fix: change invalid backup code status

Author: Bekacru

packages/better-auth/src/plugins/two-factor/backup-codes/index.ts

@@ -132,7 +132,7 @@ export const backupCode2fa = (
 						ctx.context.secret,
 					);
 					if (!validate.status) {
-						throw new APIError("BAD_REQUEST", {
+						throw new APIError("UNAUTHORIZED", {
 							message: "Invalid backup code",
 						});
 					}

packages/better-auth/src/plugins/two-factor/two-factor.test.ts

@@ -218,6 +218,21 @@ describe("two factor", async () => {
 		});
 		expect(currentBackupCodes.backupCodes).toBeDefined();
 		expect(currentBackupCodes.backupCodes).not.toContain(backupCode);
+
+		const res = await client.twoFactor.verifyBackupCode({
+			code: "invalid-code",
+			fetchOptions: {
+				headers,
+				onSuccess(context) {
+					const parsed = parseSetCookieHeader(
+						context.response.headers.get("Set-Cookie") || "",
+					);
+					const token = parsed.get("better-auth.session_token")?.value;
+					expect(token?.length).toBeGreaterThan(0);
+				},
+			},
+		});
+		expect(res.error?.message).toBe("Invalid backup code");
 	});
 
 	it("should trust device", async () => {