{"record":{"id":"80f2de2a47288d93","repo":"eyaltoledano/claude-task-master","slug":"mfa-verification-failed-80f2de","errorCode":"MFA_VERIFICATION_FAILED","errorMessage":"`MFA verification failed: ${(error as Error).message}`","messagePattern":"`MFA verification failed: (.+?)`","errorType":"exception","errorClass":"AuthenticationError","httpStatus":null,"severity":"error","filePath":"packages/tm-core/src/modules/auth/services/session-manager.ts","lineNumber":356,"sourceCode":"\t\t\t\ttoken: session.access_token,\n\t\t\t\trefreshToken: session.refresh_token,\n\t\t\t\tuserId: user.id,\n\t\t\t\temail: user.email,\n\t\t\t\texpiresAt: session.expires_at\n\t\t\t\t\t? new Date(session.expires_at * 1000).toISOString()\n\t\t\t\t\t: undefined,\n\t\t\t\ttokenType: 'standard',\n\t\t\t\tsavedAt: new Date().toISOString(),\n\t\t\t\tselectedContext: context || undefined\n\t\t\t};\n\n\t\t\tthis.logger.info('Successfully verified MFA and authenticated');\n\t\t\treturn credentials;\n\t\t} catch (error) {\n\t\t\tif (error instanceof AuthenticationError) {\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t\tthrow new AuthenticationError(\n\t\t\t\t`MFA verification failed: ${(error as Error).message}`,\n\t\t\t\t'MFA_VERIFICATION_FAILED'\n\t\t\t);\n\t\t}\n\t}\n\n\t// ========== Session Lifecycle ==========\n\n\t/**\n\t * Logout and clear credentials\n\t */\n\tasync logout(): Promise<void> {\n\t\tawait this.waitForInitialization();\n\t\ttry {\n\t\t\t// First try to sign out from Supabase to revoke tokens\n\t\t\tawait this.supabaseClient.signOut();\n\t\t} catch (error) {\n\t\t\t// Log but don't throw - we still want to clear local credentials","sourceCodeStart":338,"sourceCodeEnd":374,"githubUrl":"https://github.com/eyaltoledano/claude-task-master/blob/c0c98d367c55296bfe69e65680625b6db437af02/packages/tm-core/src/modules/auth/services/session-manager.ts#L338-L374","documentation":"This error is thrown by SessionManager.verifyMFA when the MFA verification flow fails with an unexpected error. If the underlying failure is already an AuthenticationError it is re-thrown as-is; otherwise it is wrapped in a new AuthenticationError with code MFA_VERIFICATION_FAILED. It signals that multi-factor authentication could not be completed during login.","triggerScenarios":"Calling verifyMFA (directly or via the credentials/session flows) when the MFA code is wrong/expired, the Supabase challenge verify call throws, or any non-AuthenticationError (network, malformed response) escapes the try block.","commonSituations":"User types an outdated 6-digit code after requesting a new one; authenticator app clock drift causing TOTP mismatch; network outage or Supabase outage mid-login; Supabase client returning an error object that is not an AuthenticationError.","solutions":["Re-request a fresh MFA code and verify it promptly before it expires","Check network connectivity and Supabase service status, then retry","Confirm the authenticator app time sync (TOTP drift) and re-enroll MFA if codes consistently fail","Inspect the wrapped cause message to identify the underlying provider error"],"exampleFix":"// before\nawait sessionManager.verifyMFA('123456');\n// after\ntry {\n  await sessionManager.verifyMFA(await promptFreshTotpCode());\n} catch (e) {\n  if (e instanceof AuthenticationError && e.code === 'MFA_VERIFICATION_FAILED') {\n    await sessionManager.requestMfaChallenge(); // get a new code, then retry\n  } else { throw e; }\n}","handlingStrategy":"try-catch","validationCode":"// Before verifying, ensure a code was entered and a challenge is active\nif (!code || !/^\\d{6}$/.test(code.trim())) throw new Error('Enter the 6-digit MFA code');\nif (!sessionManager.hasPendingChallenge()) await sessionManager.requestMfaChallenge();","typeGuard":"function isAuthenticationError(e: unknown): e is AuthenticationError {\n  return e instanceof AuthenticationError;\n}","tryCatchPattern":"try {\n  await sessionManager.verifyMFA(code);\n} catch (e) {\n  if (isAuthenticationError(e) && e.code === 'MFA_VERIFICATION_FAILED') {\n    // prompt for a fresh code / check connectivity, then retry once\n  } else { throw e; }\n}","preventionTips":["Always request a fresh challenge before prompting for a code; never reuse old codes","Sync device clock (TOTP drift) when codes consistently fail","Distinguish AuthenticationError from other errors so network issues get a retry, not a re-prompt","Limit retry attempts to avoid account lockout"],"tags":["auth","mfa","login"],"backgroundTag":"mfa-verification-failed","analyzedSha":"c0c98d367c55296bfe69e65680625b6db437af02","analyzedAt":"2026-08-29T02:56:26.071Z","schemaVersion":2},"datasetVersion":"2026-08-29T07:17:48.351Z"}