Motivation

• Better-Auth's twoFactor plugin defers final session issuance to /two-factor/* endpoints, which were not included in the post-callback policy cleanup, allowing OAuth/social sign-ins to bypass workspace SSO and auth-method restrictions for 2FA-enabled accounts.

Description

• Normalize hook path handling with normalizeAuthPath so policy code matches both @opencoven-feedback/... prefixed route ids and raw auth endpoint paths.
• Treat two-factor verification endpoints as session-creating callback paths and add TWO_FACTOR_SESSION_COMPLETION_PATHS so they are considered by post-session policy logic.
• Carry the first-factor provider across the 2FA challenge using a short-lived signed cookie (quackback.2fa_policy_provider, 10 minutes) via rememberTwoFactorPolicyProvider and consumeTwoFactorPolicyProvider so the /two-factor/* completion can be evaluated against the same OAuth policy as the original callback.
• Update handleCallbackPolicyCleanup to remember the provider when a callback defers final session issuance and to recover & apply the existing SSO hard-binding / auth-method revocation logic on the two-factor verification endpoints; make token revocation conditional and normalize redirect targets/paths.
• Add regression coverage: extend apps/web/src/lib/server/auth/__tests__/hooks-callback-cleanup.test.ts with tests that assert the provider is remembered on deferred callbacks and that /two-factor/verify-totp enforces the same OAuth policy.

Testing

• Added unit tests exercising the deferred-2FA provider remember/consume flow and enforcement in apps/web/src/lib/server/auth/__tests__/hooks-callback-cleanup.test.ts (tests committed with the change).
• Performed repository checks: git diff --check passed locally.
• Attempted static/run checks (bun --check and bun run test), but test/runtime validation could not be executed in this environment because bun install --frozen-lockfile failed fetching dependencies (npm registry 403s) and vitest/other test runner deps were not available, so the test suite was not run here.

Codex Task