github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-22 22:32:01 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #9057] [MERGED] feat(two-factor)!: add OTP enablement and discriminated response #25306

New Issue
Closed
opened 2026-04-15 22:49:22 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-15 22:49:22 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/9057
Author: @gustavovalverde
Created: 4/9/2026
Status: ✅ Merged
Merged: 4/10/2026
Merged by: @gustavovalverde

Base: next ← Head: worktree-feat-2fa-otp-enable

📝 Commits (8)

  • 47b2664 feat(two-factor)!: add OTP-only enablement via method parameter
  • 3f888d1 fix: resolve CI typecheck and snapshot failures
  • f94a043 fix: add totpURI to JSON type casts in OTP enable tests
  • 5ea5970 fix(two-factor): use atomic upsert, fix verified semantics, harden error messages
  • e622bfe fix(two-factor): restore legacy-safe sign-in guard, fix OpenAPI schema and docs
  • ad7dfff fix(two-factor): target update by row id instead of userId
  • 1fd4b49 refactor(two-factor)!: narrow OTP enablement to policy-only, discriminated response
  • cdaa427 fix(two-factor): use correct password fixture, strengthen test assertions

📊 Changes

7 files changed (+570 additions, -436 deletions)

View changed files

➕ .changeset/two-factor-otp-enable.md (+23 -0)
📝 docs/content/docs/plugins/2fa.mdx (+271 -300)
📝 packages/better-auth/src/plugins/two-factor/error-code.ts (+2 -0)
📝 packages/better-auth/src/plugins/two-factor/index.ts (+74 -48)
📝 packages/better-auth/src/plugins/two-factor/two-factor.test.ts (+200 -71)
📝 packages/better-auth/src/plugins/two-factor/types.ts (+0 -5)
📝 packages/cli/src/commands/init/configs/temp-plugins.config.ts (+0 -12)

📄 Description

Summary

  • enableTwoFactor accepts a method parameter ("otp" | "totp", default "totp")
  • OTP path: sets twoFactorEnabled = true immediately, returns { method: "otp" }
  • TOTP path: returns { method: "totp", totpURI, backupCodes }
  • The method field in the response serves as a TypeScript discriminant
  • Server validates the requested method against configuration: rejects "otp" without sendOTP, rejects "totp" when disabled
  • TOTP writes use update-or-create by row id instead of delete+create

Breaking changes

  • Removed skipVerificationOnEnable: use method: "otp" for immediate activation, or the standard TOTP verification flow.
  • Response shape: enableTwoFactor now includes a method field in the response.

Closes #5739
Closes #5738

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/9057 **Author:** [@gustavovalverde](https://github.com/gustavovalverde) **Created:** 4/9/2026 **Status:** ✅ Merged **Merged:** 4/10/2026 **Merged by:** [@gustavovalverde](https://github.com/gustavovalverde) **Base:** `next` ← **Head:** `worktree-feat-2fa-otp-enable` --- ### 📝 Commits (8) - [`47b2664`](https://github.com/better-auth/better-auth/commit/47b2664b152ce53d2dd4c318a565b9f0fc0dcfc9) feat(two-factor)!: add OTP-only enablement via method parameter - [`3f888d1`](https://github.com/better-auth/better-auth/commit/3f888d1af820d47f631f58de0ddc79a3cf27dd0d) fix: resolve CI typecheck and snapshot failures - [`f94a043`](https://github.com/better-auth/better-auth/commit/f94a043cd9da376ca3effef62e51c901c626ca00) fix: add totpURI to JSON type casts in OTP enable tests - [`5ea5970`](https://github.com/better-auth/better-auth/commit/5ea597002d129221743f7e720d71b1d2aa8182a9) fix(two-factor): use atomic upsert, fix verified semantics, harden error messages - [`e622bfe`](https://github.com/better-auth/better-auth/commit/e622bfe6e93c5293729f33520f4cf84ea53c9ea5) fix(two-factor): restore legacy-safe sign-in guard, fix OpenAPI schema and docs - [`ad7dfff`](https://github.com/better-auth/better-auth/commit/ad7dfff0ba7b92731152945dbbada4144dad2be9) fix(two-factor): target update by row id instead of userId - [`1fd4b49`](https://github.com/better-auth/better-auth/commit/1fd4b4992fea0c1c0ee1530fed6d027645795459) refactor(two-factor)!: narrow OTP enablement to policy-only, discriminated response - [`cdaa427`](https://github.com/better-auth/better-auth/commit/cdaa42708781fff16723641f03995cca03116482) fix(two-factor): use correct password fixture, strengthen test assertions ### 📊 Changes **7 files changed** (+570 additions, -436 deletions) <details> <summary>View changed files</summary> ➕ `.changeset/two-factor-otp-enable.md` (+23 -0) 📝 `docs/content/docs/plugins/2fa.mdx` (+271 -300) 📝 `packages/better-auth/src/plugins/two-factor/error-code.ts` (+2 -0) 📝 `packages/better-auth/src/plugins/two-factor/index.ts` (+74 -48) 📝 `packages/better-auth/src/plugins/two-factor/two-factor.test.ts` (+200 -71) 📝 `packages/better-auth/src/plugins/two-factor/types.ts` (+0 -5) 📝 `packages/cli/src/commands/init/configs/temp-plugins.config.ts` (+0 -12) </details> ### 📄 Description ## Summary - `enableTwoFactor` accepts a `method` parameter (`"otp" | "totp"`, default `"totp"`) - OTP path: sets `twoFactorEnabled = true` immediately, returns `{ method: "otp" }` - TOTP path: returns `{ method: "totp", totpURI, backupCodes }` - The `method` field in the response serves as a TypeScript discriminant - Server validates the requested method against configuration: rejects `"otp"` without `sendOTP`, rejects `"totp"` when disabled - TOTP writes use update-or-create by row id instead of delete+create ### Breaking changes - **Removed `skipVerificationOnEnable`**: use `method: "otp"` for immediate activation, or the standard TOTP verification flow. - **Response shape**: `enableTwoFactor` now includes a `method` field in the response. Closes #5739 Closes #5738 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-15 22:49:22 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#25306
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?