leave() in /mfa/enroll ended with router.push(returnTo) followed by
router.refresh(). Enrolling raises the session to aal2, which
lib/supabase/middleware.ts only re-evaluates on a fresh document request;
the push and the refresh raced, the refresh won, and the user was left on
the QR screen with 2FA already active and no way forward but the address
bar. Always window.location.assign(returnTo) instead, the way the same
function already did for /api/ destinations and /mfa/verify does for its
invite and route-handler paths. returnTo is already validated by
safeReturnTo, so the unconditional hard navigation stays same-origin.
Claude-Session: https://claude.ai/code/session_01FkUfWtuFCUkNtRAgMQCse2
Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Jakob Wennberg
04406edb0f
