Complete two-factor recovery and safer authentication flows

Both starter kits now provide a complete recovery path for two-factor authentication alongside clearer account verification, invitation and organization workflows.

Complete two-factor recovery

• Backup codes are displayed during two-factor setup so users can save them before closing the flow.
• Users can sign in with a backup code when their authenticator is unavailable.
• Signed-in users can regenerate their backup codes from security settings.
• Administrators can help a user recover by disabling their two-factor authentication through an explicit confirmation flow.

Clearer authentication and invitation states

• Email verification now distinguishes pending, successful, expired and already-used links and provides a reliable resend path.
• Organization invitation failures now explain when an invitation is invalid, expired, revoked or no longer available.
• Malformed invitation links are handled as invalid invitations without surfacing a database error.
• Invitation revocation is enforced on the server before the interface reports success.

Reliability and interface improvements

• Temporary organization lookup failures no longer appear as not-found pages.
• Sentry user and organization context is isolated for every request to prevent stale tags from leaking into later events.
• Sole owners now see why they cannot leave an organization before attempting the action.
• Account deletion is blocked when it would remove an organization's sole owner, with guidance to transfer ownership or delete the organization first.
• Browser Back closes the top modal layer while preserving pending protected actions and restoring focus correctly.
• Verification and invitation state pages now use proper heading semantics.

Verification

Formatting, linting, TypeScript checks, focused tests and production builds pass in both Pro Prisma and Pro Drizzle. Browser QA covers backup-code recovery, email verification, invitation failures, owner restrictions and modal history behavior.

Existing projects

No database migration or new environment variable is required. Review the individual changes and apply the authentication and reliability improvements that fit your project.