Separate second-factor verification and delivery from auth (#40)

frontend/packages/sxchnge_auth/lib/src/mappers/backend.dart

@@ -9,15 +9,20 @@ abstract final class BackendMapper {
     return AuthResult(userId: dto.userId, isSimulated: false);
   }
 
-  static FactorChallenge challenge(BackendDTO dto, String id) =>
-      FactorChallenge(
-        id: id,
-        purpose: FactorPurpose.login,
-        operation: id,
-        target: dto.target,
-        expiresAt: dto.expiresAt,
-        resendAt: dto.resendAt,
-      );
+  static FactorChallenge challenge(BackendDTO dto, String id) {
+    if (dto.challengeId.isEmpty || dto.channel != 'email') {
+      throw const FactorException(FactorError.unavailable);
+    }
+    return FactorChallenge(
+      id: id,
+      purpose: FactorPurpose.login,
+      operation: id,
+      target: dto.target,
+      expiresAt: dto.expiresAt,
+      resendAt: dto.resendAt,
+    );
+  }
+
   static AuthSession session(BackendDTO dto) {
     if (dto.accessToken.isEmpty || dto.userId.isEmpty) {
       throw const FormatException('Missing session');