pnpm add @railman/auth-login-factor

import { betterAuth } from "better-auth";
import {
  AUTH_REQUIRE_PRESETS,
  createElevateOpener,
  loginFactors,
  requireAccess,
} from "@railman/auth-login-factor";

const secret = process.env.BETTER_AUTH_SECRET!;

export const auth = betterAuth({
  secret,
  session: {
    // Required: cookieCache would expose returned session fields to the client
    cookieCache: { enabled: false },
  },
  plugins: [loginFactors()],
});

export async function assertPrivileged(session: {
  userId: string;
  sessionToken: string;
  loginFactor?: string | null;
  elevateClaim?: string | null;
}) {
  await requireAccess({
    secret,
    session,
    map: AUTH_REQUIRE_PRESETS.privilegedAction,
    elevateOpener: createElevateOpener({
      secret,
      userId: session.userId,
      sessionToken: session.sessionToken,
      ttlSec: 300,
      maxElevatedSec: 3600,
    }),
    // enrolled: { passkey, totp, password }, // server lookup for password AMR
  });
}