better-auth 1.7.7 → 1.7.9

package/dist/plugins/phone-number/routes.mjs

@@ -4,8 +4,7 @@ import { generateRandomString } from "../../crypto/random.mjs";
 import { setSessionCookie } from "../../cookies/index.mjs";
 import { getSessionFromCtx } from "../../api/routes/session.mjs";
 import { HIDE_METADATA } from "../../utils/hide-metadata.mjs";
-import { assertPasswordNotTooLong, assertPasswordNotTooShort } from "../../utils/password.mjs";
-import "../../utils/index.mjs";
+import { assertPasswordNotTooLong, assertPasswordNotTooShort, resetCredentialPassword } from "../../utils/password.mjs";
 import { PHONE_NUMBER_ERROR_CODES } from "./error-codes.mjs";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { createAuthEndpoint } from "@better-auth/core/api";
@@ -176,15 +175,19 @@ const sendPhoneNumberOTP = (opts) => createAuthEndpoint("/phone-number/send-otp"
 async function verifyAndConsumePhoneNumberOTP(ctx, opts, body) {
 	const { phoneNumber, code } = body;
 	if (opts.verifyOTP) {
-		if (!await opts.verifyOTP({
-			phoneNumber,
-			code
-		}, ctx)) throw APIError.from("BAD_REQUEST", PHONE_NUMBER_ERROR_CODES.INVALID_OTP);
-		await ctx.context.internalAdapter.deleteVerificationByIdentifier(phoneNumber);
+		await verifyWithCustomVerifier(ctx, opts.verifyOTP, phoneNumber, code, phoneNumber);
 		return;
 	}
 	await verifyPhoneNumberOTP(ctx, opts, phoneNumber, code);
 }
+/** Checks the code with `verifyOTP`, then drops the code stored under `identifier`. */
+async function verifyWithCustomVerifier(ctx, verifyOTP, phoneNumber, code, identifier) {
+	if (!await verifyOTP({
+		phoneNumber,
+		code
+	}, ctx)) throw APIError.from("BAD_REQUEST", PHONE_NUMBER_ERROR_CODES.INVALID_OTP);
+	await ctx.context.internalAdapter.deleteVerificationByIdentifier(identifier);
+}
 /**
 * ### API Methods
 *
@@ -460,7 +463,17 @@ const resetPasswordPhoneNumber = (opts) => createAuthEndpoint("/phone-number/res
 		} }
 	} }
 }, async (ctx) => {
-	await verifyPhoneNumberOTP(ctx, opts, `${ctx.body.phoneNumber}-request-password-reset`, ctx.body.otp);
+	const phoneResetIdentifier = `${ctx.body.phoneNumber}-request-password-reset`;
+	let otpConsumed = false;
+	if (opts.verifyOTP) {
+		assertPasswordNotTooShort(ctx, ctx.body.newPassword);
+		assertPasswordNotTooLong(ctx, ctx.body.newPassword);
+		await verifyWithCustomVerifier(ctx, opts.verifyOTP, ctx.body.phoneNumber, ctx.body.otp, phoneResetIdentifier);
+		otpConsumed = true;
+	} else if (!await matchesUsableStoredPhoneNumberOTP(ctx, opts, phoneResetIdentifier, ctx.body.otp)) {
+		await verifyPhoneNumberOTP(ctx, opts, phoneResetIdentifier, ctx.body.otp);
+		otpConsumed = true;
+	}
 	const user = await ctx.context.adapter.findOne({
 		model: "user",
 		where: [{
@@ -472,15 +485,8 @@ const resetPasswordPhoneNumber = (opts) => createAuthEndpoint("/phone-number/res
 	assertPasswordNotTooShort(ctx, ctx.body.newPassword);
 	assertPasswordNotTooLong(ctx, ctx.body.newPassword);
 	const hashedPassword = await ctx.context.password.hash(ctx.body.newPassword);
-	if (!await ctx.context.internalAdapter.findCredentialAccount(user.id)) await ctx.context.internalAdapter.createAccount({
-		userId: user.id,
-		providerId: "credential",
-		accountId: user.id,
-		password: hashedPassword
-	});
-	else await ctx.context.internalAdapter.updatePassword(user.id, hashedPassword);
+	await resetCredentialPassword(ctx, user.id, hashedPassword, otpConsumed ? void 0 : () => verifyPhoneNumberOTP(ctx, opts, phoneResetIdentifier, ctx.body.otp));
 	if (ctx.context.options.emailAndPassword?.onPasswordReset) await ctx.context.options.emailAndPassword.onPasswordReset({ user }, ctx.request);
-	if (ctx.context.options.emailAndPassword?.revokeSessionsOnPasswordReset) await ctx.context.internalAdapter.deleteUserSessions(user.id);
 	return ctx.json({ status: true });
 });
 /**
@@ -519,6 +525,17 @@ async function verifyPhoneNumberOTP(ctx, opts, identifier, providedCode) {
 		throw APIError.from("BAD_REQUEST", PHONE_NUMBER_ERROR_CODES.INVALID_OTP);
 	}
 }
+/**
+* Reports whether the provided code matches a stored, unexpired record with
+* attempts left, without consuming it or counting an attempt.
+*/
+async function matchesUsableStoredPhoneNumberOTP(ctx, opts, identifier, providedCode) {
+	const existing = await ctx.context.internalAdapter.findVerificationValue(identifier);
+	if (!existing || existing.expiresAt < /* @__PURE__ */ new Date()) return false;
+	const [otpValue, rawAttempts] = existing.value.split(":");
+	if (parseVerificationAttempts(rawAttempts) >= (opts?.allowedAttempts ?? 3)) return false;
+	return otpValue === providedCode;
+}
 function parseVerificationAttempts(value) {
 	const attempts = Number(value ?? 0);
 	return Number.isSafeInteger(attempts) && attempts > 0 ? attempts : 0;

package/dist/utils/password.mjs

@@ -1,3 +1,4 @@
+import { runWithTransaction } from "@better-auth/core/context";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 //#region src/utils/password.ts
 function assertPasswordNotTooShort(ctx, password) {
@@ -12,6 +13,37 @@ function assertPasswordNotTooLong(ctx, password) {
 		throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.PASSWORD_TOO_LONG);
 	}
 }
+/**
+* Sets a user's credential password after a reset, revoking their sessions
+* when `emailAndPassword.revokeSessionsOnPasswordReset` is enabled.
+*
+* `consumeResetToken` spends the single-use reset token or OTP and throws when
+* it is no longer valid. It runs first inside the same transaction as
+* revocation and the password write, so a failure in any of them leaves all
+* three unchanged and the user can retry. Verification values held only in
+* secondary storage are consumed with `getAndDelete`, which can't roll back,
+* so a later failure there still spends the token. Secondary-storage sessions are
+* removed by an after-commit hook, so they can't roll back with the write.
+* Sessions are revoked before the write so that on an adapter without
+* transactions a failure still keeps the old password rather than committing a
+* new one while existing sessions stay valid.
+*/
+async function resetCredentialPassword(ctx, userId, passwordHash, consumeResetToken) {
+	await runWithTransaction(ctx.context.adapter, async () => {
+		await consumeResetToken?.();
+		if (ctx.context.options.emailAndPassword?.revokeSessionsOnPasswordReset) await ctx.context.internalAdapter.deleteUserSessions(userId);
+		if (!await ctx.context.internalAdapter.findCredentialAccount(userId)) {
+			await ctx.context.internalAdapter.createAccount({
+				userId,
+				providerId: "credential",
+				accountId: userId,
+				password: passwordHash
+			});
+			return;
+		}
+		await ctx.context.internalAdapter.updatePassword(userId, passwordHash);
+	});
+}
 async function validatePassword(ctx, data) {
 	assertPasswordNotTooLong(ctx, data.password);
 	const credentialAccount = await ctx.context.internalAdapter.findCredentialAccount(data.userId);
@@ -43,4 +75,4 @@ async function shouldRequirePassword(ctx, userId, allowPasswordless) {
 	return Boolean(credentialAccount?.password);
 }
 //#endregion
-export { assertPasswordNotTooLong, assertPasswordNotTooShort, checkPassword, shouldRequirePassword, validatePassword };
+export { assertPasswordNotTooLong, assertPasswordNotTooShort, checkPassword, resetCredentialPassword, shouldRequirePassword, validatePassword };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "better-auth",
-  "version": "1.7.7",
+  "version": "1.7.9",
   "description": "The most comprehensive authentication framework for TypeScript.",
   "type": "module",
   "license": "MIT",
@@ -463,23 +463,23 @@
     }
   },
   "dependencies": {
-    "@better-auth/utils": "0.4.2",
+    "@better-auth/utils": "0.5.0",
     "@better-fetch/fetch": "1.3.2",
     "@noble/ciphers": "^2.2.0",
     "@noble/hashes": "^2.2.0",
-    "better-call": "1.4.0",
+    "better-call": "1.4.2",
     "defu": "^6.1.4",
     "jose": "^6.2.3",
     "kysely": "^0.28.17 || ^0.29.0",
     "nanostores": "^1.3.0",
     "zod": "^4.5.4",
-    "@better-auth/core": "1.7.7",
-    "@better-auth/drizzle-adapter": "1.7.7",
-    "@better-auth/kysely-adapter": "1.7.7",
-    "@better-auth/memory-adapter": "1.7.7",
-    "@better-auth/mongo-adapter": "1.7.7",
-    "@better-auth/prisma-adapter": "1.7.7",
-    "@better-auth/telemetry": "1.7.7"
+    "@better-auth/core": "1.7.9",
+    "@better-auth/drizzle-adapter": "1.7.9",
+    "@better-auth/kysely-adapter": "1.7.9",
+    "@better-auth/memory-adapter": "1.7.9",
+    "@better-auth/mongo-adapter": "1.7.9",
+    "@better-auth/prisma-adapter": "1.7.9",
+    "@better-auth/telemetry": "1.7.9"
   },
   "devDependencies": {
     "@lynx-js/react": "^0.121.2",
@@ -487,8 +487,8 @@
     "@opentelemetry/sdk-trace-base": "^2.10.0",
     "@opentelemetry/sdk-trace-node": "^2.10.0",
     "@sveltejs/kit": "^2.70.1",
-    "@tanstack/react-start": "^1.168.4",
-    "@tanstack/solid-start": "^1.168.4",
+    "@tanstack/react-start": "^1.168.60",
+    "@tanstack/solid-start": "^1.168.57",
     "@types/bun": "^1.3.14",
     "@types/google.accounts": "^0.0.18",
     "@types/pg": "^8.20.0",
@@ -511,7 +511,7 @@
   "peerDependencies": {
     "@lynx-js/react": "*",
     "@prisma/client": "^5.0.0 || ^6.0.0 || ^7.0.0",
-    "@sveltejs/kit": "^2.0.0",
+    "@sveltejs/kit": "^2.0.0 || ^3.0.0",
     "@tanstack/react-start": "^1.0.0",
     "@tanstack/solid-start": "^1.0.0",
     "drizzle-kit": ">=0.31.4 || >=1.0.0-beta.1",

package/dist/utils/index.mjs

@@ -1,5 +0,0 @@
-import "./url.mjs";
-import "../state.mjs";
-import "../oauth2/state.mjs";
-import "./hide-metadata.mjs";
-export {};