better-auth 1.7.2 → 1.7.4

package/dist/plugins/oauth-proxy/index.mjs

@@ -8,22 +8,50 @@ import { resolveOAuthAccountKey, toOAuthProfileRecord } from "../../oauth2/accou
 import { redirectOnError } from "../../oauth2/errors.mjs";
 import { getOAuthCallbackPath } from "../../oauth2/utils.mjs";
 import { handleOAuthUserInfo } from "../../oauth2/link-account.mjs";
+import { setOAuthState } from "../../api/state/oauth.mjs";
 import { parseGenericState } from "../../state.mjs";
 import { PACKAGE_VERSION } from "../../version.mjs";
 import { parseJSON } from "../../client/parser.mjs";
 import { checkSkipProxy, resolveCurrentURL, stripTrailingSlash } from "./utils.mjs";
+import { accountSchema, userSchema } from "@better-auth/core/db";
 import { safeJSONParse } from "@better-auth/core/utils/json";
 import { defu } from "defu";
 import { createAuthEndpoint, createAuthMiddleware } from "@better-auth/core/api";
 import * as z from "zod";
 //#region src/plugins/oauth-proxy/index.ts
-const consumeOAuthProxyState = async (ctx, state) => {
+/**
+* Passthrough payload containing OAuth profile data.
+* Used to transfer OAuth credentials from production to preview
+* without creating user/session on production.
+* @internal
+*/
+const passthroughPayloadSchema = z.looseObject({
+	userInfo: z.looseObject(userSchema.omit({
+		createdAt: true,
+		updatedAt: true
+	}).shape),
+	account: z.looseObject(accountSchema.omit({
+		id: true,
+		userId: true,
+		createdAt: true,
+		updatedAt: true
+	}).shape),
+	profile: z.record(z.string(), z.unknown()).optional(),
+	state: z.string().min(1),
+	callbackURL: z.string().min(1),
+	newUserURL: z.string().optional(),
+	errorURL: z.string().optional(),
+	disableSignUp: z.boolean().optional(),
+	timestamp: z.number()
+});
+const restoreOAuthProxyState = async (ctx, state) => {
 	try {
-		await parseGenericState(ctx, state, { skipStateCookieCheck: true });
-		return true;
+		const stateData = await parseGenericState(ctx, state, { skipStateCookieCheck: true });
+		await setOAuthState(stateData);
+		return stateData;
 	} catch (e) {
 		ctx.context.logger.warn("OAuth proxy state missing or invalid", e);
-		return false;
+		return null;
 	}
 };
 const oauthProxyQuerySchema = z.object({
@@ -38,104 +66,122 @@ const oauthCallbackQuerySchema = z.object({
 const oAuthProxy = (opts) => {
 	const maxAge = opts?.maxAge ?? 60;
 	const getEncryptionKey = (ctx) => opts?.secret ?? ctx.context.secretConfig;
+	const oauthProxyCompletion = createAuthEndpoint("/callback/:id/oauth-proxy", {
+		method: "GET",
+		operationId: "oauthProxyCompletion",
+		query: oauthProxyQuerySchema,
+		use: [originCheck((ctx) => ctx.query.callbackURL)],
+		metadata: { scope: "http" }
+	}, async (ctx) => {
+		const baseURLStr = typeof ctx.context.options.baseURL === "string" ? ctx.context.options.baseURL : getOrigin(ctx.context.baseURL) || "";
+		const defaultErrorURL = ctx.context.options.onAPIError?.errorURL || `${stripTrailingSlash(baseURLStr)}/api/auth/error`;
+		const encryptedProfile = ctx.query.profile;
+		if (!encryptedProfile) {
+			ctx.context.logger.error("OAuth proxy callback missing profile data");
+			throw redirectOnError(ctx, defaultErrorURL, "missing_profile");
+		}
+		let decryptedPayload;
+		try {
+			decryptedPayload = await symmetricDecrypt({
+				key: getEncryptionKey(ctx),
+				data: encryptedProfile
+			});
+		} catch (e) {
+			ctx.context.logger.error("Failed to decrypt OAuth proxy profile", e);
+			throw redirectOnError(ctx, defaultErrorURL, "invalid_profile");
+		}
+		let payload;
+		try {
+			payload = passthroughPayloadSchema.parse(parseJSON(decryptedPayload));
+		} catch (e) {
+			ctx.context.logger.error("Failed to parse OAuth proxy payload", e);
+			throw redirectOnError(ctx, defaultErrorURL, "invalid_payload");
+		}
+		const errorURL = payload.errorURL || defaultErrorURL;
+		if (ctx.path?.startsWith("/callback/") && ctx.params.id !== payload.account.providerId) {
+			ctx.context.logger.warn("OAuth proxy callback provider mismatch");
+			throw redirectOnError(ctx, errorURL, "provider_mismatch");
+		}
+		const age = (Date.now() - payload.timestamp) / 1e3;
+		if (age > maxAge || age < -10) {
+			ctx.context.logger.error(`OAuth proxy payload expired or invalid (age: ${age}s, maxAge: ${maxAge}s)`);
+			throw redirectOnError(ctx, errorURL, "payload_expired");
+		}
+		if (!await restoreOAuthProxyState(ctx, payload.state)) throw redirectOnError(ctx, errorURL, "state_mismatch");
+		let result;
+		try {
+			result = await handleOAuthUserInfo(ctx, {
+				userInfo: payload.userInfo,
+				account: payload.account,
+				callbackURL: payload.callbackURL,
+				disableSignUp: payload.disableSignUp,
+				source: {
+					method: "oauth",
+					oauth: {
+						providerId: payload.account.providerId,
+						profile: payload.profile
+					}
+				}
+			});
+		} catch (e) {
+			if (isAPIError(e) && e.body?.code) throw redirectOnError(ctx, errorURL, e.body.code, e.body.message);
+			throw e;
+		}
+		if (result.error) {
+			ctx.context.logger.error("OAuth proxy callback error", result.error);
+			throw redirectOnError(ctx, errorURL, result.error.split(" ").join("_"));
+		}
+		if (!result.data) {
+			ctx.context.logger.error("OAuth proxy callback missing session data");
+			throw redirectOnError(ctx, errorURL, "user_creation_failed");
+		}
+		await setSessionCookie(ctx, result.data);
+		const finalURL = result.isRegister ? payload.newUserURL || payload.callbackURL : payload.callbackURL;
+		throw ctx.redirect(finalURL);
+	});
 	return {
 		id: "oauth-proxy",
 		version: PACKAGE_VERSION,
 		options: opts,
-		endpoints: { oAuthProxy: createAuthEndpoint("/oauth-proxy-callback", {
-			method: "GET",
-			operationId: "oauthProxyCallback",
-			query: oauthProxyQuerySchema,
-			use: [originCheck((ctx) => ctx.query.callbackURL)],
-			metadata: { openapi: {
+		endpoints: {
+			/**
+			* @deprecated OAuth proxy callbacks now use `/callback/:id/oauth-proxy`.
+			* This endpoint will be removed in the next minor release.
+			*/
+			oAuthProxy: createAuthEndpoint("/oauth-proxy-callback", {
+				method: "GET",
 				operationId: "oauthProxyCallback",
-				description: "OAuth Proxy Callback",
-				parameters: [{
-					in: "query",
-					name: "callbackURL",
-					required: true,
-					description: "The URL to redirect to after the proxy"
-				}, {
-					in: "query",
-					name: "profile",
-					required: false,
-					description: "Encrypted OAuth profile data"
-				}],
-				responses: { 302: {
-					description: "Redirect",
-					headers: { Location: {
-						description: "The URL to redirect to",
-						schema: { type: "string" }
+				query: oauthProxyQuerySchema,
+				use: [originCheck((ctx) => ctx.query.callbackURL)],
+				metadata: { openapi: {
+					operationId: "oauthProxyCallback",
+					deprecated: true,
+					description: "OAuth Proxy Callback",
+					parameters: [{
+						in: "query",
+						name: "callbackURL",
+						required: true,
+						description: "The URL to redirect to after the proxy"
+					}, {
+						in: "query",
+						name: "profile",
+						required: false,
+						description: "Encrypted OAuth profile data"
+					}],
+					responses: { 302: {
+						description: "Redirect",
+						headers: { Location: {
+							description: "The URL to redirect to",
+							schema: { type: "string" }
+						} }
 					} }
 				} }
-			} }
-		}, async (ctx) => {
-			const baseURLStr = typeof ctx.context.options.baseURL === "string" ? ctx.context.options.baseURL : getOrigin(ctx.context.baseURL) || "";
-			const defaultErrorURL = ctx.context.options.onAPIError?.errorURL || `${stripTrailingSlash(baseURLStr)}/api/auth/error`;
-			const encryptedProfile = ctx.query.profile;
-			if (!encryptedProfile) {
-				ctx.context.logger.error("OAuth proxy callback missing profile data");
-				throw redirectOnError(ctx, defaultErrorURL, "missing_profile");
-			}
-			let decryptedPayload;
-			try {
-				decryptedPayload = await symmetricDecrypt({
-					key: getEncryptionKey(ctx),
-					data: encryptedProfile
-				});
-			} catch (e) {
-				ctx.context.logger.error("Failed to decrypt OAuth proxy profile", e);
-				throw redirectOnError(ctx, defaultErrorURL, "invalid_profile");
-			}
-			let payload;
-			try {
-				payload = parseJSON(decryptedPayload);
-			} catch (e) {
-				ctx.context.logger.error("Failed to parse OAuth proxy payload", e);
-				throw redirectOnError(ctx, defaultErrorURL, "invalid_payload");
-			}
-			if (typeof payload.timestamp !== "number" || !payload.userInfo || !payload.account || !payload.state || !payload.callbackURL) {
-				ctx.context.logger.error("Failed to parse OAuth proxy payload");
-				throw redirectOnError(ctx, defaultErrorURL, "invalid_payload");
-			}
-			const errorURL = payload.errorURL || defaultErrorURL;
-			const age = (Date.now() - payload.timestamp) / 1e3;
-			if (age > maxAge || age < -10) {
-				ctx.context.logger.error(`OAuth proxy payload expired or invalid (age: ${age}s, maxAge: ${maxAge}s)`);
-				throw redirectOnError(ctx, errorURL, "payload_expired");
-			}
-			if (!await consumeOAuthProxyState(ctx, payload.state)) throw redirectOnError(ctx, errorURL, "state_mismatch");
-			let result;
-			try {
-				result = await handleOAuthUserInfo(ctx, {
-					userInfo: payload.userInfo,
-					account: payload.account,
-					callbackURL: payload.callbackURL,
-					disableSignUp: payload.disableSignUp,
-					source: {
-						method: "oauth",
-						oauth: {
-							providerId: payload.account.providerId,
-							profile: payload.profile
-						}
-					}
-				});
-			} catch (e) {
-				if (isAPIError(e) && e.body?.code) throw redirectOnError(ctx, errorURL, e.body.code, e.body.message);
-				throw e;
-			}
-			if (result.error) {
-				ctx.context.logger.error("OAuth proxy callback error", result.error);
-				throw redirectOnError(ctx, errorURL, result.error.split(" ").join("_"));
-			}
-			if (!result.data) {
-				ctx.context.logger.error("OAuth proxy callback missing session data");
-				throw redirectOnError(ctx, errorURL, "user_creation_failed");
-			}
-			await setSessionCookie(ctx, result.data);
-			const finalURL = result.isRegister ? payload.newUserURL || payload.callbackURL : payload.callbackURL;
-			throw ctx.redirect(finalURL);
-		}) },
+			}, async (ctx) => oauthProxyCompletion({
+				...ctx,
+				params: { id: "oauth-proxy" }
+			})),
+			oAuthProxyCompletion: oauthProxyCompletion
+		},
 		hooks: {
 			before: [{
 				matcher(context) {
@@ -143,6 +189,8 @@ const oAuthProxy = (opts) => {
 				},
 				handler: createAuthMiddleware(async (ctx) => {
 					if (checkSkipProxy(ctx, opts)) return;
+					const providerId = ctx.body?.provider;
+					if (!providerId) return;
 					const currentURL = resolveCurrentURL(ctx, opts);
 					const productionURL = opts?.productionURL;
 					const originalCallbackURL = ctx.body?.callbackURL || ctx.context.baseURL;
@@ -150,8 +198,7 @@ const oAuthProxy = (opts) => {
 						const productionBaseURL = `${stripTrailingSlash(productionURL)}${ctx.context.options.basePath || "/api/auth"}`;
 						ctx.context.baseURL = productionBaseURL;
 					}
-					const newCallbackURL = `${stripTrailingSlash(currentURL.origin)}${ctx.context.options.basePath || "/api/auth"}/oauth-proxy-callback?callbackURL=${encodeURIComponent(originalCallbackURL)}`;
-					if (!ctx.body) return;
+					const newCallbackURL = `${stripTrailingSlash(currentURL.origin)}${ctx.context.options.basePath || "/api/auth"}/callback/${providerId}/oauth-proxy?callbackURL=${encodeURIComponent(originalCallbackURL)}`;
 					ctx.body.callbackURL = newCallbackURL;
 				})
 			}, {
@@ -261,7 +308,6 @@ const oAuthProxy = (opts) => {
 						},
 						profile: providerProfile,
 						account: {
-							providerId: provider.id,
 							...accountKey,
 							accessToken: tokens.accessToken,
 							refreshToken: tokens.refreshToken,
@@ -342,7 +388,7 @@ const oAuthProxy = (opts) => {
 				},
 				handler: createAuthMiddleware(async (ctx) => {
 					const location = ctx.context.responseHeaders?.get("location");
-					if (!location?.includes("/oauth-proxy-callback?callbackURL") || !location.startsWith("http")) return;
+					if (!location?.includes("/oauth-proxy?callbackURL") && !location?.includes("/oauth-proxy-callback?callbackURL") || !location.startsWith("http")) return;
 					const productionOrigin = getOrigin(opts?.productionURL || (typeof ctx.context.options.baseURL === "string" ? ctx.context.options.baseURL : void 0) || ctx.context.baseURL);
 					const locationURL = new URL(location);
 					if (locationURL.origin === productionOrigin) {

package/dist/plugins/one-tap/index.mjs

@@ -71,7 +71,6 @@ const oneTap = (options) => ({
 			},
 			account: {
 				providerId: "google",
-				issuer: "https://accounts.google.com",
 				accountId: sub,
 				idToken,
 				scope: "openid,profile,email"

package/dist/plugins/open-api/generator.mjs

@@ -113,6 +113,20 @@ function schemaAcceptsUndefined(zodType) {
 	}
 	return false;
 }
+/**
+* Resolve input optionality exactly as Zod's JSON Schema emitter does.
+*
+* @see https://github.com/colinhacks/zod/blob/v4.5.4/packages/zod/src/v4/core/json-schema-processors.ts#L294-L308
+*/
+function getZodInputOptionality(zodType) {
+	const def = zodType._zod.def;
+	if (def.type === "pipe") {
+		const pipeDef = def;
+		if (pipeDef.in._zod.traits.has("$ZodTransform")) return getZodInputOptionality(pipeDef.out);
+	}
+	if (def.type === "catch") return getZodInputOptionality(def.innerType);
+	return zodType._zod.optin;
+}
 function isUndefinedOnlySchema(zodType) {
 	return zodType instanceof z.ZodUndefined || zodType instanceof z.ZodVoid;
 }
@@ -252,7 +266,7 @@ function toOpenApiSchema(zodType) {
 			Object.entries(shape).forEach(([key, value]) => {
 				if (value instanceof z.ZodType) {
 					properties[key] = toOpenApiSchema(value);
-					if (!schemaAcceptsUndefined(value)) required.push(key);
+					if (getZodInputOptionality(value) === void 0) required.push(key);
 				}
 			});
 			return withDescription({

package/dist/plugins/open-api/index.mjs

@@ -1,5 +1,4 @@
 import { HIDE_METADATA } from "../../utils/hide-metadata.mjs";
-import "../../utils/index.mjs";
 import { APIError } from "../../api/index.mjs";
 import { PACKAGE_VERSION } from "../../version.mjs";
 import { generator } from "./generator.mjs";

package/dist/plugins/organization/has-permission.mjs

@@ -3,6 +3,7 @@ import { defaultRoles } from "./access/statement.mjs";
 import { cacheAllRoles, hasPermissionFn } from "./permission.mjs";
 import * as z from "zod";
 //#region src/plugins/organization/has-permission.ts
+const rolePermissionsSchema = z.record(z.string(), z.array(z.string()));
 const hasPermission = async (input, ctx) => {
 	let acRoles = { ...input.options.roles || defaultRoles };
 	if (ctx && input.organizationId && input.options.dynamicAccessControl?.enabled && input.options.ac && !input.useMemoryCache) {
@@ -14,9 +15,10 @@ const hasPermission = async (input, ctx) => {
 			}]
 		});
 		for (const { role, permission: permissionsString } of roles) {
-			const result = z.record(z.string(), z.array(z.string())).safeParse(JSON.parse(permissionsString));
+			const permissions = JSON.parse(permissionsString);
+			const result = rolePermissionsSchema.safeParse(permissions);
 			if (!result.success) {
-				ctx.context.logger.error("[hasPermission] Invalid permissions for role " + role, { permissions: JSON.parse(permissionsString) });
+				ctx.context.logger.error("[hasPermission] Invalid permissions for role " + role, { permissions });
 				throw new APIError("INTERNAL_SERVER_ERROR", { message: "Invalid permissions for role " + role });
 			}
 			const merged = { ...acRoles[role]?.statements };

package/dist/plugins/phone-number/routes.mjs

@@ -4,9 +4,7 @@ import { generateRandomString } from "../../crypto/random.mjs";
 import { setSessionCookie } from "../../cookies/index.mjs";
 import { getSessionFromCtx } from "../../api/routes/session.mjs";
 import { HIDE_METADATA } from "../../utils/hide-metadata.mjs";
-import "../../utils/index.mjs";
 import { PHONE_NUMBER_ERROR_CODES } from "./error-codes.mjs";
-import { createLocalAccountIssuer } from "@better-auth/core/db";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { createAuthEndpoint } from "@better-auth/core/api";
 import * as z from "zod";
@@ -476,7 +474,6 @@ const resetPasswordPhoneNumber = (opts) => createAuthEndpoint("/phone-number/res
 	if (!await ctx.context.internalAdapter.findCredentialAccount(user.id)) await ctx.context.internalAdapter.createAccount({
 		userId: user.id,
 		providerId: "credential",
-		issuer: createLocalAccountIssuer("credential"),
 		accountId: user.id,
 		password: hashedPassword
 	});

package/dist/plugins/siwe/index.mjs

@@ -6,7 +6,6 @@ import { PACKAGE_VERSION } from "../../version.mjs";
 import { toChecksumAddress } from "../../utils/hashing.mjs";
 import { normalizeSiweDomain, parseSiweMessage } from "./parse-message.mjs";
 import { schema } from "./schema.mjs";
-import { createLocalAccountIssuer } from "@better-auth/core/db";
 import { createAuthEndpoint } from "@better-auth/core/api";
 import * as z from "zod";
 import { createPlaceholderEmail } from "@better-auth/core/utils/email";
@@ -215,7 +214,6 @@ const siwe = (options) => {
 						await ctx.context.internalAdapter.createAccount({
 							userId: user.id,
 							providerId: "siwe",
-							issuer: createLocalAccountIssuer("siwe"),
 							accountId: `${walletAddress}:${chainId}`,
 							createdAt: /* @__PURE__ */ new Date(),
 							updatedAt: /* @__PURE__ */ new Date()
@@ -234,7 +232,6 @@ const siwe = (options) => {
 						await ctx.context.internalAdapter.createAccount({
 							userId: user.id,
 							providerId: "siwe",
-							issuer: createLocalAccountIssuer("siwe"),
 							accountId: `${walletAddress}:${chainId}`,
 							createdAt: /* @__PURE__ */ new Date(),
 							updatedAt: /* @__PURE__ */ new Date()

package/dist/plugins/test-utils/auth-helpers.mjs

@@ -1,10 +1,15 @@
 import { createCookieHeaders, createTestCookie } from "./cookie-builder.mjs";
+import { sessionSchema } from "@better-auth/core/db";
 //#region src/plugins/test-utils/auth-helpers.ts
+function createSession(ctx, opts) {
+	const additionalFields = Object.fromEntries(Object.entries(opts.session ?? {}).filter(([key]) => !Object.hasOwn(sessionSchema.shape, key)));
+	return ctx.internalAdapter.createSession(opts.userId, false, additionalFields, true);
+}
 function createLogin(ctx) {
 	return async (opts) => {
 		const user = await ctx.internalAdapter.findUserById(opts.userId);
 		if (!user) throw new Error(`User not found: ${opts.userId}`);
-		const session = await ctx.internalAdapter.createSession(opts.userId);
+		const session = await createSession(ctx, opts);
 		return {
 			session,
 			user,
@@ -16,12 +21,12 @@ function createLogin(ctx) {
 }
 function createGetAuthHeaders(ctx) {
 	return async (opts) => {
-		return createCookieHeaders(ctx, (await ctx.internalAdapter.createSession(opts.userId)).token);
+		return createCookieHeaders(ctx, (await createSession(ctx, opts)).token);
 	};
 }
 function createGetCookies(ctx) {
 	return async (opts) => {
-		return createTestCookie(ctx, (await ctx.internalAdapter.createSession(opts.userId)).token, opts.domain);
+		return createTestCookie(ctx, (await createSession(ctx, opts)).token, opts.domain);
 	};
 }
 //#endregion

package/dist/plugins/test-utils/index.d.mts

@@ -1,4 +1,4 @@
-import { LoginResult, TestCookie, TestHelpers, TestUtilsOptions } from "./types.mjs";
+import { LoginResult, TestAuthOptions, TestCookie, TestHelpers, TestUtilsOptions } from "./types.mjs";
 import * as _$_better_auth_core0 from "@better-auth/core";
 
 //#region src/plugins/test-utils/index.d.ts

package/dist/plugins/test-utils/types.d.mts

@@ -21,6 +21,12 @@ interface LoginResult {
   cookies: TestCookie[];
   token: string;
 }
+/** Options for creating a session with the test auth helpers. */
+interface TestAuthOptions {
+  userId: string;
+  /** Additional session fields. Standard session fields are ignored. */
+  session?: Record<string, unknown>;
+}
 interface TestHelpers {
   createUser(overrides?: Partial<User> & Record<string, unknown>): User;
   createOrganization?(overrides?: Record<string, unknown>): Record<string, unknown>;
@@ -33,18 +39,13 @@ interface TestHelpers {
   }): Promise<Record<string, unknown>>;
   deleteUser(userId: string): Promise<void>;
   deleteOrganization?(orgId: string): Promise<void>;
-  login(opts: {
-    userId: string;
-  }): Promise<LoginResult>;
-  getAuthHeaders(opts: {
-    userId: string;
-  }): Promise<Headers>;
-  getCookies(opts: {
-    userId: string;
+  login(opts: TestAuthOptions): Promise<LoginResult>;
+  getAuthHeaders(opts: TestAuthOptions): Promise<Headers>;
+  getCookies(opts: TestAuthOptions & {
     domain?: string;
   }): Promise<TestCookie[]>;
   getOTP?(identifier: string): string | undefined;
   clearOTPs?(): void;
 }
 //#endregion
-export { LoginResult, TestCookie, TestHelpers, TestUtilsOptions };
+export { LoginResult, TestAuthOptions, TestCookie, TestHelpers, TestUtilsOptions };

package/dist/plugins/two-factor/client.d.mts

@@ -61,6 +61,7 @@ declare const twoFactorClient: (options?: {
     OTP_NOT_CONFIGURED: _$_better_auth_core_utils_error_codes0.RawError<"OTP_NOT_CONFIGURED">;
     OTP_HAS_EXPIRED: _$_better_auth_core_utils_error_codes0.RawError<"OTP_HAS_EXPIRED">;
     TOTP_NOT_ENABLED: _$_better_auth_core_utils_error_codes0.RawError<"TOTP_NOT_ENABLED">;
+    TOTP_ALREADY_ENABLED: _$_better_auth_core_utils_error_codes0.RawError<"TOTP_ALREADY_ENABLED">;
     TOTP_NOT_CONFIGURED: _$_better_auth_core_utils_error_codes0.RawError<"TOTP_NOT_CONFIGURED">;
     TWO_FACTOR_NOT_ENABLED: _$_better_auth_core_utils_error_codes0.RawError<"TWO_FACTOR_NOT_ENABLED">;
     BACKUP_CODES_NOT_ENABLED: _$_better_auth_core_utils_error_codes0.RawError<"BACKUP_CODES_NOT_ENABLED">;

package/dist/plugins/two-factor/error-code.d.mts

@@ -6,6 +6,7 @@ declare const TWO_FACTOR_ERROR_CODES: {
   OTP_NOT_CONFIGURED: _$_better_auth_core_utils_error_codes0.RawError<"OTP_NOT_CONFIGURED">;
   OTP_HAS_EXPIRED: _$_better_auth_core_utils_error_codes0.RawError<"OTP_HAS_EXPIRED">;
   TOTP_NOT_ENABLED: _$_better_auth_core_utils_error_codes0.RawError<"TOTP_NOT_ENABLED">;
+  TOTP_ALREADY_ENABLED: _$_better_auth_core_utils_error_codes0.RawError<"TOTP_ALREADY_ENABLED">;
   TOTP_NOT_CONFIGURED: _$_better_auth_core_utils_error_codes0.RawError<"TOTP_NOT_CONFIGURED">;
   TWO_FACTOR_NOT_ENABLED: _$_better_auth_core_utils_error_codes0.RawError<"TWO_FACTOR_NOT_ENABLED">;
   BACKUP_CODES_NOT_ENABLED: _$_better_auth_core_utils_error_codes0.RawError<"BACKUP_CODES_NOT_ENABLED">;

package/dist/plugins/two-factor/error-code.mjs

@@ -5,6 +5,7 @@ const TWO_FACTOR_ERROR_CODES = defineErrorCodes({
 	OTP_NOT_CONFIGURED: "OTP is not available",
 	OTP_HAS_EXPIRED: "OTP has expired",
 	TOTP_NOT_ENABLED: "TOTP not enabled",
+	TOTP_ALREADY_ENABLED: "TOTP is already enabled",
 	TOTP_NOT_CONFIGURED: "TOTP is not available",
 	TWO_FACTOR_NOT_ENABLED: "Two factor isn't enabled",
 	BACKUP_CODES_NOT_ENABLED: "Backup codes aren't enabled",

package/dist/plugins/two-factor/index.d.mts

@@ -705,6 +705,7 @@ declare const twoFactor: <O extends TwoFactorOptions>(options?: O) => {
     OTP_NOT_CONFIGURED: _$_better_auth_core_utils_error_codes0.RawError<"OTP_NOT_CONFIGURED">;
     OTP_HAS_EXPIRED: _$_better_auth_core_utils_error_codes0.RawError<"OTP_HAS_EXPIRED">;
     TOTP_NOT_ENABLED: _$_better_auth_core_utils_error_codes0.RawError<"TOTP_NOT_ENABLED">;
+    TOTP_ALREADY_ENABLED: _$_better_auth_core_utils_error_codes0.RawError<"TOTP_ALREADY_ENABLED">;
     TOTP_NOT_CONFIGURED: _$_better_auth_core_utils_error_codes0.RawError<"TOTP_NOT_CONFIGURED">;
     TWO_FACTOR_NOT_ENABLED: _$_better_auth_core_utils_error_codes0.RawError<"TWO_FACTOR_NOT_ENABLED">;
     BACKUP_CODES_NOT_ENABLED: _$_better_auth_core_utils_error_codes0.RawError<"BACKUP_CODES_NOT_ENABLED">;

package/dist/plugins/two-factor/index.mjs

@@ -122,7 +122,6 @@ const twoFactor = (options) => {
 					await ctx.context.internalAdapter.deleteSession(ctx.context.session.session.token);
 					return ctx.json({ method: "otp" });
 				}
-				const backupCodes = await generateBackupCodes(ctx.context.secretConfig, backupCodeOptions);
 				const existingTwoFactor = await ctx.context.adapter.findOne({
 					model: opts.twoFactorTable,
 					where: [{
@@ -130,6 +129,8 @@ const twoFactor = (options) => {
 						value: user.id
 					}]
 				});
+				if (existingTwoFactor && existingTwoFactor.verified !== false) throw APIError.from("BAD_REQUEST", TWO_FACTOR_ERROR_CODES.TOTP_ALREADY_ENABLED);
+				const backupCodes = await generateBackupCodes(ctx.context.secretConfig, backupCodeOptions);
 				const secret = generateRandomString(32);
 				const encryptedSecret = await symmetricEncrypt({
 					key: ctx.context.secretConfig,
@@ -146,7 +147,7 @@ const twoFactor = (options) => {
 				const totpData = {
 					secret: encryptedSecret,
 					backupCodes: backupCodes.encryptedBackupCodes,
-					verified: existingTwoFactor != null && existingTwoFactor.verified === true || !!options?.skipVerificationOnEnable
+					verified: !!options?.skipVerificationOnEnable
 				};
 				if (existingTwoFactor) await ctx.context.adapter.update({
 					model: opts.twoFactorTable,

package/dist/state.d.mts

@@ -9,26 +9,13 @@ declare const stateDataSchema: z.ZodObject<{
   errorURL: z.ZodOptional<z.ZodString>;
   newUserURL: z.ZodOptional<z.ZodString>;
   expiresAt: z.ZodNumber;
-  /**
-   * CSRF nonce returned to the OAuth provider. When using cookie state storage,
-   * this must match the callback `state` query parameter.
-   */
   oauthState: z.ZodOptional<z.ZodString>;
   link: z.ZodOptional<z.ZodObject<{
     email: z.ZodString;
     userId: z.ZodCoercedString<unknown>;
   }, z.core.$strip>>;
   requestSignUp: z.ZodOptional<z.ZodBoolean>;
-  /**
-   * OIDC nonce sent as the authorization request `nonce` parameter when the
-   * provider requires an ID token to be bound to this redirect flow.
-   */
   idTokenNonce: z.ZodOptional<z.ZodString>;
-  /**
-   * Server-controlled values that ride the state across the provider redirect.
-   * Populated only by `generateState` from `addOAuthServerContext`, never from
-   * the request body, so it is safe to trust on the callback.
-   */
   serverContext: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 }, z.core.$loose>;
 type StateData = z.infer<typeof stateDataSchema>;

package/dist/test-utils/test-instance.mjs

@@ -90,7 +90,7 @@ async function getTestInstance(options, config) {
 		advanced: { cookies: {} },
 		logger: { level: "debug" }
 	};
-	const auth = betterAuth({
+	const authOptions = {
 		baseURL: "http://localhost:" + (config?.port || 3e3),
 		...opts,
 		...options,
@@ -100,7 +100,15 @@ async function getTestInstance(options, config) {
 			password: options?.emailAndPassword?.password ?? testPassword
 		},
 		plugins: [bearer(), ...options?.plugins || []]
-	});
+	};
+	if (testWith !== "mongodb") {
+		const { runMigrations } = await getMigrations({
+			...authOptions,
+			database: opts.database
+		});
+		await runMigrations();
+	}
+	const auth = betterAuth(authOptions);
 	const testUser = {
 		email: "test@test.com",
 		password: "test123456",
@@ -117,13 +125,6 @@ async function getTestInstance(options, config) {
 			headers
 		});
 	}
-	if (testWith !== "mongodb") {
-		const { runMigrations } = await getMigrations({
-			...auth.options,
-			database: opts.database
-		});
-		await runMigrations();
-	}
 	await createTestUser();
 	const cleanup = async () => {
 		if (testWith === "mongodb") {