post:
  operationId: validate2FACode
  summary: Validate 2FA code
  description: |
    **Step 2 of 2-step login flow.**

    Accepts the 6-digit TOTP code from the Authenticator app together
    with the `user_id`. On success the server
    returns whether the 2FA code is valid.
  tags: [staffManagement]
  requestBody:
    required: true
    content:
      application/json:
        schema:
          $ref: "../../components.yaml#/components/schemas/VerifyOTPRequest"
        example:
          otp_code: "123456"
          user_id: "6643f1a2b4c5d60012e34abc"
  responses:
    "200":
      description: 2FA code validation result returned.
      content:
        application/json:
          schema:
            $ref: "../../components.yaml#/components/schemas/ValidateCodeResponse"
          example:
            valid: true
    "400":
      $ref: "../../components.yaml#/components/responses/Failure"