How to fix mfa_verification_failed: MFA verification failed in Supabase

// Example: Proper MFA verification flow
const { data, error } = await supabase.auth.mfa.verify({
  factorId: factorId,
  challengeId: challengeId,
  code: '123456' // Enter fresh code immediately after generation
});

if (error) {
  console.error('MFA verification failed:', error.message);
  // Prompt user to try again with a fresh code
}

// Start fresh with a new challenge
async function retryMfaVerification(factorId) {
  try {
    // Step 1: Create a new challenge
    const { data: challengeData, error: challengeError } =
      await supabase.auth.mfa.challenge({ factorId });

    if (challengeError) {
      console.error('Challenge creation failed:', challengeError);
      return;
    }

    // Step 2: Wait for user to enter fresh TOTP code
    const totpCode = prompt('Enter 6-digit code from authenticator app:');

    // Step 3: Verify with the new challenge
    const { data, error } = await supabase.auth.mfa.verify({
      factorId: factorId,
      challengeId: challengeData.id,
      code: totpCode
    });

    if (error) {
      console.error('Verification failed:', error.message);
      // Suggest waiting and trying again
    } else {
      console.log('MFA verification successful!');
    }
  } catch (err) {
    console.error('MFA retry failed:', err);
  }
}

// Step 1: Unenroll the existing factor (requires authentication)
async function reenrollMfa() {
  // Get existing factors
  const { data: factors } = await supabase.auth.mfa.listFactors();

  // Unenroll problematic factor
  const problematicFactor = factors.totp[0]; // Or identify the specific factor
  const { error: unenrollError } = await supabase.auth.mfa.unenroll({
    factorId: problematicFactor.id
  });

  if (unenrollError) {
    console.error('Unenroll failed:', unenrollError);
    return;
  }

  // Step 2: Enroll a new factor
  const { data: enrollData, error: enrollError } =
    await supabase.auth.mfa.enroll({
      factorType: 'totp',
      friendlyName: 'My Authenticator App'
    });

  if (enrollError) {
    console.error('Enrollment failed:', enrollError);
    return;
  }

  // Step 3: Display QR code to user
  const qrCode = enrollData.totp.qr_code;
  const secret = enrollData.totp.secret;

  console.log('Scan this QR code with your authenticator app:');
  console.log(qrCode);
  console.log('Or manually enter secret:', secret);

  // Step 4: Verify the newly enrolled factor
  const totpCode = prompt('Enter code from authenticator app:');

  const { data: challengeData } = await supabase.auth.mfa.challenge({
    factorId: enrollData.id
  });

  const { error: verifyError } = await supabase.auth.mfa.verify({
    factorId: enrollData.id,
    challengeId: challengeData.id,
    code: totpCode
  });

  if (verifyError) {
    console.error('New factor verification failed:', verifyError);
  } else {
    console.log('MFA re-enrollment successful!');
  }
}

// Example: MFA verification with comprehensive error handling
async function secureMfaVerification(factorId, challengeId, code) {
  const MAX_ATTEMPTS = 3;
  const LOCKOUT_DURATION = 60000; // 1 minute

  try {
    const { data, error } = await supabase.auth.mfa.verify({
      factorId,
      challengeId,
      code
    });

    if (error) {
      // Track failed attempts
      const attempts = incrementFailedAttempts(factorId);

      if (attempts >= MAX_ATTEMPTS) {
        return {
          success: false,
          error: 'Too many failed attempts. Please wait 1 minute and try again.',
          lockout: true
        };
      }

      return {
        success: false,
        error: 'Invalid code. Please try again with a fresh code.',
        attemptsRemaining: MAX_ATTEMPTS - attempts
      };
    }

    // Reset failed attempts on success
    clearFailedAttempts(factorId);

    return {
      success: true,
      data: data
    };
  } catch (err) {
    console.error('MFA verification exception:', err);
    return {
      success: false,
      error: 'An unexpected error occurred. Please try again.'
    };
  }
}

// Helper functions for rate limiting (implement with Redis or in-memory store)
function incrementFailedAttempts(factorId) {
  // Store in Redis or session storage
  // Return current count
}

function clearFailedAttempts(factorId) {
  // Clear stored attempts
}