In `@apps/web/components/auth/BackupCode.tsx` at line 7, The component in this
file is misnamed: change the default exported function name from TwoFactor to
BackupCode so the component identity matches imports (e.g., BackupCode used in
login.tsx) and avoids collision with the other TwoFactor component; update the
function declaration/export to "BackupCode" (and any internal references like
props typing or displayName if present) so the default export and component name
are consistent.

In `@apps/web/components/settings/EnableTwoFactorModal.tsx` at line 64, The state
backupCodes is initialized with an empty array which TypeScript infers as
never[]; update the useState call in EnableTwoFactorModal (the backupCodes /
setBackupCodes declaration) to include an explicit type parameter (e.g.,
useState<string[]>([]) or useState<YourBackupCodeType[]>([])) so
setBackupCodes(body.backupCodes) and mapping over backupCodes have the correct
type; if a BackupCode interface/type exists, use that type instead of string.

In `@apps/web/components/settings/EnableTwoFactorModal.tsx` around lines 273 -
282, The onClick handler for the Button that calls
navigator.clipboard.writeText(backupCodes.map(formatBackupCode).join("\n")) can
throw and needs error handling: wrap the clipboard call in a try/catch (or use
await navigator.clipboard.writeText(...).catch(...)) inside the onClick for the
Button in EnableTwoFactorModal, and on failure call showToast with an error
message (e.g., t("backup_codes_copy_failed"), "error") while preserving
e.preventDefault(); keep using formatBackupCode and backupCodes as before.

In `@apps/web/pages/api/auth/two-factor/totp/disable.ts` around lines 46 - 67,
Wrap the JSON.parse(symmetricDecrypt(user.backupCodes,
process.env.CALENDSO_ENCRYPTION_KEY)) call in a try-catch to handle
decryption/parse failures (catch and return a 400 response with an appropriate
ErrorCode), then validate the parsed value is an array using
Array.isArray(backupCodes) before calling backupCodes.indexOf(...); if it's not
an array return a 400 error as well. Ensure you reference user.backupCodes,
symmetricDecrypt, JSON.parse, backupCodes, and req.body.backupCode in the
change.

In `@apps/web/pages/api/auth/two-factor/totp/disable.ts` around lines 49 - 52, The
code throws an Error when process.env.CALENDSO_ENCRYPTION_KEY is missing (the if
block checking CALENDSO_ENCRYPTION_KEY) which causes an unhandled exception;
replace the throw with a proper HTTP response (e.g., return
res.status(500).json({ error: ErrorCode.InternalServerError, message: "Missing
encryption key" })) so it matches the other error branches that use
res.status(...).json(...), and apply the same change to the analogous checks in
the TOTP path (the other CALENDSO_ENCRYPTION_KEY guards around the TOTP
handling) to ensure consistent response-based error handling instead of
throwing.

In `@apps/web/playwright/login.2fa.e2e.ts` around lines 50 - 53, The current
assertion uses page.locator(...).isChecked() (a Promise<boolean>) wrapped in
expect(...).toBeTruthy(), which always passes; replace it with an awaited
Playwright matcher on the locator itself — e.g., await
expect(page.locator(`[data-testid=two-factor-switch]`)).toBeChecked() or mirror
the working pattern using the attribute check await
expect(page.locator(`[data-testid=two-factor-switch][data-state="checked"]`)).toBeVisible();
ensure you remove the isChecked() call and use the locator-based expect so the
assertion evaluates the resolved state.

In `@packages/features/auth/lib/next-auth-options.ts` around lines 131 - 157, The
backupCode branch (condition user.twoFactorEnabled && credentials.backupCode)
allows bypassing password verification because the earlier check uses
!credentials.totpCode; ensure password verification always runs when
user.password exists by moving or duplicating the password check so it is
executed regardless of totpCode/backupCode presence. Concretely, in
next-auth-options.ts ensure the logic that verifies user.password against
credentials.password is invoked before entering the backup code block (or add
the same password verification inside the backup code branch), then proceed to
decrypt user.backupCodes via symmetricDecrypt, validate and null out the used
code, and re-encrypt with symmetricEncrypt before calling prisma.user.update;
keep existing error throws (ErrorCode.IncorrectBackupCode, MissingBackupCodes,
InternalServerError) intact.

In `@packages/features/auth/lib/next-auth-options.ts` around lines 139 - 141, Wrap
the JSON.parse call that parses decrypted backup codes in a try-catch around the
symmetricDecrypt(user.backupCodes, process.env.CALENDSO_ENCRYPTION_KEY) result
(the variable backupCodes) so that malformed or corrupted JSON does not throw an
unhandled exception; on parse failure, handle the error by returning a
controlled error response or throwing a specific, user-facing error (rather than
letting a raw exception bubble up) so callers of the next-auth-options logic can
respond gracefully.

In `@packages/ui/components/form/inputs/Input.tsx` around lines 47 - 51, The
password visibility toggle button in Input.tsx is currently unreachable by
keyboard because it uses tabIndex={-1}; change this to be keyboard-focusable
(remove tabIndex or set tabIndex={0}) so the button (the element with
onClick={() => toggleIsPasswordVisible()}) is operable via Tab, or if the
removal was intentional, add a concise code comment on the button explaining the
accessibility decision and implement an alternative keyboard activation (e.g.,
handle a key binding on the input that calls toggleIsPasswordVisible) so
keyboard-only users can toggle the password.