{"record":{"id":"f324e9a1d0ed59b3","repo":"medusajs/medusa","slug":"recovery-code-count-must-be-between-1-and-50","errorCode":null,"errorMessage":"Recovery code count must be between 1 and 50","messagePattern":"Recovery code count must be between 1 and 50","errorType":"exception","errorClass":"MedusaError","httpStatus":400,"severity":"error","filePath":"packages/modules/auth/src/services/auth-module.ts","lineNumber":634,"sourceCode":"\n  @InjectManager()\n  async generateAuthMfaRecoveryCodes(\n    data: AuthTypes.GenerateAuthMfaRecoveryCodesDTO,\n    @MedusaContext() sharedContext: Context = {}\n  ): Promise<AuthTypes.GenerateAuthMfaRecoveryCodesResponse> {\n    return await this.generateAuthMfaRecoveryCodes_(data, sharedContext)\n  }\n\n  @InjectTransactionManager()\n  protected async generateAuthMfaRecoveryCodes_(\n    data: AuthTypes.GenerateAuthMfaRecoveryCodesDTO,\n    @MedusaContext() sharedContext: Context = {}\n  ): Promise<AuthTypes.GenerateAuthMfaRecoveryCodesResponse> {\n    const count =\n      data.count ?? this.moduleOptions_.mfa?.recovery_code_count ?? 10\n\n    if (!Number.isInteger(count) || count < 1 || count > 50) {\n      throw new MedusaError(\n        MedusaError.Types.INVALID_DATA,\n        \"Recovery code count must be between 1 and 50\"\n      )\n    }\n\n    await this.authIdentityService_.retrieve(\n      data.auth_identity_id,\n      {},\n      sharedContext\n    )\n\n    const codes = await this.authMfaProviderService_.generateCodes(\n      \"recovery_code\",\n      {\n        auth_identity_id: data.auth_identity_id,\n        count,\n      },\n      sharedContext","sourceCodeStart":616,"sourceCodeEnd":652,"githubUrl":"https://github.com/medusajs/medusa/blob/5e06e544a296b9033f20f71f11c559f81a0e5739/packages/modules/auth/src/services/auth-module.ts#L616-L652","documentation":"Thrown when generating MFA recovery codes with an explicit count that is not an integer between 1 and 50. The count defaults to data.count, then moduleOptions.mfa.recovery_code_count, then 10; whichever resolves must pass the integer range check.","triggerScenarios":"Calling generateAuthMfaRecoveryCodes({ count: 0 }), count: 51, count: 5.5, or a non-numeric value; configuring mfa.recovery_code_count in medusa-config to an out-of-range value.","commonSituations":"Typos in the module options (e.g. recovery_code_count: 100); passing user-supplied count from an API without validating; passing a string count like \"10\".","solutions":["Clamp/validate count to an integer 1-50 before calling","Fix the recovery_code_count value in medusa-config auth module options","If count is optional, omit it to use the default of 10"],"exampleFix":"// before\nawait authModule.generateAuthMfaRecoveryCodes({ auth_identity_id: id, count })\n// after\nconst safeCount = Math.min(50, Math.max(1, Math.floor(Number(count) || 10)))\nawait authModule.generateAuthMfaRecoveryCodes({ auth_identity_id: id, count: safeCount })","handlingStrategy":"validation","validationCode":"const count = Math.min(50, Math.max(1, Math.floor(Number(rawCount) || 10)))","typeGuard":"const isValidCount = (c: unknown): c is number => Number.isInteger(c) && c >= 1 && c <= 50","tryCatchPattern":"null","preventionTips":["Validate/clamp user-supplied counts","Keep medusa-config recovery_code_count within 1-50"],"tags":["mfa","validation","recovery-codes","auth-module"],"backgroundTag":"input-validation-failed","analyzedSha":"5e06e544a296b9033f20f71f11c559f81a0e5739","analyzedAt":"2026-08-27T07:24:39.599Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}