fix: fix CI failures from the recovery-code round-trip test and dash normalization

1. testDisplayedRecoveryCodeRedeemsThroughVerifyRecoveryCode called
   AbstractMFAChallengeStrategy::verifyRecoveryCode() directly, but it
   takes a PESSIMISTIC_WRITE row lock that requires an open transaction
   (Doctrine\ORM\TransactionRequiredException in CI). Route it through
   IAuthService::verifyMFARecoveryCode(), like the real login flow,
   which wraps the call in a transaction.

2. Several pre-existing test fixtures hashed a "plain" recovery code
   with a literal "-" baked in (e.g. 'RECOVERY-REUSE-TX-' . uniqid())
   and then submitted that same string for verification. The dash
   normalization added earlier in this PR strips separators from the
   submitted code before Hash::check(), so a hash made from a
   dash-containing string can never match its own normalized
   submission - a real generated code never contains a dash in its
   raw/hashed form, only in its display formatting. Fixed the 7
   affected fixtures across TwoFactorLoginFlowTest and
   AbstractMFAChallengeStrategyTest to drop the literal dash.

Author: romanetar

tests/RecoveryCodeRegenerationTest.php

@@ -19,6 +19,7 @@
 use Illuminate\Support\Facades\Session;
 use LaravelDoctrine\ORM\Facades\EntityManager;
 use Strategies\MFA\MFAChallengeStrategyFactory;
+use Utils\Services\IAuthService;
 
 /**
  * Integration tests for regenerating recovery codes from the user profile
@@ -141,8 +142,11 @@ public function testDisplayedRecoveryCodeRedeemsThroughVerifyRecoveryCode(): voi
 
         // The hash was generated over the dash-less string; redeeming the code
         // exactly as it was displayed (with its "-" separator) must still work.
+        // Goes through IAuthService, like the real login flow, because
+        // verifyRecoveryCode() takes a PESSIMISTIC_WRITE row lock that requires
+        // an open transaction.
         $strategy = MFAChallengeStrategyFactory::create(User::MFAMethod_OTP);
-        $strategy->verifyRecoveryCode($admin, $displayedCode);
+        app(IAuthService::class)->verifyMFARecoveryCode($admin, $strategy, $displayedCode);
 
         EntityManager::clear();
         $unusedAfter = EntityManager::getRepository(UserRecoveryCode::class)

tests/TwoFactorLoginFlowTest.php

@@ -482,7 +482,10 @@ public function testOTPCodeRejectsReuseAfterSuccessfulVerification(): void
     public function testRecoveryCodeRejectsReuseAfterTransactionCommit(): void
     {
         $admin = $this->user(self::ADMIN_EMAIL);
-        $plain = 'RECOVERY-REUSE-TX-' . uniqid();
+        // No "-" in the fixture: verifyRecoveryCode() now strips separators before
+        // Hash::check() (real codes are hashed dash-less; the dash is display-only),
+        // so a fixture hashed with one baked in would never match its own submission.
+        $plain = 'RECOVERYREUSETX' . uniqid();
         $this->createRecoveryCode($admin, $plain, false);
 
         // First use — must succeed.
@@ -603,7 +606,7 @@ public function testOTPRedeemRowLockBlocksConcurrentConnection(): void
     public function testRecoveryCodeRowLockBlocksConcurrentConnection(): void
     {
         $admin = $this->user(self::ADMIN_EMAIL);
-        $plain = 'RECOVERY-LOCK-' . uniqid();
+        $plain = 'RECOVERYLOCK' . uniqid();
         $codeId = $this->createRecoveryCode($admin, $plain, false);
 
         /** @var IUserRecoveryCodeRepository $recoveryRepo */
@@ -783,7 +786,7 @@ public function testRecoveryAuditFailureDoesNotBlockLogin(): void
         // Audit is best-effort: a failure emitting recovery_used must NOT 500 a
         // user whose recovery code is already burned and session established.
         $admin = $this->user(self::ADMIN_EMAIL);
-        $plain = 'RECOVERY-AUDIT-FAIL-' . uniqid();
+        $plain = 'RECOVERYAUDITFAIL' . uniqid();
         $this->createRecoveryCode($admin, $plain, false);
 
         $auditMock = \Mockery::mock(ITwoFactorAuditService::class);
@@ -836,7 +839,7 @@ public function testDeviceTrustFailureDoesNotBlockLogin(): void
     public function testRecoveryCodeLoginSucceeds(): void
     {
         $admin = $this->user(self::ADMIN_EMAIL);
-        $plain = 'RECOVERY-PLAIN-123';
+        $plain = 'RECOVERYPLAIN123';
         $codeId = $this->createRecoveryCode($admin, $plain, false);
 
         $this->postLogin(self::ADMIN_EMAIL, self::SEED_PASSWORD);
@@ -856,7 +859,7 @@ public function testRecoveryCodeLoginSucceeds(): void
     public function testUsedRecoveryCodeFails(): void
     {
         $admin = $this->user(self::ADMIN_EMAIL);
-        $plain = 'RECOVERY-USED-456';
+        $plain = 'RECOVERYUSED456';
         $this->createRecoveryCode($admin, $plain, true); // already used
 
         $this->postLogin(self::ADMIN_EMAIL, self::SEED_PASSWORD);

tests/unit/MFA/AbstractMFAChallengeStrategyTest.php

@@ -95,7 +95,10 @@ public function testClearPendingState_removesAllSessionKeys(): void
     public function testVerifyRecoveryCode_withMatchingCode_marksAsUsed(): void
     {
         $user = new User();
-        $code = 'VALID-CODE';
+        // No "-" in the fixture: verifyRecoveryCode() strips separators before
+        // Hash::check() (real codes are hashed dash-less), so a fixture hashed
+        // with one baked in would never match its own submission.
+        $code = 'VALIDCODE';
 
         $recoveryCode = \Mockery::mock(\App\libs\Auth\Models\UserRecoveryCode::class);
         $recoveryCode->shouldReceive('getCodeHash')->andReturn(Hash::make($code));
@@ -120,7 +123,10 @@ public function resendChallenge(User $user, ?Client $client, bool $remember): ar
     public function testVerifyRecoveryCode_locksAndRejects_whenUsedAfterLock(): void
     {
         $user = new User();
-        $code = 'VALID-CODE';
+        // No "-" in the fixture: verifyRecoveryCode() strips separators before
+        // Hash::check() (real codes are hashed dash-less), so a fixture hashed
+        // with one baked in would never match its own submission.
+        $code = 'VALIDCODE';
 
         // Hash matches, but a concurrent winner marked it used; the lock+recheck
         // must reject without double-spending (regression guard for 3357348455).