From 34060c7be47aa532ef5d7016a9b413886bc05ae2 Mon Sep 17 00:00:00 2001
From: Gustavo Valverde <g.valverde02@gmail.com>
Date: Sat, 30 May 2026 23:32:14 +0100
Subject: [PATCH] test: adapt merged mcp and two-factor tests to next's
 breaking APIs

The merge auto-combined these test files without textual conflict, but they
referenced APIs next changed, so type checking failed:

- mcp.test.ts drove one (skipped) confidential-client test through the
  removed generic-oauth client (genericOAuthClient + signIn.oauth2). It now
  uses signIn.social like the surrounding tests.
- two-factor.security.test.ts read enrollment.totpURI directly; next's #9057
  made the enable response a discriminated { method } union, so the tests now
  narrow on method === "totp" before reading totpURI.

tsc --build is clean across the workspace.

(cherry picked from commit d3cd3c2eb39f0c7209f45ff27ac4b943250b93be)
---
 packages/better-auth/src/plugins/mcp/mcp.test.ts           | 7 +++----
 .../src/plugins/two-factor/two-factor.security.test.ts     | 6 +++---
 2 files changed, 6 insertions(+), 7 deletions(-)

diff --git a/packages/better-auth/src/plugins/mcp/mcp.test.ts b/packages/better-auth/src/plugins/mcp/mcp.test.ts
index dea11bbc84..cacfb9d6e4 100644
--- a/packages/better-auth/src/plugins/mcp/mcp.test.ts
+++ b/packages/better-auth/src/plugins/mcp/mcp.test.ts
@@ -369,18 +369,17 @@ describe("mcp", async () => {
 			});
 		const oAuthHeaders = new Headers();
 		const client = createAuthClient({
-			plugins: [genericOAuthClient()],
 			baseURL: "http://localhost:5004",
 			fetchOptions: { customFetchImpl: customFetchImplRP },
 		});
 
-		const data = await client.signIn.oauth2(
-			{ providerId: "test-confidential", callbackURL: "/dashboard" },
+		const data = await client.signIn.social(
+			{ provider: "test-confidential", callbackURL: "/dashboard" },
 			{ throw: true, onSuccess: cookieSetter(oAuthHeaders) },
 		);
 
 		let redirectURI = "";
-		await serverClient.$fetch(data.url, {
+		await serverClient.$fetch(data.url!, {
 			method: "GET",
 			onError(context: any) {
 				redirectURI = context.response.headers.get("Location") || "";
diff --git a/packages/better-auth/src/plugins/two-factor/two-factor.security.test.ts b/packages/better-auth/src/plugins/two-factor/two-factor.security.test.ts
index 62f3661020..2a48f96578 100644
--- a/packages/better-auth/src/plugins/two-factor/two-factor.security.test.ts
+++ b/packages/better-auth/src/plugins/two-factor/two-factor.security.test.ts
@@ -113,7 +113,7 @@ describe("two-factor security: sign-in does not leak session cookies (cookieCach
 		body: { password: testUser.password },
 		headers,
 	});
-	if (!enrollment.totpURI) {
+	if (enrollment.method !== "totp") {
 		throw new Error("expected totp enrollment");
 	}
 	const row = await db.findOne<TwoFactorTable>({
@@ -225,7 +225,7 @@ describe("two-factor security: sign-in does not leak session cookies (cookieCach
 		body: { password: testUser.password },
 		headers,
 	});
-	if (!enrollment.totpURI) {
+	if (enrollment.method !== "totp") {
 		throw new Error("expected totp enrollment");
 	}
 	const dbUser = await db.findOne<User>({
@@ -327,7 +327,7 @@ describe("two-factor security: chunked session_data is fully scrubbed on 2FA-req
 		body: { password: testUser.password },
 		headers,
 	});
-	if (!enrollment.totpURI) {
+	if (enrollment.method !== "totp") {
 		throw new Error("expected totp enrollment");
 	}
 	const row = await db.findOne<TwoFactorTable>({