How to fix mfa_verification_rejected: MFA verification was rejected in Supabase

async function verifyMFA(code: string, challengeId: string) {
  try {
    const { data, error } = await supabase.auth.mfa.verify({
      factorId: factorId,
      challengeId: challengeId,
      code: code
    });

    if (error) {
      if (error.message.includes('mfa_verification_rejected')) {
        // Provide user-friendly feedback
        return {
          success: false,
          message: 'Verification code was rejected. Please try a fresh code from your authenticator app.',
          canRetry: true
        };
      }
      throw error;
    }

    return { success: true, data };
  } catch (err) {
    console.error('MFA verification error:', err);
    throw err;
  }
}

const [lastAttempt, setLastAttempt] = useState<number>(0);

async function handleVerify(code: string) {
  const now = Date.now();
  const timeSinceLastAttempt = now - lastAttempt;

  if (timeSinceLastAttempt < 2000) {
    toast.error('Please wait before trying again');
    return;
  }

  setLastAttempt(now);
  await verifyMFA(code, challengeId);
}

// Example MFA verification hook that may be too strict
export const handler = async (event, context) => {
  const { user, factor_id, valid } = event;

  // Check if this hook is causing rejections
  const attempts = await getRecentAttempts(user.id);

  if (attempts > 5) {
    return {
      decision: 'reject',
      message: 'You have exceeded maximum number of MFA attempts.'
    };
  }

  // Add logging to diagnose rejections
  console.log('MFA verification attempt:', {
    userId: user.id,
    factorId: factor_id,
    isValid: valid,
    attemptCount: attempts
  });

  return { decision: 'continue' };
};

async function getValidChallenge(factorId: string) {
  // Challenge IDs may expire after several minutes
  const { data: challenge, error } = await supabase.auth.mfa.challenge({
    factorId: factorId
  });

  if (error) {
    throw new Error(`Failed to create MFA challenge: ${error.message}`);
  }

  return challenge;
}

// Use this in your verification flow
const challenge = await getValidChallenge(factorId);
const result = await verifyMFA(userCode, challenge.id);

async function resetMFAEnrollment(userId: string) {
  // Admin API call to unenroll the user's factor
  const { data: factors } = await supabase.auth.admin.mfa.listFactors({
    userId: userId
  });

  for (const factor of factors) {
    await supabase.auth.admin.mfa.deleteFactor({
      id: factor.id,
      userId: userId
    });
  }

  // User can now re-enroll with a fresh QR code
  console.log('MFA enrollment reset for user:', userId);
}