handleVerify in /mfa/verify ended its default path with router.push(...)
followed by router.refresh(). Verifying the challenge raises the session
to aal2, which lib/supabase/middleware.ts only re-evaluates on a fresh
document request; the push and the refresh raced, the refresh won, and
the user stayed on the code screen with a session that was already aal2.
Re-entering the same TOTP code is then rejected as reuse, which bumps the
lockout counter and makes MFA look broken. PR #1984 closed the identical
shape in leave() on /mfa/enroll (#1948) and listed this file as the
follow-up.
Always window.location.assign(...) instead, exactly as #1984 did, and
fold the now-redundant /api/ returnTo branch into the same call. The
WL-14 cockpit landing is unchanged: resolvePostLoginDestination() is
still awaited before navigating, and it only ever returns '/clients' or
'/'. returnTo is already validated by safeReturnTo, so the unconditional
hard navigation stays same-origin. The invite path keeps its own
window.location.href = '/' since it deliberately ignores returnTo.
Accepted trade-off, same as #1984 and DECISIONS.md 2026-07-26: a toast
fired before the hard navigation does not survive the full page load. On
this page that is the invite-problem warning; the invite cookie survives
non-definitive outcomes so /onboarding and /select-company retry
acceptance server-side.
Fixes#2056
Claude-Session: https://claude.ai/code/session_015qgLgdt4mLmha1ZLFMwq1u
Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com>
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
Jakob Wennberg
6a68ecb4d4
