Añadir 2FA a tu app Next.js en 30 minutos con Better Auth

bun add better-auth

import { betterAuth } from 'better-auth';
import { twoFactor } from 'better-auth/plugins';
import { prismaAdapter } from 'better-auth/adapters/prisma';
import { db } from '@/lib/db/client';

export const auth = betterAuth({
  database: prismaAdapter(db, { provider: 'postgresql' }),
  emailAndPassword: { enabled: true },
  plugins: [
    twoFactor({
      issuer: 'CREA.MBA',
    }),
  ],
});

model TwoFactor {
  id          String @id
  secret      String
  backupCodes String
  userId      String
  user        User   @relation(fields: [userId], references: [id], onDelete: Cascade)
}

bunx prisma migrate dev --name add-2fa

import { auth } from '@/lib/auth/server';
import { headers } from 'next/headers';
import { NextResponse } from 'next/server';

export async function POST() {
  const session = await auth.api.getSession({ headers: await headers() });
  if (!session) {
    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
  }

  const result = await auth.api.enableTwoFactor({
    body: { password: '' }, // pedir contraseña en producción
    headers: await headers(),
  });

  return NextResponse.json({
    qrCode: result.totpURI,
    backupCodes: result.backupCodes,
  });
}

'use client';
import { useState } from 'react';
import QRCode from 'react-qr-code';

export function Enable2FA() {
  const [qrCode, setQrCode] = useState<string | null>(null);
  const [backupCodes, setBackupCodes] = useState<string[]>([]);
  const [verificationCode, setVerificationCode] = useState('');

  async function startSetup() {
    const res = await fetch('/api/auth/2fa/enable', { method: 'POST' });
    const data = await res.json();
    setQrCode(data.qrCode);
    setBackupCodes(data.backupCodes);
  }

  async function verifyAndActivate() {
    const res = await fetch('/api/auth/2fa/verify', {
      method: 'POST',
      body: JSON.stringify({ code: verificationCode }),
      headers: { 'Content-Type': 'application/json' },
    });
    if (res.ok) alert('2FA activado');
  }

  if (!qrCode) {
    return <button onClick={startSetup}>Activar 2FA</button>;
  }

  return (
    <div>
      <p>Escanea con tu app de autenticación:</p>
      <QRCode value={qrCode} />
      <p>Códigos de respaldo (guarda estos):</p>
      <ul>
        {backupCodes.map((c) => (
          <li key={c}>
            <code>{c}</code>
          </li>
        ))}
      </ul>
      <input
        value={verificationCode}
        onChange={(e) => setVerificationCode(e.target.value)}
        placeholder="Código de 6 dígitos"
      />
      <button onClick={verifyAndActivate}>Verificar</button>
    </div>
  );
}

async function handleLogin(email: string, password: string) {
  const res = await auth.signIn.email({ email, password });
  if (res.requiresTwoFactor) {
    setShow2FAInput(true);
    return;
  }
  // login completo
}

async function handle2FACode(code: string) {
  const res = await auth.twoFactor.verifyTotp({ code });
  if (res.success) {
    // login completo
  }
}