Pin auth instead of magic links

Since the number can be guessed more easily than a long token, I think you need an additional check client-side

Workflow:
- user enters their email
- client-side, we generate and store a unique token (which is **unrelated** to the pin)
- server-side, we generate a 6 digits pin, and we store the pin + the client-side token in db
- user receives the pin code by mail, they enter it
- we send the client-side token + the pin to the backend, it checks agains the db

The main difference with magic link is that the pin can be guessed, the client-side token is meant to parry this issue: an attacker that read the email with the pin doesn't have the client-side token.

I feel like it's more secure than magic link.

This is my current understanding, I need to check how it's implemented in existing libs, maybe there is a passport plugin already.