fix(auth): expire stale MFA forms before accepting codes

packages/auth/src/engine.ts

@@ -490,6 +490,7 @@ export function createAuthEngine(options: AuthEngineOptions): AuthEngine {
         message: "Additional verification is required but no verification method is available",
       };
     }
+    const mfaExpiresAt = now() + 5 * 60_000;
     const mfaToken = await issueToken(user.id, "login-mfa", {
       ttlMs: 5 * 60_000,
       metadata,
@@ -500,6 +501,7 @@ export function createAuthEngine(options: AuthEngineOptions): AuthEngine {
       message: "Complete two-step verification to finish signing in.",
       user: publicUser(user),
       mfaToken,
+      mfaExpiresAt,
       requires: { mfa: methods },
     };
   }
@@ -1081,6 +1083,7 @@ export function createAuthEngine(options: AuthEngineOptions): AuthEngine {
             risk,
           };
         }
+        const mfaExpiresAt = now() + 5 * 60_000;
         const mfaToken = await issueToken(user.id, "login-mfa", {
           ttlMs: 5 * 60_000,
           metadata: {
@@ -1099,6 +1102,7 @@ export function createAuthEngine(options: AuthEngineOptions): AuthEngine {
           user: publicUser(user),
           risk,
           mfaToken,
+          mfaExpiresAt,
           requires: { captcha: risk.requireCaptcha, mfa: methods },
         };
       }
@@ -1961,6 +1965,7 @@ export function createAuthEngine(options: AuthEngineOptions): AuthEngine {
       account = await engine.linkOAuth(user.id, providerName, normalizedProfile, tokens);
       if (await hasMfa(user.id)) {
         const methods = await availableMfaMethods(user.id);
+        const mfaExpiresAt = now() + 5 * 60_000;
         const mfaToken = await issueToken(user.id, "login-mfa", {
           ttlMs: 5 * 60_000,
           metadata: { oauthProvider: providerName },
@@ -1970,6 +1975,7 @@ export function createAuthEngine(options: AuthEngineOptions): AuthEngine {
           code: "mfa-required",
           user: publicUser(user),
           mfaToken,
+          mfaExpiresAt,
           requires: { mfa: methods },
         };
       }