From 330c2237f9be5de927f3c7d194171b83bf129e5e Mon Sep 17 00:00:00 2001
From: "Rudy B." <btte.rudy@gmail.com>
Date: Sat, 25 Apr 2026 20:30:38 +0200
Subject: [PATCH] fix(2FA): mark OTP used in transaction

---
 src/app/api/2fa/setup/confirm/route.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/app/api/2fa/setup/confirm/route.ts b/src/app/api/2fa/setup/confirm/route.ts
index 93138f46b..1e262d065 100644
--- a/src/app/api/2fa/setup/confirm/route.ts
+++ b/src/app/api/2fa/setup/confirm/route.ts
@@ -69,9 +69,9 @@ export async function POST(request: Request) {
     await tx.twoFactorBackupCode.createMany({
       data: hashed.map(codeHash => ({ userId, codeHash })),
     });
+    await markOtpUsed(userId, token, tx);
   });
 
-  await markOtpUsed(userId, token);
   await resetRateLimit(userId);
 
   return json({ backupCodes: plaintext });