github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 15:42:09 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #4102] feat(phone-number): add possibility to overwrite otp function with custom one #5190

New Issue
Open
opened 2026-03-13 12:13:30 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-03-13 12:13:30 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/4102
Author: @piotr-graczyk-dev
Created: 8/20/2025
Status: 🔄 Open

Base: canary ← Head: feat/possibility-to-overwrite-otp-function

📝 Commits (4)

  • 85a1625 feat(phone-number): add possibility to overwrite otp function with custom one
  • 9e7b762 docs(phone-number): add generateOTP option in phone-number docs
  • 3aa9449 refactor: format code
  • 7d5edfa fix(phone-number): ensure generateOTP option is optional and update tests

📊 Changes

3 files changed (+527 additions, -4 deletions)

View changed files

📝 docs/content/docs/plugins/phone-number.mdx (+13 -0)
📝 packages/better-auth/src/plugins/phone-number/index.ts (+19 -4)
📝 packages/better-auth/src/plugins/phone-number/phone-number.test.ts (+495 -0)

📄 Description

Add support for custom OTP generation function in the phone number plugin, allowing developers to implement their own OTP generation logic while maintaining full backward compatibility. This will be very useful during testing.

Changes Made

  • ✅ Add optional generateOTP parameter to PhoneNumberOptions interface
  • ✅ Update phone number plugin implementation to use custom generateOTP function when provided
  • ✅ Maintain backward compatibility with existing default OTP generation
  • ✅ Add comprehensive tests covering both regular OTP flows and password reset scenarios
  • ✅ Update documentation with clear usage examples and API reference

Problem Solved

Previously, developers were limited to the built-in OTP generation logic using numeric codes. This enhancement enables:

  • Custom OTP formats (alphanumeric, different patterns)
  • External OTP service integration (when using third-party generators)
  • Enhanced security requirements (custom randomization algorithms)
  • Business-specific OTP patterns (branded or formatted codes)

Implementation Details

The implementation follows the existing plugin pattern:

// New optional parameter in PhoneNumberOptions
generateOTP?: (otpLength: number) => string;

// Usage in plugin
const code = options.generateOTP
  ? options.generateOTP(opts.otpLength)
  : generateOTP(opts.otpLength);

Usage Example

import { phoneNumber } from "better-auth/plugins"

const auth = betterAuth({
  plugins: [
    phoneNumber({
      sendOTP: ({ phoneNumber, code }) => {
        // Send OTP via SMS service
      },
      generateOTP: (otpLength) => {
        // Custom OTP generation - e.g., alphanumeric
        return generateAlphanumericOTP(otpLength);
      }
    })
  ]
})

Testing

  • ✅ All existing tests continue to pass
  • ✅ New comprehensive test suite added for custom generateOTP functionality
  • ✅ Tests cover regular OTP sending, verification, and password reset flows
  • ✅ Backward compatibility verified through existing test suite
  • ✅ Edge cases tested (different OTP lengths, call counts, etc.)

Documentation

  • ✅ Updated /docs/content/docs/plugins/phone-number.mdx with new option
  • ✅ Added clear usage examples and API documentation
  • ✅ Included in the Options section with proper description

Breaking Changes

None - This is a fully backward-compatible addition. All existing functionality remains unchanged.

Related Issues

This enhancement addresses the need for flexible OTP generation while maintaining the security and reliability of the existing phone number authentication flow.

Summary by cubic

Adds support for a custom OTP generator in the phone-number plugin so teams can plug in their own logic. Fully backward compatible.

  • New Features
    • Added generateOTP?: (length) => string to PhoneNumberOptions.
    • Used the custom generator for send OTP, sign-in verification (requireVerification), and password reset.
    • Falls back to the default numeric generator when not provided.
    • Added tests for custom generators and edge cases.
    • Updated plugin docs with the new option and example.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/4102 **Author:** [@piotr-graczyk-dev](https://github.com/piotr-graczyk-dev) **Created:** 8/20/2025 **Status:** 🔄 Open **Base:** `canary` ← **Head:** `feat/possibility-to-overwrite-otp-function` --- ### 📝 Commits (4) - [`85a1625`](https://github.com/better-auth/better-auth/commit/85a162514698ec5fba53965dd6e176f40eb7db03) feat(phone-number): add possibility to overwrite otp function with custom one - [`9e7b762`](https://github.com/better-auth/better-auth/commit/9e7b76255cbd73e374c060b9f6aa2fcc7d63aa50) docs(phone-number): add generateOTP option in phone-number docs - [`3aa9449`](https://github.com/better-auth/better-auth/commit/3aa9449c478a0287196e0542680630251345affd) refactor: format code - [`7d5edfa`](https://github.com/better-auth/better-auth/commit/7d5edfaebb60a5db7414fba3a366d96acbcc22ca) fix(phone-number): ensure generateOTP option is optional and update tests ### 📊 Changes **3 files changed** (+527 additions, -4 deletions) <details> <summary>View changed files</summary> 📝 `docs/content/docs/plugins/phone-number.mdx` (+13 -0) 📝 `packages/better-auth/src/plugins/phone-number/index.ts` (+19 -4) 📝 `packages/better-auth/src/plugins/phone-number/phone-number.test.ts` (+495 -0) </details> ### 📄 Description Add support for custom OTP generation function in the phone number plugin, allowing developers to implement their own OTP generation logic while maintaining full backward compatibility. This will be very useful during testing. ## Changes Made - ✅ Add optional `generateOTP` parameter to `PhoneNumberOptions` interface - ✅ Update phone number plugin implementation to use custom `generateOTP` function when provided - ✅ Maintain backward compatibility with existing default OTP generation - ✅ Add comprehensive tests covering both regular OTP flows and password reset scenarios - ✅ Update documentation with clear usage examples and API reference ## Problem Solved Previously, developers were limited to the built-in OTP generation logic using numeric codes. This enhancement enables: - **Custom OTP formats** (alphanumeric, different patterns) - **External OTP service integration** (when using third-party generators) - **Enhanced security requirements** (custom randomization algorithms) - **Business-specific OTP patterns** (branded or formatted codes) ## Implementation Details The implementation follows the existing plugin pattern: ```typescript // New optional parameter in PhoneNumberOptions generateOTP?: (otpLength: number) => string; // Usage in plugin const code = options.generateOTP ? options.generateOTP(opts.otpLength) : generateOTP(opts.otpLength); ``` ## Usage Example ```typescript import { phoneNumber } from "better-auth/plugins" const auth = betterAuth({ plugins: [ phoneNumber({ sendOTP: ({ phoneNumber, code }) => { // Send OTP via SMS service }, generateOTP: (otpLength) => { // Custom OTP generation - e.g., alphanumeric return generateAlphanumericOTP(otpLength); } }) ] }) ``` ## Testing - ✅ All existing tests continue to pass - ✅ New comprehensive test suite added for custom `generateOTP` functionality - ✅ Tests cover regular OTP sending, verification, and password reset flows - ✅ Backward compatibility verified through existing test suite - ✅ Edge cases tested (different OTP lengths, call counts, etc.) ## Documentation - ✅ Updated `/docs/content/docs/plugins/phone-number.mdx` with new option - ✅ Added clear usage examples and API documentation - ✅ Included in the Options section with proper description ## Breaking Changes **None** - This is a fully backward-compatible addition. All existing functionality remains unchanged. ## Related Issues This enhancement addresses the need for flexible OTP generation while maintaining the security and reliability of the existing phone number authentication flow. <!-- This is an auto-generated description by cubic. --> --- ## Summary by cubic Adds support for a custom OTP generator in the phone-number plugin so teams can plug in their own logic. Fully backward compatible. - New Features - Added generateOTP?: (length) => string to PhoneNumberOptions. - Used the custom generator for send OTP, sign-in verification (requireVerification), and password reset. - Falls back to the default numeric generator when not provided. - Added tests for custom generators and edge cases. - Updated plugin docs with the new option and example. <!-- End of auto-generated description by cubic. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-03-13 12:13:30 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#5190
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?