fix: preserve extra login options in MFA flows

[boomshakar]

Jira Link

N/A

Description

enableMFA() and manageMFA() currently replace the caller's
extraLoginOptions with an object containing only the authenticated user's
login_hint.

This was reproduced in the Manage MFA custom-JWT flow, where caller-provided
values such as client_id and a fresh id_token are required to continue the
hosted authentication step. Source review found the same parameter-loss
behavior in enableMFA().

This change merges caller-provided extraLoginOptions before setting
login_hint from authenticated session state in both MFA methods. It:

• preserves custom-JWT credentials and other supported login options;
• ensures the authenticated user's login_hint takes precedence;
• retains existing behavior when extraLoginOptions is omitted;
• preserves all other Enable MFA and Manage MFA payload fields;
• does not change login() or any public API.

The change is backward-compatible because callers without extra login options
receive the same payload as before.

Security

Tests use synthetic identifiers and tokens only. The change does not log or
otherwise expose credentials; it preserves caller-supplied values within the
existing MFA auth-request payload path.

How has this been tested?

• npm test — 17 test files and 433 tests passed.
• npm run lint — passed with no errors.
• npm run build — ESM and CJS builds completed successfully.
• Eight focused regression tests cover both enableMFA() and manageMFA():
  • preserving client_id and id_token;
  • authenticated login_hint precedence;
  • omitted extraLoginOptions;
  • existing payload fields and flow-specific behavior.

Screenshots (if appropriate)

N/A

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality not to work as expected)

Checklist

• My code follows the code style of this project. (run lint)
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have added tests to cover my changes.
• All new and existing tests passed.

---

Note

Medium Risk
Changes how MFA auth-start payloads assemble login options in security-sensitive flows, though behavior is backward compatible and covered by new tests.

Overview
Fixes a bug where enableMFA() and manageMFA() built extraLoginOptions with only the session login_hint, dropping caller-supplied values (e.g. custom-JWT client_id and id_token) needed for Manage MFA.

Both methods now spread params.extraLoginOptions first, then set login_hint from the authenticated user so session identity still wins over a caller-provided hint. Omitted extraLoginOptions behaves as before.

Adds test/auth.test.ts with eight Vitest cases covering preservation of JWT fields, login_hint precedence, omitted options, and unchanged MFA payload/flow behavior for both APIs.

^{Reviewed by Cursor Bugbot for commit 9a0396e. Bugbot is set up for automated code reviews on this repo. Configure here.}