Function requestLoginOtp

spec/vulnerabilities.spec.js:5056–5072

(username, password)

    }

    async function requestLoginOtp(username, password) {
      try {
        await request({
          method: 'POST',
          url: 'http://localhost:8378/1/login',
          headers: mfaHeaders,
          body: JSON.stringify({
            username,
            password,
            authData: { mfa: { token: 'request' } },
          }),
        });
      } catch (_err) {
        // Expected: adapter throws "Please enter the token"
      }
      return sentToken;
    }

    it('rejects concurrent logins using the same SMS MFA OTP', async () => {
      const user = await setupSmsMfaUser();