../../api/routes/session.mjs";
+import { getAuthoritativeSessionFromCtx, sensitiveSessionMiddleware, sessionMiddleware } from "../../api/routes/session.mjs";
 import { shouldRequirePassword, validatePassword } from "../../utils/password.mjs";
+import { isSessionOutsideStore } from "../../api/state/session-source.mjs";
 import { PACKAGE_VERSION } from "../../version.mjs";
 import { TWO_FACTOR_ERROR_CODES } from "./error-code.mjs";
 import { twoFactorClient } from "./client.mjs";
@@ -18,6 +19,39 @@ import * as z from "zod";
 import { createHMAC } from "@better-auth/utils/hmac";
 import { createOTP } from "@better-auth/utils/otp";
 //#region src/plugins/two-factor/index.ts
+const signInPaths = /* @__PURE__ */ new Set([
+	"/sign-in/email",
+	"/sign-in/username",
+	"/sign-in/phone-number"
+]);
+const signInTwoFactorStates = /* @__PURE__ */ new WeakMap();
+async function readSignInTwoFactorState(ctx, trustDeviceMaxAge) {
+	const data = ctx.context.newSession;
+	if (!data?.user.twoFactorEnabled) return {
+		requiresTwoFactor: false,
+		trustDeviceCookie: null
+	};
+	const cookie = ctx.context.createAuthCookie(TRUST_DEVICE_COOKIE_NAME, { maxAge: trustDeviceMaxAge });
+	const trustDeviceCookie = await ctx.getSignedCookie(cookie.name, ctx.context.secret);
+	if (!trustDeviceCookie) return {
+		requiresTwoFactor: true,
+		trustDeviceCookie
+	};
+	const [token, trustIdentifier] = trustDeviceCookie.split("!");
+	if (!token || !trustIdentifier) return {
+		requiresTwoFactor: true,
+		trustDeviceCookie
+	};
+	if (token !== await createHMAC("SHA-256", "base64urlnopad").sign(ctx.context.secret, `${data.user.id}!${trustIdentifier}`)) return {
+		requiresTwoFactor: true,
+		trustDeviceCookie
+	};
+	const verificationRecord = await ctx.context.internalAdapter.findVerificationValue(trustIdentifier);
+	return {
+		requiresTwoFactor: !verificationRecord || verificationRecord.value !== data.user.id || !(verificationRecord.expiresAt > /* @__PURE__ */ new Date()),
+		trustDeviceCookie
+	};
+}
 const twoFactor = (options) => {
 	const opts = { twoFactorTable: "twoFactor" };
 	const trustDeviceMaxAge = options?.trustDeviceMaxAge ?? 2592e3;
@@ -48,9 +82,26 @@ const twoFactor = (options) => {
 		issuer: issuerField
 	});
 	const disableTwoFactorBodySchema = allowPasswordless ? z.object({ password: passwordSchema.optional() }) : z.object({ password: passwordSchema });
+	function getSignInTwoFactorState(ctx) {
+		const remembered = signInTwoFactorStates.get(ctx.context);
+		if (remembered) return remembered;
+		const state = readSignInTwoFactorState(ctx, trustDeviceMaxAge);
+		signInTwoFactorStates.set(ctx.context, state);
+		return state;
+	}
+	async function shouldRequireTwoFactor(ctx) {
+		if (!signInPaths.has(ctx.path)) return false;
+		return (await getSignInTwoFactorState(ctx)).requiresTwoFactor;
+	}
 	return {
 		id: "two-factor",
 		version: PACKAGE_VERSION,
+		/**
+		* Whether this sign-in still requires a second factor.
+		*
+		* @internal
+		*/
+		shouldRequireTwoFactor,
 		endpoints: {
 			...totp.endpoints,
 			...otp.endpoints,
@@ -102,7 +153,12 @@ const twoFactor = (options) => {
 					} }
 				} }
 			}, async (ctx) => {
-				const user = ctx.context.session.user;
+				const session = await isSessionOutsideStore(ctx.context.session.session.token) ? ctx.context.session : await getAuthoritativeSessionFromCtx(ctx);
+				if (!session) throw APIError.from("UNAUTHORIZED", {
+					message: "Unauthorized",
+					code: "UNAUTHORIZED"
+				});
+				const user = session.user;
 				const { password, issuer, method } = ctx.body;
 				if (await shouldRequirePassword(ctx, user.id, allowPasswordless)) {
 					if (!password) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.INVALID_PASSWORD);
@@ -246,36 +302,28 @@ const twoFactor = (options) => {
 		options,
 		hooks: { after: [{
 			matcher(context) {
-				return context.path === "/sign-in/email" || context.path === "/sign-in/username" || context.path === "/sign-in/phone-number";
+				return signInPaths.has(context.path ?? "");
 			},
 			handler: createAuthMiddleware(async (ctx) => {
 				const data = ctx.context.newSession;
-				if (!data) return;
 				if (!data?.user.twoFactorEnabled) return;
+				const { requiresTwoFactor, trustDeviceCookie } = await getSignInTwoFactorState(ctx);
 				const trustDeviceCookieAttrs = ctx.context.createAuthCookie(TRUST_DEVICE_COOKIE_NAME, { maxAge: trustDeviceMaxAge });
-				const trustDeviceCookie = await ctx.getSignedCookie(trustDeviceCookieAttrs.name, ctx.context.secret);
-				if (trustDeviceCookie) {
-					const [token, trustIdentifier] = trustDeviceCookie.split("!");
-					if (token && trustIdentifier) {
-						if (token === await createHMAC("SHA-256", "base64urlnopad").sign(ctx.context.secret, `${data.user.id}!${trustIdentifier}`)) {
-							const verificationRecord = await ctx.context.internalAdapter.findVerificationValue(trustIdentifier);
-							if (verificationRecord && verificationRecord.value === data.user.id && verificationRecord.expiresAt > /* @__PURE__ */ new Date()) {
-								await ctx.context.internalAdapter.deleteVerificationByIdentifier(trustIdentifier);
-								const newTrustIdentifier = `trust-device-${generateRandomString(32)}`;
-								const newToken = await createHMAC("SHA-256", "base64urlnopad").sign(ctx.context.secret, `${data.user.id}!${newTrustIdentifier}`);
-								await ctx.context.internalAdapter.createVerificationValue({
-									value: data.user.id,
-									identifier: newTrustIdentifier,
-									expiresAt: new Date(Date.now() + trustDeviceMaxAge * 1e3)
-								});
-								const newTrustDeviceCookie = ctx.context.createAuthCookie(TRUST_DEVICE_COOKIE_NAME, { maxAge: trustDeviceMaxAge });
-								await ctx.setSignedCookie(newTrustDeviceCookie.name, `${newToken}!${newTrustIdentifier}`, ctx.context.secret, trustDeviceCookieAttrs.attributes);
-								return;
-							}
-						}
-					}
-					expireCookie(ctx, trustDeviceCookieAttrs);
+				if (!requiresTwoFactor && trustDeviceCookie) {
+					const trustIdentifier = trustDeviceCookie.split("!")[1];
+					await ctx.context.internalAdapter.deleteVerificationByIdentifier(trustIdentifier);
+					const newTrustIdentifier = `trust-device-${generateRandomString(32)}`;
+					const newToken = await createHMAC("SHA-256", "base64urlnopad").sign(ctx.context.secret, `${data.user.id}!${newTrustIdentifier}`);
+					await ctx.context.internalAdapter.createVerificationValue({
+						value: data.user.id,
+						identifier: newTrustIdentifier,
+						expiresAt: new Date(Date.now() + trustDeviceMaxAge * 1e3)
+					});
+					const newTrustDeviceCookie = ctx.context.createAuthCookie(TRUST_DEVICE_COOKIE_NAME, { maxAge: trustDeviceMaxAge });
+					await ctx.setSignedCookie(newTrustDeviceCookie.name, `${newToken}!${newTrustIdentifier}`, ctx.context.secret, trustDeviceCookieAttrs.attributes);
+					return;
 				}
+				if (trustDeviceCookie) expireCookie(ctx, trustDeviceCookieAttrs);
 				/**
 				* Remove the session cookie set by the credential sign-in.
 				*