fix(mfa): mint session before deleting ticket, collapse dead invalid_code branch

server/internal/auth/mfa_enrol.go

@@ -83,11 +83,11 @@ func finishEnrolment(c *gin.Context, t *Ticket, ticketID, factor string) {
 		c.JSON(http.StatusUnauthorized, gin.H{"error": "invalid credentials"})
 		return
 	}
-	_ = DeleteTicket(c.Request.Context(), ticketID)
 	if err := mintSession(c, u, []string{"pwd", factor}); err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "session save failed"})
 		return
 	}
+	_ = DeleteTicket(c.Request.Context(), ticketID)
 	services.LogEvent(t.InstanceID, "mfa.enrolled", u.Email, "", "", "factor="+factor)
 	c.JSON(http.StatusOK, gin.H{"ok": true, "recovery_codes": codes})
 }

server/internal/auth/mfa_login.go

@@ -1,7 +1,6 @@
 package auth
 
 import (
-	"errors"
 	"net/http"
 	"time"
 
@@ -94,12 +93,8 @@ func handleMFAVerify(c *gin.Context, factor string) {
 			abortTicketExpired(c)
 			return
 		}
-		code := "invalid_code"
-		if errors.Is(err, services.ErrCodeReplayed) {
-			code = "invalid_code"
-		}
 		c.JSON(http.StatusUnauthorized, gin.H{
-			"error": "that code is not valid", "code": code, "attempts_left": left,
+			"error": "that code is not valid", "code": "invalid_code", "attempts_left": left,
 		})
 		return
 	}
@@ -109,11 +104,11 @@ func handleMFAVerify(c *gin.Context, factor string) {
 		c.JSON(http.StatusUnauthorized, gin.H{"error": "invalid credentials"})
 		return
 	}
-	_ = DeleteTicket(c.Request.Context(), ticketID)
 	if err := mintSession(c, u, []string{"pwd", factor}); err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "session save failed"})
 		return
 	}
+	_ = DeleteTicket(c.Request.Context(), ticketID)
 	if factor == services.FactorRecovery {
 		services.LogEvent(t.InstanceID, "mfa.recovery_used", u.Email, "", "", "")
 	}