Function enrollViaService

apps/api/tests/api/auth/mfa.routes.test.ts:71–100

(
  userId: string
)

  });

const enrollViaService = async (
  userId: string
): Promise<{ secretBase32: string; recoveryCodes: string[] }> => {
  const setup = await mfaService.setup(userId, PASSWORD);
  const staged = await cacheService.get<{ secretEncrypted: string }>(
    MFA_CACHE_KEYS.setup(userId)
  );

  if (staged === null) {
    throw new Error("setup did not stage a secret");
  }

  const secretBase32 = decryptString(staged.secretEncrypted);

  await mfaService.verifySetup(userId, totpFor(secretBase32));

  /*
   * Verifying setup writes the current TOTP step into mfaLastTotpStep
   * for replay protection. The route tests then immediately try to log
   * in inside that same 30-second window, which the replay guard would
   * otherwise reject. Clearing the step is safe — a real user picks
   * up the same protection on their next verify.
   */
  await db
    .update(users)
    .set({ mfaLastTotpStep: null })
    .where(eq(users.id, userId));

  return { secretBase32, recoveryCodes: setup.recoveryCodes };
};

describe("MFA routes", () => {
  beforeEach(async () => {