From 160c937dc2614078030982c233ac5b8251c9ad3f Mon Sep 17 00:00:00 2001
From: Steven Nguyen <stnguyen90@users.noreply.github.com>
Date: Fri, 13 Jun 2025 09:01:38 -0700
Subject: [PATCH] fix: prevent 'Attribute "factors" must be an array' error

Because array_unique() preserves keys, the $factors can go from:

[
    0 => 'password',
    1 => 'totp',
    2 => 'totp',
    3 => 'email'
]

to:

[
    0 => 'password',
    1 => 'totp',
    3 => 'email'
]

and because this is not an array list, the validation fails.

Using array_values() after array_unique() will reset the keys to be sequential, resulting in:

[
    0 => 'password',
    1 => 'totp',
    2 => 'email'
]
---
 app/controllers/api/account.php | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/app/controllers/api/account.php b/app/controllers/api/account.php
index ac01476314..a7ff7c099d 100644
--- a/app/controllers/api/account.php
+++ b/app/controllers/api/account.php
@@ -3880,7 +3880,7 @@ App::patch('/v1/account/mfa')
             if ($user->getAttribute('phone', false) && $user->getAttribute('phoneVerification', false)) {
                 $factors[] = Type::PHONE;
             }
-            $factors = \array_unique($factors);
+            $factors = \array_values(\array_unique($factors));
 
             $session->setAttribute('factors', $factors);
             $dbForProject->updateDocument('sessions', $session->getId(), $session);
@@ -4065,7 +4065,7 @@ App::put('/v1/account/mfa/authenticators/:type')
 
         $factors = $session->getAttribute('factors', []);
         $factors[] = $type;
-        $factors = \array_unique($factors);
+        $factors = \array_values(\array_unique($factors));
 
         $session->setAttribute('factors', $factors);
         $dbForProject->updateDocument('sessions', $session->getId(), $session);
@@ -4549,7 +4549,7 @@ App::put('/v1/account/mfa/challenge')
 
         $factors = $session->getAttribute('factors', []);
         $factors[] = $type;
-        $factors = \array_unique($factors);
+        $factors = \array_values(\array_unique($factors));
 
         $session
             ->setAttribute('factors', $factors)