github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-22 22:32:01 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #6072] [CLOSED] [WIP] Add support for delegating OTP verification to user-provided object #6424

New Issue
Closed
opened 2026-03-13 12:58:56 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-03-13 12:58:56 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/6072
Author: @Copilot
Created: 11/18/2025
Status: ❌ Closed

Base: canary ← Head: copilot/implement-otp-verification-delegation

📝 Commits (1)

📄 Description

Thanks for asking me to work on this. I will get started on it and keep this PR's description up to date as I form a plan and make progress.

Original prompt

Summary:

Implement support for delegating OTP verification to a user-provided object with a verify() method when passed as opts.storeOTP across the repository. Add unit tests to cover the new behavior and update documentation where appropriate. Keep backward compatibility for existing storeOTP behaviors.

Scope of work (actionable steps):

  1. Discover code paths
  • Search repository for all occurrences of storeOTP, otp verification, and OTP-related plugins (likely under packages/plugins or plugins/email-otp, plugins/two-factor/otp). Identify files that perform OTP verification or compare storedOtp to the provided otp.
  1. Implement verification delegation
  • In each verification location, add a branch that checks if opts.storeOTP is an object and has a verify function. If so, await opts.storeOTP.verify({ password: otp, hash: storedOtp }) and use the boolean result as verification result.
  • Ensure both sync and async verify implementations are supported by awaiting the result.
  • Do not change existing verification logic beyond adding this new branch (fallback to existing behavior).
  1. TypeScript types
  • Add a type alias/interface for StoreOtpVerifier: an object with verify(input: { password: string; hash: string }): boolean | Promise.
  • Update the storeOTP option type unions in any central types definitions to include StoreOtpVerifier.
  • Export updated types where applicable so consumers get correct typing.
  1. Tests
  • Add unit tests that verify:
    • When opts.storeOTP is an object with verify(), verify() is called with correct args and its returned boolean controls success/failure.
    • Existing hashed/plain verification continues to work unchanged.
    • Error handling: if verify() throws, behavior matches existing error patterns (fail verification or rethrow as appropriate).
  • Place tests in the appropriate test suites for the plugins changed.
  1. Documentation
  • Search docs and READMEs for references to storeOTP and OTP storage/verification.
  • Update relevant docs to mention that storeOTP may be an object with verify({ password, hash }) and encourage modern hashing algorithms (argon2, bcrypt) and explain security rationale. Recommend migrating from SHA-1.
  1. Lint/format and CI
  • Run lint/format and adjust code to meet repo standards. Ensure tests pass locally if possible and CI will run.

Acceptance criteria:

  • Add code changes implementing the delegation in all OTP verification locations.
  • Update types and export them.
  • Add tests covering new and existing behavior.
  • Update docs where storeOTP or OTP storage/verification is documented.
  • Create a PR in better-auth/better-auth with these changes. The PR description should list changed files and tests added, but must NOT include raw code snippets.

Notes and constraints:

  • Do not change default runtime behavior except to add the new delegation branch.
  • Keep changes minimal and well-tested.
  • The PR should not include raw implementation code in the PR description per user instruction.

If you want, I can first search and list the exact files that will need edits before making the code changes. Otherwise I will proceed to create a feature branch, implement the code, add tests and docs, and open a PR.

This pull request was created as a result of the following prompt from Copilot chat.

Summary:

Implement support for delegating OTP verification to a user-provided object with a verify() method when passed as opts.storeOTP across the repository. Add unit tests to cover the new behavior and update documentation where appropriate. Keep backward compatibility for existing storeOTP behaviors.

Scope of work (actionable steps):

  1. Discover code paths
  • Search repository for all occurrences of storeOTP, otp verification, and OTP-related plugins (likely under packages/plugins or plugins/email-otp, plugins/two-factor/otp). Identify files that perform OTP verification or compare storedOtp to the provided otp.
  1. Implement verification delegation
  • In each verification location, add a branch that checks if opts.storeOTP is an object and has a verify function. If so, await opts.storeOTP.verify({ password: otp, hash: storedOtp }) and use the boolean result as verification result.
  • Ensure both sync and async verify implementations are supported by awaiting the result.
  • Do not change existing verification logic beyond adding this new branch (fallback to existing behavior).
  1. TypeScript types
  • Add a type alias/interface for StoreOtpVerifier: an object with verify(input: { password: string; hash: string }): boolean | Promise.
  • Update the storeOTP option type unions in any central types definitions to include StoreOtpVerifier.
  • Export updated types where applicable so consumers get correct typing.
  1. Tests
  • Add unit tests that verify:
    • When opts.storeOTP is an object with verify(), verify() is called with correct args and its returned boolean controls success/failure.
    • Existing hashed/plain verification continues to work unchanged.
    • Error handling: if verify() throws, behavior matches existing error patterns (fail verification or rethrow as appropriate).
  • Place tests in the appropriate test suites for the plugins changed.
  1. Documentation
  • Search docs and READMEs for references to storeOTP and OTP storage/verification.
  • Update relevant docs to mention that storeOTP may be an object with verify({ password, hash }) and encourage modern hashing algorithms (argon2, bcrypt) and explain security rationale. Recommend migrating from SHA-1.
  1. Lint/format and CI
  • Run lint/format and adjust code to meet repo standards. Ensure tests pass locally if possible and CI will run.

Acceptance criteria:

  • Add code changes implementing the delegation in all OTP verification locations.
  • Update types and export them.
  • Add tests covering new and existing behavior.
  • Update docs where storeOTP or OTP storage/verification is documented.
  • Create a PR in better-auth/better-auth with these changes. The PR description should list changed files and tests added, but must NOT include raw code snippets.

Notes and constraints:

  • Do not change default runtime behavior except to add the new delegation branch.
  • Keep changes minimal and well-tested.
  • The PR should not include raw implementation code in the PR description per user instruction.

If you want, I can first search and list the exact files that will need edits before making the code changes. Otherwise I will proceed to create a feature branch, implement the code, add tests and docs, and open a PR.

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

Summary by cubic

Adds OTP verification delegation to a user-provided verifier via opts.storeOTP.verify, with full backward compatibility. Updates types, tests, and docs to support the new behavior.

  • New Features
    • Support opts.storeOTP as an object with verify() across all OTP checks; works with sync or async implementations.
    • Added StoreOtpVerifier type and updated option unions; exported for consumers.
    • Backward compatible: existing plain/hashed comparison remains the fallback.
    • Updated docs and added unit tests for delegation, fallback, and error handling; recommend modern hashing (argon2, bcrypt).

Written for commit 70cf8c4aab. Summary will update automatically on new commits.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/6072 **Author:** [@Copilot](https://github.com/apps/copilot-swe-agent) **Created:** 11/18/2025 **Status:** ❌ Closed **Base:** `canary` ← **Head:** `copilot/implement-otp-verification-delegation` --- ### 📝 Commits (1) - [`70cf8c4`](https://github.com/better-auth/better-auth/commit/70cf8c4aab3dfc81a0b9f645c903a16f9a3ef881) Initial plan ### 📄 Description Thanks for asking me to work on this. I will get started on it and keep this PR's description up to date as I form a plan and make progress. <!-- START COPILOT CODING AGENT SUFFIX --> <details> <summary>Original prompt</summary> > Summary: > > Implement support for delegating OTP verification to a user-provided object with a verify() method when passed as opts.storeOTP across the repository. Add unit tests to cover the new behavior and update documentation where appropriate. Keep backward compatibility for existing storeOTP behaviors. > > Scope of work (actionable steps): > > 1) Discover code paths > - Search repository for all occurrences of storeOTP, otp verification, and OTP-related plugins (likely under packages/plugins or plugins/email-otp, plugins/two-factor/otp). Identify files that perform OTP verification or compare storedOtp to the provided otp. > > 2) Implement verification delegation > - In each verification location, add a branch that checks if opts.storeOTP is an object and has a verify function. If so, await opts.storeOTP.verify({ password: otp, hash: storedOtp }) and use the boolean result as verification result. > - Ensure both sync and async verify implementations are supported by awaiting the result. > - Do not change existing verification logic beyond adding this new branch (fallback to existing behavior). > > 3) TypeScript types > - Add a type alias/interface for StoreOtpVerifier: an object with verify(input: { password: string; hash: string }): boolean | Promise<boolean>. > - Update the storeOTP option type unions in any central types definitions to include StoreOtpVerifier. > - Export updated types where applicable so consumers get correct typing. > > 4) Tests > - Add unit tests that verify: > - When opts.storeOTP is an object with verify(), verify() is called with correct args and its returned boolean controls success/failure. > - Existing hashed/plain verification continues to work unchanged. > - Error handling: if verify() throws, behavior matches existing error patterns (fail verification or rethrow as appropriate). > - Place tests in the appropriate test suites for the plugins changed. > > 5) Documentation > - Search docs and READMEs for references to storeOTP and OTP storage/verification. > - Update relevant docs to mention that storeOTP may be an object with verify({ password, hash }) and encourage modern hashing algorithms (argon2, bcrypt) and explain security rationale. Recommend migrating from SHA-1. > > 6) Lint/format and CI > - Run lint/format and adjust code to meet repo standards. Ensure tests pass locally if possible and CI will run. > > Acceptance criteria: > - Add code changes implementing the delegation in all OTP verification locations. > - Update types and export them. > - Add tests covering new and existing behavior. > - Update docs where storeOTP or OTP storage/verification is documented. > - Create a PR in better-auth/better-auth with these changes. The PR description should list changed files and tests added, but must NOT include raw code snippets. > > Notes and constraints: > - Do not change default runtime behavior except to add the new delegation branch. > - Keep changes minimal and well-tested. > - The PR should not include raw implementation code in the PR description per user instruction. > > If you want, I can first search and list the exact files that will need edits before making the code changes. Otherwise I will proceed to create a feature branch, implement the code, add tests and docs, and open a PR. > </details> *This pull request was created as a result of the following prompt from Copilot chat.* > Summary: > > Implement support for delegating OTP verification to a user-provided object with a verify() method when passed as opts.storeOTP across the repository. Add unit tests to cover the new behavior and update documentation where appropriate. Keep backward compatibility for existing storeOTP behaviors. > > Scope of work (actionable steps): > > 1) Discover code paths > - Search repository for all occurrences of storeOTP, otp verification, and OTP-related plugins (likely under packages/plugins or plugins/email-otp, plugins/two-factor/otp). Identify files that perform OTP verification or compare storedOtp to the provided otp. > > 2) Implement verification delegation > - In each verification location, add a branch that checks if opts.storeOTP is an object and has a verify function. If so, await opts.storeOTP.verify({ password: otp, hash: storedOtp }) and use the boolean result as verification result. > - Ensure both sync and async verify implementations are supported by awaiting the result. > - Do not change existing verification logic beyond adding this new branch (fallback to existing behavior). > > 3) TypeScript types > - Add a type alias/interface for StoreOtpVerifier: an object with verify(input: { password: string; hash: string }): boolean | Promise<boolean>. > - Update the storeOTP option type unions in any central types definitions to include StoreOtpVerifier. > - Export updated types where applicable so consumers get correct typing. > > 4) Tests > - Add unit tests that verify: > - When opts.storeOTP is an object with verify(), verify() is called with correct args and its returned boolean controls success/failure. > - Existing hashed/plain verification continues to work unchanged. > - Error handling: if verify() throws, behavior matches existing error patterns (fail verification or rethrow as appropriate). > - Place tests in the appropriate test suites for the plugins changed. > > 5) Documentation > - Search docs and READMEs for references to storeOTP and OTP storage/verification. > - Update relevant docs to mention that storeOTP may be an object with verify({ password, hash }) and encourage modern hashing algorithms (argon2, bcrypt) and explain security rationale. Recommend migrating from SHA-1. > > 6) Lint/format and CI > - Run lint/format and adjust code to meet repo standards. Ensure tests pass locally if possible and CI will run. > > Acceptance criteria: > - Add code changes implementing the delegation in all OTP verification locations. > - Update types and export them. > - Add tests covering new and existing behavior. > - Update docs where storeOTP or OTP storage/verification is documented. > - Create a PR in better-auth/better-auth with these changes. The PR description should list changed files and tests added, but must NOT include raw code snippets. > > Notes and constraints: > - Do not change default runtime behavior except to add the new delegation branch. > - Keep changes minimal and well-tested. > - The PR should not include raw implementation code in the PR description per user instruction. > > If you want, I can first search and list the exact files that will need edits before making the code changes. Otherwise I will proceed to create a feature branch, implement the code, add tests and docs, and open a PR. > <!-- START COPILOT CODING AGENT TIPS --> --- ✨ Let Copilot coding agent [set things up for you](https://github.com/better-auth/better-auth/issues/new?title=✨+Set+up+Copilot+instructions&body=Configure%20instructions%20for%20this%20repository%20as%20documented%20in%20%5BBest%20practices%20for%20Copilot%20coding%20agent%20in%20your%20repository%5D%28https://gh.io/copilot-coding-agent-tips%29%2E%0A%0A%3COnboard%20this%20repo%3E&assignees=copilot) — coding agent works faster and does higher quality work when set up for your repo. <!-- This is an auto-generated description by cubic. --> --- ## Summary by cubic Adds OTP verification delegation to a user-provided verifier via opts.storeOTP.verify, with full backward compatibility. Updates types, tests, and docs to support the new behavior. - **New Features** - Support opts.storeOTP as an object with verify() across all OTP checks; works with sync or async implementations. - Added StoreOtpVerifier type and updated option unions; exported for consumers. - Backward compatible: existing plain/hashed comparison remains the fallback. - Updated docs and added unit tests for delegation, fallback, and error handling; recommend modern hashing (argon2, bcrypt). <sup>Written for commit 70cf8c4aab3dfc81a0b9f645c903a16f9a3ef881. Summary will update automatically on new commits.</sup> <!-- End of auto-generated description by cubic. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-03-13 12:58:56 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#6424
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?