auth service changes done

kafm-backend/src/main/java/com/example/kafm_backend/service/AuthService.java

@@ -50,69 +50,92 @@ public class AuthService {
     }
 
     public AuthResponse login(LoginRequest request) {
-        Optional<User> userOptional = userRepository.findByEmail(request.getEmail());
 
-        // FIRST TIME USER: Auto-register and grant direct entry to dashboard
+        Optional<User> userOptional =
+                userRepository.findByEmail(request.getEmail());
+
+        User user;
+
         if (userOptional.isEmpty()) {
-            User newUser = new User();
-            newUser.setEmail(request.getEmail());
-            newUser.setPassword(passwordEncoder.encode(request.getPassword()));
 
-            // Generate 2FA secret now so it's ready for their 2nd login
+            // NEW USER
+            user = new User();
+            user.setEmail(request.getEmail());
+            user.setPassword(
+                    passwordEncoder.encode(request.getPassword())
+            );
+
             String secret = secretGenerator.generate();
-            newUser.setTwoFactorSecret(secret);
-            newUser.setTwoFactorEnabled(false);
 
-            userRepository.save(newUser);
+            user.setTwoFactorSecret(secret);
+            user.setTwoFactorEnabled(false);
 
-            String token = jwtService.generateToken(newUser.getEmail());
+            userRepository.save(user);
 
-            AuthResponse response = new AuthResponse();
-            response.setSuccess(true);
-            response.setAuthenticated(true);
-            response.setRequiresTwoFactor(false);
-            response.setRequiresTwoFactorSetup(false);
-            response.setMessage("First time login successful. Welcome!");
-            response.setToken(token);
-            return response;
-        }
+        } else {
+
+            // EXISTING USER
+            user = userOptional.get();
+
+            if (!passwordEncoder.matches(
+                    request.getPassword(),
+                    user.getPassword())) {
 
-        // EXISTING USER: Verify password
-        User user = userOptional.get();
-        if (!passwordEncoder.matches(request.getPassword(), user.getPassword())) {
                 throw new ResponseStatusException(
                         HttpStatus.UNAUTHORIZED,
                         "Invalid email or password"
                 );
             }
+        }
+
+        // =========================================
+        // ALWAYS CHECK 2FA AFTER PASSWORD LOGIN
+        // =========================================
 
-        // RETURNING USER: Require 2FA verification on subsequent logins
         AuthResponse response = new AuthResponse();
+
         response.setSuccess(true);
         response.setAuthenticated(false);
         response.setRequiresTwoFactor(true);
 
-        // If they haven't set up 2FA in Authenticator app yet, send QR code
         if (!user.isTwoFactorEnabled()) {
+
             response.setRequiresTwoFactorSetup(true);
-            response.setQrCode(generateQrCode(user.getEmail(), user.getTwoFactorSecret()));
-            response.setMessage("Please scan the QR code in your Authenticator app and enter the code.");
+
+            response.setQrCode(
+                    generateQrCode(
+                            user.getEmail(),
+                            user.getTwoFactorSecret()
+                    )
+            );
+
+            response.setMessage(
+                    "Scan the QR code with your Authenticator app and enter the code."
+            );
+
         } else {
+
             response.setRequiresTwoFactorSetup(false);
-            response.setMessage("Enter the code from your Authenticator app");
+            response.setQrCode(null);
+
+            response.setMessage(
+                    "Enter the code from your Authenticator app."
+            );
         }
 
         return response;
     }
-
     public AuthResponse verifyLogin2FA(Verify2FARequest request) {
+
         User user = userRepository.findByEmail(request.getEmail())
                 .orElseThrow(() -> new ResponseStatusException(
                         HttpStatus.UNAUTHORIZED,
                         "User not found"
                 ));
 
-        if (user.getTwoFactorSecret() == null || user.getTwoFactorSecret().isBlank()) {
+        if (user.getTwoFactorSecret() == null ||
+                user.getTwoFactorSecret().isBlank()) {
+
             throw new ResponseStatusException(
                     HttpStatus.BAD_REQUEST,
                     "Authenticator setup has not been initialized"
@@ -131,8 +154,10 @@ public class AuthService {
             );
         }
 
-        // Enable 2FA permanently once verified
+        // First successful OTP verification
+        // permanently enables 2FA
         if (!user.isTwoFactorEnabled()) {
+
             user.setTwoFactorEnabled(true);
             userRepository.save(user);
         }
@@ -140,6 +165,7 @@ public class AuthService {
         String token = jwtService.generateToken(user.getEmail());
 
         AuthResponse response = new AuthResponse();
+
         response.setSuccess(true);
         response.setAuthenticated(true);
         response.setRequiresTwoFactor(false);