From 6bd8f48dd5fafe21a8e1ec01b04bab6fd2acb13e Mon Sep 17 00:00:00 2001
From: "Rudy B." <btte.rudy@gmail.com>
Date: Sat, 25 Apr 2026 11:41:45 +0200
Subject: [PATCH] fix(2FA): add missing error code

---
 src/app/api/2fa/verify/route.ts | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/src/app/api/2fa/verify/route.ts b/src/app/api/2fa/verify/route.ts
index 619a3fd73..b61922624 100644
--- a/src/app/api/2fa/verify/route.ts
+++ b/src/app/api/2fa/verify/route.ts
@@ -46,7 +46,7 @@ export async function POST(request: Request) {
   const twoFactor = await prisma.client.twoFactorAuth.findUnique({ where: { userId } });
 
   if (!twoFactor?.isEnabled) {
-    return badRequest({ message: '2FA not enabled for this user' });
+    return badRequest({ code: 'two-factor-error-not-enabled', message: '2FA not enabled for this user' });
   }
 
   const rateCheck = await checkRateLimit(userId);
@@ -72,7 +72,10 @@ export async function POST(request: Request) {
 
     if (matchIndex === null) {
       await recordFailedAttempt(userId);
-      return badRequest({ code: 'two-factor-error-invalid-backup-code', message: 'Invalid backup code' });
+      return badRequest({
+        code: 'two-factor-error-invalid-backup-code',
+        message: 'Invalid backup code',
+      });
     }
 
     await prisma.client.twoFactorBackupCode.update({
@@ -91,7 +94,10 @@ export async function POST(request: Request) {
 
     if (!(await verifyTotp(token, decryptedSecret))) {
       await recordFailedAttempt(userId);
-      return badRequest({ code: 'two-factor-error-invalid-code', message: 'Invalid verification code' });
+      return badRequest({
+        code: 'two-factor-error-invalid-code',
+        message: 'Invalid verification code',
+      });
     }
 
     await markOtpUsed(userId, token);