twofactor

Documentation

Overview

Package twofactor provides an opt-in Better Auth-shaped two-factor plugin.

Index

• Constants
• func New(config Config) (betterauth.Plugin, error)
• type Config
• type Manager
  • func NewManager(config Config) (*Manager, error)
  • func (manager *Manager) Plugin() betterauth.Plugin
  • func (manager *Manager) ViewBackupCodes(ctx context.Context, database betterauth.DatabaseAdapter, userID string) ([]string, error)
• type OTPDelivery

Constants

const (
	// ModelTwoFactor is the logical adapter model contributed by this plugin.
	ModelTwoFactor = "twoFactor"
)

Functions

func New

func New(config Config) (betterauth.Plugin, error)

New returns the common descriptor-only integration.

Types

type Config

type Config struct {
	Issuer                   string
	Cipher                   betterauth.TokenCipher
	DeliverOTP               OTPDelivery
	PendingCookie            string
	TrustedDeviceCookie      string
	PendingTTL               time.Duration
	OTPTTL                   time.Duration
	TrustedDeviceTTL         time.Duration
	TOTPDigits               int
	TOTPPeriod               time.Duration
	BackupCodeCount          int
	BackupCodeLength         int
	ChallengeMaxAttempts     int
	AccountMaxFailedAttempts int
	AccountLockoutDuration   time.Duration
	AllowPasswordless        bool
	SkipVerificationOnEnable bool
	DisableTOTP              bool
	Schema                   betterauth.ModelSchema
}

Config is immutable after construction.

type Manager

type Manager struct {
	// contains filtered or unexported fields
}

Manager exposes the plugin descriptor and the server-only backup-code API.

func NewManager

func NewManager(config Config) (*Manager, error)

NewManager returns an integration with server-only management operations.

func (*Manager) Plugin

func (manager *Manager) Plugin() betterauth.Plugin

Plugin returns the immutable server plugin descriptor.

func (*Manager) ViewBackupCodes

func (manager *Manager) ViewBackupCodes(
	ctx context.Context,
	database betterauth.DatabaseAdapter,
	userID string,
) ([]string, error)

ViewBackupCodes decrypts a user's current recovery codes for trusted server-side use. It is deliberately not an HTTP endpoint.

type OTPDelivery

type OTPDelivery func(*betterauth.HookContext, betterauth.User, string) error

OTPDelivery delivers a library-generated second-factor code. Implementations must be concurrency-safe and must not retain HookContext.