Update Multi-Factor Authentication routes to work with new clients

Enabling MFA (POST /api/v9/users/@me/mfa/totp/enable):

Request:

{"code":"123456","secret":"2fa-secret"}

Response:

{
  "message": "Two factor is required for this operation",
  "code": 60003,
  "mfa": {
    "ticket": "totp-ticket",
    "methods": [{ "type": "password" }]
  }
}

This is referenced also in https://github.com/spacebarchat/server/issues/1314#issuecomment-3082044103

The response returns a new cookie called __Secure-recent_mfa which is empty.

Then a request is sent to POST /api/v9/mfa/finish.

Request:

{
  "ticket": "totp-ticket",
  "mfa_type": "password",
  "data": "password or 2fa code"
}

Response:

{"token":"finish-token"}

Then a final request is sent to POST /api/v9/users/@me/mfa/totp/enable with the cookie __Secure-recent_mfa containing the /api/v9/mfa/finish response token (bypasses MFA for 5 minutes), along with the X-Discord-MFA-Authorization header, also containing that token.

Request:

{ "code": "123456", "secret": "2fa-secret" }

Response:

{
  "token": "token2",
  "backup_codes": [
    { "user_id": "snowflake", "code": "abcdabcd", "consumed": false },
    { "user_id": "snowflake", "code": "abcdabcd", "consumed": false },
    { "user_id": "snowflake", "code": "abcdabcd", "consumed": false },
    { "user_id": "snowflake", "code": "abcdabcd", "consumed": false },
    { "user_id": "snowflake", "code": "abcdabcd", "consumed": false },
    { "user_id": "snowflake", "code": "abcdabcd", "consumed": false },
    { "user_id": "snowflake", "code": "abcdabcd", "consumed": false },
    { "user_id": "snowflake", "code": "abcdabcd", "consumed": false },
    { "user_id": "snowflake", "code": "abcdabcd", "consumed": false },
    { "user_id": "snowflake", "code": "abcdabcd", "consumed": false }
  ]
}

If you need to find out more about the flow, there's a page on Userdoccers:

https://docs.discord.food/authentication#login-account - contains the authentication flow too

https://docs.discord.food/authentication#mfa-verification

Start with the POST /api/v9/users/@me/mfa/totp/enable and POST /api/v9/mfa/finish entry points, then compare their current behavior with the request and response flow described here. Verify the MFA ticket, finish token, __Secure-recent_mfa cookie, X-Discord-MFA-Authorization header, and backup_codes response for the final enable request.