2026 NestJS Customer Support Backend for SMS OTP Abuse Budgets and Audit

NestJS two-factor authentication backend with SMS has responsibility to decide between allowed transitions and events under retry pressure. It should handle SMS OTP issuance, verification, throttling, recovery-code usage, recipient suppression, and audit emission within one backend-owned challenge state machine. Controllers should translate HTTP requests, but not invent authentication state or own counters for counters.

A send is an effect of an accepted challenge transition, not proof of receipt. Governance starts with evidence ledger and boundary between agent's access and invalid phone numbers or repeated delivery failures. Use separate budgets for issuance and verification to prevent abuse. Key both dimensions - account plus destination for issuance and challenge plus account for verification - to prevent a single input from erasing control.

Acceptance decision and counter updates should be atomic. Use in-memory counter in tests, not production authority. Store one-way verifier for recovery codes and consume exactly one code in the same transaction that marks the challenge recovered. Short-lived codes are still secrets. Store implementation must provide compare-and-swap or transactional semantics for update and adapter should return only a normalized delivery classification.