feat(mfa): support test OTPs for phone mfa

[singh-inder]

What kind of change does this PR introduce?

feature

What is the current behavior?

test OTPs are supported for phone confirmation, but MFA phone challenges always generate and send a new OTP via sms provider or send-sms hook.

What is the new behavior?

use configured test OTP functionality for MFA phone challenges as well. When a test OTP is configured for the phone number, MFA uses that OTP and skips sending sms.

[annabkr]

Hi @singh-inder! Thank you for the PR.

The test OTP feature exists for one specific reason: App Store review. Apple and Google now use automated reviewers to test apps before approval. If an app's first sign-in screen asks for a real phone number, the reviewer cannot supply one, and the app gets rejected. Test OTP solves this by giving the reviewer a known phone number and a known code to use for that specific case.

MFA is a second check, done only after a user has already signed in with their first factor. App Store reviewers don't go through the MFA setup and challenge flows as part of the standard review process.

So, the problem the test OTP feature was built to solve does not apply to MFA at all.

Could you tell us more about your use case and what problem this PR solves for you?

[singh-inder]

Hi @annabkr! Thanks for the review!

Main use case is to avoid sending sms during development. Currently, a user who wants to test phone MFA without sending real sms would need to set up a send_sms hook and skip sending the OTP within that function.
This could be simplified by letting the existing test phone number config also apply to phone MFA.

[annabkr]

Hi @annabkr! Thanks for the review!

Main use case is to avoid sending sms during development. Currently, a user who wants to test phone MFA without sending real sms would need to set up a send_sms hook and skip sending the OTP within that function. This could be simplified by letting the existing test phone number config also apply to phone MFA.

Understood. For MFA, setting up a hook that accepts a test code is our recommendation. However, we're always evaluating these flows and we'll discuss this as a team.

Thank you for the PR!