better-auth-api 1.0.0-alpha.5

use super::*;

impl TwoFactorPlugin {
    pub(super) async fn after_sign_in<S: better_auth_core::AuthSchema>(
        &self,
        req: &AuthRequest,
        response: &mut AuthResponse,
        ctx: &AuthContext<S>,
    ) -> AuthResult<()> {
        if !matches!(
            req.path(),
            "/sign-in/email" | "/sign-in/username" | "/sign-in/phone-number"
        ) {
            return Ok(());
        }
        let Some(data) = req.new_session()? else {
            return Ok(());
        };
        if !data.user_field("twoFactorEnabled")?.is_truthy() {
            return Ok(());
        }
        let user_value = data.user_value()?;
        let fields = user_value
            .as_object()
            .ok_or_else(|| AuthError::internal("A two-factor challenge requires a User object"))?;
        let user = better_auth_core::UserView::try_from(fields.snapshot_fields()?)?;
        let trusted = inspect_trusted_device(req, &user, ctx).await?;
        for cookie in trusted.set_cookie_headers {
            response.headers.append("Set-Cookie", cookie);
        }
        if trusted.trusted {
            return Ok(());
        }

        delete_session_cookies(req, &ctx.config, true, Some(&mut response.headers))?;
        delete_factor_session(&data, ctx).await?;
        req.clear_new_session()?;
        let challenge = begin_sign_in_challenge(&user, ctx, &mut response.headers).await?;
        response.replace_returned(AuthResponse::json(None, &challenge)?);
        Ok(())
    }
}