New SMS MFA Auth Adapter not verifying setup token

New Issue Checklist

• I am not disclosing a vulnerability.
• I am not just asking a question.
• I have searched through existing issues.
• I can reproduce the issue with the latest version of Parse Server.

Issue Description

MFA sms authentication method ignores initial signup token

Steps to reproduce

Setup mfa auth adapter. e.g.

auth: {
            mfa: {
                enabled: true,
                options: ['SMS','TOTP'], //You can just SMS here
                algorithm: 'SHA1',
                digits: 6,
                period: 30,
                sendSMS(smsCode, number) {
                    console.log("SMSCODE: " + smsCode);
                    console.log("NUMBER: " + number);
                },
            },
        }

Perform initial signup and link to mfa

const user = await Parse.User.signUp('username', 'password');
const sessionToken = user.getSessionToken();
await user.save({ authData: { mfa: { mobile: '+11111111111' } } }, { sessionToken });
await user.fetch({ sessionToken });
console.log(user.get('authData'));

The log should produce { mfa: { status: 'disabled' } }

On the server in the logs you should see something like this
SMSCODE: 211392 NUMBER: +11111111111

If you had an SMS service linked this code would be send to your mobile.

Issue arises when you have to verify this code. You have to verify this code otherwise the adapter status will remain disabled.

Looking at spec file in order to do this you need to run

await user.save({ authData: { mfa: { mobile: '+11111111111', token: '848722' } } });
The issue is that token there, can be anything, you can put anything in then token field and the mfa authData will be set to enabled. There's no verification at this step. So if I get an SMS with 123456 for the token, and I put in the text 'donkey' in there it will still work.

After doing this the Auth Adapter works as it should, you have to use 'request' for token and then you have to use the actual token to login. It's just that initial enabling of SMS auth that seems to be broken.

Actual Outcome

The setup token for validation isn't verified before enabling SMS mfa for user.

Expected Outcome

For the token to be verified at this step.

Environment

NodeJS: 18.6.1

Server

• Parse Server version: 6.4.0-alpha.6
• Operating system: MacOS 14.0
• Local or remote host (AWS, Azure, Google Cloud, Heroku, Digital Ocean, etc): Local

Database

• System (MongoDB or Postgres): `Mongo
• Database version: 6.0
• Local or remote host (MongoDB Atlas, mLab, AWS, Azure, Google Cloud, etc): `local

Client

• SDK (iOS, Android, JavaScript, PHP, Unity, etc): JavaScript SDK
• SDK version: 4.3.0-alpha.4

Logs

Start with the SMS MFA auth adapter and the spec file referenced in the issue, then run the provided signup and save reproduction. Verify that an invalid setup token is rejected, while the actual SMS token enables MFA; preserve the existing request-and-login behavior.