{"record":{"id":"f151461e15729981","repo":"medusajs/medusa","slug":"mfa-challenge-with-id-id-was-not-found","errorCode":null,"errorMessage":"MFA challenge with id \"${id}\" was not found","messagePattern":"MFA challenge with id \"(.+?)\" was not found","errorType":"exception","errorClass":"MedusaError","httpStatus":404,"severity":"error","filePath":"packages/modules/auth/src/services/auth-module.ts","lineNumber":1039,"sourceCode":"    if (policy !== \"challenge\" && policy !== \"session\") {\n      throw new MedusaError(\n        MedusaError.Types.INVALID_DATA,\n        'MFA disable policy must be either \"challenge\" or \"session\"'\n      )\n    }\n\n    return policy\n  }\n\n  protected async retrieveMfaChallenge_(\n    id: string\n  ): Promise<AuthTypes.AuthMfaChallengeDTO> {\n    const challenge = await this.getCache_().get<AuthTypes.AuthMfaChallengeDTO>(\n      this.getMfaChallengeCacheKey_(id)\n    )\n\n    if (!challenge) {\n      throw new MedusaError(\n        MedusaError.Types.NOT_FOUND,\n        `MFA challenge with id \"${id}\" was not found`\n      )\n    }\n\n    return {\n      ...challenge,\n      expires_at: new Date(challenge.expires_at),\n      completed_at: challenge.completed_at\n        ? new Date(challenge.completed_at)\n        : null,\n    }\n  }\n\n  protected async setMfaChallenge_(\n    challenge: AuthTypes.AuthMfaChallengeDTO,\n    ttlSeconds?: number\n  ): Promise<void> {","sourceCodeStart":1021,"sourceCodeEnd":1057,"githubUrl":"https://github.com/medusajs/medusa/blob/5e06e544a296b9033f20f71f11c559f81a0e5739/packages/modules/auth/src/services/auth-module.ts#L1021-L1057","documentation":"Thrown when retrieving an MFA challenge by id from the cache and nothing is stored under that key — the challenge never existed, expired from cache, or the cache was flushed.","triggerScenarios":"Calling retrieveAuthMfaChallenge with an unknown/typo'd id; cache TTL elapsed or Redis restarted; multi-instance deployment where the challenge was created on a node with a different cache.","commonSituations":"In-memory cache with multiple app instances (challenge on instance A, verify hits instance B); cache eviction; long user idle time beyond TTL.","solutions":["Use a shared cache (e.g. Redis) for the MFA challenge cache in multi-instance deployments","Catch NOT_FOUND and restart the MFA flow to create a new challenge","Verify the challenge id round-trips unmodified between create and verify"],"exampleFix":"// before\nconst challenge = await authModule.retrieveAuthMfaChallenge(challengeId)\n// after\nlet challenge\ntry { challenge = await authModule.retrieveAuthMfaChallenge(challengeId) }\ncatch (e) { if (e.type === 'not_found') return createNewMfaChallenge() ; throw e }","handlingStrategy":"try-catch","validationCode":"null","typeGuard":"null","tryCatchPattern":"try { return await authModule.retrieveAuthMfaChallenge(id) } catch (e) { if (e.type === 'not_found') return createNewMfaChallenge(); throw e }","preventionTips":["Use a shared cache (Redis) across instances","Pass challenge ids through unmodified"],"tags":["mfa","challenge","cache","not-found"],"backgroundTag":"cache-miss","analyzedSha":"5e06e544a296b9033f20f71f11c559f81a0e5739","analyzedAt":"2026-08-27T07:24:39.599Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}