From 38e9eda9e53398bea598413778d6e6a92d3a4d1f Mon Sep 17 00:00:00 2001
From: "shaily@4linesinfotech.com" <shaily@4linesinfotech.com>
Date: Mon, 24 Aug 2026 11:49:06 +0530
Subject: [PATCH] auth service changes done

---
 .../kafm_backend/service/AuthService.java     | 102 +++++++++++-------
 1 file changed, 64 insertions(+), 38 deletions(-)

diff --git a/kafm-backend/src/main/java/com/example/kafm_backend/service/AuthService.java b/kafm-backend/src/main/java/com/example/kafm_backend/service/AuthService.java
index b830514..a41b6b1 100644
--- a/kafm-backend/src/main/java/com/example/kafm_backend/service/AuthService.java
+++ b/kafm-backend/src/main/java/com/example/kafm_backend/service/AuthService.java
@@ -50,69 +50,92 @@ public class AuthService {
     }
 
     public AuthResponse login(LoginRequest request) {
-        Optional<User> userOptional = userRepository.findByEmail(request.getEmail());
 
-        // FIRST TIME USER: Auto-register and grant direct entry to dashboard
+        Optional<User> userOptional =
+                userRepository.findByEmail(request.getEmail());
+
+        User user;
+
         if (userOptional.isEmpty()) {
-            User newUser = new User();
-            newUser.setEmail(request.getEmail());
-            newUser.setPassword(passwordEncoder.encode(request.getPassword()));
 
-            // Generate 2FA secret now so it's ready for their 2nd login
-            String secret = secretGenerator.generate();
-            newUser.setTwoFactorSecret(secret);
-            newUser.setTwoFactorEnabled(false);
-
-            userRepository.save(newUser);
-
-            String token = jwtService.generateToken(newUser.getEmail());
-
-            AuthResponse response = new AuthResponse();
-            response.setSuccess(true);
-            response.setAuthenticated(true);
-            response.setRequiresTwoFactor(false);
-            response.setRequiresTwoFactorSetup(false);
-            response.setMessage("First time login successful. Welcome!");
-            response.setToken(token);
-            return response;
-        }
-
-        // EXISTING USER: Verify password
-        User user = userOptional.get();
-        if (!passwordEncoder.matches(request.getPassword(), user.getPassword())) {
-            throw new ResponseStatusException(
-                    HttpStatus.UNAUTHORIZED,
-                    "Invalid email or password"
+            // NEW USER
+            user = new User();
+            user.setEmail(request.getEmail());
+            user.setPassword(
+                    passwordEncoder.encode(request.getPassword())
             );
+
+            String secret = secretGenerator.generate();
+
+            user.setTwoFactorSecret(secret);
+            user.setTwoFactorEnabled(false);
+
+            userRepository.save(user);
+
+        } else {
+
+            // EXISTING USER
+            user = userOptional.get();
+
+            if (!passwordEncoder.matches(
+                    request.getPassword(),
+                    user.getPassword())) {
+
+                throw new ResponseStatusException(
+                        HttpStatus.UNAUTHORIZED,
+                        "Invalid email or password"
+                );
+            }
         }
 
-        // RETURNING USER: Require 2FA verification on subsequent logins
+        // =========================================
+        // ALWAYS CHECK 2FA AFTER PASSWORD LOGIN
+        // =========================================
+
         AuthResponse response = new AuthResponse();
+
         response.setSuccess(true);
         response.setAuthenticated(false);
         response.setRequiresTwoFactor(true);
 
-        // If they haven't set up 2FA in Authenticator app yet, send QR code
         if (!user.isTwoFactorEnabled()) {
+
             response.setRequiresTwoFactorSetup(true);
-            response.setQrCode(generateQrCode(user.getEmail(), user.getTwoFactorSecret()));
-            response.setMessage("Please scan the QR code in your Authenticator app and enter the code.");
+
+            response.setQrCode(
+                    generateQrCode(
+                            user.getEmail(),
+                            user.getTwoFactorSecret()
+                    )
+            );
+
+            response.setMessage(
+                    "Scan the QR code with your Authenticator app and enter the code."
+            );
+
         } else {
+
             response.setRequiresTwoFactorSetup(false);
-            response.setMessage("Enter the code from your Authenticator app");
+            response.setQrCode(null);
+
+            response.setMessage(
+                    "Enter the code from your Authenticator app."
+            );
         }
 
         return response;
     }
-
     public AuthResponse verifyLogin2FA(Verify2FARequest request) {
+
         User user = userRepository.findByEmail(request.getEmail())
                 .orElseThrow(() -> new ResponseStatusException(
                         HttpStatus.UNAUTHORIZED,
                         "User not found"
                 ));
 
-        if (user.getTwoFactorSecret() == null || user.getTwoFactorSecret().isBlank()) {
+        if (user.getTwoFactorSecret() == null ||
+                user.getTwoFactorSecret().isBlank()) {
+
             throw new ResponseStatusException(
                     HttpStatus.BAD_REQUEST,
                     "Authenticator setup has not been initialized"
@@ -131,8 +154,10 @@ public class AuthService {
             );
         }
 
-        // Enable 2FA permanently once verified
+        // First successful OTP verification
+        // permanently enables 2FA
         if (!user.isTwoFactorEnabled()) {
+
             user.setTwoFactorEnabled(true);
             userRepository.save(user);
         }
@@ -140,6 +165,7 @@ public class AuthService {
         String token = jwtService.generateToken(user.getEmail());
 
         AuthResponse response = new AuthResponse();
+
         response.setSuccess(true);
         response.setAuthenticated(true);
         response.setRequiresTwoFactor(false);