From 84b08eaba8cbfc72b7027d081237dccbbfbe1615 Mon Sep 17 00:00:00 2001
From: Evert Pot <me@evertpot.com>
Date: Wed, 8 Jan 2025 13:10:14 -0500
Subject: [PATCH] A few small bugfixes related to email OTP

---
 schemas/authorization-challenge-request.json | 2 +-
 src/api-types.ts                             | 2 +-
 src/login/challenge/email-otp.ts             | 9 +++++++--
 3 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/schemas/authorization-challenge-request.json b/schemas/authorization-challenge-request.json
index 47eb0e82..fec1053d 100644
--- a/schemas/authorization-challenge-request.json
+++ b/schemas/authorization-challenge-request.json
@@ -30,7 +30,7 @@
       "maxLength": 6,
       "pattern": "^[0-9]{6}$"
     },
-    "email_opt_code": {
+    "email_otp_code": {
       "type": "string",
       "description": "A 6 digit one-time password sent to an email address.",
       "minLength": 6,
diff --git a/src/api-types.ts b/src/api-types.ts
index d668cf8b..3ec96c07 100644
--- a/src/api-types.ts
+++ b/src/api-types.ts
@@ -180,7 +180,7 @@ export interface AuthorizationChallengeRequest {
   /**
    * A 6 digit one-time password sent to an email address.
    */
-  email_opt_code?: string;
+  email_otp_code?: string;
   /**
    * Ip address (ipv4 or ipv6) of the client making the request. For logging and anomaly detection.
    */
diff --git a/src/login/challenge/email-otp.ts b/src/login/challenge/email-otp.ts
index 55d70e53..0f163815 100644
--- a/src/login/challenge/email-otp.ts
+++ b/src/login/challenge/email-otp.ts
@@ -50,7 +50,12 @@ export class LoginChallengeEmailOtp extends AbstractLoginChallenge<EmailOtpParam
       return true;
     } catch (err) {
       if (err instanceof BadRequest) {
-        throw new A12nLoginChallengeError('Invalid or expired email_otp_code', 'email_otp_invalid');
+        await services.principalIdentity.sendOtpRequest(identity, this.ip);
+        throw new A12nLoginChallengeError(
+          'Invalid or expired email_otp_code',
+          'email_otp_invalid',
+          { censored_email: censor(identity.uri) }
+        );
       } else {
         throw err;
       }
@@ -66,7 +71,7 @@ export class LoginChallengeEmailOtp extends AbstractLoginChallenge<EmailOtpParam
    */
   parametersContainsResponse(parameters: AuthorizationChallengeRequest): parameters is EmailOtpParameters & AuthorizationChallengeRequest {
 
-    return parameters.email_opt_code !== undefined;
+    return parameters.email_otp_code !== undefined;
 
   }