fix(2FA): put disable 2FA cleanup in transaction

src/app/api/2fa/disable/route.ts

@@ -101,9 +101,11 @@ export async function POST(request: Request) {
     });
   }
 
-  await markOtpUsed(userId, token);
-  await prisma.client.twoFactorAuth.delete({ where: { userId } });
-  await prisma.client.twoFactorBackupCode.deleteMany({ where: { userId } });
+  await prisma.transaction(async tx => {
+    await markOtpUsed(userId, token, tx);
+    await tx.twoFactorAuth.delete({ where: { userId } });
+    await tx.twoFactorBackupCode.deleteMany({ where: { userId } });
+  });
   await resetRateLimit(userId);
 
   return json({ ok: true });

src/lib/two-factor/replay-prevention.ts

@@ -1,9 +1,13 @@
 import prisma from '@/lib/prisma';
+import { Prisma } from '@/generated/prisma/client';
+
+type TxClient = Prisma.TransactionClient;
 
 /** Records a one-time password as used so it cannot be reused within the next 90 seconds. */
-export async function markOtpUsed(userId: string, otp: string): Promise<void> {
+export async function markOtpUsed(userId: string, otp: string, tx?: TxClient): Promise<void> {
+  const client = tx ?? prisma.client;
   const expiresAt = new Date(Date.now() + 90 * 1000);
-  await prisma.client.twoFactorOtpUsed.upsert({
+  await client.twoFactorOtpUsed.upsert({
     where: { userId_otp: { userId, otp } },
     update: { expiresAt },
     create: { userId, otp, expiresAt },