Function consumeRecoveryCode

packages/auth/src/totp.ts:85–103

({
  hashes,
  input,
}: {
  hashes: string[];
  input: string;
})

}

export async function consumeRecoveryCode({
  hashes,
  input,
}: {
  hashes: string[];
  input: string;
}): Promise<{ valid: boolean; remaining: string[] }> {
  const normalized = normalizeRecoveryCode(input);
  for (let i = 0; i < hashes.length; i++) {
    const hash = hashes[i]!;
    // Sequential verify is fine — argon2 is slow on purpose and the list is 10 entries.
    const matched = await verifyPasswordHash(hash, normalized);
    if (matched) {
      const remaining = hashes.slice(0, i).concat(hashes.slice(i + 1));
      return { valid: true, remaining };
    }
  }
  return { valid: false, remaining: hashes };
}