No MFA/2FA

// BAD: single-factor authentication only
async function login(email: string, password: string) {
  const user = await verifyPassword(email, password);
  if (!user) throw new Error('Invalid credentials');
  return createSession(user); // one factor = compromised if password leaks
}

// GOOD: require TOTP as second factor for sensitive accounts
async function login(email: string, password: string, totpCode?: string) {
  const user = await verifyPassword(email, password);
  if (!user) throw new Error('Invalid credentials');
  if (user.mfaEnabled) {
    if (!totpCode || !verifyTOTP(user.totpSecret, totpCode))
      throw new Error('MFA code required');
  }
  return createSession(user);
}