Separate second-factor verification and delivery from auth (#40)

frontend/packages/sxchnge_auth/lib/src/services/backend.dart

@@ -48,7 +48,7 @@ class BackendAuthServices
   final String clientId;
   final http.Client _client;
   final String _deviceId = _key();
-  final _pending = <String, String>{};
+  final _pending = <String, ({String token, String challengeId})>{};
   final _grants = <String, AuthSession>{};
   final _retryKeys = <String, String>{};
   String? _queuedSignup;
@@ -125,7 +125,7 @@ class BackendAuthServices
     });
     final id = _key();
     final challenge = BackendMapper.challenge(dto, id);
-    _pending[id] = dto.pendingToken;
+    _pending[id] = (token: dto.pendingToken, challengeId: dto.challengeId);
     return AuthResult(userId: '', isSimulated: false, challenge: challenge);
   }
 
@@ -185,11 +185,16 @@ class BackendAuthServices
     if (pending == null) throw const FactorException(FactorError.expired);
     final key = _retryKeys.putIfAbsent('login:$challengeId', _key);
     final dto = await _post('login/resend', {
-      'pendingToken': pending,
+      'pendingToken': pending.token,
+      'challengeId': pending.challengeId,
       'idempotencyKey': key,
     }, factor: true);
+    final challenge = BackendMapper.challenge(dto, challengeId);
+    if (dto.challengeId != pending.challengeId) {
+      throw const FactorException(FactorError.unavailable);
+    }
     _retryKeys.remove('login:$challengeId');
-    return BackendMapper.challenge(dto, challengeId);
+    return challenge;
   }
 
   @override
@@ -197,7 +202,8 @@ class BackendAuthServices
     final pending = _pending[challengeId];
     if (pending == null) throw const FactorException(FactorError.expired);
     final dto = await _post('login/verify', {
-      'pendingToken': pending,
+      'pendingToken': pending.token,
+      'challengeId': pending.challengeId,
       'code': code,
     }, factor: true);
     final session = BackendMapper.session(dto);