fix: login via code

Signed-off-by: Sebastian Krupinski <krupinski01@gmail.com>

lib/Stores/EnrollmentStore.php

@@ -116,9 +116,9 @@ class EnrollmentStore
     }
 
     /**
-     * Get unused recovery codes for a user
-     * 
-     * @return array<string> Unused recovery codes
+     * Get unused recovery codes for a user, keyed by their original index
+     *
+     * @return array<int, string> Unused recovery codes
      */
     public function getRecoveryCodes(string $tenantId, string $userId): array
     {
@@ -130,14 +130,15 @@ class EnrollmentStore
         $codes = $enrollment['recovery_codes'] ?? [];
         $usedIndices = $enrollment['used_recovery_codes'] ?? [];
 
-        // Filter out used codes
+        // Filter out used codes, preserving original indices so callers
+        // can mark the correct code as used
         $result = [];
         foreach ($codes as $index => $code) {
             if (!in_array($index, $usedIndices, true)) {
-                $result[] = $code;
+                $result[$index] = $code;
             }
         }
-        
+
         return $result;
     }